Partitions "vanished" after taking drive out of standalone

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
FrostedGeulleisia
Posts: 4
Joined: 28 Aug 2023, 13:27

Partitions "vanished" after taking drive out of standalone

#1 Post by FrostedGeulleisia »

Hello.

I've been trying to read data off of one of my older Seagate drives (model #: ST100DM003) after I took it out from my old standalone (I put a different drive in it since I wanted to repurpose the machine).
Before failure, the drive had two NTFS partitions on it, and an MBR partition table. I've used it in said standalone ever since mid-2013, first to store the OS alongside data, and then resized a bit to store just data on a larger partition, and remnants of said Win7 install on a smaller one. I'll refer to the partitions as D for the "Win7 leftovers" one, and E for the main data partition.
Unfortunately, as I plug the drive into my 3,5 inch drive bay: it all went downhill.
Before you ask, I know the drive bay works. I've used it a couple days prior to read a couple 500GB drives with no issues whatsoever. One of those drives was even older than the one I'm trying to rescue.
First of all, Windows's Disk Management snap-in reports the drive as "Dynamic", lists no capacity, the status as "Invalid" (instead of Online), and overall doesn't let me do anything with it.
Image
So, I've resorted to looking at GParted, which correctly sees the drive's capacity (931.51 GiB, drive's advertised capacity is 1000GB, and this's exactly the same as my 1TB external drive, so it lines up), but again sees no partitions.
I let TestDisk run overnight, a quick scan allows me to recover partition D (which basically has nothing on it, I've moved almost all the interesting stuff out of it), but claims E is unrecoverable.
One Deeper Scan later, I get this.

Code: Select all



Sun Aug 27 23:00:58 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=71331840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=10485760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=71331840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=10485760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511451412992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500103643136
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - WDC PC SN530 SDBPNPZ-512G-1114, S/N:E823_8FA6_BF53_0001_001B_448B_4597_E74C., FW:21113000
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - KINGSTON SA2000M8500G, S/N:0026_B768_3E1C_E7B5., FW:S5Z42105
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Expansion, S/N:NA8RTWPT, FW:0707
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - External USB 3.0, S/N:000123456792, FW:0104
Disk /dev/sde - 71 MB / 68 MiB - CHS 1 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Disk /dev/sdf - 10 MB / 10 MiB - 2560 sectors, sector size=4096 - MSFT XVDD, FW:1.0
Disk /dev/sdg - 8589 MB / 8192 MiB - CHS 1044 255 63, sector size=512 - Msft Virtual Disk, FW:1.0
Disk \\.\PhysicalDrive4 - 71 MB / 68 MiB - CHS 1 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Disk \\.\PhysicalDrive5 - 10 MB / 10 MiB - CHS 2560 1 1, sector size=4096 - MSFT XVDD, FW:1.0

Partition table type (auto): Intel
Disk /dev/sdd - 1000 GB / 931 GiB - External USB 3.0
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1 121601  48 31 1953523057
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(7,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           245825536
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 15314 205 59  245825536 [D]
     NTFS, blocksize=4096, 125 GB / 117 GiB
NTFS at 15314/205/59
filesystem size           245825536
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 15314 205 59  245825536 [D]
     NTFS found using backup sector, blocksize=4096, 125 GB / 117 GiB
NTFS at 40966/95/25
filesystem size           1707685888
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=336959897088, part_size=874335174656, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 50992/214/38
filesystem size           818993152
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 50992 214 38  818993152 [D]
     NTFS found using backup sector, blocksize=4096, 419 GB / 390 GiB
NTFS at 50992/214/39
filesystem size           1707685888
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          50992 214 39 157291  94 51 1707685888 [E]
     NTFS, blocksize=4096, 874 GB / 814 GiB
This partition ends after the disk limits. (start=819200000, size=1707685888, end=2526885887, disk end=1953525168)
file_pread(7,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1293 GB / 1204 GiB)
The following partition can't be recovered:
     HPFS - NTFS          50992 214 39 157291  94 51 1707685888 [E]
     NTFS, blocksize=4096, 874 GB / 814 GiB

Results
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS             12 223 19    25 159  5     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS             12 223 20 15314 205 59  245825536 [D]
     NTFS, blocksize=4096, 125 GB / 117 GiB
     HPFS - NTFS             12 223 20 50992 214 38  818993152 [D]
     NTFS found using backup sector, blocksize=4096, 419 GB / 390 GiB

The partition sizes seem somewhat correct, E was somewhere in the 800-900GB range when I last saw the drive working properly.
The reason I cancelled the quick scan here, was because I ran them on different sessions and in different environments, the former being from a Live Debian USB, and latter being from my main Windows 10 install. Since the former's log was basically stored on a RAM disk, I unfortunately cannot provide it, but if needed - I can re-run a quick scan. (I just think it's kind of redundant with a log of a deeper scan provided, but feel free to prove me wrong)
Attempted recovering at least something via PhotoRec, but even that only grabbed ~45 GB of data, most of which are leftovers from that Windows 7 install that was on there, and as such - leftovers from the D partition.

Checked SMART values as well, the drive's doing fine mechanically, it's just old.

Obviously, I have not written anything to the disk since, and even if I manage to recover data from it, I wouldn't want to use it for any serious data storage going forward, maybe it'll go back in to one of my standalones as test drive.

If you need any more info, please let me know: I've tried to provide as much as I can.

And one last thing: I have backups of most data on this drive, but not all. I would at the very least get far enough to be able to see the filesystem on E and analyze what I have backups of and what I lack (some of the non-backed up data I can redownload, some others are an annoying - but acceptable loss).
recuperation
Posts: 3041
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partitions "vanished" after taking drive out of standalone

#2 Post by recuperation »

What is "standalone"?
FrostedGeulleisia
Posts: 4
Joined: 28 Aug 2023, 13:27

Re: Partitions "vanished" after taking drive out of standalone

#3 Post by FrostedGeulleisia »

Sorry but, what exactly are you asking about? The machine I pulled it from or the enclosure I was using to connect it via USB?
recuperation
Posts: 3041
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partitions "vanished" after taking drive out of standalone

#4 Post by recuperation »

Did you remove your drive from a computer or from an external enclosure?
FrostedGeulleisia
Posts: 4
Joined: 28 Aug 2023, 13:27

Re: Partitions "vanished" after taking drive out of standalone

#5 Post by FrostedGeulleisia »

It's an internal drive, removed from a computer and put into one of those enclosures you can buy and plug internal drives into.
recuperation
Posts: 3041
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partitions "vanished" after taking drive out of standalone

#6 Post by recuperation »

I don't find a question in your posting unfortunately.
FrostedGeulleisia
Posts: 4
Joined: 28 Aug 2023, 13:27

Re: Partitions "vanished" after taking drive out of standalone

#7 Post by FrostedGeulleisia »

Alright, I know it's been a while, but I had a lot of stuff going on and only now managed to get back to this.
Nothing has changed over those few months, the drive's still experiencing the same behavior.
Weirdly, an Ubuntu live CD sees the partitions, as well as all the "empty spaces" in-between, from trying to shrink and expand them all that time ago. As expected though, mounting E: fails.
And to recuperation: I simply don't understand what you mean. The drive was sitting in a computer, used for almost a decade, and when I disassembled that PC to repurpose it: I took the drive out, and put it into an external enclosure with SATA ports, so I can hook it up via USB. The enclosure is not the problem here, as it handles every other drive I throw at it just fine.
To clarify, this's hind of how it looks like, in fact it may be the exact one I have: Image
I hope this clears up the confusion.
recuperation
Posts: 3041
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partitions "vanished" after taking drive out of standalone

#8 Post by recuperation »

FrostedGeulleisia wrote: 28 Aug 2023, 14:15 Hello.

I've been trying to read data off of one of my older Seagate drives (model #: ST100DM003) after I took it out from my old standalone
What is "standalone"? If this is referring to an external enclosure you might have done something wrong by removing it. External enclosure may do undocumented things to your disk and cause trouble when the disk inside is being used elsewhere.


Checked SMART values as well, the drive's doing fine mechanically, it's just old.
I don't believe in SMART talk unless you can prove your statement with a complete smartmontools report:

viewtopic.php?f=5&t=10910
Locked