Please post your TestDisk logfile!
Using ddrescue was the right thing to do.
When duplicating the disk onto a bigger disc using ddrescue, it is a good idea to complete delete the clone target before filling it with zeros. This will prevent confusing TestDisk and other recovery software to interpret invalid content in the last TB of your target disk.
As you definitively have a broken source disk you should duplicate your clone again to have a clean second clone of your broken source.
You can use the second clone to play around without worries.
If you do something wrong with the second clone you can clone the first clone to the second one again.
This will be pretty fast as you do not face delays due to unreadable sectors.
As for your smartmontools failure, read my posting here:
viewtopic.php?f=5&t=10910
You bought a an external disk with a size of 4 TB which is beyond the 2 TB boundary for the MBR partitioning schema with sectors having a size of 512 bytes.
As you got the disk with an enclosure from the manufacturer, chances are high that it contains some electronics emulating a sector size of 4096 bytes.
This will allow to use MBR as a partition scheme for greater compatibility. Without emulating electronics, MBR can only address 2 TB with disks using a sector size of 512 bytes and the rest of space will be unusable under windows.
If you partitioned and formated your disk yourself try to remember if you used MBR or GPT.
You should provide TestDisk with the correct partitioning scheme when being asked.
My current questions:
So based on the above, do you have an idea of what might be the problem with the original disk and if I have a better way of fixing it then what I tried?
(By fixing it I mean recovering the data either from the original or the 5TB copy.)
You have unreadable sectors. A smartmontools report would deliver more information. Using ddrescue was a good idea.
Keeping your ddrescue logfile enables to continue the recovery in the future.
In the mean time you should not modifiy your first clone.
I would rerun ddrescue so that it takes care of the unrecovered area if you are not in a hurry. Transfer speed will guide you a little bit. Due to the number of read retries by the firmware of your disk the transfer speed can drop dramatically.
If the way to go is the PhotoRec, is there a way to recover filenames, folderstructure, and maybe to filter out files that were already recovered?
No, not with PhotoRec is the tool of last resort. PhotoRec is a kind of generic method to recovery file data in a smart way but requires files to be stored unfragmented on the disk.
Between the defined and limited repair abilities of TestDisk and the recovery abilities of PhotoRec is a big gap that you can fill with commercial recovery tools.
This gap requires file system specific recovery code.
If such tools cannot provide file names and folder structure at all, there is no need to pay for them because PhotoRec is assumably still the best tool for the "Mad Max" scenario when everything is broken.
I did not find anything I can use in the guide, maybe a Linux batch for finding duplicates of images,
Sorry, finding duplicates is completely out of scope of data recovery software.
but I have a lot more files with divers formats.
With PhotoRec, progress was quite fast, the first 20% was recovered in about 8 hours, however then the tool seemed to have stopped or stalled at least and not recovered anything new for over a day, at which point I have stopped it. Any idea what might be the reason?
Have you run PhotoRec against your defective cloning source? This would be a bad idea as you would have stressed a broken disk.
Furthermore PhotoRec does not deal with unreadable sectors. Ddrescue deals with that.
Also is there a way to continue the recovery from the last tried point like with ddrescue? I have read yes in the guide but when I tried recovery again it started from the very beginning and I could not find any options in the windows GUI version. Should I use the commandline version?
The command line version asks you if the program should continue with an already existing recovery.
Maybe the GUI-version did not see the PhotoRec.ses or it got lost (using a linux USB pen drive?).
If you partitioned and formated your disk yourself, try to buy that external disk again, zero out the disk and redo that partitioning and formating procedure or note the parameters if the disk came the way you used it. There is a backup function for the partition structure in TestDisk that will export that information in a readable text file.
Using some of those hex editors around which translate sector content into user-readable information (for partition tables and boot sectors) you could try to insert that information into your second duplicate.
You are on your own as this is beyond the scope of TestDisk support. You find enough free information about MBR and GPT. There is a open documentation of EXFAT by Microsoft. There is a forensic book by Brian Carrier on file systems.
One issue to overcome is that your target disk most likely has sectors with a size of 512 bytes. Your ddrescue duplicate residing on your target disk has information about a sector size of most likely 4096 bytes. Under linux this can be overcome with the losetup command and creating a virtual device. Under Windows you either have an expensive disk with a sector size of 4096 bytes or have used ddrescue to clone into a file (which requires a disk with a capacity of slighty more than 4 TB) and have some file mounting software which mounts your cloned target file as a device assuming a sector size of 4096 bytes.
Modified 10.1.2024 23:17 MEZ