Protective MBR Topic is solved

[interpolgp]

Hey all, sorry for this post. I have read all the Protective MBR posts but most are from 2015 or before. I am a little worried about getting out of date information.

I imagine most people come here with a similar story. I have a Seagate 3TB drive from 2015 and everything was working great till it wasn't. It appears the power board in the USB enclosure died and now when I plug in the directly to my PC via Sata Cable none of my Operating systems are able to read the data.

Windows 10 sees it as RAW DATA
Fedora doesn't mount it. (Only appears in Testdisk and disk size appears correct)

The disk was one large partition that I stored videos on. I was connected via USB3 to a RaspberryPi and I believe the file format was NTFS.

My understanding is that because of the size of my Drive, there is a workaround where a GBT partition is used but it appears as MBR to facilitate the large capacity.

Could you advise on what to use when I launch test disk? Testdisk says the partition is MBR, but this can]t be true. I have run a quick search on both MBR and GPT and I am unable to list the files like I see others do in tutorials.

Is there any advice you can give?

Code: Select all

Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - SanDisk SDSSDX12, FW:R211
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, FW:CC43
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LX015-1U71, FW:SDM1

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM001-1CH1
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
BAD_RS LBA=51456 16450559


test_FAT()
 2 P FAT32                    3  51 49 45600  40  8  732515072
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 0B
Current partition structure:
 1 P EFI GPT                  0   0  2     3  47 50      51205

Bad relative sector.
Invalid FAT boot sector
 2 P FAT32                    3  51 49 45600  40  8  732515072
 2 P FAT32                    3  51 49 45600  40  8  732515072

Bad relative sector.
No partition is bootable
Backup partition structure
partition_save

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           732563456
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              1   5  5 364800 190 62 5860507648
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
   * HPFS - NTFS              1   5  5 364800 190 62 5860507648
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 5860507648 linear /dev/sdb 16384" | dmsetup create test0
ntfs_mst_post_read_fixup_warn: magic: 0xfe8f7130  size: 4096   usa_ofs: 22298  usa_count: 41598: Invalid argument
Record 0 has no FILE magic (0xfe8f7130)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfe8f7130  size: 4096   usa_ofs: 22298  usa_count: 41598: Invalid argument
Record 0 has no FILE magic (0xfe8f7130)
Failed to load $MFT: Input/output error

[recuperation]

Hey all, sorry for this post. I have read all the Protective MBR posts but most are from 2015 or before. I am a little worried about getting out of date information.

I imagine most people come here with a similar story. I have a Seagate 3TB drive from 2015 and everything was working great till it wasn't. It appears the power board in the USB enclosure died and now when I plug in the directly to my PC via Sata Cable none of my Operating systems are able to read the data.

Windows 10 sees it as RAW DATA
Fedora doesn't mount it. (Only appears in Testdisk and disk size appears correct)

The disk was one large partition that I stored videos on. I was connected via USB3 to a RaspberryPi and I believe the file format was NTFS.

My understanding is that because of the size of my Drive, there is a workaround where a GBT partition is used but it appears as MBR to facilitate the large capacity.

Could you advise on what to use when I launch test disk? Testdisk says the partition is MBR, but this can]t be true. I have run a quick search on both MBR and GPT and I am unable to list the files like I see others do in tutorials.

As the log file outlines a discrepancy between the sector size of the harddisk that is now operated without its external enclosure ( 512 bytes) on one hand and a sector size of 4096 bytes as reflected by the content of the harddisk, your disk most likely used a MBR structure.

Given a sector size of 512 bytes though, the MBR structure could only adress 512 byte * 2^32 ~= 2TB. This well known limitation had likely been overcome by a translating mechanism of your enclosure interface. The interface simulated a sector size of 4096 bytes towards the computer.
This way even the old MBR structure was able to adress 3 TB as 3 TB <= 4096 byte * 2^32.

Therefore, a protective MBR is not your problem.

Now, when being operated without the translating electronics, your harddisk shows its real face exhibiting a sector size of 512 bytes.

Solution 1:
The easiest solution is to buy your outdated device again and putting your hard disk inside.

Solution 2: ??? not sure if that works ???
For the following other solutions I urge you to clone your disk to disk or into a file as my hints are not tested.
In advanced options set the sector size equal to 4096 bytes.
Then run TestDisk. If only your enclosure broke down and your hard disk is still healthy, TestDisk should find the partition and you can use TestDisk to rescue the content of your partition to another location.

Solution 3:
Mount your cloned blockdevice (HDD or SSD) or your image file as a loop device by using the losetup command in linux. Use the --sector-size command to set your sector size to 4096.
If your hard disk has not been dammaged, you should be able to mount that loop device or run TestDisk against the loop device.

[interpolgp]

Thank you for your reply. I will follow your instructions and report back.

I only have one question and it may be impossible to answer. Do you think any external HDD enclosure can perform this translating mechanism? (simulated a sector size of 4096 bytes). Or will I search to find the exact same Seagate HDD enclosure?

Again thanks for your help. My first job is to back up the Drive

[recuperation]

Thank you for your reply. I will follow your instructions and report back.

I only have one question and it may be impossible to answer. Do you think any external HDD enclosure can perform this translating mechanism? (simulated a sector size of 4096 bytes). Or will I search to find the exact same Seagate HDD enclosure?

If any external HDD enclosure translated sector sizes, I would not have recommended buying the original enclosure.

The TestDisk log file tells you, what sector size the external enclosure returns upon request.
A translating enclosure will return a different sector size than the size specified on the sticker on top of the disk.

[interpolgp]

Sorry for the stupid question but it wasn't clear to me.

I can't find the old enclosure anywhere, so I will backup the old HDD (Seagate3tb) to a new 4TB HDD.

My first thought was to use image creation in TestDisk, it found two partitions 1. 25mb and 2. a 345GB. I copied them to a location and I will try to mount them as loop devices as you said, but I do not expect them to be successful. Surely the 345GB is too small and all my data will not be present

I am currently trying to use clonezila and rescuezila to do a "disk to disk" clone of my 3tb HDD to a new 4tb HDD, but I am running into the same issue. They are both seeing incorrect information and crash with errors.

I will try to find another way to clone.

[recuperation]

To clone your disk use ddrescue as described in the manual.

[interpolgp]

I have cloned the disk and set the sector size equal to 4096 bytes of the cloned drive. The partition name is now displayed but I still cant list the files. I will attempt to mount it and see if I get anything

Code: Select all

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 4000 GB / 3726 GiB - CHS 60801 255 63

     Partition                  Start        End    Size in sectors
> 1 P EFI GPT                  0   0  2     3  47 50      51205
  2 P FAT32                    3  51 49 45600  40  8  732515072 [SEAGATE 3TB]

[interpolgp]

I can't mount the cloned drive. I keep getting errors.

I decided to run photorec on the cloned HDD and it has found my data so finally something good.

I guess this means the original drive is good, I just have to figure out the partition map issue.

I am reading about 512e, I believe it is the emulation you were talking about.

Thanks for the help so far