Partition issues with 3TB drive - newbe

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Partition issues with 3TB drive - newbe

#1 Post by gdoran »

I have a 3TB external drive(actually two is a Buffalo Drive system enclosure) that apparently got messed up due to improper shutdown. Windows 7-64bit is showing it in Disk Management having two partitions, one 2048.00 gb unallocated and a 746.21 GB unallocated but there is just one partition on the disk. The second hard drive is showing up perfectly fine as a Basic 2794.08 GB NTFS healthy primary partition. Analyse is still running, I am posting what has come up as of 89% complete, hoping that this might be enough to give me some direction. I will post the rest when it is done

Thanking you in advance for your help!

Mon Oct 1 16:52:37 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308556070912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=524386304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000120639488
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST3320413AS, S/N:2020202020202020202020205636584d53324833, FW:JC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 5722535 32 32, sector size=512 - BUFFALO HD-WLU3/R1 1, FW:0001
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 2, FW:0001
Drive D: - 524 MB / 500 MiB - CHS 125 64 32, sector size=2048 - TSSTcorp DVD+-RW TS-H653H, FW:D800

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - BUFFALO HD-WLU3/R1 1
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 5722535 32 32
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5859875983 (expected 5859875983)
hdr_lba_start=34
hdr_lba_end=5859875950
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Warning: number of heads/cylinder mismatches 255 (NTFS) != 32 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 32 (HD)
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#2 Post by gdoran »

After three days on analysing, here is what we came up with. It said there were two partitions that could not be recovered and I selected ok, then it said hard disk (3000gb/2794 gib) seems to small << 600gb/5588 gib, check hd humpers and bios detecttion (see attachment for actual print screens). Then it showed me a partition, ntfs, blocksize=4096, 2199gb/2047. This eems very strange to me because I originaly could read files and copy, even through around 480gb it did seem to start at square one with the copy. It is a two drive Buffalo Drive station that has the ability to do two forms of raid, one a mirror and one combining the two drives into a 6 gb partion. Not sure if that is causing problems? I would really appreciate some insight on how to proceed since I have over a 1TB of data on the drive.
Thank you in advance.


Mon Oct 1 16:52:37 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308556070912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=524386304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000120639488
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST3320413AS, S/N:2020202020202020202020205636584d53324833, FW:JC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 5722535 32 32, sector size=512 - BUFFALO HD-WLU3/R1 1, FW:0001
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 2, FW:0001
Drive D: - 524 MB / 500 MiB - CHS 125 64 32, sector size=2048 - TSSTcorp DVD+-RW TS-H653H, FW:D800

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - BUFFALO HD-WLU3/R1 1
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 5722535 32 32
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5859875983 (expected 5859875983)
hdr_lba_start=34
hdr_lba_end=5859875950
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Warning: number of heads/cylinder mismatches 255 (NTFS) != 32 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 32 (HD)
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
Backup partition structure
partition_save

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 5722535 32 32
NTFS at 0/2/1
heads/cylinder 255 (NTFS) != 32 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 4294961621
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 64 4294961684 4294961621
NTFS, blocksize=4096, 2199 GB / 2047 GiB
check_FAT: Bad jump in FAT partition
file_pread(5,1,buffer,1564908688(5722535/4/17)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1564908689(5722535/4/18)) lseek err Invalid argument
** deleted much more of the same du to message size. **
file_pread(5,1,buffer,1564908690(5722535/4/19)) lseek err Invalid argument
le_pread(5,1,buffer,1564909563(5722535/31/28)) lseek err Invalid argument
file_pread(5,1,buffer,1564909564(5722535/31/29)) lseek err Invalid argument
file_pread(5,1,buffer,1564909565(5722535/31/30)) lseek err Invalid argument
file_pread(5,1,buffer,1564909566(5722535/31/31)) lseek err Invalid argument
file_pread(5,1,buffer,1564909567(5722535/31/32)) lseek err Invalid argument
NTFS at 5722533/31/32
heads/cylinder 255 (NTFS) != 32 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 5859610624
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,4096,buffer,1571198975(5728677/31/32)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 5859874815 11719485438 5859610624
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=1564907519, size=1564643328, end=3129550846, disk end=1564908688)
file_pread(5,1,buffer,1564909568(5722536/0/1)) lseek err Invalid argument
** Deleted much more of the same due to size **

file_pread(5,1,buffer,1564909755(5722536/5/28)) lseek err Invalid argument
file_pread(5,1,buffer,1564909756(5722536/5/29)) lseek err Invalid argument
file_pread(5,1,buffer,1564909757(5722536/5/30)) lseek err Invalid argument
file_pread(5,1,buffer,1564909758(5722536/5/31)) lseek err Invalid argument
file_pread(5,1,buffer,1564909759(5722536/5/32)) lseek err Invalid argument
file_pread(5,1,buffer,1564909760(5722536/6/1)) lseek err Invalid argument
file_pread(5,1,buffer,1564909761(5722536/6/2)) lseek err Invalid argument
file_pread(5,1,buffer,1564909762(5722536/6/3)) lseek err Invalid argument
NTFS at 5722534/6/3
heads/cylinder 255 (NTFS) != 32 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 1564907651
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,4096,buffer,1571199170(5728678/6/3)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 5859875010 7424782660 1564907651
NTFS, blocksize=4096, 801 GB / 746 GiB
This partition ends after the disk limits. (start=1564907714, size=1564907651, end=3129815364, disk end=1564908688)
file_pread(5,1,buffer,1564909763(5722536/6/4)) lseek err Invalid argument
file_pread(5,1,buffer,1564909764(5722536/6/5)) lseek err Invalid argument
** deleted many more of the same
file_pread(5,1,buffer,1564910399(5722536/25/32)) lseek err Invalid argument
file_pread(5,1,buffer,1564910400(5722536/26/1)) lseek err Invalid argument
file_pread(5,1,buffer,1564910401(5722536/26/2)) lseek err Invalid argument
file_pread(5,1,buffer,1564910402(5722536/26/$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Attachments
testdisk-output.zip
print screens
(164.75 KiB) Downloaded 446 times

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Partition issues with 3TB drive - newbe

#3 Post by dragonfly41 »

I've no experience of that fault but out of curiosity I googled the key word

"$MFT has invalid magic"

and found these hits which might give some clues ..

http://ubuntuforums.org/showthread.php?t=1012825

http://forum.cgsecurity.org/phpBB3/ran- ... -t798.html

http://tuxera.com/forum/viewtopic.php?f=3&t=571

http://ubuntuforums.org/showthread.php? ... alid+magic

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#4 Post by gdoran »

Thanks for your input. It seems pretty odd, TestDisk seems to know all about the filesystem, it pulls up directories and files that appears to be valid, I would just copy everything off but there seems to be a problem when the copy hits around 480GB for the single file.

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Partition issues with 3TB drive - newbe

#5 Post by dragonfly41 »

I've suggested to users in other posts to try a free trial of RecoverMyFiles (i.e. just use in evaluation mode)

http://www.recovermyfiles.com/

If you can see your file structure using this commercial program then you can choose to use a commercial recovery program such as this or keep trying testdisk.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition issues with 3TB drive - newbe

#6 Post by Fiona »

Looks like that your Data-Partition is still in your GUID-partition table.
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
Did you already try a boot sector diagnose?
I'd need some infos from TestDisk / Advanced.
You can copy and paste the content from your testdisk.log.

Fiona

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#7 Post by gdoran »

It looked like there was some geometry issues, so I looked at the second drive in the enclosure and found the cyl=364760, Heads=255, Sectors=63, Sector size =512. Started to re-run quick search, ran all night, only at 80% done. If you happen to be online, let me know if you want me just to quit that. I did try a boot sector repair, didn't seem to do much, Windows still sees the drive with two partitions that are un-allocated. Perhaps I should try boot sector repair with the geomtry changed?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition issues with 3TB drive - newbe

#8 Post by Fiona »

Windows still sees the drive with two partitions that are un-allocated.
Would it be possible to upload a screen from your disk management console?
So I can compare it between windows and TestDisk.
Unallocated means easily empty.
The difference is, unallocated or empty disk doesn't contain any partition.
If you have an unformatted partition created (also valid for GUID partition table) your partition will be recognized but unformatted.
Windows will format it, but you shouldn't do it, because you'll override your previous partitions.
Geometry issues are only important if you have an Intel MBR partition.
As long as you use EFI GPT in TestDisk, TestDisk will search each sector for partitions.
This consumes a lot of time.
That's why, if it possible, I diagnose the partition table first (doesn't a matter, is it Intel or GUID partition table).
If any partition is still in the partition table, I'll diagnose the boot sector.
Intel MBR only supports partitions and disks up to 2.2 TB.
Bigger disks and partitions require GUID partitions (GPT
GUID partitions are build in slices.
So that geometry is not important or needed.
Despite that, a boot sector recovery or diagnose is possible.

GUID partitions are a little bit different.
Under windows, you have a MS Reserved partition at the start of your disk and your impotant partition containing data is your MS Data-partition.
Sometimes TestDisk / Advanced lists the MS Data partition but no file system.
In case you can use the menu Type to set it to NTFS for example.
Then you'd be able to use the menu boot and Rebuild BS to have a try to rebuild a boot sector for example.

Fiona

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#9 Post by gdoran »

Here is the screen shot from Disk Manager. I am showing the Disk 1 which is damanged and it's "twin" in Disk 2 for your benefit. Did you want me to stop quick search, and start doing something from Advanced menu right away?
DiskAdmin.PNG
DiskAdmin.PNG (9.31 KiB) Viewed 7090 times

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#10 Post by gdoran »

Here is the info from Advanced menu.

Fri Oct 5 12:31:58 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308556070912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2982248448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000120639488
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST3320413AS, S/N:2020202020202020202020205636584d53324833, FW:JC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 1, FW:0001
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 2, FW:0001
Drive D: - 2982 MB / 2844 MiB - CHS 711 64 32, sector size=2048 - TSSTcorp DVD+-RW TS-H653H, FW:D800

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - BUFFALO HD-WLU3/R1 1
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5859875983 (expected 5859875983)
hdr_lba_start=34
hdr_lba_end=5859875950
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

ntfs_boot_sector
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
ADV-1.PNG
ADV-1.PNG (14.41 KiB) Viewed 7085 times
ADV-1.PNG
ADV-1.PNG (14.41 KiB) Viewed 7085 times
ADV-1.PNG
ADV-1.PNG (14.41 KiB) Viewed 7085 times
Attachments
AVD-2.PNG
AVD-2.PNG (11.36 KiB) Viewed 7085 times

Locked