Yet another 3TB HDD fail

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Yet another 3TB HDD fail

#1 Post by zomzom »

My WD 3TB HDD has failed after 425 hours of operation. I was connecting it via docking station which has eSata and USB 3.0, I was mainly using eSata because of higher transfer speeds.
Once I looked for size of one folder on that HDD and Windows showed 0 Bytes, I have reconnected HDD and after that I could no longer access my files. I have found that I am not the only one who faced with this problem, for example here.

HDD: GPT, NTFS, 1 big partition; it was filled up to about 2-2.2TB, mainly with large (10-30GB) files. No OS was installed on it.
System: Win7, 64bit.

When I connect HDD, Windows asks me to format it. Of course, I don't do it.
Image

Windows recognizes it as 3TB unformatted drive.
Image

I was hoping that R-Studio will help me out. But it found only the last few copied files. All the other files (notice that it found more than 10 mil of files; the max number of files that could be in HDD is around 1000) were wrongly identified.
Image

S.M.A.R.T. shows no problems. LifeGuard (WD utility for HDDs) as well.
Image

When I connect HDD via eSata TestDisk sees only 800GB.
Image

But when I connect it via USB 3.0 TestDisk sees 3TB.
Image

And here are some other print screen of TestDisk.
Image
Image
Image

Quick Search is very slow. It takes 1 second to analyze 1 segment, in other words it will take over 4 days to analyse this HDD. And yes, I run TestDisk as administrator.

So, what should I do next? Please help!
Last edited by zomzom on 05 Dec 2012, 14:55, edited 1 time in total.

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#2 Post by zomzom »

Some updates:
1 update. To do a Quick Search I have used a Live CD. TestDisk was able to recognize 3 TB plugged via eSata. The speed of Quick Search was almost 10 times faster. So here are the results:
Image
Image

TestDisk has found 5 HFS partitions, while there should be only 1 NTFS.

I have run gdisk as well, here some results:
root@PartedMagic:~# gdisk /dev/sdc
GPT fdisk (gdisk) version 0.8.5

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present

Found valid GPT with protective MBR; using GPT.

Warning! Secondary partition table overlaps the last partition by
4294966385 blocks!
Try reducing the partition table size by 17179865540 entries.
(Use the 's' item on the experts' menu.)

Command (? for help): i
Partition number (1-2): 1
Partition GUID code: E3C9E316-0B5C-4DB8-817D-F92DF00215AE (Microsoft reserved)
Partition unique GUID: 24CFA9CF-E448-4D4C-A118-AB52891AA286
First sector: 34 (at 17.0 KiB)
Last sector: 262177 (at 128.0 MiB)
Partition size: 262144 sectors (128.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'Microsoft reserved partition'

Command (? for help): i
Partition number (1-2): 2
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: 99E5BE9C-DF3B-4135-A733-2040953ADD25
First sector: 264192 (at 129.0 MiB)
Last sector: 5860532223 (at 2.7 TiB)
Partition size: 5860268032 sectors (2.7 TiB)
Attribute flags: 0000000000000000
Partition name: 'Basic data partition'
And here is what fdisk has to say about this HDD:
Disk /dev/sdc: 3000.6 GB, 3000592982016 bytes
256 heads, 63 sectors/track, 363376 cylinders, total 5860533168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdc1 1 4294967295 2147483647+ ee GPT
Partition 1 does not start on physical sector boundary.
Update 2. And I am almost sure I found what has caused all this trouble. In short, crappy Intel AHCI driver that does not support more than 2 TB. More about it here. This also explains why under Windows TestDisk didn't show 3 TB size when HDD was connected via eSata. By the way, my current driver version is 8.9.8.

Is there anything I can do to recover my lost data?
Last edited by zomzom on 07 Dec 2012, 09:50, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Yet another 3TB HDD fail

#3 Post by Fiona »

Is your disk an external disk?
Did you remove it from its enclosure?
Your partition ist still in your GUID partition table.
That's why a boot sector diagnose would be recommended first.
Info will follow.

Fiona

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#4 Post by zomzom »

My disk is internal (WD 3TB RED).
I use HDD docking station (SATDOCKU3E) to connect it to my laptop.

How to do a boot sector diagnose?
Also, how to make a proper copy of current disk? I will get another exactly the same disk soon. How to be sure that my current system will not corrupt already corrupted data while making bit-by-bit copy, if you know what I mean?

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#5 Post by zomzom »

If "boot sector diagnose" means doing these steps ([Create] -> Select disk -> [Proceed] -> Select partition table (GPT in my case) -> [Advanced] -> Select partition (2nd in my case) -> [Type] -> [Proceed] -> Select partition type (NTFS in my case) -> [Proceed] -> [Boot] -> [Dump]) then here is the result:
Image
Image
Image
Image

I have tried using Backup boot sector (I have cloned my hdd and I am not using hdd that has failed) but system was still not able to access data and offered to format disk.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Yet another 3TB HDD fail

#6 Post by cgrenier »

Please run TestDisk, Advanced, select the partition, Boot, List.
If you can see your files, choose BackupBS, confirm, Quit and restart your computer.

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#7 Post by zomzom »

Thank you for your response. I have done what you have suggested and got "No file found".
Image

There was stored some mkv files on that disk, so I have done a hex (low level) search within disk and found many entries which makes me think that there is still a chance to recover data. Question is why none of my tested professional recovery programs cannot find more than last 6 files I have copied to that disk?
Image

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#8 Post by zomzom »

It is sad that there is no one here to help.

biotank
Posts: 5
Joined: 06 Dec 2012, 07:57

Re: Yet another 3TB HDD fail

#9 Post by biotank »

I had the same issue with you, and I send email to another guy regarding retrieve partitions, but he suggest me it's more of the file system issue not partition issue. his page can be find here http://www.rodsbooks.com/gdisk/

I am still trying to see which data recovery software can get me the best result, will let you know when I try them.

zomzom
Posts: 7
Joined: 04 Dec 2012, 06:57

Re: Yet another 3TB HDD fail

#10 Post by zomzom »

Thanks for your response. Yes, it is file structure problem, $MFT and $MFTMirr are damaged (or overwritten) and most probably big disk fragmentation. These two issues causes recovery software to no be able to do any recovery. I have tried over 15 different professional and semi-professional recovery programs and all of the have failed.

Locked