3 terabyte (3tb) filesystem RAW, boot sectors both "bad"

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
SkinsFan346
Posts: 2
Joined: 16 Mar 2013, 19:24

3 terabyte (3tb) filesystem RAW, boot sectors both "bad"

#1 Post by SkinsFan346 »

While attempting to format another drive, my 3 terabyte toshiba canvio external hard drive was "apparently" formatted (never got a format completion pop-up window), so it is possible a full format did not occur.

Either way, both boot sectors (original & backup) are corrupted from the looks of it.

The drive now lists the filesystem in windows (Win 7 pro, 64-bit) as "RAW".

I proceeded to run the testdisk software in hopes of correcting the problem.

I also ran a "Deeper Scan", and the following image is the end result of the search:
testdisk deepscan screen shot
testdisk deepscan screen shot
testdisk deepscan screen.png (42.84 KiB) Viewed 3214 times
My original log should be shown below (I am now currently trying to now "RebuildBS" via MFT search).
testdisk MFT search screen shot
testdisk MFT search screen shot
testdisk MFT search screen shot.png (12.56 KiB) Viewed 3214 times
Admittedly, I am a bit ignorant on the inner-workings of hard disk recovery, so I appreciate any help that the community can possibly provide.

Thank you for your time, and have a great day.

Brett

Code: Select all

Fri Mar 15 20:48:40 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-03-10T16:32:17
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=320070483968
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=320070483968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2000398901760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=3000592723968
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEKT-22F3T0, S/N:2020202057202d44585738453830465033343832, FW:11.01A11
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEKT-00F3T0, S/N:2020202057202d445857394d38304c5333303930, FW:11.01A11
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - FANTOM ST2000DL003-9VT1, S/N:5YD16SH3, FW:2.10
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Toshiba External USB 3.0, S/N:3176C413, FW:0201
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Toshiba External USB 3.0, S/N:3176C413, FW:0201
Drive T: - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Toshiba External USB 3.0, S/N:3176C413, FW:0201

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - Toshiba External USB 3.0
Partition table type: Intel

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
NTFS at 0/4/5
filesystem size           732566016
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(7,1,buffer,732566650(45600/42/5)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566656(45600/42/11)) lseek err Invalid argument
file_pread(7,1,buffer,732566672(45600/42/27)) lseek err Invalid argument
file_pread(7,1,buffer,732566688(45600/42/43)) lseek err Invalid argument
file_pread(7,1,buffer,732566704(45600/42/59)) lseek err Invalid argument
file_pread(7,1,buffer,732566720(45600/43/12)) lseek err Invalid argument
file_pread(7,1,buffer,732566736(45600/43/28)) lseek err Invalid argument
file_pread(7,1,buffer,732566752(45600/43/44)) lseek err Invalid argument
file_pread(7,1,buffer,732566768(45600/43/60)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566785(45600/44/14)) lseek err Invalid argument
file_pread(7,1,buffer,732566786(45600/44/15)) lseek err Invalid argument
file_pread(7,2,buffer,732566791(45600/44/20)) lseek err Invalid argument
file_pread(7,2,buffer,732566793(45600/44/22)) lseek err Invalid argument
file_pread(7,3,buffer,732566799(45600/44/28)) lseek err Invalid argument
file_pread(7,1,buffer,732567040(45600/48/17)) lseek err Invalid argument

Results
   * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB


dir_partition inode=5
   * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 14-Mar-2013 20:49 .
       5 dr-xr-xr-x     0      0         0 14-Mar-2013 20:49 ..
      83 dr-xr-xr-x     0      0         0 12-Mar-2013 00:10 C Drive Downloads
   12504 -r--r--r--     0      0       294 10-Mar-2013 14:41 !!CAUTION!!_DO_NOT_MODIFY_YOUR_BACKUP_FILES.txt
      50 dr-xr-xr-x     0      0         0 10-Mar-2013 12:11 $RECYCLE.BIN
      35 dr-xr-xr-x     0      0         0 19-Jan-2013 07:37 autorun
      70 -r--r--r--     0      0       124 29-Aug-2011 04:08 autorun.bak
      71 -r--r--r--     0      0       135  1-Sep-2010 01:29 autorun.inf
   77216 dr-xr-xr-x     0      0         0 14-Mar-2013 19:06 boot
      40 -r--r--r--     0      0      9324  2-Jul-2012 06:58 Declaration of Conformity.pdf
   77160 dr-xr-xr-x     0      0         0 13-Mar-2013 23:16 Downloads
      53 dr-xr-xr-x     0      0         0 11-Mar-2013 20:48 Fantom Drive
   77219 -r--r--r--     0      0    217769 14-Jun-2011 15:54 grldr
   77215 dr-xr-xr-x     0      0         0 14-Mar-2013 19:06 Images(Brett-PC)
   77220 -r--r--r--     0      0       161 14-Mar-2013 19:06 menu.lst
     123 dr-xr-xr-x     0      0         0 10-Mar-2013 14:41 My Files(Brett-PC)
      41 dr-xr-xr-x     0      0         0 19-Jan-2013 07:37 NTI
      44 dr-xr-xr-x     0      0         0 19-Jan-2013 07:37 OpenSourceSoftwareInfo
   12109 dr-xr-xr-x     0      0         0 10-Mar-2013 14:40 restore
      47 -r--r--r--     0      0  15602770 24-May-2012 00:11 Setup.exe
   77181 dr-xr-xr-x     0      0         0 12-Mar-2013 19:04 System Volume Information
      48 -r--r--r--     0      0     75833 23-Apr-2012 13:39 Warranty.pdf

interface_write()
 1 * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
NTFS at 0/4/5
filesystem size           732566016
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(7,1,buffer,732566650(45600/42/5)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566656(45600/42/11)) lseek err Invalid argument
file_pread(7,1,buffer,732566672(45600/42/27)) lseek err Invalid argument
file_pread(7,1,buffer,732566688(45600/42/43)) lseek err Invalid argument
file_pread(7,1,buffer,732566704(45600/42/59)) lseek err Invalid argument
file_pread(7,1,buffer,732566720(45600/43/12)) lseek err Invalid argument
file_pread(7,1,buffer,732566736(45600/43/28)) lseek err Invalid argument
file_pread(7,1,buffer,732566752(45600/43/44)) lseek err Invalid argument
file_pread(7,1,buffer,732566768(45600/43/60)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566785(45600/44/14)) lseek err Invalid argument
file_pread(7,1,buffer,732566786(45600/44/15)) lseek err Invalid argument
file_pread(7,2,buffer,732566791(45600/44/20)) lseek err Invalid argument
file_pread(7,2,buffer,732566793(45600/44/22)) lseek err Invalid argument
file_pread(7,3,buffer,732566799(45600/44/28)) lseek err Invalid argument
file_pread(7,1,buffer,732567040(45600/48/17)) lseek err Invalid argument

Results
   * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
 1 * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
NTFS at 0/4/5
filesystem size           732566016
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(7,1,buffer,732566650(45600/42/5)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566656(45600/42/11)) lseek err Invalid argument
file_pread(7,1,buffer,732566672(45600/42/27)) lseek err Invalid argument
file_pread(7,1,buffer,732566688(45600/42/43)) lseek err Invalid argument
file_pread(7,1,buffer,732566704(45600/42/59)) lseek err Invalid argument
file_pread(7,1,buffer,732566720(45600/43/12)) lseek err Invalid argument
file_pread(7,1,buffer,732566736(45600/43/28)) lseek err Invalid argument
file_pread(7,1,buffer,732566752(45600/43/44)) lseek err Invalid argument
file_pread(7,1,buffer,732566768(45600/43/60)) lseek err Invalid argument
file_pread(7,1,buffer,732566784(45600/44/13)) lseek err Invalid argument
file_pread(7,1,buffer,732566785(45600/44/14)) lseek err Invalid argument
file_pread(7,1,buffer,732566786(45600/44/15)) lseek err Invalid argument
file_pread(7,2,buffer,732566791(45600/44/20)) lseek err Invalid argument
file_pread(7,2,buffer,732566793(45600/44/22)) lseek err Invalid argument
file_pread(7,3,buffer,732566799(45600/44/28)) lseek err Invalid argument
file_pread(7,1,buffer,732567040(45600/48/17)) lseek err Invalid argument

Results
   * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
 1 * HPFS - NTFS              0   4  5 45600  36  4  732566016 [TOSHIBA EXT]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 45600  41 63  732566583
filesystem size           1
sectors_per_cluster       0
mft_lcn                   0
mftmirr_lcn               0
clusters_per_mft_record   0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 3 terabyte (3tb) filesystem RAW, boot sectors both "bad"

#2 Post by Fiona »

Either your boot sector or your file system is damaged.
You can use tetsdisk and the menu "Advanced / Boot to diagnose it.
Please upload another screen shot or copy and paste the content of your testdisk.log.
At the menu List you can list and copy/backup your files first.
At the bottom of the screen shot, you'll find all the commands.
Checking that two dots and pressing enter, you'll come up on directory until you get to your disk selection.
You can select another intact disk as destiny/target where you can to copy your data to.
To navigate into a folder you can use your arrow key on your keyboard.
After backup (recommended) you can write/repair your boot sector using rebuild BS.
both boot sectors (original & backup) are corrupted from the looks of it.
Did Rebuild BS help?
If your file system is damaged, boot sector repair is not recommended.

Fiona

SkinsFan346
Posts: 2
Joined: 16 Mar 2013, 19:24

Re: 3 terabyte (3tb) filesystem RAW, boot sectors both "bad"

#3 Post by SkinsFan346 »

Fiona,

Thank you for the reply.

The "Rebuild BS" via MFT search is still on-going (taken a couple of days...should be finished in the next 8 hours or so...numerous sectors).

When I click "Analyze" and hit "P" to view files on drive, positive results come up, which I believe my initial log shows:
dir_partition inode=5
* HPFS - NTFS 0 4 5 45600 36 4 732566016 [TOSHIBA EXT]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Directory /
5 dr-xr-xr-x 0 0 0 14-Mar-2013 20:49 .
5 dr-xr-xr-x 0 0 0 14-Mar-2013 20:49 ..
83 dr-xr-xr-x 0 0 0 12-Mar-2013 00:10 C Drive Downloads
12504 -r--r--r-- 0 0 294 10-Mar-2013 14:41 !!CAUTION!!_DO_NOT_MODIFY_YOUR_BACKUP_FILES.txt
50 dr-xr-xr-x 0 0 0 10-Mar-2013 12:11 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2013 07:37 autorun
70 -r--r--r-- 0 0 124 29-Aug-2011 04:08 autorun.bak
71 -r--r--r-- 0 0 135 1-Sep-2010 01:29 autorun.inf
77216 dr-xr-xr-x 0 0 0 14-Mar-2013 19:06 boot
40 -r--r--r-- 0 0 9324 2-Jul-2012 06:58 Declaration of Conformity.pdf
77160 dr-xr-xr-x 0 0 0 13-Mar-2013 23:16 Downloads
53 dr-xr-xr-x 0 0 0 11-Mar-2013 20:48 Fantom Drive
77219 -r--r--r-- 0 0 217769 14-Jun-2011 15:54 grldr
77215 dr-xr-xr-x 0 0 0 14-Mar-2013 19:06 Images(Brett-PC)
77220 -r--r--r-- 0 0 161 14-Mar-2013 19:06 menu.lst
123 dr-xr-xr-x 0 0 0 10-Mar-2013 14:41 My Files(Brett-PC)
41 dr-xr-xr-x 0 0 0 19-Jan-2013 07:37 NTI
44 dr-xr-xr-x 0 0 0 19-Jan-2013 07:37 OpenSourceSoftwareInfo
12109 dr-xr-xr-x 0 0 0 10-Mar-2013 14:40 restore
47 -r--r--r-- 0 0 15602770 24-May-2012 00:11 Setup.exe
77181 dr-xr-xr-x 0 0 0 12-Mar-2013 19:04 System Volume Information
48 -r--r--r-- 0 0 75833 23-Apr-2012 13:39 Warranty.pdf
I am hopeful this indicates that if the boot sector can be "rebuilt", then the O/S might be able to recognize the drive once again?

If I am able to "view" files via the "P" keystroke, does that support the notion that the "filesystem" may be intact?

Looking at my log, how does it "read" to you? Are you able to gather anything of significance from it?

It is a new drive, recently purchased it (3/10/13) and just completed the process of transferring data from a 2 tb drive when the inadvertent format occurred.

Also, should I be concerned about the number of "heads" in the partition that testdisk is showing?
1 * HPFS - NTFS 0 1 1 45600 41 63 732566583
It is reporting 41, but should it not be 255?

I will upload results (screens) of the "RebuildBS" when it is finished. Hopefully, I am able to "list" files upon completion of this step.

Loading the information onto another disk might be tricky due to its size (3tb...do not have excess capacity on another drive). Obviously, I am shooting for a new boot sector, which might enable the O/S to recognize the HDD.

Thank you for your assistance Fiona, really appreciate it.

Brett

Locked