Can't recover RAID 0 Partitions - wrong geometry ?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bbarylowicz
Posts: 3
Joined: 22 Apr 2013, 14:04

Can't recover RAID 0 Partitions - wrong geometry ?

#1 Post by bbarylowicz »

Hi,

I had a RAID 0 matrix on intel controller consisted of two 250GB HDDs. After BIOS reset one of the disk became NOT Member Disk.
I removed the other disk from the matrix and recreated the matrix.

Before the accident there were three partitions on the matrix formated with NTFS.
I started TestDisk to restore my partitions. Unfortunatelly it finds only one partition formatted with FAT16 (no matter if I use Quick or deeper search). It also displays the message: The harddisk ... seems too small!
Is there a way to restore my partitions ?

I am attaching the images from the restoring process:
Image
Image
Image
Last edited by bbarylowicz on 25 Apr 2013, 09:27, edited 1 time in total.

bbarylowicz
Posts: 3
Joined: 22 Apr 2013, 14:04

Re: Can't recover RAID 0 Partitions

#2 Post by bbarylowicz »

Here's the log from the process:

Code: Select all

Thu Apr 25 07:06:07 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-14T19:46:54
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500095254528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500095254528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107610112000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4005625856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD1600AAJS-07WAA0, S/N:2020202057202d44435753413432343537353638, FW:58.01D58
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512 - GRAID, S/N:RAID, FW:0000
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Backup+ BK, S/N:NA51Z45R, FW:0409
Disk /dev/sdd - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - OCZ Rally2, FW:PMAP

Partition table type default to Intel
Disk /dev/sdb - 500 GB / 465 GiB - GRAID
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63
BAD_RS LBA=1238363997 10426170
file_pread(5,3,buffer,1238363997(77084/151/25)) lseek err Invalid argument
file_pread(5,1,buffer,1238363997(77084/151/25)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            77084 151 25 118629 191 24  667422945
This partition ends after the disk limits. (start=1238363997, size=667422945, end=1905786941, disk end=976748544)
file_pread(5,14,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,1,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,8,buffer,976748552(60799/200/18)) lseek err Invalid argument
file_pread(5,3,buffer,976748560(60799/200/26)) lseek err Invalid argument
file_pread(5,3,buffer,976748607(60799/201/10)) lseek err Invalid argument
file_pread(5,8,buffer,976748623(60799/201/26)) lseek err Invalid argument
file_pread(5,11,buffer,976748670(60799/202/10)) lseek err Invalid argument
file_pread(5,2,buffer,976750592(60799/232/42)) lseek err Invalid argument
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 975 GB / 908 GiB)
The following partition can't be recovered:
     FAT16 LBA            77084 151 25 118629 191 24  667422945

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63
BAD_RS LBA=1238363997 10426170
file_pread(5,3,buffer,1238363997(77084/151/25)) lseek err Invalid argument
file_pread(5,1,buffer,1238363997(77084/151/25)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            77084 151 25 118629 191 24  667422945
This partition ends after the disk limits. (start=1238363997, size=667422945, end=1905786941, disk end=976748544)
file_pread(5,14,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,1,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,8,buffer,976748552(60799/200/18)) lseek err Invalid argument
file_pread(5,3,buffer,976748560(60799/200/26)) lseek err Invalid argument
file_pread(5,3,buffer,976748607(60799/201/10)) lseek err Invalid argument
file_pread(5,8,buffer,976748623(60799/201/26)) lseek err Invalid argument
file_pread(5,11,buffer,976748670(60799/202/10)) lseek err Invalid argument
file_pread(5,2,buffer,976750592(60799/232/42)) lseek err Invalid argument
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 975 GB / 908 GiB)
The following partition can't be recovered:
     FAT16 LBA            77084 151 25 118629 191 24  667422945

Results

interface_write()
 
No partition found or selected for recovery

bbarylowicz
Posts: 3
Joined: 22 Apr 2013, 14:04

Re: Can't recover RAID 0 Partitions - wrong geometry ?

#3 Post by bbarylowicz »

I run Photorec with the default geometry.
It restored about 130 GB of data.

I changed number of cylinders to 160000 and used Photorec to restore my files
It found about 160GB.
Then I run testdisk with cylinders = 160000 and here's the log:

Code: Select all

Tue Apr 23 21:31:28 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-14T19:46:54
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500095254528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500095254528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107610112000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4005625856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD1600AAJS-07WAA0, S/N:2020202057202d44435753413432343537353638, FW:58.01D58
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512 - GRAID, S/N:RAID, FW:0000
Disk /dev/sdc - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - OCZ Rally2, FW:PMAP
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Backup+ BK, S/N:NA51Z45R, FW:0409

Partition table type default to Intel
Disk /dev/sdb - 500 GB / 465 GiB - GRAID
Partition table type: Intel
New geometry
Disk /dev/sdb - 1316 GB / 1225 GiB - CHS 160000 255 63 sector_size=512

Analyse Disk /dev/sdb - 1316 GB / 1225 GiB - CHS 160000 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 1316 GB / 1225 GiB - CHS 160000 255 63
BAD_RS LBA=1238363997 10426170
file_pread(5,3,buffer,1238363997(77084/151/25)) lseek err Invalid argument
file_pread(5,1,buffer,1238363997(77084/151/25)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            77084 151 25 118629 191 24  667422945
file_pread(5,16,buffer,1905786942(118629/191/25)) lseek err Invalid argument
file_pread(5,3,buffer,1905786958(118629/191/41)) lseek err Invalid argument
file_pread(5,3,buffer,1905787005(118629/192/25)) lseek err Invalid argument
file_pread(5,8,buffer,1905787021(118629/192/41)) lseek err Invalid argument
file_pread(5,11,buffer,1905787068(118629/193/25)) lseek err Invalid argument
file_pread(5,2,buffer,1905788990(118629/223/57)) lseek err Invalid argument

Results
   L FAT16 LBA            77084 151 25 118629 191 24  667422945
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         77084   0  1 118629 254 63  667436490
 5 L FAT16 LBA            77084 151 25 118629 191 24  667422945

search_part()
Disk /dev/sdb - 1316 GB / 1225 GiB - CHS 160000 255 63
BAD_RS LBA=1238363997 10426170
file_pread(5,3,buffer,1238363997(77084/151/25)) lseek err Invalid argument
file_pread(5,1,buffer,1238363997(77084/151/25)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            77084 151 25 118629 191 24  667422945
file_pread(5,14,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,1,buffer,976748546(60799/200/12)) lseek err Invalid argument
file_pread(5,8,buffer,976748552(60799/200/18)) lseek err Invalid argument
file_pread(5,3,buffer,976748560(60799/200/26)) lseek err Invalid argument
file_pread(5,3,buffer,976748607(60799/201/10)) lseek err Invalid argument
file_pread(5,8,buffer,976748623(60799/201/26)) lseek err Invalid argument
file_pread(5,11,buffer,976748670(60799/202/10)) lseek err Invalid argument
file_pread(5,2,buffer,976750592(60799/232/42)) lseek err Invalid argument

Results
   L FAT16 LBA            77084 151 25 118629 191 24  667422945
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         77084   0  1 118629 254 63  667436490
 5 L FAT16 LBA            77084 151 25 118629 191 24  667422945
It founds two partition but still none was NTFS partition.

Image

I guess that the geometry is incorrect.
Is there a way to find the proper geometry or restore my data with the proper structure of directories?

Locked