Win7-64 Intel RAID5 Recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Win7-64 Intel RAID5 Recovery

#1 Post by rchinnis »

In short, I updated my ASUS BIOS, and 2 of my 4 disks were removed from my Intel RAID5 array. The array was not a boot drive. I was using it simply as a data drive. I deleted the array and recreated it identically to the previous array, and am hoping to use TestDisk to make this disk available to Windows 7 64-bit again.

When I run TestDisk, it successfully discovers a partition on the array, and I am able to browse and see all of my files. However, when I write the data to the drive, Windows still can't see the files. When I go back into TestDisk, the partition information that I requested it to write didn't appear to write. Hopefully, you will be able to give me some pointers from the log file.

Thanks for the help.

richard

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Wed May 1 00:37:50 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199023255040
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: Intel
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 3130871808 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 3130871808 > partition 4294967295
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,7,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,8,buffer,3131138056(729603/7/13)) lseek err Invalid argument
file_pread(5,3,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,3,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138127(729603/8/21)) lseek err Invalid argument
file_pread(5,11,buffer,3131138174(729603/9/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131140096(729603/39/37)) lseek err Invalid argument

Results
* HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB


dir_partition inode=5
P HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
Directory /
5 dr-xr-xr-x 0 0 0 29-Apr-2013 12:38 .
5 dr-xr-xr-x 0 0 0 29-Apr-2013 12:38 ..
149 dr-xr-xr-x 0 0 0 6-Nov-2012 00:50 $RECYCLE.BIN
27323 -r--r--r-- 0 0 592208 11-Sep-2009 18:22 install.exe
27549 -r--r--r-- 0 0 659 11-Sep-2009 18:16 install.ini
27450 -r--r--r-- 0 0 32096 11-Sep-2009 18:22 install.res.1028.dll
27530 -r--r--r-- 0 0 53072 11-Sep-2009 18:22 install.res.1031.dll
27531 -r--r--r-- 0 0 47456 11-Sep-2009 18:22 install.res.1033.dll
27533 -r--r--r-- 0 0 53600 11-Sep-2009 18:22 install.res.1036.dll
27534 -r--r--r-- 0 0 52064 11-Sep-2009 18:22 install.res.1040.dll
27535 -r--r--r-- 0 0 37728 11-Sep-2009 18:22 install.res.1041.dll
27536 -r--r--r-- 0 0 36192 11-Sep-2009 18:22 install.res.1042.dll
27537 -r--r--r-- 0 0 49488 11-Sep-2009 18:22 install.res.1049.dll
27324 -r--r--r-- 0 0 31584 11-Sep-2009 18:22 install.res.2052.dll
27532 -r--r--r-- 0 0 52576 11-Sep-2009 18:22 install.res.3082.dll
27354 dr-xr-xr-x 0 0 0 28-Jan-2013 23:20 msdownld.tmp
35 dr-xr-xr-x 0 0 0 29-Apr-2013 17:22 System Volume Information
39 dr-xr-xr-x 0 0 0 5-Nov-2012 22:47 Users
27136 -r--r--r-- 0 0 5686 7-Nov-2007 08:00 vcredist.bmp
27137 -r--r--r-- 0 0 1442522 7-Nov-2007 08:09 VC_RED.cab
27135 -r--r--r-- 0 0 232960 7-Nov-2007 08:12 VC_RED.MSI
27342 -r--r--r-- 0 0 2073703 19-Mar-2010 19:55 VS_EXPBSLN_x64_enu.CAB
27343 -r--r--r-- 0 0 551424 19-Mar-2010 19:58 VS_EXPBSLN_x64_enu.MSI
27539 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1028.txt
27540 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1031.txt
27541 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1033.txt
27543 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1036.txt
27544 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1040.txt
27545 -r--r--r-- 0 0 9558 11-Sep-2009 18:16 eula.1041.txt
27546 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1042.txt
27547 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1049.txt
27538 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.2052.txt
27542 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.3082.txt
27548 -r--r--r-- 0 0 586 11-Sep-2009 18:16 globdata.ini

interface_write()
1 P HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 3130871808 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 3130871808 > partition 4294967295
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,7,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,8,buffer,3131138056(729603/7/13)) lseek err Invalid argument
file_pread(5,3,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,3,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138127(729603/8/21)) lseek err Invalid argument
file_pread(5,11,buffer,3131138174(729603/9/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131140096(729603/39/37)) lseek err Invalid argument

Results
* HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB

interface_write()
1 * HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Re: Win7-64 Intel RAID5 Recovery

#2 Post by rchinnis »

A bit of additional info. Here's what Windows 7 is seeing in Disk Management

Disk 1: Basic: 5589.04 GB: Online
129MB Unallocated
(E:) 2048.00 GB RAW Healthy (Primary Partition)
3540.92 GB Unallocated

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Win7-64 Intel RAID5 Recovery

#3 Post by Fiona »

129 unallocated was probably a MS Reserved partition?

You MS Data-partition should be your important partition containing your data.
It's still displayed in your GUID-partition table.

Would it be possible to make a boot sector diagnose to check are your data are listed or an error message?

Start TestDisk, confirm at create a log with enter and select your affected disk/RAID.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
If your partition is listed as "Unknown" you can use the menu List to add your previous file system (partition type probably NTFS?) to your partition.
Afterwards, the menu Boot becomes available.
Confirm at Boot.
If you're able to list your files, you can either copy/backup your files using testdisk to another disk or write your boot sector at write.
Otherwise;
Highlight Rebuild BS and hit Enter.
Rebuild BS will be in progress.
Normally, it takes some minutes.
If you see the menu List, please highlight it and press enter.
If you see your data, you can copy your data or write your boot sector.

Fiona

rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Re: Win7-64 Intel RAID5 Recovery

#4 Post by rchinnis »

Fiona,

Thanks for the reply. I think I'm getting closer! One problem was that I was selecting Intel instead of GPT for the partition type. I have since selected GPT and verified that the boot sectors are ok and that I can list the files in TestDisk. I have written the partition table, but there still appears to be some cleanup remaining.

Windows is now showing three partitions for this Disk:
(E:) 100 MB RAW Healthy (Primary Partition)
26 MB Unallocated
Data Drive (F:) 5588.92 GB NTFS Healthy (Primary Partition)

I can read all of my data within Windows on the F: drive! This is progress!

Before the mess occurred, however, there was just one drive (the current F: was my E:). I'm attaching the latest log file after doing a Deeper Search to ask for more advice about cleaning up these two smaller bits of disk space.

Thanks for the help!

richard

Code: Select all


Fri May  3 13:23:27 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=6001052876800
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: EFI GPT
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     6400     211199     204800
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size           11720806400
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138051(729603/7/8)) lseek err Invalid argument
file_pread(5,1,buffer,3131138052(729603/7/9)) lseek err Invalid argument
file_pread(5,1,buffer,3131138053(729603/7/10)) lseek err Invalid argument
file_pread(5,1,buffer,3131138054(729603/7/11)) lseek err Invalid argument
...
{snip lots of these errors}
...
file_pread(5,1,buffer,3131138062(729603/7/19)) lseek err Invalid argument
file_pread(5,1,buffer,3131138065(729603/7/22)) lseek err Invalid argument
file_pread(5,1,buffer,3131138112(729603/8/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138133(729603/8/27)) lseek err Invalid argument
file_pread(5,1,buffer,3131138183(729603/9/14)) lseek err Invalid argument
file_pread(5,1,buffer,3131140096(729603/39/37)) lseek err Invalid argument
file_pread(5,1,buffer,3131138063(729603/7/20)) lseek err Invalid argument
file_pread(5,1,buffer,3131138066(729603/7/23)) lseek err Invalid argument
file_pread(5,1,buffer,3131138113(729603/8/7)) lseek err Invalid argument
file_pread(5,1,buffer,3131138134(729603/8/28)) lseek err Invalid argument
file_pread(5,1,buffer,3131138184(729603/9/15)) lseek err Invalid argument
file_pread(5,1,buffer,3131140097(729603/39/38)) lseek err Invalid argument

Results
   P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
   P MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB

interface_write()
 1 P MS Data                     6400     211199     204800
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=3276800, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/101/38
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
NTFS at 8/37/6
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=66998272, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 8/37/6
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   130856     335655     204800
     NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size           11720806400
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=6001052876800, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           11720806400
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
Search for partition aborted

Results
     MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
     MS Data                   130856     335655     204800
     NTFS, 104 MB / 100 MiB
     MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB

     MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.

     MS Data                   130856     335655     204800
     NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
     MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
Directory /
       5 dr-xr-xr-x     0      0         0  3-May-2013 13:20 .
       5 dr-xr-xr-x     0      0         0  3-May-2013 13:20 ..
     149 dr-xr-xr-x     0      0         0  6-Nov-2012 00:50 $RECYCLE.BIN
   27323 -r--r--r--     0      0    592208 11-Sep-2009 18:22 install.exe
   27549 -r--r--r--     0      0       659 11-Sep-2009 18:16 install.ini
   27450 -r--r--r--     0      0     32096 11-Sep-2009 18:22 install.res.1028.dll
   27530 -r--r--r--     0      0     53072 11-Sep-2009 18:22 install.res.1031.dll
   27531 -r--r--r--     0      0     47456 11-Sep-2009 18:22 install.res.1033.dll
   27533 -r--r--r--     0      0     53600 11-Sep-2009 18:22 install.res.1036.dll
   27534 -r--r--r--     0      0     52064 11-Sep-2009 18:22 install.res.1040.dll
   27535 -r--r--r--     0      0     37728 11-Sep-2009 18:22 install.res.1041.dll
   27536 -r--r--r--     0      0     36192 11-Sep-2009 18:22 install.res.1042.dll
   27537 -r--r--r--     0      0     49488 11-Sep-2009 18:22 install.res.1049.dll
   27324 -r--r--r--     0      0     31584 11-Sep-2009 18:22 install.res.2052.dll
   27532 -r--r--r--     0      0     52576 11-Sep-2009 18:22 install.res.3082.dll
   27354 dr-xr-xr-x     0      0         0 28-Jan-2013 23:20 msdownld.tmp
      35 dr-xr-xr-x     0      0         0 29-Apr-2013 17:22 System Volume Information
      39 dr-xr-xr-x     0      0         0  5-Nov-2012 22:47 Users
   27136 -r--r--r--     0      0      5686  7-Nov-2007 08:00 vcredist.bmp
   27137 -r--r--r--     0      0   1442522  7-Nov-2007 08:09 VC_RED.cab
   27135 -r--r--r--     0      0    232960  7-Nov-2007 08:12 VC_RED.MSI
   27342 -r--r--r--     0      0   2073703 19-Mar-2010 19:55 VS_EXPBSLN_x64_enu.CAB
   27343 -r--r--r--     0      0    551424 19-Mar-2010 19:58 VS_EXPBSLN_x64_enu.MSI
   27539 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1028.txt
   27540 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1031.txt
   27541 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1033.txt
   27543 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1036.txt
   27544 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1040.txt
   27545 -r--r--r--     0      0      9558 11-Sep-2009 18:16 eula.1041.txt
   27546 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1042.txt
   27547 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.1049.txt
   27538 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.2052.txt
   27542 -r--r--r--     0      0     20716 11-Sep-2009 18:16 eula.3082.txt
   27548 -r--r--r--     0      0       586 11-Sep-2009 18:16 globdata.ini

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.

rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Re: Win7-64 Intel RAID5 Recovery

#5 Post by rchinnis »

Here's what Disk Management looks like

Image

rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Re: Win7-64 Intel RAID5 Recovery

#6 Post by rchinnis »

Ok, so, after doing some research online, I noticed that these GPT disks are supposed to have a 32- or 128-MB Microsoft Reserved partition at the beginning of the disk depending on size. For me, it's 128-MB.

So, I deleted the MS Data partition at the beginning of the disk (spanned 100 MB from 6400 - 211199), and Added an MS Reserved / NTFS partition beginning at sector(?) 1 and ending just before my true MS Data partition began. Something like this:

MS Reserved 1 - 264191
MS Data 264192 - 11720806400

Then I wrote that to the disk and rebooted.

Voila! It worked! The worst-case scenario had happened: two out of four disks in a RAID5 array had been booted from the array, and I've been able to recover everything. Zero loss.

These are links that helped me immensely:

http://msdn.microsoft.com/en-us/library ... 63525.aspx

http://technet.microsoft.com/en-us/libr ... s.10).aspx

http://support.microsoft.com/kb/302873

Also, thanks to the crew here supporting TestDisk. In addition to the software itself allowing me to write these partition tables, I read tons of material here that educated me about the latest partition technology being used and was able to "ask" better questions of the internet to find what I needed. Thanks again!

richard

rchinnis
Posts: 7
Joined: 01 May 2013, 05:44

Re: Win7-64 Intel RAID5 Recovery

#7 Post by rchinnis »

Also, here's a copy of the log from the successful configuration / write. Just in case you guys see something else I need to take care of.

Code: Select all


Fri May  3 13:45:53 2013
Command line: TestDisk

Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=6001052876800
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: EFI GPT
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB

 1 P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
 1 P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
NTFS at 0/101/38
filesystem size           204800 1
sectors_per_cluster       8 0
mft_lcn                   8533 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size           11720806400
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
 1 P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
NTFS at 0/101/38
filesystem size           204800 1
sectors_per_cluster       8 0
mft_lcn                   8533 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     6400     211199     204800
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size           11720806400
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138051(729603/7/8)) 
lseek err Invalid argument
file_pread(5,1,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138125(729603/8/19)) lseek err Invalid argument
file_pread(5,11,buffer,3131138172(729603/9/3)) lseek err Invalid argument
file_pread(5,1,buffer,3131138184(729603/9/15)) lseek err Invalid argument
file_pread(5,1,buffer,3131140097(729603/39/38)) lseek err Invalid argument

Results
   P MS Data                     6400     211199     204800
     NTFS, 104 MB / 100 MiB
   P MS Data                   264192 11721070591 11720806400 [Data Drive]
     NTFS, 6001 GB / 5588 GiB
gpt_change_part_type
Change partition type:
     MS Reserved                    1     264191     264191
Change partition type:
     NTFS                           1     264191     264191

   P MS Reserved                    1     264191     264191
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P MS Reserved                    1     264191     264191
 2 P MS Data                   264192 11721070591 11720806400 [Data Drive]
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Locked