Help recovering data from external HDD

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
horsetrank
Posts: 2
Joined: 12 Jun 2013, 01:36

Help recovering data from external HDD

#1 Post by horsetrank »

I have a Seagate Freeplay 1500GB external HDD that stopped working. There were no lights on, no noise, no power so I removed it from the enclosure and mounted it on an external caddy.
The Mounted HDD shows up in explorer but does not let me open it - "F:\ is not accessible. The parameter is incorrect"
I've tried rebuilding the boot sector, but testdisk can't read the backup boot sector. I have also tried rebuilding that, to no avail.
I'm still pretty new to this whole data recovery thing. If anyone is able to suggest what else I can try, I would be most grateful.
Cheers

PS. The following is a dump from the log file, if that helps.
Wed Jun 5 08:31:31 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-03-31T19:22:00
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=32218389504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=174877678080
filewin32_getfilesize(\\.\E:) GetFileSize err The parameter is incorrect.

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=2000396289024
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Hitachi HTS723225A7A, S/N:3E285426XGUMNA, FW:ECBO
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 22800 255 63, sector size=4096 - ST1500LM 003-9YH148
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Desktop, FW:0130
Disk \\.\PhysicalDrive1 - 1500 GB / 1397 GiB - CHS 22800 255 63, sector size=4096 - ST1500LM 003-9YH148
Drive E: - 736 MB / 702 MiB - CHS 1438768 1 1, sector size=512 - hp DVDRAM GT31L, S/N:0MB0672401 1, FW:MR52
Drive F: - 1500 GB / 1397 GiB - CHS 22800 255 63, sector size=4096 - ST1500LM 003-9YH148

Partition table type (auto): Intel
Drive F: - 1500 GB / 1397 GiB - ST1500LM 003-9YH148
Partition table type: Intel

Analyse Drive F: - 1500 GB / 1397 GiB - CHS 22800 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 182400 254 63 2930272002
1 P HPFS - NTFS 0 1 1 182400 254 63 2930272002
No partition is bootable

search_part()
Drive F: - 1500 GB / 1397 GiB - CHS 22800 255 63
BAD_RS LBA=1638758668 9219668
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 102008 2 23 288237 214 22 2991782241
This partition ends after the disk limits. (start=1638758668, size=2991782241, end=335573612, disk end=366284646)
BAD_RS LBA=1136527821 15623
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 70745 149 10 101730 105 53 497771297
This partition ends after the disk limits. (start=1136527821, size=497771297, end=1634299117, disk end=366284646)

recover_EXT2: s_block_group_nr=0/59, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1965824
recover_EXT2: part_size 1965824
Linux 8803 123 25 8925 216 59 1965824
ext4 blocksize=4096 Large file Sparse superblock Recover, 8052 MB / 7679 MiB
BAD_RS LBA=1094932555 2380195
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 68156 101 53 184518 108 21 1869355940
This partition ends after the disk limits. (start=1094932555, size=1869355940, end=2964288494, disk end=366284646)
Drive F: - 1500 GB / 1397 GiB - CHS 22800 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1500 GB / 1397 GiB) seems too small! (< 18 TB / 17 TiB)
The following partitions can't be recovered:
FAT12 68156 101 53 184518 108 21 1869355940
FAT12 70745 149 10 101730 105 53 497771297
FAT16 LBA 102008 2 23 288237 214 22 2991782241

Results
* Linux 8803 123 25 8925 216 59 1965824
ext4 blocksize=4096 Large file Sparse superblock Recover, 8052 MB / 7679 MiB

interface_write()
1 * Linux 8803 123 25 8925 216 59 1965824
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 182400 254 63 2930272002

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 182400 254 63 2930272002
filesystem size 129878220123906251 1
sectors_per_cluster 0 0
mft_lcn 648382976 0
mftmirr_lcn 2525733066 0
clusters_per_mft_record 80 0
clusters_per_index_record 91 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 86648393, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 116075447, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 4
ntfs_find_mft: mftmirr_lcn 28415690
ntfs_find_mft: mft_record_size 1024

mft at 153525473, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 185730903, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 4
ntfs_find_mft: mftmirr_lcn 28415690
ntfs_find_mft: mft_record_size 1024

Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 182400 254 63 2930272002
filesystem size 129878220123906251 1
sectors_per_cluster 0 0
mft_lcn 648382976 0
mftmirr_lcn 2525733066 0
clusters_per_mft_record 80 0
clusters_per_index_record 91 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Help recovering data from external HDD

#2 Post by Lito »

Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 22800 255 63, sector size=4096 - ST1500LM 003-9YH148
Try running TestDisk choosing /dev/sdb. It looks like that is your Seagate HDD.

Log in as Administrator. You might have to start your PC in Safe Mode to see the Administrator account.

Also make sure you have some sort of device with enough space to hold any data you might like to save.

Best of luck

horsetrank
Posts: 2
Joined: 12 Jun 2013, 01:36

Re: Help recovering data from external HDD

#3 Post by horsetrank »

I tried running testdisk on /dev/sdb, as you suggested, but I still get the same result.

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Help recovering data from external HDD

#4 Post by Lito »

Hi, there
do you mean, you could not write the new Boot Sector to disk?
It is difficult to guess what you did, but I thoght you was trying to Rebuild the Boot Sector.
In any case you have two file systems in that HDD. You do not say why.

The safest bet, would be to clone your disk. Follow the instructions in this page:

http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

If Knoppix does not appeal to you, you may want to try Parted Magic.
There is a review of Parted Magic here:

http://www.linuxinsider.com/story/73085.html

Here there is another review:

http://www.linuxuser.co.uk/reviews/parted-magic-review

If your trying to recover your Linux partition, have a look at this article/tutorial:

http://linuxexpresso.wordpress.com/2010 ... in-ubuntu/

If at all possible, disconnect other USB disks. Even better if you could work with only the cloned disk
connected and boot from your Parted Magic CD.

If needed, start Testdisk and instead of Analyze, choose Advanced, and then select Boot, to have a go at rebuilding
the boot sector. To be able to write to the disk you either have to be the Administrator or Root. Also have to remember to disable (albeit temporarily) your antivirus software.

You do not say which files system hold the data you are after, but you can also recover data
using PhotoRec. You can select which type of files to recover to speed things up or even to have a
trial run, for instance recovering picture files (.jpg, .gif, .bmp, etc).

Other alternatives may include, this Boot CD from DiskInternals:

http://www.diskinternals.com/boot-cd/

It creates a Bart PE CD with tools from this commercial company on top.

This place offers a big list of tools and utilities to choose from:

http://www.forensicswiki.org/wiki/Tools:Data_Recovery

This Minitool Partition Wizard CD (to boot from):

http://www.partitionwizard.com/download/pwhe7.iso

will make copying a whole partition to another disk, easy work.
Most people agree that it is a reliable tool, but you can search
the Internet and make your own mind.
If booting from this CD, you could see the NTFS and the Linux partitions, you could copy them to separate disks, and work on them, one at the time.
Also it makes light work of wiping HDDs as and when required.

That's it for now. I run out of ideas.

Best of luck

MariettaMike
Posts: 1
Joined: 27 Jun 2013, 01:59

Re: Help recovering data from external HDD

#5 Post by MariettaMike »

Have had extensive problem with Seagate Freeagent USB drive and have spent much time over 6 months trying to recover. Tried a number of free and purchase file recovery software that did not work. Stumbled upon a solution today that has recovered most of the files. First: download and burn CD of PuppyLinux. Boot from the CD,mount the drive then copy to another disk. This process does not attempt any writes to the drive. If any files are not recoverable, then download and install FindAndMountPartition, a free edition is available. Create an image to another disk that you can work with then try some standard undelete software.

berkolyn
Posts: 1
Joined: 26 Feb 2014, 09:18

Re: Help recovering data from external HDD

#6 Post by berkolyn »

Data Recovery is capable to scan and get your data back from virtually all storage drives, such as most external storage media like digital cameras, USB drives, Kindles, iPods and SD cards and internal hard drives. In addition, it is capable to even scan your drive when it is inaccessible, failed or when partition is lost. With having a lot of powerful algorithms for scanning, Data Recovery can recover data from external hard drive completely for your Mac OS X.Your hard disk partition might be lost if you suddenly lose the ability to retrieve and mount files. Data Recovery has certain features that can help you repair and recover missing partitions and get your data back.

Locked