Can't recover partition: The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
flatline
Posts: 3
Joined: 22 Apr 2020, 20:19

Can't recover partition: The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

#1 Post by flatline »

Hi,

FIrst time on this forum, and first time using testdisk. I'm trying to rescue files from a fairly old 1TB external hard drive (which was previously plugged into Windows machines, but I now have a Mac). I've run testdisk, it's turning up two 'deleted' partitions, which look identical (and overlapping), apart from one is 'linux' and one is 'NTFS'. I've tried several times to mark one as Primary, write, then restart, but I still can't access the drive, and both partitions again appear as 'deleted'. (the write doesn't appear to have any effect)

I'm also seeing

Code: Select all

Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
but I'm not sure what to do about this, can't find much on this elsewhere on the forum, and I don't want to start guessing. Full log below. Can anyone tell me how to fix the above issue? Will fixing this issue fix the overall issue?

Thanks in advance,

Code: Select all

ext2fs lib: none, ntfs lib: none, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.7
Hard disk list
Disk /dev/disk2 - 1000 GB / 931 GiB - 1953525168 sectors, sector size=512
Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/rdisk2 - 1000 GB / 931 GiB
Partition table type: EFI GPT

Analyse Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors
Current partition structure:
 1 P Linux filesys. data           63 1953520062 1953520000

search_part()
Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors
NTFS part_offset=32256, part_size=1000202241024, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
Filesystem created: Mon Aug 27 15:13:47 2012
Last mount time:    Mon Jul 22 14:01:54 2013
     Linux filesys. data           63 1953520062 1953520000
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 1000 GB / 931 GiB
     MS Data                       63 1953520064 1953520002 [Iomega HDD]
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS: Can't read MFT
     MS Data               1953520064 3907040065 1953520002
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits.
Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     MS Data               1953520064 3907040065 1953520002
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 P Linux filesys. data           63 1953520062 1953520000
Top
User avatar
cgrenier
Site Admin
Posts: 5441
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Can't recover partition: The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

#2 Post by cgrenier »

Currently there is a Linux partition.
If you want to recover the NTFS partition, set the NTFS partition as P(rimary) and choose Write on next screen, BackupBS, confirm, Quit.
After a reboot, run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
If it doesn't work, use PhotoRec.
Good luck
Top
flatline
Posts: 3
Joined: 22 Apr 2020, 20:19

Re: Can't recover partition: The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

#3 Post by flatline »

Thanks for the quick response, much appreciated. I'm on a Mac, so running the equivalent...

Code: Select all


Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors
     Partition                  Start        End    Size in sectors
 1 P MS Data                       63 1953520064 1953520002 [Iomega HDD]

Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

[  Quit  ]  [  List  ] >[Rebuild BS]  [Repair MFT]  [  Dump  ]
                              Rebuild boot sector
There's no 'BackupBS', but there's a 'Rebuild BS', so I assume that's the one...

Code: Select all

Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953525168 sectors
     Partition                  Start        End    Size in sectors
 1 P MS Data                       63 1953520064 1953520002 [Iomega HDD]

filesystem size           1953520002
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122095000
clusters_per_mft_record   -10
clusters_per_index_record 1
Extrapolated boot sector and current boot sector are identical.
When I try and List files, I get

Code: Select all

 1 P MS Data                       63 1953520064 1953520002 [Iomega HDD]

Support for this filesystem wasn't enabled during compilation.
(I'm on a Mac)

I ignored the option to 'Repair MFT', and followed the instructions. Upon rebooting, (mac equivalent of chkdsk)

Code: Select all

dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk2
   1:       Microsoft Basic Data Iomega HDD              1.0 TB     disk2s1

➜  ~ diskutil verifyVolume /dev/disk2s1
Error starting file system verification for disk2s1 Iomega HDD: Invalid request (-69886)
➜  ~ diskutil verifyVolume /dev/disk2
Error starting file system verification for disk2: Invalid request (-69886)
➜  ~
Not sure what GUID_partition_Scheme is, but it doesn't show up when I run testdisk.

I've run photorec, and it finds a load of files, but not all of them (I believe). Any further options I can try? Would 'repair 'MFT' help?

Thanks,
Top
flatline
Posts: 3
Joined: 22 Apr 2020, 20:19

Re: Can't recover partition: The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

#4 Post by flatline »

I've also tried the following (from the pdf manual):

Code: Select all

➜  ~ sudo fsck_hfs /dev/disk2s1
** /dev/rdisk2s1
   Executing fsck_hfs (version hfs-522.100.5).
volumeType is 0
/dev/rdisk2s1 0000:  0000 004e 5446 5320 2020 2000 0208 0000       |...NTFS.........|
/dev/rdisk2s1 0010:  0000 0000 00f8 0000 0100 0100 3f00 0000       |................|
/dev/rdisk2s1 0020:  0000 0000 0000 0000 8159 7074 0000 0000       |.........Ypt....|
/dev/rdisk2s1 0030:  0000 0c00 0000 0000 9805 4707 0000 0000       |..........G.....|
/dev/rdisk2s1 0040:  f600 0000 0100 0000 0000 0000 0000 0000       |................|
/dev/rdisk2s1 0050:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
/dev/rdisk2s1 01f0:  0000 0000 0000 0000 0000 0000 0000 55aa       |..............U.|
➜  ~ mount /dev/disk2s1
mount: /dev/disk2s1: unknown special file or file system.
Still don't appear to be able to mount it. Any suggestions appreciated.

Thanks,
Top
Locked

Return to “Partition Recovery”