cgsecurity.org

Hello!

I am trying to recover an external Seagate Barracuda 3000GB hard drive that shows up on Windows with E: but cannot be opened. I am being prompted to format it.
In TestDisk I am able to list all my existing files and copy them to another drive. However, I am trying to recover the partition table by selecting Intel. Once I analyze the disk, select write and reboot, the result in Windows is the same and the hard drive still cannot be opened.

Could you please check my testdisk logfile below and advise?

Am I doing something wrong by selecting Intel instead of another system file?

If the partition table cannot be recovered, is it somehow possible to create a new partition by dividing the drive so I can move files from the raw partition to the new one. For example, by having 2 partitions of 1500GB each? How can I do that?

I don't have a secondary hard drive that I could use to move the files and completely format the 3000GB hard drive, as the other drives I have are less than 500GB.

Thank you in advance for your help and have a great weekend!

Sat May 2 19:50:30 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=8103395328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=8103395328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=101923511808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=122167827968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199023255040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8103366656
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - ADATA XM11 256GB-V2, S/N:1303130202000184, FW:5.0.2a
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM 003-1CD16N, S/N:0000AB123481, FW:0425
Disk /dev/sdc - 8103 MB / 7728 MiB - CHS 985 255 63, sector size=512 - SMI USB DISK, S/N:AANAU9HM3MUR6DFP, FW:1100

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM 003-1CD16N
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Error: size boot_sector 732563456 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Error: size boot_sector 732563456 > partition 4294967295
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 1 5 5 267350 94 7 4294967295
1 * HPFS - NTFS 1 5 5 267350 94 7 4294967295

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732563456
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 1 5 5 364800 190 62 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(5,2,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534273(364801/98/35)) lseek err Invalid argument
file_pread(5,14,buffer,5860534274(364801/98/36)) lseek err Invalid argument
file_pread(5,3,buffer,5860534288(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534351(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,5860534398(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860536320(364801/131/3)) lseek err Invalid argument

Results
* HPFS - NTFS 1 5 5 364800 190 62 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
1 * HPFS - NTFS 1 5 5 364800 190 62 5860507648 [Seagate Backup Plus Drive]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

As your disk is over 3 TB, choose EFI GPT instead of Intel.

Hi Christophe,

I tried the option you recommended by selecting EFI GPT before trying to write the partition table.

Once ready, I restarted my PC and now I am unfortunately no longer able to see the external hard drive on Windows 10.

Here are the new logs in .zip file attached. Thanks for your assistance.

cgrenier wrote: 04 May 2020, 10:33 As your disk is over 3 TB, choose EFI GPT instead of Intel.

Sorry I had to zip the logs since they were too many characters for me to include them as a post. Hope it's ok, otherwise please let me know if there is any way to add them here. Thanks!

cgrenier wrote: 04 May 2020, 10:33 As your disk is over 3 TB, choose EFI GPT instead of Intel.

Hi Christophe,

I tried again the steps given and now I can see the drive in Windows 10 but I cannot browse it since it only prompts to format it.

See logs attached:
Am I doing anything wrong?

If the partition cannot be re-written, is it possible to create a new partition on that same drive so I can move the files using "P - list files" and then copy and paste the files on the new partition?

Thanks for your insights and have a great Sunday