cgsecurity.org

A rogue app looks to have messed up my partitions on some Storage Spaces 2 way mirrors (upgraded to the latest pool version). In Windows disk management they show up "unallocated", physically the drives are fine - checked with Crystal disk info and all looking great. Can anyone help me with what steps to take as I know the data is present and OK - some of he 3rd party tools can see the file system. My main problem is I don't really have a drive big enough to make a clone of the disks so I am bit concerned I could make things much worse when making changes. I did have a couple of smaller drives which I have setup in a similar way to compare partition setup, thought it might be helpful.

Below is the output when I view one of the disks from the 1TB test pool I created so these are intact and working...
Disk /dev/sdn - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure: Partition Start End Size in sectors
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 32767 32734 [Microsoft reserved partition]
1 P MS Reserved 34 32767 32734 [Microsoft reserved partition]
2 P Unknown 32768 1953523711 1953490944 [Storage pool]


When I scan one of the drives where its partition is damaged I get the following...
Partition table type (auto): EFI GPT
Disk /dev/sdn - 2000 GB / 1863 GiB - WDC WD20 03FZEX-00Z4SA0
Partition table type: EFI GPT

Analyse Disk /dev/sdn - 2000 GB / 1863 GiB - CHS 243201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029167 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907029134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 32767 32734 [Microsoft reserved partition]
e75caf8f f680 4cee af a3 b0 01 e5 6e fc 2d
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 32767 32734 [Microsoft reserved partition]
1 P MS Reserved 34 32767 32734 [Microsoft reserved partition]
2 P Unknown 32768 3907028991 3906996224 [Storage pool]

search_part()
Disk /dev/sdn - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 149/6/50
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 485850875
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1225785344, part_size=1990045184000, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 149/6/50
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 485850875
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2394112 3889201111 3886807000
NTFS, blocksize=4096, 1990 GB / 1853 GiB
NTFS at 243200/170/42
filesystem size 3906985984
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 32768 3907018751 3906985984
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
NTFS at 243200/170/42
filesystem size 3906985984
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(17,2,buffer,3913310213(243592/75/9)) lseek err Invalid argument
file_pread(17,1,buffer,3913310213(243592/75/9)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 3907018751 7814004734 3906985984
NTFS, blocksize=4096, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=3907018751, size=3906985984, end=7814004734, disk end=3907029168)
NTFS at 243201/45/44
filesystem size 3906994176
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 32768 3907026943 3906994176
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243201/45/44
filesystem size 3906994176
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(17,2,buffer,3913318405(243592/205/11)) lseek err Invalid argument
file_pread(17,1,buffer,3913318405(243592/205/11)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 3907026943 7814021118 3906994176
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907026943, size=3906994176, end=7814021118, disk end=3907029168)
file_pread(17,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).





I get a load of line like this in the log...
file_pread(17,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument



then at the end...

Disk /dev/sdn - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partitions can't be recovered:
MS Data 3907018751 7814004734 3906985984
NTFS, blocksize=4096, 2000 GB / 1862 GiB
MS Data 3907026943 7814021118 3906994176
NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
MS Data 32768 3907018751 3906985984
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
MS Data 32768 3907026943 3906994176
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
MS Data 2394112 3889201111 3886807000
NTFS, blocksize=4096, 1990 GB / 1853 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

TestDisk doesn't handle MS Storage Space.
I think the Storage space is configured as Raid 0, not as Raid 1 (mirror).

Hi,
Its 100% a two way mirror, that data is just from one of the drives. Sorry if I am being asking silly questions but in what way do you mean does not handle storage spaces? I assumed that the partition tables part of the drive would be similar to a regular drive and so with something like testdisk I should be able to construct it. The storage spaces metadata for the raid1 itself will be intact along with all the actual data as all that has happened I think it the rogue app turned them from GPT to MBR disks. No new partitions were created or any data added to the drive.

Thanks

TeddyUK wrote: 06 May 2020, 19:47 Hi,
Its 100% a two way mirror, that data is just from one of the drives. Sorry if I am being asking silly questions but in what way do you mean does not handle storage spaces?

Nor do I understand the japanese language nor does Testdisk understand the format of storage spaces.

I assumed that the partition tables part of the drive would be similar to a regular drive and so with something like testdisk I should be able to construct it.

This is wishful thinking.

TeddyUK wrote: 05 May 2020, 14:00 My main problem is I don't really have a drive big enough to make a clone of the disks so I am bit concerned I could make things much worse when making changes.

You are right by fearing the worst. Buy storage! Otherwise buy not being able to restore a backup of your faulty configuration to a kind of tryout zone you put your data at risk.