incorrect number of bytes per sector

[schwarznold]

Hello,
Since it is my first message, please let me introduce myself. I am a medical doctor who recently crashes his hdd (probably after using an "optimising" tool under windows 7). I love (and hate) computers since 30 years (you know: commodore 64, Amiga, i386, windows 3.10, etc...).
I must say that I am stuck for a week now, having tried a lot of different things (probably too much ) in order to fix my disk. However, this let me discover a lot of new things, including testdisk and its fantastic community, ddrescue, ubuntu, ...

Here is the problem:
Internal WD7500BPVT "scorpio" SATA disk had a boot error either, probably after intempestive reboots.
Recovery from hidden Acer partition did not work (Acer Aspire 7750G, intel i5, windows 7, 64bit)
Recovery windows 7 disk wasn't able to finalize its restoration (either the first one I made soon after the purchase, nor a second one made on another i5 computer)
Creating a Windows 7 DVD after having downloaded the official iso from microsoft also failed.
I bought a USB2-SATA interface and connected it to a Sony Vaio VPCEB3L1E (sic!). Windows considered my disk unreadable and suggested I format it (which I did not!).
At that time, I discover TESTDISK.
A was please to see 3 partitions PQSERVICE, SYSTEM RESERVED, and ACER, the one I woud like to restore.
I followed the step by step guide, but I had to stop at several time points, especially because file operations lasted four days, only for 0.10% ...
I connected the device to a macbookpro. It easily read the drive without any soft, but was not able to copy the files on its own drive...
Then I heard about DDRESCUE. I therefore installed ubuntu on another partition of the above cited VAIO and started to use the soft in order to make an image. The problem was that the transfer rate was about 10 to 30 Kb (not Mb) per second, so that my 750 Gb would not have been backed up even after a year of work.
I also try NTFSFIX, which found and restore a problem... which didn't change anything

Now about the log (and the title of the topic, which may not have to do with the real problem...)

Disk /dev/sdc - 750 GB / 698 GiB - CHS 11400 255 63
Current partition structure:
Partition Start End Size in sectors

Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
1 * HPFS - NTFS 0 4 5 261 25 20 4194304 [PQSERVICE]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
2 P HPFS - NTFS 261 25 21 262 176 42 25600 [SYSTEM RESERVED]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
3 P HPFS - NTFS 262 176 43 11400 34 26 178923008 [Acer]

Impossible to set a "L" state on partition 3

Although the partition was correctly listed, only some of the directories were listed in the next steps...

Another error about boot sector:
Disk /dev/sdc - 750 GB / 698 GiB - CHS 11400 255 63
Partition Start End Size in sectors
3 P HPFS - NTFS 262 176 43 11400 34 26 178923008 [Acer]

Boot sector
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

Ok, I guess that's enough for a first post.
My question is: "should I try to change the number of bytes per sector"?
Thank you very much for your help

Schwarznold

[Fiona]

4096 Bytes sectors are a little bit difficult to handle.
It's a new standard and should improve memory management, because it would decrease the amount of sectors to manage.
Otherwise it can bypass the 2 TB limit of Intel-MBR and increase it up to 16 TB, because one sector is 8 times as big.
But there is a certain problems about Intel MBR and 4096 Bytes sectors.
Problems are booting and some other related stuff.
Infos;
http://msdn.microsoft.com/en-us/library ... 85%29.aspx
If you'd like to boot, the BIOS simulates the sector size as 512 Bytes.
In this case you're limited to 2 TB again.
For example as an external USB device sector size is not changed and will cause a message that's 4096.
So there is nothing to do.
Determining your sector size you can use the TestDisk log.
At your Disk selection the sector size is available.
Manufacturer often offer an advanced format tool for 4096 Bytes sector size disks.

Some things about partitions found by TestDisk.
TestDisk using Quick Search always is setting up the first partition as bootable.
You can watch it that your first partition has a star at the left side.
Star always means bootable activ, P is primary only and L for logical partitions.
A logical partition requires a container which is the extended partition to manage all local partitions.
It also a bypasses that an Intel-MBR disk can contain more than 4 primary partitions.
TestDisk recognizes the structur of your logical disk and is setting up the extended partition automatically.
Example;
http://www.cgsecurity.org/wiki/Partitio ... nd_logical
Logically partitions requires some small additional space.
Otherwise a logical partition wouldn't fit.

Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
1 * HPFS - NTFS 0 4 5 261 25 20 4194304 [PQSERVICE]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
2 P HPFS - NTFS 261 25 21 262 176 42 25600 [SYSTEM RESERVED]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
3 P HPFS - NTFS 262 176 43 11400 34 26 178923008 [Acer]

TestDisk after Quick Search displays your first partition as activ and bootable.
It's a partition created from your computer manufacturer and has another partition type as PQService.
It's intended that windows doesn't recognize it and will use it.
Your second partition "System Reserved" is a normal NTFS partition used by Win7, but without driveletter, so you can't change anything either.
It's intended for using bootrec and encryption bitlocker.
This is your boot partition and should be set to * star as active partition, where you boot from.
Acer is your normal OS-partition and is only P for primary, because you boot from your system reserved partition.
A disk always can contain one active partition.

Your current partition table/strucur should look like this;

Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
1 P HPFS - NTFS 0 4 5 261 25 20 4194304 [PQSERVICE]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
2 * HPFS - NTFS 261 25 21 262 176 42 25600 [SYSTEM RESERVED]
Warning: Incorrect number of bytes per sector 512 (NTFS) != 4096 (HD)
3 P HPFS - NTFS 262 176 43 11400 34 26 178923008 [Acer]

To get an overview about your current partition table you can use TestDisk and the menu Analyse.
<Analyse displays your current partition table just as it is.

Hopefully it helps.

Fiona

[schwarznold]

Dear Fiona,
Thank you for your quick and detailled answer.
For sure, I'll get more info about 4096 sectors.
You must be right; it has something to do with boot error. Unfortunately, when I tried to assign a boot "*" tag the the "system reserved partition" instead of the "pqservice" one, testdisk returned a sober "write error"...
Is there a way to correct the drive (bad sectors), without spending months.
Could a reformating followed by a chkdsk be useful, prior to using an undelete program able to found files on a reformated drive (which soft do you recommand?).
Have a nice and sunny week-end (at least, htat's the case, here in Belgium, Europe)
Schhwarznold

[schwarznold]

Hi.
I didn' try to change the sector size, since it is probably correct (I checked that my Acer computer proposed NTFS 4096 as a standard format for HDD...).
I had a look to the boot sectors which appeared to be deeply damaged:
Disk /dev/sdc - 750 GB / 698 GiB - CHS 11400 255 63
3 P HPFS - NTFS 2101 138 22 91201 20 19 1431384064
Boot sector Backup boot sector
0000 88a8b8bc dcb2e4f4 ........ 00000000 00000000 ........
0008 fcceeede d7dfbc76 .......v 00000000 00000000 ........
0010 ee427d7a 5631e56f .B}zV1.o 00000000 00000000 ........
0018 2363030f 3eb4ed56 #c..>..V 00000000 00000000 ........
0020 ed485b73 5b76461a .H[s[vF. 00000000 00000000 ........
0028 451873cb a375f5b7 E.s..u.. 00000000 00000000 ........
0030 fa7bfbef 3871e4bd .{..8q.. 00000000 00000000 ........
0038 0b57376f da88ab8f .W7o.... 00000000 00000000 ........
0040 c5393e3d 77c7d143 .9>=w..C 00000000 00000000 ........
0048 cc7245c5 a67b0edd .rE..{.. 00000000 00000000 ........
0050 b365e783 7ddd4347 .e..}.CG 00000000 00000000 ........
0058 0eed029e f5677ff9 .....g.. 00000000 00000000 ........
0060 1b1f7d6e c34f5faf ..}n.O_. 00000000 00000000 ........
0068 a69338ae a505a43e ..8....> 00000000 00000000 ........

I Tried again to do an image with ddrescue, but it should take months... even with the newest options from version 1.16.

What is strange is that the message testdisk returns is now slightly different (maybe since I tried to improve (?) boot sectors):

Disk /dev/sdc - 750 GB / 698 GiB - CHS 11400 255 63
Current partition structure:
Partition Start End Size in sectors

Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 32 33 2088 202 34 33554432
1 P HPFS - NTFS 0 32 33 2088 202 34 33554432
Invalid NTFS or EXFAT boot
2 * HPFS - NTFS 2088 202 35 2101 138 21 204800
2 * HPFS - NTFS 2088 202 35 2101 138 21 204800
Invalid NTFS or EXFAT boot
3 P HPFS - NTFS 2101 138 22 91201 20 19 1431384064
3 P HPFS - NTFS 2101 138 22 91201 20 19 1431384064


But the next information seems correct, although I am not able to list all the directories from the third partition (which of course is the one of interest)
Disk /dev/sdc - 750 GB / 698 GiB - CHS 11401 255 63
Partition Start End Size in sectors
>P HPFS - NTFS 0 4 5 261 25 20 4194304 [PQSERVICE]
P HPFS - NTFS 261 25 21 262 176 42 25600 [SYSTEM RESERVED]
P HPFS - NTFS 262 176 43 11400 34 26 178923008 [Acer]

Do you I would be able to recover most files by myself in a reasonable amount of time or I should give and send the HDD to a recovery company?

Thank you very much
Schwarznold

[Fiona]

Sry, I'm on vacation.
How did you try to improve boot sectors?
Because, now all partitions are listed as invalid boot.
In your case, most important is;
-Not to change anything to your disk.
- You mentioned, testdisk doesn't list all directories?
Please let me know, what's lacking?
TestDisk is only used by arrow and page up and down keys.
To enter a folder, you can use the right arrow key.
Normally, testdisk copy speed should be ok.
It should keep your directories and file names.
-What kind of win7 version do you use?
From that link above;
To get full support of 4 k sector size, you shoul use win7 servicepack 1.

Builds upon the Windows 7 SP1 support for 4K disks with emulation (512e), and provides full inbox support for disks with 4K sector size without emulation (4K Native). Some supported apps and scenarios include:

Ability to install Windows to and boot from a 4K sector disk without emulation (4K Native Disk)

In case it should be also possible to create a disk containing win7 and servicepack 1.
Could you diagnose your disk using CrystalDiskInfo;
http://crystalmark.info/software/Crysta ... dex-e.html
It's only intended to exclude problems related to bad sectors.

In your case, there should be only a necessity to send your disk to a labor, if your disk has a physically or electronically defect.
Another datarecovery software would be, if you're not satisfy with PhotoRec, scavenger or restorer ultomate to test the trial first.
But only if there is a necessity to, and you can't fix your problems using TestDisk.

Fiona