cgsecurity.org

Hi there.

I have a WD MyBook. It's a Raid unit with x2 1TB hard drives.

Yesterday, when I plugged it in, I got a lovely error... "This drive needs to be formatted" or something similar.

So I found Testdisk and started the tutorial. But I'm a little unsure about what to do next because I'm not sure if my drive is any different to a normal HDD.

I'm currently scanning my drive as I type. Here is the log so far (below) but it's just thrown up this in testdisk which hasn't been written in to the log yet:

HPFS - NTFS 0 65 2 121600 108 28 1953506736
Check FAT cannot read FAT boot sector
Invalid FAT boot sector
0 D FAT12 343174 142 62 521156 85 54 2859710987
FAT12 343174 142 62 521156 85 54 2859710987

Could someone guide me to what to do next?

Many thanks


---------------
Current Log
----------------

Thu Aug 20 08:50:11 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, August 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000392994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000392994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308679802880
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1000195448832
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00BEVT-22A0R, S/N:W -DXW1C5AM02812, FW:01.0
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512 - WD My Book, S/N:WU2Q10140339, FW:1015

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - WD My Book
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121600 75 59 1953506736
1 * HPFS - NTFS 0 32 33 121600 75 59 1953506736

---------------------------------

Try TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.

Hi.

Many thanks, I'll try that now.

Here's the log file from that last session. It didn't look good to me, but I don't really know what it all means?



Thu Aug 20 08:50:11 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, August 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000392994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000392994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308679802880
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1000195448832
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00BEVT-22A0R, S/N:W -DXW1C5AM02812, FW:01.0
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512 - WD My Book, S/N:WU2Q10140339, FW:1015

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - WD My Book
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121600 75 59 1953506736
1 * HPFS - NTFS 0 32 33 121600 75 59 1953506736

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63
NTFS at 0/65/2
filesystem size 1953506736
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094170
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 65 2 121600 108 28 1953506736
NTFS, blocksize=4096, 1000 GB / 931 GiB
BAD_RS LBA=1217698266 10583
file_pread(5,3,buffer,1217698266(343147/142/62)) lseek err Invalid argument
file_pread(5,1,buffer,1217698266(343147/142/62)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 343147 142 62 521156 85 54 2859710987
This partition ends after the disk limits. (start=5512665562, size=2859710987, end=8372376548, disk end=3907017568)
file_pread(5,2,buffer,3907018751(243200/170/42)) lseek err Invalid argument
file_pread(5,1,buffer,3907018751(243200/170/42)) lseek err Invalid argument
file_pread(5,2,buffer,3907018752(243200/170/43)) lseek err Invalid argument
file_pread(5,14,buffer,3907018754(243200/170/45)) lseek err Invalid argument
file_pread(5,3,buffer,3907018768(243200/170/59)) lseek err Invalid argument
file_pread(5,3,buffer,3907018815(243200/171/43)) lseek err Invalid argument
file_pread(5,8,buffer,3907018831(243200/171/59)) lseek err Invalid argument
file_pread(5,11,buffer,3907018878(243200/172/43)) lseek err Invalid argument
file_pread(5,2,buffer,3907020800(243200/203/12)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4286 GB / 3992 GiB)
The following partition can't be recovered:
FAT12 343147 142 62 521156 85 54 2859710987

Results
* HPFS - NTFS 0 65 2 121600 117 53 1953507328
NTFS, blocksize=4096, 1000 GB / 931 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

You seem to have lots of read errors.
Checkout the available tools from WD to get two SMART reports for both drives.
For single drives I would recommend smartmontools but as your combined drives have to act like one unique drive but I have no experience how to get 2 individual reports.
Maybe it's possible to put one drive after the other into a docking station running under Linux.

Post the SMART parameters here attaching them as a text file or picture using the attachment function below.
The next hint would be to duplicate the RAID array using ddrescue.

Hi.

Thanks for the advice.

My laptop somehow re-booted over night but trying the re-build option again it's come up with this, any further advice?:

TestDisk 7.2-WIP, Data Recovery Utility, August 2020 Christophe GRENIER <grenier@cgsecurity.org> https://www.cgsecurity.org Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243200 255 63 Partition Start End Size in sectors 1 * HPFS - NTFS 0 32 33 121600 75 59 1953506736 Boot sector Status: Bad Backup boot sector Status: Bad Sectors are not identical. A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable. >[ Quit ] [Rebuild BS] [ Dump ] Return to Advanced menu

Using a quick search in Data Lifeguard it's come up as a PASS

I'm confused now.

Unfortunately I don't use Linux.

Any other suggestions? I really need to save my drive.

If you can't follow the advice given you would have to bite the bullet and contact a professional data recovery company.

I can and I have followed the advice but I am unable to use Linux, that is all.

I'm just looking for any other advice.

Thanks

There is no Windows equivalent to ddrescue in Linux => There is no other advice.
smartmontools is available for Windows, too.

Many thanks.

Do you think my drive beyond repair? Should I just re-format it?

I can't understand how this happened to my drive. It was working fine the other week. I've not used it in a few weeks.

If you have any other ideas on how I can recover the data, please update me.

Many thanks