Busted Raid 1 Filesystem

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
thegatekeeper
Posts: 1
Joined: 21 Jul 2021, 19:44

Busted Raid 1 Filesystem

#1 Post by thegatekeeper »

Hey guys,

First of all thanks for this amazing software. Let me explain my situation a little bit.

I have 2 6TB hard disks in an external enclosure running Raid 1 using the enclosure's hardware. During moving, one of the hard disks (the top one) got disconnected. I turned it off, plugged it back in, and turned it on again. The data did show at this point as normal, which is when I should have taken it. First mistake!

I restarted the enclosure because the light was still red on the top hard disk (meaning "rebuilding") and the raid became uninitialized and unallocated. I did make another mistake at this point by initializing the raid from disk manager, using the same partition structure as before (GPT).

Long story short I discovered testdisk and was able to find the partition on the drive. It was marked as "D" for deleted, so I changed it to "P" for primary. I wrote the partition and was able to see all of the files from testdisk, in fact I was even copying the data.

The Raid showed up as normal in disk manager, so I restarted the drive thinking I could copy the data from explorer. The data did show as normal, but all of the sizes were 0. When I tried to access anything, it gave me "inaccessible" and "corrupt" errors. Then all of the folders disappeared except the first one, which was called "backup"; this was the only folder I copied some of the contents from but I'm not sure if this matters or not. After a bit, the raid uninitialized itself again.

From this point on, testdisk will only show the "backup" folder on either drives from the raid and it also gives "Bad GPT partition, invalid signature." errors. I know I messed up big time, but is there any way to fix this? I think the data is still there but windows or the enclosure somehow messed up the filesystem even more.

Here is the log from the first attempt where I could see the files:

Code: Select all

Tue Jul 20 14:37:09 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=6001143054848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=15527313408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=6001143054848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=15527313408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=118875257856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=15523184640
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=119664541696
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 840 Series, S/N:S19HNEAD493342T, FW:DXT08B0Q
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Corsair Force GT, S/N:13407911000097950151, FW:5.07
Disk /dev/sde - 6001 GB / 5589 GiB - CHS 729597 255 63, sector size=512 - SST TS231UC RAID 1, S/N:B41987654321
Disk /dev/sdf - 15 GB / 14 GiB - CHS 1887 255 63, sector size=512 - Verbatim STORE N GO, S/N:0E7409090030, FW:PMAP

Partition table type (auto): EFI GPT
Disk /dev/sde - 6001 GB / 5589 GiB - SST TS231UC RAID 1
Partition table type: EFI GPT

Analyse Disk /dev/sde - 6001 GB / 5589 GiB - CHS 729597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720982528 (expected 11720982528)
hdr_lba_start=34
hdr_lba_end=11720982495
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]

search_part()
Disk /dev/sde - 6001 GB / 5589 GiB - CHS 729597 255 63
NTFS at 729597/74/13
filesystem size           11720716288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 11720980479 11720716288 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
NTFS at 729597/74/13
filesystem size           11720716288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(6,2,buffer,11727271941(729988/233/43)) lseek err Invalid argument
file_pread(6,1,buffer,11727271941(729988/233/43)) lseek err Invalid argument
NTFS: Can't read MFT
     MS Data               11720980479 23441696766 11720716288
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
This partition ends after the disk limits. (start=11720980479, size=11720716288, end=23441696766, disk end=11720982529)
file_pread(6,2,buffer,11720982578(729597/107/33)) lseek err Invalid argument
file_pread(6,1,buffer,11720982578(729597/107/33)) lseek err Invalid argument
file_pread(6,2,buffer,11720982591(729597/107/46)) lseek err Invalid argument
file_pread(6,1,buffer,11720982591(729597/107/46)) lseek err Invalid argument
file_pread(6,2,buffer,11720982641(729597/108/33)) lseek err Invalid argument
file_pread(6,1,buffer,11720982641(729597/108/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sde - 6001 GB / 5589 GiB - CHS 729597 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 12 TB / 10 TiB)
The following partition can't be recovered:
     MS Data               11720980479 23441696766 11720716288
     NTFS, blocksize=4096, 6001 GB / 5588 GiB

Results
   P MS Data                   264192 11720980479 11720716288 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
NTFS Volume is dirty.


dir_partition inode=5
   P MS Data                   264192 11720980479 11720716288 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 15-Feb-2021 21:00 .
       5 dr-xr-xr-x     0      0         0 15-Feb-2021 21:00 ..
    1454 dr-xr-xr-x     0      0         0 10-Feb-2021 21:58 $RECYCLE.BIN
  393648 dr-xr-xr-x     0      0         0 22-Jun-2021 19:36 Backups
   95316 dr-xr-xr-x     0      0         0 22-Jun-2021 19:36 Documents
   22809 dr-xr-xr-x     0      0         0 19-Jan-2020 23:11 Drivers
   48118 dr-xr-xr-x     0      0         0 16-Oct-2020 00:13 Images
   48114 dr-xr-xr-x     0      0         0  9-Feb-2021 19:58 Miscellaneous
  309714 dr-xr-xr-x     0      0         0  9-Feb-2021 18:01 Movies
  393676 dr-xr-xr-x     0      0         0  2-Feb-2021 00:14 Programming & Related
    1457 dr-xr-xr-x     0      0         0  5-Feb-2021 00:05 Programs
  270044 dr-xr-xr-x     0      0         0  1-Feb-2021 23:56 Videos
  393662 -r--r--r--     0      0        16  2-Feb-2021 00:07 ToDo.txt

interface_write()
 1 P MS Data                   264192 11720980479 11720716288 [Data]
write!
No extended partition

ntfs_boot_sector
 1 P MS Data                   264192 11720980479 11720716288 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size           11720716288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
And here is the current one with only one folder showing:

Code: Select all


Wed Jul 21 23:04:24 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=15527313408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=15527313408
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=118875257856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=15523184640
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=119664541696
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 840 Series, S/N:S19HNEAD493342T, FW:DXT08B0Q
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Corsair Force GT, S/N:13407911000097950151, FW:5.07
Disk /dev/sdc - 15 GB / 14 GiB - CHS 1887 255 63, sector size=512 - Verbatim STORE N GO, S/N:0E7409090030, FW:PMAP
Disk /dev/sdf - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WDC WD60 EZAZ-00ZGHB0, S/N:152D20337A0C

Partition table type defaults to EFI GPT
Disk /dev/sdf - 6001 GB / 5589 GiB - WDC WD60 EZAZ-00ZGHB0
Partition table type: EFI GPT

Analyse Disk /dev/sdf - 6001 GB / 5589 GiB - CHS 729601 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdf - 6001 GB / 5589 GiB - CHS 729601 255 63
NTFS at 729601/61/60
filesystem size           11720779776
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 11721043967 11720779776 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
NTFS at 729601/61/60
filesystem size           11720779776
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(7,2,buffer,11727335429(729992/221/27)) lseek err Invalid argument
file_pread(7,1,buffer,11727335429(729992/221/27)) lseek err Invalid argument
NTFS: Can't read MFT
     MS Data               11721043967 23441823742 11720779776
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
This partition ends after the disk limits. (start=11721043967, size=11720779776, end=23441823742, disk end=11721045168)
file_pread(7,2,buffer,11721046015(729601/94/29)) lseek err Invalid argument
file_pread(7,1,buffer,11721046015(729601/94/29)) lseek err Invalid argument
file_pread(7,2,buffer,11721046016(729601/94/30)) lseek err Invalid argument
file_pread(7,1,buffer,11721046016(729601/94/30)) lseek err Invalid argument
file_pread(7,2,buffer,11721046019(729601/94/33)) lseek err Invalid argument
file_pread(7,1,buffer,11721046019(729601/94/33)) lseek err Invalid argument
file_pread(7,2,buffer,11721046079(729601/95/30)) lseek err Invalid argument
file_pread(7,1,buffer,11721046079(729601/95/30)) lseek err Invalid argument
file_pread(7,2,buffer,11721046082(729601/95/33)) lseek err Invalid argument
file_pread(7,1,buffer,11721046082(729601/95/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdf - 6001 GB / 5589 GiB - CHS 729601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 12 TB / 10 TiB)
The following partition can't be recovered:
     MS Data               11721043967 23441823742 11720779776
     NTFS, blocksize=4096, 6001 GB / 5588 GiB

Results
   P MS Data                   264192 11721043967 11720779776 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
NTFS Volume is dirty.


dir_partition inode=5
   P MS Data                   264192 11721043967 11720779776 [Data]
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Jul-2021 20:06 .
       5 dr-xr-xr-x     0      0         0 20-Jul-2021 20:06 ..
   32840 dr-xr-xr-x     0      0         0 20-Jul-2021 20:06 $RECYCLE.BIN
  393648 dr-xr-xr-x     0      0         0 22-Jun-2021 19:36 Backups
   32801 dr-xr-xr-x     0      0         0 20-Jul-2021 20:05 System Volume Information

interface_write()
 1 P MS Data                   264192 11721043967 11720779776 [Data]
simulate write!

TestDisk exited normally.
Please note that the first run was on the full raid, while the second is on one disk from that raid connected using USB because the enclosure can no longer read it. Not sure if this makes a difference or not.

I noticed that the "search_part()" has different values and also the partitions them selves.

I do have a backup of the most important data, but still I would like to restore the drive if possible, or am I too far gone?

Thanks a lot for your help!

Locked