Is it possible to resume testdisk after a stop?

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Tiamet
Posts: 4
Joined: 21 Sep 2021, 03:52

Is it possible to resume testdisk after a stop?

#1 Post by Tiamet »

I am trying to recover an external disk that went RAW on me. I have internalized the bare 4TB Seagate SATA drive and began the process of checking to restore the MFT. I may have made a terrible mistake by choosing to create a log, because the log is currently 812GB and growing and my drive containing it is only a 930GB drive. I am considering stopping it in the hopes that I can delete or move the log file to a different drive, but it has been running for 4 days now and I do not know if testdisk can be resumed. I have searched this forum and cannot find a direct answer to my question. I have limited time before my hard drive becomes completely full and I crash, so I am really hoping for an answer stat. TIA to anyone who can help.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Is it possible to resume testdisk after a stop?

#2 Post by recuperation »

Tiamet wrote: 21 Sep 2021, 04:04 I am trying to recover an external disk that went RAW on me. I have internalized the bare 4TB Seagate SATA drive
Your external drive housing could contain an additional electronic interface that changes the drive geometry. You should leave the bare drive in its housing for recovery.
and began the process of checking to restore the MFT.
/quote]There is no unique diagnosis like "restoring the MFT" when faced with a raw drive. Furthermore, the so-called MFT backup only contains a few entries of the MFT. Therefore no complete recovery is possible, only a small repair.
I may have made a terrible mistake by choosing to create a log,
No, that is perfectly OK.
because the log is currently 812GB
I guess this is due to the extraction of the bare drive
and growing and my drive containing it is only a 930GB drive. I am considering stopping it in the hopes that I can delete or move the log file to a different drive, but it has been running for 4 days now and I do not know if testdisk can be resumed. I have searched this forum and cannot find a direct answer to my question. I have limited time before my hard drive becomes completely full and I crash, so I am really hoping for an answer stat. TIA to anyone who can help.
Put the bare drive into the housing and restart the recovery. If the log file starts growing that much you can pause, duplicate the log file and post its beginning (~200 lines approximately) here.

Tiamet
Posts: 4
Joined: 21 Sep 2021, 03:52

Re: Is it possible to resume testdisk after a stop?

#3 Post by Tiamet »

Thank you so much for your response. I took the drive out of it's housing because the drive does not register at all on my Windows 10 Pro machine when connected via USB between the original housing and the computer. At first it registered for a few seconds before then disappearing from both explorer and disk management. It seemed to have an intermittent connection when I first started attempting recovery, but now it does not register at all. The bare drive itself is a Seagate Barracuda 4TB drive that came housed as a Seagate Desktop Pro 4TB external drive, PN:1DXAP - 500 4TB.
I was able to see the entire contents of the drive after I initially removed it from the housing and ran Easeus Partition Recovery, but after recovering a couple of folders about 75% of the folders/files no longer appear under LIST. This is when I began the Testdisk atttempt in order to recover the file table. I put the drive back in the housing and ran an MFT repair that began scanning, and after the first evening it had scanned both the MFT and the backup MFT, determining that they were identical and null. I realized that the drive had again become disconnected at some point during the process and Testdisk must have continued to probe for the disk without connection. That is when I restarted the MFT repair with the bare drive attached directly via SATA.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Is it possible to resume testdisk after a stop?

#4 Post by recuperation »

I would check the smart parameters of your drive.
This is something that should work even with a direct connection of your bare drive with your machine.

It would be interesting to find out if the interface electronics changes the sector size from 512 back to its original 4096 bytes.
You could test that using the linux hdparm command.
I don't have to time and motivation to find out if that can be cured manually when duplicating your drive to a machine with a sector size of emulated 512 bytes.

I have an untested idea. If you had a another 4 TB drive which shows a sector size of 4096 externally you could duplicate your removed bare drive to the other 4TB drive. This other drive would not need to be in the external housing to operate correctly - assuming that the interface electronics emulate 4096 byte externally out of a possible 512e available from the drive.
Unfortunately you did not disclose the exact model of your bare drive.

Tiamet
Posts: 4
Joined: 21 Sep 2021, 03:52

Re: Is it possible to resume testdisk after a stop?

#5 Post by Tiamet »

I did not want to overload you with information, but I have been working on this for over a month now (I just realized this) and I do have the CrystaldiskInfo for this drive taken at the end of July, when I first started my attempts to recover the data.
Here is the data edited to just that regarding the drive in question:

----------------------------------------------------------------------------
CrystalDiskInfo 8.12.4 (C) 2008-2021 hiyohiyo
Crystal Dew World: https://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 10 Professional [10.0 Build 18363] (x64)
Date : 2021/07/30 0:49:11

-- Disk List ---------------------------------------------------------------
(03) ST4000DM000-1F2168 : 4000.7 GB [2/3/0, sa1]

----------------------------------------------------------------------------
(03) ST4000DM000-1F2168
----------------------------------------------------------------------------
Model : ST4000DM000-1F2168
Firmware : CC51
Serial Number : Z3004B92
Disk Size : 4000.7 GB (8.4/137.4/4000.7/4000.7)
Buffer Size : Unknown
Queue Depth : 32
# of Sectors : 7814037168
Rotation Rate : 5900 RPM
Interface : UASP (Serial ATA)
Major Version : ATA8-ACS
Minor Version : ATA8-ACS version 4
Transfer Mode : SATA/300 | SATA/600
Power On Hours : 68924 hours
Power On Count : 218 count
Temperature : 51 C (123 F)
Health Status : Caution
Features : S.M.A.R.T., APM, NCQ
APM Level : 8080h [ON]
AAM Level : ----
Drive Letter : F:

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 _97 _87 __6 00000AAF93D2 Read Error Rate
03 _92 _92 __0 000000000000 Spin-Up Time
04 _68 _68 _20 00000000816A Start/Stop Count
05 100 100 _10 0000000000B8 Reallocated Sectors Count
07 _66 _57 _30 00150556C020 Seek Error Rate
09 _22 _22 __0 000000010D3C Power-On Hours
0A 100 100 _97 000000000000 Spin Retry Count
0C 100 100 _20 0000000000DA Power Cycle Count
B7 100 100 __0 000000000000 Vendor Specific
B8 100 100 _99 000000000000 End-to-End Error
BB __1 __1 __0 0000000000D9 Reported Uncorrectable Errors
BC 100 _94 __0 001A001A0022 Command Timeout
BD _87 _87 __0 00000000000D High Fly Writes
BE _49 _40 _45 0794332B0033 Airflow Temperature
BF 100 100 __0 000000000000 G-Sense Error Rate
C0 100 100 __0 00000000009A Power-off Retract Count
C1 __1 __1 __0 0000000311EA Load/Unload Cycle Count
C2 _51 _60 __0 FFF800000033 Temperature
C5 __1 __1 __0 0000000068F0 Current Pending Sector Count
C6 __1 __1 __0 0000000068F0 Uncorrectable Sector Count
C7 200 200 __0 000000000000 UltraDMA CRC Error Count
F0 100 253 __0 E63B0000236C Head Flying Hours
F1 100 253 __0 000EE2D85C40 Total Host Writes
F2 100 253 __0 001B44DDC259 Total Host Reads

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 0C5A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2020 2020 2020 2020 5A33 3030 3442 3932
020: 0000 0000 0004 4343 3531 2020 2020 5354 3430 3030
030: 444D 3030 302D 3146 3231 3638 2020 2020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 4000 2F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0010
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 850E 0004 004C 0040
080: 01F0 0029 346B 7D09 4163 3469 BC09 4163 407F 8102
090: 8102 8080 FFFE 0000 D000 0000 0000 0000 0000 0000
100: BEB0 D1C0 0001 0000 0000 0000 6003 0000 5000 C500
110: 4F76 A16E 0000 0000 0000 0000 0000 0000 0000 401E
120: 401C 0000 0000 0000 0000 0000 0000 0000 0021 BEB0
130: D1C0 BEB0 D1C0 2020 0002 0140 0100 5000 3C06 3C0A
140: 0000 003C 0000 0008 0000 0000 05FF 0280 0000 0000
150: 0008 0000 0000 0000 0000 0000 0000 0000 7000 8800
160: 0000 0000 0000 0000 0000 0000 0000 0000 0002 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 1085 0000 0000 4000
210: 0000 0000 0000 0000 0000 0000 0000 170C 0000 0000
220: 0000 0000 1020 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
240: 0000 0000 0000 0003 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 D1A5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 0A 00 01 0F 00 61 57 D2 93 AF 0A 00 00 00 03 03
010: 00 5C 5C 00 00 00 00 00 00 00 04 32 00 44 44 6A
020: 81 00 00 00 00 00 05 33 00 64 64 B8 00 00 00 00
030: 00 00 07 0F 00 42 39 20 C0 56 05 15 00 00 09 32
040: 00 16 16 3C 0D 01 00 00 00 00 0A 13 00 64 64 00
050: 00 00 00 00 00 00 0C 32 00 64 64 DA 00 00 00 00
060: 00 00 B7 32 00 64 64 00 00 00 00 00 00 00 B8 32
070: 00 64 64 00 00 00 00 00 00 00 BB 32 00 01 01 D9
080: 00 00 00 00 00 00 BC 32 00 64 5E 22 00 1A 00 1A
090: 00 00 BD 3A 00 57 57 0D 00 00 00 00 00 00 BE 22
0A0: 00 31 28 33 00 2B 33 94 07 00 BF 32 00 64 64 00
0B0: 00 00 00 00 00 00 C0 32 00 64 64 9A 00 00 00 00
0C0: 00 00 C1 32 00 01 01 EA 11 03 00 00 00 00 C2 22
0D0: 00 33 3C 33 00 00 00 F8 FF 00 C5 12 00 01 01 F0
0E0: 68 00 00 00 00 00 C6 10 00 01 01 F0 68 00 00 00
0F0: 00 00 C7 3E 00 C8 C8 00 00 00 00 00 00 00 F0 00
100: 00 64 FD 6C 23 00 00 3B E6 07 F1 00 00 64 FD 40
110: 5C D8 E2 0E 00 00 F2 00 00 64 FD 59 C2 DD 44 1B
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 64 02 00 73
170: 03 00 01 00 01 FF 02 17 02 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 01 08 06 08 08 08 08 11
190: 08 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 24 00 20 2D 59 B3 AB E1 00 00
1B0: 00 00 00 00 01 00 83 03 40 5C D8 E2 0E 00 00 00
1C0: 59 C2 DD 44 1B 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 92 00 00 00 6A 0B 00 00 01 00 00 00
1E0: 00 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 01 00 01 06 00 00 00 00 00 00 00 00 00 00 03 00
010: 00 00 00 00 00 00 00 00 00 00 04 14 00 00 00 00
020: 00 00 00 00 00 00 05 0A 00 00 00 00 00 00 00 00
030: 00 00 07 1E 00 00 00 00 00 00 00 00 00 00 09 00
040: 00 00 00 00 00 00 00 00 00 00 0A 61 00 00 00 00
050: 00 00 00 00 00 00 0C 14 00 00 00 00 00 00 00 00
060: 00 00 B7 00 00 00 00 00 00 00 00 00 00 00 B8 63
070: 00 00 00 00 00 00 00 00 00 00 BB 00 00 00 00 00
080: 00 00 00 00 00 00 BC 00 00 00 00 00 00 00 00 00
090: 00 00 BD 00 00 00 00 00 00 00 00 00 00 00 BE 2D
0A0: 00 00 00 00 00 00 00 00 00 00 BF 00 00 00 00 00
0B0: 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00
0C0: 00 00 C1 00 00 00 00 00 00 00 00 00 00 00 C2 00
0D0: 00 00 00 00 00 00 00 00 00 00 C5 00 00 00 00 00
0E0: 00 00 00 00 00 00 C6 00 00 00 00 00 00 00 00 00
0F0: 00 00 C7 00 00 00 00 00 00 00 00 00 00 00 F0 00
100: 00 00 00 00 00 00 00 00 00 00 F1 00 00 00 00 00
110: 00 00 00 00 00 00 F2 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FD
----------------------------------------------------------------------------

Also, Here is the Testdisk log from a previous attempt on 9/13 that I believe is the one where the drive disappeared from the map mid-operation.
I did notice that you mentioned something in regards to 512 byte sector emulation from 4096 (?) and there are some lines in this log that seem to correlate to that, but I am very new to this and flying by the seat of my pants. I have no idea what that means as yet.

----------------------------------------------------------------------------

Mon Sep 13 11:49:23 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999158201856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=500096303104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000650887168
Hard disk list
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:Z3004B92, FW:CC51
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SHGS31-1000GS-2, S/N:SI04T000412004E18, FW:90000Q00
Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate Portable, S/N:NAAZWRBT, FW:0712

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: EFI GPT

Interface Advanced
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: EFI GPT
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Analyse Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CHS 486401 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS part_offset=8388608, part_size=4000770424832, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
MS Data 16384 7814021119 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
file_win32_pread(584,11,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(584,8,buffer,3519069869(486401/80/61)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069860(486401/80/52)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069861(486401/80/53)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069862(486401/80/54)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069863(486401/80/55)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069864(486401/80/56)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069868(486401/80/60)) read err: read after end of file
file_win32_pread(584,14,buffer,3519069870(486401/80/62)) read err: read after end of file

Results
P MS Data 16384 7814021119 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
gpt_change_part_type
Change partition type:
P MS Data 16384 7814021119 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Change partition type:
P NTFS 16384 7814021119 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB

interface_write()
1 P MS Data 16384 7814021119 7814004736 [Seagate Backup Plus Drive]

----------------------------------------------------------------------------

Thank you SO much for taking the time to help me with this. I am facing losing a wealth of family pictures and work related documents, thus desperate. I am truly grateful for your assistance. :)

Tiamet
Posts: 4
Joined: 21 Sep 2021, 03:52

Re: Is it possible to resume testdisk after a stop?

#6 Post by Tiamet »

This attempt completed without the drive disconnecting while attached internally via SATA. Here is that log:
Fri Sep 17 18:50:57 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Failed to startup volume: Invalid argument.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999158201856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500096303104
Hard disk list
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:Z3004B92, FW:CC51
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SHGS31-1000GS-2, S/N:SI04T000412004E18, FW:90000Q00

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 0 32 33 60800 10 10 976750592
Not an exFAT boot sector.

1 P HPFS - NTFS 0 32 33 60800 10 10 976750592
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 60800 10 10 976750592
filesystem size 1 8025048168091467285
sectors_per_cluster 0 162
mft_lcn 0 3793532289
mftmirr_lcn 0 899429187
clusters_per_mft_record 0 4
clusters_per_index_record 0 28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 14352
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096

mft at 6305792
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096

file_win32_pread(604,16,buffer,522578800(32529/6/38)) read err: read after end of file
file_win32_pread(604,16,buffer,522578801(32529/6/39)) read err: read after end of file
file_win32_pread(604,16,buffer,522578898(32529/8/10)) read err: read after end of file
file_win32_pread(604,16,buffer,522578899(32529/8/11)) read err: read after end of file
file_win32_pread(604,16,buffer,640488500(39868/144/9)) read err: read after end of file
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 60800 10 10 976750592
filesystem size 1 8025048168091467285
sectors_per_cluster 0 162
mft_lcn 0 3793532289
mftmirr_lcn 0 899429187
clusters_per_mft_record 0 4
clusters_per_index_record 0 28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
SIGHUP detected! PhotoRec has been killed.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Is it possible to resume testdisk after a stop?

#7 Post by recuperation »

After running assumably continuously for years your drive has roughly noticed 27000 broken sectors which may only be the tip of the iceberg unless you have not done something what made every sector being read in. It is definitively about to die.
With regards to the content you might consider consulting a professional recovery service.

Otherwise you would need to duplicate the drive as described in the manual because any use of this drive could further reduce its health.
The target drive has to be as big as your broken source if you duplicate it directly, when duplicating into a file your target needs to be bigger because of the storage requirements of the file system overhead.

In your case I would duplicate the duplicate drive to another drive. The initial copy process of the broken drive might take lots of time. You should post a screenshot or picture of the ddrescue screen.
Duplicating the duplicate should run fast - at the minimum of the native sustained speed of both drives.

For Testdisk to work correctly you should run Testdisk with your duplicated drive being one with a sector size of 4096 shown externally, not 512 byte emulated.

These drive are expensive. The cheapest one I found is
Toshiba Enterprise Capacity MG04ACA 4TB, 4Kn, SATA 6Gb/s (MG04ACA400A) , it costs €155,- here in Germany.

There are a couple of stores offering the
Western Digital Ultrastar DC HC310 4TB, SE, 4Kn, SATA 6Gb/s (HUS726T4TALN6L4 / 0B35948), local best price here is €174,-.

Locked