cgsecurity.org

Posted: **27 Sep 2021, 09:48**

Hi,
a ntfs/gpt/3TB disk unexpectedly became raw and I tried to use testdisk to recover the partition.
But the auto-detected geometry for the disk at the testdisk start-up looks suspicious

What Computer management shows:
Disk 0: C: 931.51 GB NTFS (MBR Partition)
Disk 1: D: 2794.39 GB NTFS (GPT Partition)
Disk 2: F: 931.51 GB NTFS (MBR Partition)
Disk 3: E: 2794.39 GB (GPT Partition). This is the disk that became raw

What teskdisk 7.0 shows (Windows Server 2003, so no version 7.2 is possible)
(but the same is for FreeDos/testdisk 7.2 version boot)

Disk /dev/sda - 1000 GB / 931 GiB
Disk /dev/sdb - 801 GB / 746 GiB
Disk /dev/sdc - 1000 GB / 931 GiB
Disk /dev/sdd - 801 GB / 746 GiB
Drive C: - 1000 GB / 931 GiB
Drive D: - 3000 GB / 2794 GiB
Drive F: - 1000 GB / 931 GiB

So both 3TB drives are listed incorrectly with the drives enumeration and one with the correct NTFS system is shown correctly when enumerated with the drive letters

As for my task, testdisk can't detect anything when I used it for the problem disk (/dev/sdd ) both with the default geometry and I change it forcingly to the one I found at the Drive D: item (364784 cylinders). I could suggest that nothing is possible with my disk, but for the healthy ntfs disk (Drive D) testdisk can't detect ntfs partition in the following three cases:

/dev/sdb default geometry . Detects EFI GPT, Big "MS Data partition", but "No FAT, NTFS, ext2... marker" after Analyze
/dev/sdb, forced 3TB (364784 cylinders). The same...
Drive D: item . Doesn't detect EFI Gpt, if I choose one, Bad GPT Partition, invalid signature

that hints that testdisk just can't communicate adequately with my hardware when the disks are 3TB. Is this possible and I'm out of luck here?
(The motherboard is MSI G31TM-P35)

Posted: **27 Sep 2021, 13:57**

Have you removed the 3TB out of its original housing?
How did you physically connect it to your computer?
Use the most current Testdisk version 7.2 WIP. You can run it from a USB stick with a live linux installed on it, p.e. GParted.
There is a small CD-image available for download with a size of roughly 300 MB.

Posted: **27 Sep 2021, 16:31**

Thanks for your prompt reply

recuperation wrote: 27 Sep 2021, 13:57 Have you removed the 3TB out of its original housing?
How did you physically connect it to your computer?

All disks are connected to the same motherboard for about year or so. So all my tests are on the same computer. The disk in question is not system so I can boot and work on the same computer in the same OS (Windows Server 2003).

recuperation wrote: Use the most current Testdisk version 7.2 WIP. You can run it from a USB stick with a live linux installed on it, p.e. GParted.
There is a small CD-image available for download with a size of roughly 300 MB.

I already did this, sorry, I mentioned this just briefly. The FreeDos with the latest DOS testdisk (7.2). The geometry was still incorrect.

I'm attaching two logs, if you don't mind

windows_server_2003_disk_d_3tb_read.log - testdisk 7.0, three tests in the log (I inserted lines inside).
1. is by going to working D: disk (ntfs) listed correctly but failed to find GPT partitiong, forcing GPT and analyze gives an error.
2. Going the the /dev/sdb - 801 GB / 746 GiB, detected GPT, but failed to find NTFS
3. Going the the /dev/sdb - 801 GB / 746 GiB, forcing 364784 cylinders to match 3TB, detected GPT, failed to find NTFS
dos_log1.LOG - the log from the FreeDos/7.2 run. Disks listed as 801 GB / 746 GiB are 3TB in Windows

I see that the program itself warns about wrong detecting and hints to change jumpers, but I see this disks correctly in Bios and can not think of something else to improve detection.

Posted: **27 Sep 2021, 17:27**

Your explanation does not disclose if your disk drive has been working correctly with that old hardware and operating system before.
Please run Testdisk with your disk being attached to a system with modern hardware to see if Testdisk 7.2 gives correct size information.

Posted: **27 Sep 2021, 18:47**

recuperation wrote: 27 Sep 2021, 17:27 Your explanation does not disclose if your disk drive has been working correctly with that old hardware and operating system before.
Please run Testdisk with your disk being attached to a system with modern hardware to see if Testdisk 7.2 gives correct size information.

To which system has your disk been connected before you the detected the error?
Again, did you purchase it in an external housing?

Posted: **27 Sep 2021, 20:02**

recuperation wrote: Your explanation does not disclose if your disk drive has been working correctly with that old hardware and operating system before.
......
To which system has your disk been connected before you the detected the error?
Again, did you purchase it in an external housing?

The disk is 5 inch OEM Toshiba connected to a desktop motherboard under Windows Server 2003 after the purchase and was working there until the failure without changing hosts and without troubles.

Posted: **27 Sep 2021, 23:04**

Are there other specialty you might want to add?

I have never seen a 5'' disk. Which partitioning scheme did you use or did this disk had a sector size at its interface beyond the typical 512 bytes?

Posted: **28 Sep 2021, 09:54**

recuperation wrote: 27 Sep 2021, 23:04 Are there other specialty you might want to add?
I have never seen a 5'' disk. Which partitioning scheme did you use or did this disk had a sector size at its interface beyond the typical 512 bytes?

My mistake, it's a 3.5" drive. I connected it to a more modern motherboard and now it detects correctly in the testdisk. The procedure of analyzing has started so now I just have to wait.
Thank you for your help

cgsecurity.org

Unexpected geometry for 3TB disks

Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks

Re: Unexpected geometry for 3TB disks