File system damaged - what can I do?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Martao
Posts: 2
Joined: 12 Oct 2021, 11:35

File system damaged - what can I do?

#1 Post by Martao »

Problem description:
I was backing up some stuff from my laptop, because I needed to reinstall windows. Unfortunately, my external HDD failed at the end of making the backups. I am not sure what happened, but the file transfer became slower and slower, and I eventually cancelled the transfer and tried to safely remove the HDD. Afterwards I couldn't explore the disk anymore and windows tells me it needs to be formatted. A second laptop tells me the same. Also, the systems seem to become slow when I connect the drive. Chkdsk also doesn't seem to be able to do anything with it.

Since I moved rather than copied some of the data, there's some data I would like to recover. Also, I know there already were some photos on the disk before I started backing up. I think I do have these photos on another source, but I am not 100% sure, so I would like to be able to check the file names and match them with my NAS.

I tried to run TestDisk. When I try to list the files, it isn't able to do that ("Can't open filesystem. Filesystem seems damaged"). That's kind of what I figured, but the question is: is there anything I can do about it and repair the file system? When I try to run the analysis function, nothing happens for a long time, then it says

Code: Select all

Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121597 255 63                                                         
Analyse cylinder 121597/121596: 99%                                                                                     
Read error at 0/5/45 (lba=359)                                                                                                                                                                                                                    
MS Data                     2048 1953456127 1953454080                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Stop
I take note that it says that it's trying to read a cylinder with a higher sequence number than that's available, or something like that!?
Does this tell you anything? At least this error is not ending up in my testdisk.log file:


Tue Oct 12 11:33:35 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=227877584896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26843545600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000168488960
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - NVMe INTEL SSDPEKKW25, S/N:0000_0001_0000_0000_014D_912E_4C5C_D2E4., FW:PSF
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 2606, S/N:WXP1AB8HPCXT, FW:1024

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - WD My Passport 2606
Partition table type: EFI GPT
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953458175 (expected 1953458175)
hdr_lba_start=34
hdr_lba_end=1953458142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_win32_pread(604,2,buffer,6293504(391/191/57)) read err: read after end of file

1 P MS Data 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
gpt_change_part_type
Change partition type:
1 P MS Data 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Change partition type:
1 P FAT32 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_win32_pread(604,240,buffer,2064(0/32/49)) read err: read after end of file
disk_image write() failed: Permission denied
No space left for the file image.

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953458175 (expected 1953458175)
hdr_lba_start=34
hdr_lba_end=1953458142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB

1 P MS Data 2048 1953456127 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953458175 (expected 1953458175)
hdr_lba_start=34
hdr_lba_end=1953458142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 2048 1953456127 1953454080 [My Passport]
After this, I tried to run photorec. This way I am able to recover files, but it's taking a LOT of time, probably over a month if I have to believe photorec's own estimation. Given the fact that my disk was far from full (Maybe even less than 10%), and that I am only interested in part of the data, I am hoping there is a better solution than this.

Questions:
1) Is there anything I can do to repair the filesystem? Perhaps some expert settings, or another tool I should try?
2) Is there a way to stop photorec and continue where it left off?
3) From other Forum posts, I understand that it's better to make a copy image, and work from the copy. However, that means I probably need to buy another disk first. Or is it possible to save the image to my NAS? (Probably not!?) Would the photorec process be faster after making a copy to a SSD drive? (I suppose so?)

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: File system damaged - what can I do?

#2 Post by recuperation »

Martao wrote: 12 Oct 2021, 16:13 Problem description:
I was backing up some stuff from my laptop, because I needed to reinstall windows. Unfortunately, my external HDD failed at the end of making the backups. I am not sure what happened, but the file transfer became slower and slower, and I eventually cancelled the transfer and tried to safely remove the HDD. Afterwards I couldn't explore the disk anymore and windows tells me it needs to be formatted. A second laptop tells me the same. Also, the systems seem to become slow when I connect the drive. Chkdsk also doesn't seem to be able to do anything with it.

Since I moved rather than copied some of the data,
you did not make a backup. Backups are copies! Please do not talk about having made backups. Moving files has nothing in common with making backups.

there's some data I would like to recover. Also, I know there already were some photos on the disk before I started backing up.
You did NOT BACKUP anything!!!!

I think I do have these photos on another source, but I am not 100% sure, so I would like to be able to check the file names and match them with my NAS.

I tried to run TestDisk. When I try to list the files, it isn't able to do that ("Can't open filesystem. Filesystem seems damaged"). That's kind of what I figured, but the question is: is there anything I can do about it and repair the file system? When I try to run the analysis function, nothing happens for a long time, then it says

Code: Select all

Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121597 255 63                                                         
Analyse cylinder 121597/121596: 99%                                                                                     
Read error at 0/5/45 (lba=359)                                                                                                                                                                                                                    
MS Data                     2048 1953456127 1953454080                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Stop
I take note that it says that it's trying to read a cylinder with a higher sequence number than that's available, or something like that!?
Does this tell you anything? At least this error is not ending up in my testdisk.log file:
Your target hard drive of your MOVING operation is broken. You can try do duplicate the drive using ddrescue as described in the manual and run Testdisk on the duplicate.

Martao
Posts: 2
Joined: 12 Oct 2021, 11:35

Re: File system damaged - what can I do?

#3 Post by Martao »

@recuperation, I really do appreciate you helping people here, but I just have to ask: I feel a lot of hostility in your reply. Is that really necessary?

Yes, I do understand your point on back-ups vs simply moving files. However, I do have to point out that I'm a private person, not a big company with procedures on this matter (and even then, f-ups happen, in my experience). I really do try to keep my data stored in such a way that I am secured against (single) drive failure. However, sometimes you're lazy or just in time trouble, right? The directory that is missing now, was basically a set of files WAITING to be archived for real. Yes, I know, that turns out to be a bad mistake, but we're all human, right?

Furthermore, I am neither a data retention expert, nor a native english speaker. Hence: I make mistakes, or use the incorrect term. I'm sorry for that, but all I did try to do was provide background information and as much facts as I could. Again, I do appreciate the help you provide.
You can try do duplicate the drive using ddrescue as described in the manual and run Testdisk on the duplicate.
Yes, as I mentioned, I did take note of the advice to make a duplicate of the drive, and I am planning to do so. However, I probably have to purchase a new drive for that purpose, so I asked some questions around that. Could you answer these?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: File system damaged - what can I do?

#4 Post by recuperation »

Martao wrote: 12 Oct 2021, 16:13 Problem description:
Since I moved rather than copied some of the data, there's some data I would like to recover.
Martao wrote: 12 Oct 2021, 20:48 @recuperation, I really do appreciate you helping people here, but I just have to ask: I feel a lot of hostility in your reply. Is that really necessary?
Obviously you know the difference, see your quote above! This is not a lyrics contest here. You are a witness of your own data accident looking for help.
I am speechless about how careless people describe their problems.
For a "hostility"-free solution feel free to consult a professional recovery service who will charge you 3 to 4 digit EUR or USD figures and will treat you with all "politeness" imaginable.

What you don't realize is that you bear the consequences of a bad description - not me.
Martao wrote: 12 Oct 2021, 16:13 3) From other Forum posts, I understand that it's better to make a copy image, and work from the copy. However, that means I probably need to buy another disk first. Or is it possible to save the image to my NAS? (Probably not!?) Would the photorec process be faster after making a copy to a SSD drive? (I suppose so?)
I don't know your amount of free space on your NAS. I can't tell you if ddrescue can write to a network storage place. Based on your initial posting I would strongly disrecommend trying to write a file onto your NAS using ddrescue.
The best solution is to duplicate your drive.
Would the photorec process be faster after making a copy to a SSD drive? (I suppose so?)
Yes, because a healthy storage source won't reduce the possible speed of Photorec.
Furthermore you can easily monitor ddrescue by looking at his text output on screen when it has issues reading a particular sector and gets stucked. There is no guessing anymore if your application is still working at all.

A speed increase would appear (noticeable or not) once Photorec reads in lower sector numbers instead of advancing upwards. This is an application where a solid state drive shows its advantages of random access over a harddrive that may have to reposition its head and wait for the desired sector to pass by.

Locked