[Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
dusk3dawn
Posts: 9
Joined: 04 Nov 2021, 14:38

[Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#1 Post by dusk3dawn »

Hi Guys, CG team, Forum Contributor,

I try to search the forum before posting:
viewtopic.php?t=3682
viewtopic.php?p=27109
viewtopic.php?t=4498

But I still cannot solve my issue.

Summary:
------------------------------------------------------------------------------------------------
I use old usb to sata on 4TB GPT HDD.
This old usb sata try to force/convert to MBR, 2048GB partition, 512 sector size.
It make the 4TB hdd show unallocated on win 7.
In panic, I write 3 times using testdisk.
Now I hope I can revert back or fixed these issue.
------------------------------------------------------------------------------------------------

Detail step that I take:
I have 4 TB WD black with no partition.
Everything in one big block GPT 4TB to save data.
I really rare connect this HDD to PC, I'm pretty sure that the HDD hardware is in good shape.

Few days ago, I try to connect the 4TB hdd with old usb 2.0 to sata connector.
My HDD 4TB suddenly unallocated in windows 7.
Later I found out that usb to sata connector have limitation to 2TB HDD.
This old usb to sata connector convert/force change to old max 2TB format.
I suspect it was MBR 2048GB, 512 sector size.

In the panic I am using testdisk.
  1. 1st write
    I run testdisk > analyse to 100 % in just 2 seconds > only found 1 GPT partition with my hdd name [WD 4 TB GPT].
    with warning number of bytes per sector mismatches 4096 (ntfs) != 512 (hd)
    Then I proceed using choose default * to write and reboot.
    After reboot I still cannot access the hdd.
  2. 2nd write
    I run testdisk > analyse to 100% in just 2 seconds > only found 1 GPT partition with my hdd name [WD 4 TB GPT],
    With warning number of bytes per sector mismatches 4096 (ntfs) != 512 (hd)
    This time I choose L, write and reboot.
    Then it become 2 partition the data (2TB) and leftover ext space.
    After this I just realize that this HDD should use primary, not * or L.
  3. 3rd write
    I run testdisk > analyse only 60% around 20 minutes wait> found 1 partition > stop analyse,
    This partition don't have my hdd name.
    This time I choose P, write and reboot.
    Still no access to HDD.
After 3rd write I realized that it got worse.

Here is the latest analyse > quick search > quick search result:
  1. analyse
    Image
  2. quick search progress
    Image
  3. quick search result
    Image
Here it the latets deep search results:
  1. Analyse show sector size 512
    Image
  2. Deep search progress
    Image
  3. 2048GB partition, maybe from forced MBR 2TB.
    Image
  4. 4TB GPT Partition with HDD name
    Image
    1. It show correct HDD name, size, and path
      Image
  5. I'm sure this is not partition I'm looking for, no data inside
Image

My questions:
1. Can I revert back to original state?
Later I found out, I only have the latest testdisk.log,
because each time I do changes I choose create new log,
It seems the log overwritten by the latest testdisk.log
try to use recovery program to retrieve the log, didn't make it.
I also didn't make backup previously, because I thought, I have full log.

2. it seems that old usb to sata forced to use MBR, 2048GB, 512 size sector.
warning number of bytes per sector mismatches 4096 (ntfs) != 512 (hd)
How do I fix this warning or issue?

3. In case I can't revert back, Should I try to write P to the second partition that found in deep search?
It seems found my old partition with correct hdd name, size, and path.
Image
Image


4. If all above failed.
This HDD is my main backup, all my life & personal data inside this HDD.
Currently really frustrated and really need help.
At this point I desperately want to recover as much data as possible.
I don't mind buying recovery data software.
I can't go to professional recovery, I'm in 3rd world country,
There are high chances these professional just using the paid online software too.
Do you have any recommendation for online paid data recovery programs?

I have feedback for testdisk 7.2 WIP, win 7 64 bit.
Is it possible to create new log based on PC date and time?
So it wont overwrite previous log.
I was used putty a lot in the past. It has config to create auto log.
In this auto log file names, putty puts the PC dates and times.
So every time I use Putty I will get new log with new name based on date and time.
This way I never overwrite the log and I can know exactly which log I should read.
https://www.viktorious.nl/2013/01/14/pu ... on-output/
Since the log itself can be used for backup or revert and very small for these days PC,
I believe if testdisk have this auto log feature as default,
it will be better for testdisk and help a lot of people in the future.


Thank you if you read all my writing, appreciated your time to read, and appreciate any input or help for my issue.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#2 Post by recuperation »

Despite lots of text and pictures I don't get the necessary overview about your situation.

What is the maker and model of the 4 TB hard disk drive?
Did you buy a "naked" single drive or a package containing a drive in a box and a USB connector?
How was the drive connected when everything was working flawlessly?
Please describe the chain of connection from the drive up to the mainboard!

Did you change your setup before the incident happened?
If yes, what did you change?

How was the partition setup before the incident happened?

What exactly is a "usb sata"?!
Please post a picture by uploading it to this site using the attachment tab on the bottom of the page.

dusk3dawn
Posts: 9
Joined: 04 Nov 2021, 14:38

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#3 Post by dusk3dawn »

Thank you for your reply.
recuperation wrote: 04 Nov 2021, 20:50 What is the maker and model of the 4 TB hard disk drive?
recuperation wrote: 04 Nov 2021, 20:50 Did you buy a "naked" single drive or a package containing a drive in a box and a USB connector?
WD black 4TB. naked.
WhatsApp Image 2021-11-05 at 09.01.45.jpeg
WhatsApp Image 2021-11-05 at 09.01.45.jpeg (245.23 KiB) Viewed 7055 times
recuperation wrote: 04 Nov 2021, 20:50 How was the drive connected when everything was working flawlessly?
Please describe the chain of connection from the drive up to the mainboard!
HDD > sata cable > sata port on motherboard.
With sata power cable directly to psu.
recuperation wrote: 04 Nov 2021, 20:50 Did you change your setup before the incident happened?
If yes, what did you change?
Yes. I'm using old converter USB 2.0 to sata.
vantech connect to PC.PNG
vantech connect to PC.PNG (209.3 KiB) Viewed 7055 times
recuperation wrote: 04 Nov 2021, 20:50 How was the partition setup before the incident happened?
I choose GPT, to make 1 4TB block on the HDD.
recuperation wrote: 04 Nov 2021, 20:50 What exactly is a "usb sata"?!
Please post a picture by uploading it to this site using the attachment tab on the bottom of the page.
vantec usb to sata.PNG
vantec usb to sata.PNG (490.45 KiB) Viewed 7055 times
Let me know if you need more informations.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#4 Post by recuperation »

Go back to your initial setup using the direct SATA cable connection to your mainboard.
Run Testdisk, create a log file that you post completely here afterwards.
Select GPT as partition table type in Testdisk, you selected the wrong one.

What's the result?

With an emulated sector size of 512 bytes that shows up at your hard drive interface without using any interfering intermediate electronics such as your SATA/USB-Adapter, it is impossible to create a partition size of 4TB using the old MBR style partition scheme.

If you find that partition with your data again you don't have to care about the other partitions, just ignore them.

The best is to have another drive ready do copy all the files you are interested in before doing wrong things again.

dusk3dawn
Posts: 9
Joined: 04 Nov 2021, 14:38

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#5 Post by dusk3dawn »

Thank you for your reply, I feel that I one step closer to recover my data.
I don't have high expectation, but hope for the best, for this recovery.
recuperation wrote: 05 Nov 2021, 16:30 Go back to your initial setup using the direct SATA cable connection to your mainboard.
Run Testdisk, create a log file that you post completely here afterwards.
Select GPT as partition table type in Testdisk, you selected the wrong one.

What's the result?
That is my problems, I put connections direct sata to motherboard, then run 3 writes in the first post. Without log and backup.
I carefully choose append after I found out that new log means overwrite the log.
This is the latest log :
testdisk.log
(254.98 KiB) Downloaded 235 times
recuperation wrote: 05 Nov 2021, 16:30 With an emulated sector size of 512 bytes that shows up at your hard drive interface without using any interfering intermediate electronics such as your SATA/USB-Adapter, it is impossible to create a partition size of 4TB using the old MBR style partition scheme.
I thought It's impossible too. I remember other information.
When I used that SATA/USB adapter first time, it failed to install the 4TB HDD driver. I thought it was normal.
Then I just disconnect and connect again using different USB port and it show unallocated in win 7.

After that I put that 4TB into direct connection sata to motherboard.
I remember before I using testdisk, I used minitool partition to analyse.
It found 2048GB undetected partition. (I'm not doing any changes using other programs just analyse. I only made 3 writes using testdisk in first post.)
In my opinion, that 2048GB partition not supposed to be there,
Because when the HDD is brand new and I just go for 4GB GPT partition, I never have/put 2048GB partition in that disk.
recuperation wrote: 05 Nov 2021, 16:30 If you find that partition with your data again you don't have to care about the other partitions, just ignore them.
With 4TB directly connect to motherboard, (after 3 writes/latest state)
Here it the latets deep search results:
  1. Analyse show sector size 512
    Image
  2. Deep search progress
    Image
  3. 2048GB partition, maybe from forced MBR 2TB.
    Image
  4. 4TB GPT Partition with HDD name
    Image
    1. It show correct HDD name, size, and path
      Image
  5. I'm sure this is not partition I'm looking for, no data inside
Image

recuperation wrote: 05 Nov 2021, 16:30 The best is to have another drive ready do copy all the files you are interested in before doing wrong things again.
I have other empty 4TB.
do you have any options/reccomendations to clone 4TB to 4TB hdd?

When I try to clone usign disk drill it said not enough space. Should I buy 6TB first?
I don't mind to buy 6TB to follow the safest route to recover.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#6 Post by recuperation »

recuperation wrote: 05 Nov 2021, 16:30 Select GPT as partition table type in Testdisk, you selected the wrong one.
You did not do that.
If you ignore my advice (see above) I can't help you.

I'm sure this is not partition I'm looking for, no data inside
I already told you about how to treat additional partitions.
dusk3dawn wrote: 06 Nov 2021, 03:51 I have other empty 4TB.
do you have any options/reccomendations to clone 4TB to 4TB hdd?

When I try to clone usign disk drill it said not enough space. Should I buy 6TB first?
I don't mind to buy 6TB to follow the safest route to recover.
Cloning is always a good idea but I recommended something else, copying the files within your partition labeled "WD 4 TB GPT".

Every hard drive that has been partitioned with the GPT scheme contains a MBR as well to make the drive appear as full for any operating system that does not understand the GPT structure but understands the MBR structure.
If you continue to use Testdisk in the wrong mode it will show that MBR with a size of 2048 GB which is meaningless for a drive with the GPT scheme.

The log file suggests that you formated your drive in an environment that made your operating system recognize a sector size of 4096 bytes instead of the 512 bytes that your hard disk drive supports externally. You did not mention anything relating to it.

If you don't understand my posting or if you are using any translating software you should ask somebody who speaks English.

dusk3dawn
Posts: 9
Joined: 04 Nov 2021, 14:38

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#7 Post by dusk3dawn »

recuperation wrote: 06 Nov 2021, 09:11 Cloning is always a good idea but I recommended something else, copying the files within your partition labeled "WD 4 TB GPT".

Every hard drive that has been partitioned with the GPT scheme contains a MBR as well to make the drive appear as full for any operating system that does not understand the GPT structure but understands the MBR structure.
If you continue to use Testdisk in the wrong mode it will show that MBR with a size of 2048 GB which is meaningless for a drive with the GPT scheme.

The log file suggests that you formated your drive in an environment that made your operating system recognize a sector size of 4096 bytes instead of the 512 bytes that your hard disk drive supports externally. You did not mention anything relating to it.

If you don't understand my posting or if you are using any translating software you should ask somebody who speaks English.
Sorry I misunderstood your instructions, wont happened again.
English is not my native language and yes I'm using google translate too.
Thank you for your patience. Please ignore my post above.
recuperation wrote: 05 Nov 2021, 16:30 Go back to your initial setup using the direct SATA cable connection to your mainboard.
Run Testdisk, create a log file that you post completely here afterwards.
Select GPT as partition table type in Testdisk, you selected the wrong one.

What's the result?
Using direct SATA cable connection to my mainboard.
When I run testdisk > gpt as partition table > quick search.
It found my partition, but stuck in 99%.
It said : Analyse cylinder 486401/486400 99%.
testdisk analyse gpt.JPG
testdisk analyse gpt.JPG (68.46 KiB) Viewed 6925 times
Testdisk didn't respond any input, so I forced close the testdisk app.

Then I run again,
This time, when Analyse cylinder 16/486400 00% and just found my partition,
I immediately stop the analyse.
Here the log:
testdisk.log
(267.59 KiB) Downloaded 313 times
recuperation wrote: 05 Nov 2021, 16:30 With an emulated sector size of 512 bytes that shows up at your hard drive interface without using any interfering intermediate electronics such as your SATA/USB-Adapter, it is impossible to create a partition size of 4TB using the old MBR style partition scheme.

If you find that partition with your data again you don't have to care about the other partitions, just ignore them.

The best is to have another drive ready do copy all the files you are interested in before doing wrong things again.
I have a new 4TB ready for copy the files.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#8 Post by recuperation »

Where did you get your broken 4TB drive from?
Did you partition and format this drive yourself?
There is no reason that the NTFS file system on this drive used a sector size or 4096 byte instead of the natural 512 byte of your drive.

Because of this 4096/512 warning I can't tell you if rewriting a GPT table will be sufficient to get your drive back to work.
For that reason I recommended duplicating the files.

Otherwise if you had a drive with a native sector size of 4096 bytes (inside of the disk and outside at the interface) and you would clone your logically broken drive to this 4096/4096 type drive, the warning would disappear and you could try writing a GPT type partition table containing just the one partition that contains your visible data.

The cheapest one I could find here in Germany is
Toshiba Enterprise Capacity MG04ACA 4TB, 4Kn, SATA 6Gb/s (MG04ACA400A)
but
Western Digital Ultrastar DC HC310 4TB, SE, 4Kn, SAS 12Gb/s (HUS726T4TAL4204)
is sold by more vendors.

dusk3dawn
Posts: 9
Joined: 04 Nov 2021, 14:38

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#9 Post by dusk3dawn »

recuperation wrote: 07 Nov 2021, 22:01 Where did you get your broken 4TB drive from?
Local big computer shop which has good reputation.
I bought the drive around January 2017 and have official warranty.
recuperation wrote: 07 Nov 2021, 22:01 Did you partition and format this drive yourself?
Yes.
recuperation wrote: 07 Nov 2021, 22:01 There is no reason that the NTFS file system on this drive used a sector size or 4096 byte instead of the natural 512 byte of your drive.

Because of this 4096/512 warning I can't tell you if rewriting a GPT table will be sufficient to get your drive back to work.
For that reason I recommended duplicating the files.
I would like to follow your recommendation.
What do you need me to do to duplicating the files?
recuperation wrote: 07 Nov 2021, 22:01 Otherwise if you had a drive with a native sector size of 4096 bytes (inside of the disk and outside at the interface) and you would clone your logically broken drive to this 4096/4096 type drive, the warning would disappear and you could try writing a GPT type partition table containing just the one partition that contains your visible data.

The cheapest one I could find here in Germany is
Toshiba Enterprise Capacity MG04ACA 4TB, 4Kn, SATA 6Gb/s (MG04ACA400A)
but
Western Digital Ultrastar DC HC310 4TB, SE, 4Kn, SAS 12Gb/s (HUS726T4TAL4204)
is sold by more vendors.
I can't find both model in local market. I will search 4TB, 4K native, SATA on my local market.
Will confirm the model with you to confirm before I buy it.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: [Questions & Feedback] Win 7-64 bit, Accidentally Unallocated 4TB HDD, Need to revert back.

#10 Post by recuperation »

dusk3dawn wrote: 08 Nov 2021, 08:28 What do you need me to do to duplicating the files?
Use the copy function within the "list files" function. You already used the "list files" function.

Locked