cgsecurity.org

Hello. I had a 1TB Hard Drive formated as NTFS with no OS Installed, it was used only for storing files. From night to day suddenly I couldnt access it on File Explorer, chdsk doesn't work, it says that the MFT is corrupt, CrystalDiskInfo and Seagate softwares said there is no error, the disk also sounds completely fine, Windows Disk Management says the disk is raw, but it still has all it's 5 partitions listed there. First thing I do is unplug the HD until I buy a new WD 2TB , then I used TestDisk to copy the old HD to the new one.

I ran PhotoRec on the new HD to recover files, but most of the small files (<10 MB) were corrupted, although many big files (>1 Gb) were OK. So now I'm gonna try to fix the MFT using testdisk to see if there is a chance to get back all the files and folders, first trying to fix the RAW partitions, then fixing MFT. The 2TB disk now has the 5 old partitions summing to almost 1 Tb (Letter B and old label DDD) and another measuring 1 Tb (Letter H) which I used to recover the files



After running the Quick and Deeper Search on TestDisk 7.2 64Bits on the whole disk, it said it was not able to recover a partition and returned to me a total of 8 partitions, 2 of the are OK, the rest have Bad Structure.





One of them is the 1TB partition H, which is the only one I can access using p key, the other other give me the error "Can't open filesystem. filesystem seems damaged", so that I have absolutely no idea of how to choose the partitions which I need, or if I need to skip this and go directly to repairing MFT. Here is the log file from TestDisk https://pastebin.com/YLYEBySA .

Someone please know how to proceed?

ashiq2 wrote: 13 Nov 2021, 02:23 Hello. I had a 1TB Hard Drive formated as NTFS with no OS Installed,

Please publish the correct log file for a 1 TB drive.
Please describe the partition structure of your 1 TB drive before the incident.
Please generate a log file from smartmontools as described here:
viewtopic.php?f=5&t=10910

Avoid buying drives using SMR (shingled magnetic recording).

Thank you for your answer. Like I said, I used testdrive to clone the old 1TB Drive to a new 2TB, I have stopped using the old one and I'm playing only with the new one, Testdrive doesn't recgonize the logical clone drive, the only option I have is to search the full physical 2TB Drive.

There was 5 partitions, 422Gb, 434gb, 50gb, 12,6gb and 11,72gb.

Smartmontools gave me an error

C:\Windows\system32>"C:\Program Files\smartmontools\bin\smartctl.exe" -x B:\
smartctl 7.2 2020-12-30 r5155 [x86_64-w64-mingw32-w10-b19043] (sf-7.2-1)
Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org

Standard Inquiry (36 bytes) failed [Function not implemented]
Retrying with a 64 byte Standard Inquiry
Standard Inquiry (64 bytes) failed [Function not implemented]
A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.



I'm gonna try plug the faulty drive again and make a .dd image, instead of copying the disk

Just to update. I've actually forgot and said it wrong, I didn't at first used testdisk to copy it, I used HDD Guru's HDD Raw Copy Tool, which doesn't create a .img or .dd file, it just copy the whole hdd, I would not recommend anyone using it, better copy with testdisk, ddrescue or HDDSuperClone depending on the damage. However even with a image generated by testdisk I couldnt repair the MFT, but I was able to recover literally 100% of the files by using DMDE. Then I formatted and old drive and performed many tests using Seagate tool and smartctl and it works perfectly fine. I have no idea what caused the filesystem to go corrupt all of sudden, but I'm glad that was all of it.

Thanks for you help recuperation .