Recovering partition on External Drive

Message

samly · #1 Post by **samly** » 15 Apr 2022, 15:44

Hi, I have an external drive here that went RAW. I'm able to use TestDisk to explore the files, but there's a bunch of junk folders/files with random chinese characters. I'm guessing that's corruption of some sorts.

Analyze/Deep Search does not find partitions. any tips? I'd rather not manually move hundreds of GB of data manually but that does work.

Attaching the smartmontools output...

Code: Select all

smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w10-21H2] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Toshiba 2.5" HDD MQ01ABF...
Device Model:     TOSHIBA MQ01ABF050
Serial Number:    43PIC951T
LU WWN Device Id: 5 000039 4b3b87eec
Firmware Version: AM001U
User Capacity:    500,107,862,016 bytes [500 GB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Form Factor:      2.5 inches
Device is:        In smartctl database 7.3/5319
ATA Version is:   ATA8-ACS (minor revision not indicated)
SATA Version is:  SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Fri Apr 15 10:26:59 2022 EDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Incomplete response, ATA output registers missing
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.

General SMART Values:
Offline data collection status:  (0x00)	Offline data collection activity
					was never started.
					Auto Offline Data Collection: Disabled.
Self-test execution status:      (  41)	The self-test routine was interrupted
					by the host with a hard or soft reset.
Total time to complete Offline 
data collection: 		(  120) seconds.
Offline data collection
capabilities: 			 (0x5b) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					Offline surface scan supported.
					Self-test supported.
					No Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (   2) minutes.
Extended self-test routine
recommended polling time: 	 ( 122) minutes.
SCT capabilities: 	       (0x003d)	SCT Status supported.
					SCT Error Recovery Control supported.
					SCT Feature Control supported.
					SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000b   100   100   050    Pre-fail  Always       -       0
  2 Throughput_Performance  0x0005   100   100   050    Pre-fail  Offline      -       0
  3 Spin_Up_Time            0x0027   100   100   001    Pre-fail  Always       -       1923
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       6386
  5 Reallocated_Sector_Ct   0x0033   100   100   050    Pre-fail  Always       -       8
  7 Seek_Error_Rate         0x000b   100   100   050    Pre-fail  Always       -       0
  8 Seek_Time_Performance   0x0005   100   100   050    Pre-fail  Offline      -       0
  9 Power_On_Hours          0x0032   089   089   000    Old_age   Always       -       4750
 10 Spin_Retry_Count        0x0033   227   100   030    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       631
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       35
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       97
193 Load_Cycle_Count        0x0032   097   097   000    Old_age   Always       -       30069
194 Temperature_Celsius     0x0022   100   100   000    Old_age   Always       -       34 (Min/Max 12/45)
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       1
197 Current_Pending_Sector  0x0032   100   100   000    Old_age   Always       -       152
198 Offline_Uncorrectable   0x0030   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       0
220 Disk_Shift              0x0002   100   100   000    Old_age   Always       -       0
222 Loaded_Hours            0x0032   100   100   000    Old_age   Always       -       281
223 Load_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
224 Load_Friction           0x0022   100   100   000    Old_age   Always       -       0
226 Load-in_Time            0x0026   100   100   000    Old_age   Always       -       264
240 Head_Flying_Hours       0x0001   100   100   001    Pre-fail  Offline      -       0

SMART Error Log Version: 1
ATA Error Count: 65535 (device log contains only the most recent five errors)
	CR = Command Register [HEX]
	FR = Features Register [HEX]
	SC = Sector Count Register [HEX]
	SN = Sector Number Register [HEX]
	CL = Cylinder Low Register [HEX]
	CH = Cylinder High Register [HEX]
	DH = Device/Head Register [HEX]
	DC = Device Command Register [HEX]
	ER = Error register [HEX]
	ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 65535 occurred at disk power-on lifetime: 4750 hours (197 days + 22 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 07 01 08 00 e0  Error: UNC 7 sectors at LBA = 0x00000801 = 2049

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 08 00 08 00 e0 00      17:39:35.296  READ DMA EXT
  b0 d0 00 00 4f c2 00 00      17:39:35.185  SMART READ DATA
  ef 02 00 00 00 00 00 00      17:39:35.184  SET FEATURES [Enable write cache]
  ef 03 45 00 00 00 00 00      17:39:35.184  SET FEATURES [Set transfer mode]
  ec 00 00 00 00 00 a0 00      17:39:35.183  IDENTIFY DEVICE

Error 65534 occurred at disk power-on lifetime: 4750 hours (197 days + 22 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 07 01 08 00 40  Error: UNC 7 sectors at LBA = 0x00000801 = 2049

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 08 00 08 00 40 00      17:39:35.074  READ DMA EXT
  25 00 04 40 08 00 40 00      17:39:34.924  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.924  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.923  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.908  READ DMA EXT

Error 65533 occurred at disk power-on lifetime: 4750 hours (197 days + 22 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 07 01 08 00 e0  Error: UNC 7 sectors at LBA = 0x00000801 = 2049

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 08 00 08 00 e0 00      17:39:34.819  READ DMA EXT
  b0 d0 00 00 4f c2 00 00      17:39:34.707  SMART READ DATA
  ef 02 00 00 00 00 00 00      17:39:34.707  SET FEATURES [Enable write cache]
  ef 03 45 00 00 00 00 00      17:39:34.706  SET FEATURES [Set transfer mode]
  ec 00 00 00 00 00 a0 00      17:39:34.705  IDENTIFY DEVICE

Error 65532 occurred at disk power-on lifetime: 4750 hours (197 days + 22 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 07 01 08 00 40  Error: UNC 7 sectors at LBA = 0x00000801 = 2049

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 08 00 08 00 40 00      17:39:34.621  READ DMA EXT
  25 00 04 40 08 00 40 00      17:39:34.435  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.435  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.434  READ DMA EXT
  25 00 01 00 08 00 40 00      17:39:34.419  READ DMA EXT

Error 65531 occurred at disk power-on lifetime: 4750 hours (197 days + 22 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 07 01 08 00 e0  Error: UNC 7 sectors at LBA = 0x00000801 = 2049

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 08 00 08 00 e0 00      17:39:34.330  READ DMA EXT
  b0 d0 00 00 4f c2 00 00      17:39:34.218  SMART READ DATA
  ef 02 00 00 00 00 00 00      17:39:34.218  SET FEATURES [Enable write cache]
  ef 03 45 00 00 00 00 00      17:39:34.217  SET FEATURES [Set transfer mode]
  ec 00 00 00 00 00 a0 00      17:39:34.216  IDENTIFY DEVICE

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Interrupted (host reset)      90%      4719         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

#2 Post by **recuperation** » 15 Apr 2022, 15:57

Your drive is about to die, you already have 152 pending sectors. Duplicate your drive using ddrescue as described in the manual.
Run Photorec or any other third party software on the duplicate.

samly · #3 Post by **samly** » 15 Apr 2022, 21:35

I was able to ddrescue the drive into a file. Do you think there's a way to recover and keep (most of) the file structure intact with TestDisk? I know PhotoRec just gives you everything in an unstructured format.

#4 Post by **recuperation** » 16 Apr 2022, 07:42

I missed to mention that your first attempt to rescue should be using Testdisk.

Read here:

samly wrote: 15 Apr 2022, 15:44 Hi, I have an external drive here that went RAW. I'm able to use TestDisk to explore the files, but there's a bunch of junk folders/files with random chinese characters. I'm guessing that's corruption of some sorts.

This won't change. The physically healthy copy only prevents you from further degrading your broken drive.

samly · #5 Post by **samly** » 18 Apr 2022, 15:37

Whenever I try use TestDisk to recover specific directories from the ddrescue'd image, some copy fine, some fail (as expected) but it literally just gets stuck and I'm just not sure how to proceed with it. No progress once it it hits some bad corruption, I guess. Is there a flag or something to skip files after x retries or specific timeout or something?

#6 Post by **recuperation** » 18 Apr 2022, 23:40

What's or operating system? Which version of Testdisk do you run? Which settings do you use? Try to document what you do.

samly · #7 Post by **samly** » 19 Apr 2022, 16:51

recuperation wrote: 18 Apr 2022, 23:40 What's or operating system? Which version of Testdisk do you run? Which settings do you use? Try to document what you do.

Windows 10, 21H2
TestDisk 7.2-WIP

running: testdisk_win.exe e:\image.dd

selected the disk e:\image.dd when prompted
Partition table type -> None
Selected the partition ( P exFAT 0 0 60800 237 45 976766976)
chose List
press h to hide deleted files, selected a folder (sometimes I've selected all), pressed C, navigated location to copy to, pressed C again to confirm location

I let it run overnight last night, and it just kept "recovering" folders/files with Chinese characters taking up like 2 TB of storage on just waste. the original disk was only 500GB, most of it wasn't even used.

#8 Post by **recuperation** » 19 Apr 2022, 19:19

If Testdisk fails here use Photorec or third party software.
What about duplicating the whole disk onto a disk instead of just copying one partition into a file and running Testdisk against?
I am mentioning this possibility because for some reasons duplicating single partitions into files did not yield good results as measured by people questioning in this forum - maybe I missed a necessary setting.

cgsecurity.org

Recovering partition on External Drive

Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive

Re: Recovering partition on External Drive