cgsecurity.org

Hi, thanks in advance, and please pardon the multiple-topic new question. I'm a total data recovery newbie, pretty sure I need filesystem repair, not sure if I also need partition recovery, don't want to waste another week doing the wrong thing.

3TB Toshiba Canvio external USB drive used for file storage only, unplugged too quickly, now doesn't contain a recognizable file system. Recovery programs are able to grab bulk files, but with 2500+ folders of mp3/wav/flac albums, files without names & folders are basically useless.

After reading reading reading, I bought a WD 3TB drive to make a copy (image? clone?) of the Toshiba drive to work on. Unfortunately the WD shows up as .03 GB smaller than the Toshiba drive (see Disk Management screenshot - Disk1=WD, Disk2=Toshiba) so image programs won't copy it onto the WD. AOMEI Partition Assistant was willing to make an image of the one 349.31 GB RAW partition, so I figured I'd start with that.

TestDisk screenshot and logfile below are what resulted after the 7-day Quick Search ("partitions can't be recovered"). Was my first mistake working off a copy of the one partition rather than the whole disk (and why it said "hard disk seems too small")? Does my situation seem worth getting a larger drive to image / clone the whole Toshiba disk and running TestDisk on that?

Pgm is still at [Continue] screen, I will wait for guidance before continuing... thanks.

OS: Windows 7 (7601) SP1
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479026241536
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=375073800192
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM0 12 HN-M500MB, S/N:2SDTAJC0018228, FW:2AR1
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364797 255 63, sector size=512 - WD Elements 25A1, S/N:WX51DC81V5KK, FW:1018

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - WD Elements 25A1
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364797 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860466687 (expected 5860466687)
hdr_lba_start=34
hdr_lba_end=5860466654
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 63 732566078 732566016 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 63 732566078 732566016 [Basic data partition]
1 P MS Data 63 732566078 732566016 [Basic data partition]

tbubah wrote: 21 Apr 2022, 03:10 Hi, thanks in advance, and please pardon the multiple-topic new question. I'm a total data recovery newbie, pretty sure I need filesystem repair, not sure if I also need partition recovery, don't want to waste another week doing the wrong thing.

3TB Toshiba Canvio external USB drive used for file storage only, unplugged too quickly, now doesn't contain a recognizable file system. Recovery programs are able to grab bulk files, but with 2500+ folders of mp3/wav/flac albums, files without names & folders are basically useless.

After reading reading reading, I bought a WD 3TB drive to make a copy (image? clone?) of the Toshiba drive to work on. Unfortunately the WD shows up as .03 GB smaller than the Toshiba drive (see Disk Management screenshot - Disk1=WD, Disk2=Toshiba) so image programs won't copy it onto the WD. AOMEI Partition Assistant was willing to make an image of the one 349.31 GB RAW partition, so I figured I'd start with that.

You did not specify if you repartitioned your Toshiba disk before the incident happen. How many partitions do you expect to find?
If there is just one, trying to recover something out of 350 GB when the whole partition is 3 TB is a bad idea. Having two unallocated spaces as can be seen on the picture tells me that you did not just copied one partition.
Use ddrescue (Linux software) as described in the manual to duplicate the FULL drive onto another drive that is at least as big as your Toshiba disk.
I would zero out a 4 TB disk to make sure that the last 1 TB does not contain any information that could confuse Testdisk.

TestDisk screenshot and logfile below are what resulted after the 7-day Quick Search ("partitions can't be recovered").

A 3 TB should be read in under one day using quick search. At a native sustained speed of 150 MByte/sec a 3 TB disk requires roughly 6 hours.

Was my first mistake working off a copy of the one partition rather than the whole disk (and why it said "hard disk seems too small")? Does my situation seem worth getting a larger drive to image / clone the whole Toshiba disk and running TestDisk on that?

See above. Please upload your pictures to this site using the attachments tab on the bottom of the page.

Thank you for your fast reply and directions!

recuperation wrote: 21 Apr 2022, 07:45 You did not specify if you repartitioned your Toshiba disk before the incident happen. How many partitions do you expect to find?
If there is just one, trying to recover something out of 350 GB when the whole partition is 3 TB is a bad idea.

I had not partitioned the Toshiba disk so as far as I know it was one partition. I was working on the 350 GB partition because that was all I was able to copy with the drives I had onhand.

recuperation wrote: 21 Apr 2022, 07:45 Having two unallocated spaces as can be seen on the picture tells me that you did not just copied one partition.

In the Disk Management screenshot, Disk 2 is the original Toshiba drive; I am not aware of ever creating those two other partitions marked Unallocated... but again I was not able to copy the full drive with those partitions with the drives I had onhand.

recuperation wrote: 21 Apr 2022, 07:45 A 3 TB should be read in under one day using quick search. At a native sustained speed of 150 MByte/sec a 3 TB disk requires roughly 6 hours.

The WD drive on which I ran TestDisk is an external drive connected via USB 2.0; perhaps the form factor, or that it was trying to read a 350 GB partition as what was supposed to be 3TB drive, caused the slowness? Inanycase I was able to obtain a 4TB internal drive and docking station, I will follow your steps to duplicate the FULL drive onto the 4TB drive, and run TestDisk again.

recuperation wrote: 21 Apr 2022, 07:45 See above. Please upload your pictures to this site using the attachments tab on the bottom of the page.

Sorry, I am just NOW seeing the Attachments tab.

I will post again with results after taking further actions. Thanks again!

tbubah wrote: 21 Apr 2022, 15:12

recuperation wrote: 21 Apr 2022, 07:45 A 3 TB should be read in under one day using quick search. At a native sustained speed of 150 MByte/sec a 3 TB disk requires roughly 6 hours.

The WD drive on which I ran TestDisk is an external drive connected via USB 2.0; perhaps the form factor, or that it was trying to read a 350 GB partition as what was supposed to be 3TB drive, caused the slowness?

Assume 35 MByte/sec and do the math yourself. Leaving out important information will obviously lead to bad and unsuitable recommendations on my side.

recuperation wrote: 21 Apr 2022, 07:45 Use ddrescue (Linux software) as described in the manual to duplicate the FULL drive onto another drive that is at least as big as your Toshiba disk.

Does it have to be ddrescue? The only 'Linux' machine I have at the ready is a Raspberry Pi 3 and I'm not very fluent with it. I can't use a Windows disk copy program?

You can use a live linux system booting from a USB stick such as Knoppix, System Rescue CD and others.
But my hint was based on your misleading speed information.
I told you to do the math to calculate the time needed to run across your disk but you simply ignored my last posting.

Anyway. Post your logfile please before trying to duplicate your drive:
viewtopic.php?f=5&t=10910

recuperation wrote: 21 Apr 2022, 21:16 But my hint was based on your misleading speed information.
I told you to do the math to calculate the time needed to run across your disk but you simply ignored my last posting.

Hi, didn't mean to ignore your post, and not sure what you meant by misleading speed information, my TestDisk DID take 7 days to get to 100%. Doing the math though: 3TB = 3 mil MB @ 35 MB/sec = 86,714 sec = 1,429 min = 24 hrs. I'll look forward to that when I'm running TestDisk on a successful full disk copy.

recuperation wrote: 21 Apr 2022, 21:16 Anyway. Post your logfile please before trying to duplicate your drive:
viewtopic.php?f=5&t=10910

Hoping I followed that instruction correctly -- I installed smartmontools, ran smartctl on the Toshiba, got reports saying SMART support was disabled, read up on options, eventually got this using options -s on -T verypermissive; not sure if this tells you enough about the drive, or what my next step is. Thanks again.

=== START OF INFORMATION SECTION ===
Model Family: Toshiba 3.5" DT01ABA... Desktop HDD
Device Model: TOSHIBA DT01ABA300
Serial Number:
Firmware Version: MZ6O
Device is: In smartctl database 7.3/5319
ATA Version is: [No Information Found]
Local Time is: Thu Apr 21 21:02:56 2022 EDT
SMART support is: Available - device has SMART capability.
Enabled status cached by OS, trying SMART RETURN STATUS cmd.
SMART support is: Disabled

=== START OF ENABLE/DISABLE COMMANDS SECTION ===
SMART Enabled.
Read SMART Data failed: Function not implemented

=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Function not implemented
SMART overall-health self-assessment test result: UNKNOWN!
SMART Status, Attributes and Thresholds cannot be read.

Read SMART Error Log failed: Function not implemented

Read SMART Self-test Log failed: Function not implemented

Selective Self-tests/Logging not supported

tbubah wrote: 22 Apr 2022, 02:21

recuperation wrote: 21 Apr 2022, 21:16 But my hint was based on your misleading speed information.
I told you to do the math to calculate the time needed to run across your disk but you simply ignored my last posting.

Hi, didn't mean to ignore your post, and not sure what you meant by misleading speed information, my TestDisk DID take 7 days to get to 100%. Doing the math though: 3TB = 3 mil MB @ 35 MB/sec = 86,714 sec = 1,429 min = 24 hrs. I'll look forward to that when I'm running TestDisk on a successful full disk copy.

By using a slow USB 2.0 you are limiting the achievable speed of your drive in question. The drive cannot run at native speed. Without telling me that you did that I come to the conclusion that your drive has lots of unreadable sectors. This is what I consider "misleading".

Are you running smartmontools with admin rights?
How is your drive connected?
What is the hardware used to connect your drive to your computer?

Hi,

The drive is a Toshiba Canvio external USB drive, connected to Dell Win7 laptop blue "SS" USB port which is supposedly 3.0 capable, but the drive is quite old so probably only 2.0.

I was running smartmontools with the 'smartctl (Admin CMD)' shortcut it created. Just to be sure, I ran CMD as Admin and navigated to smartctl; it created the same report (attached).

Meanwhile, I obtained some Seagate 4TB SATA drives and borrowed a Wavlink USB 3.0 docker from work. As I am new to creating live distro USB's and Linux, and have limited time with the docker, I just used AOMEI Partition Assistant to sector-by-sector clone the Toshiba onto a Seagate (took a little over 24 hrs).

Now running TestDisk on the Seagate, the Quick Search started at 10AM EST, it instantly went up to 366xxx/486400: 75%, and is still at 75% now. I will report back again tonight or tomorrow with an updated status.

If AOMEI clones are not adequate for TestDisk to function fully, I can work on Linux USB boot / ddrescue methods over this week and borrow the docker again next weekend.

Thanks again.

Hi, TestDisk just completed quick search. Tried to attach log file but not showing up in attachments, so here it is:

Sun Apr 24 09:57:26 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479026241536
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=375073800192
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM0 12 HN-M500MB, S/N:2SDTAJC0018228, FW:2AR1
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - USB 3.0 , S/N:201803010040, FW:0101

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - USB 3.0
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=7814037167
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=7814037135
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 6291720191 6291456000 [Basic data partition]
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 6291720191 6291456000 [Basic data partition]
2 P MS Data 264192 6291720191 6291456000 [Basic data partition]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 6291720191 6291456000 [Basic data partition]
2 P MS Data 264192 6291720191 6291456000 [Basic data partition]

search_part()
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732566016
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=3000590401536, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732566016
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
MS Data 2048 5860530175 5860528128 [TOSHIBA EXT]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 5930902778 9425635412 3494732635
FATX, 1789 GB / 1666 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

HFS magic value at 371880/13/60
part_size 106494
Mac HFS 5974253078 5974359571 106494 [!µüÐ6
ˆ!1c«•ðã&¼k¦³U‘§]
HFS blocksize=512, 54 MB / 51 MiB

LVM magic value at 375039/167/7

HFS magic value at 381227/189/22
part_size 8508422
Mac HFS 6124423683 6132932104 8508422 [EÔ]
HFS blocksize=262144, 4356 MB / 4154 MiB

LVM magic value at 383764/90/17
NTFS at 391641/119/30
filesystem size 6291456000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 6291720191 6291456000
NTFS found using backup sector, blocksize=4096, 3221 GB / 3000 GiB
NTFS at 391641/119/30
filesystem size 6291456000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 6291720191 12583176190 6291456000
NTFS, blocksize=4096, 3221 GB / 3000 GiB
This partition ends after the disk limits. (start=6291720191, size=6291456000, end=12583176190, disk end=7814037168)

SYSV4 Marker at 397869/105/36

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 6391772135 2296280003558 2289888231424 [sÞþ6’v]
SysV4, 1172 TB / 1066 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 6880053323 7923727232 1043673910
FATX, 534 GB / 497 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 6908132442 9531679337 2623546896
FATX, 1343 GB / 1251 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 435088/1/44

HFS magic value at 440127/146/36
part_size 9546
Mac HFS 7070649488 7070659033 9546
HFS blocksize=4096, 4887 KB / 4773 KiB

LVM magic value at 441002/53/53
file_win32_pread(488,11,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(488,8,buffer,3519069869(486401/80/61)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069860(486401/80/52)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069861(486401/80/53)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069862(486401/80/54)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069863(486401/80/55)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069864(486401/80/56)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069868(486401/80/60)) read err: read after end of file
file_win32_pread(488,14,buffer,3519069870(486401/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (4000 GB / 3726 GiB) seems too small! (< 6442 GB / 6000 GiB)
The following partition can't be recovered:
MS Data 6291720191 12583176190 6291456000
NTFS, blocksize=4096, 3221 GB / 3000 GiB

Results
MS Data 2048 5860530175 5860528128 [TOSHIBA EXT]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
MS Data 264192 6291720191 6291456000
NTFS found using backup sector, blocksize=4096, 3221 GB / 3000 GiB
Mac HFS 5974253078 5974359571 106494 [!µüÐ6
ˆ!1c«•ðã&¼k¦³U‘§]
HFS blocksize=512, 54 MB / 51 MiB
Mac HFS 6124423683 6132932104 8508422 [EÔ]
HFS blocksize=262144, 4356 MB / 4154 MiB
P Mac HFS 7070649488 7070659033 9546
HFS blocksize=4096, 4887 KB / 4773 KiB