cgsecurity.org

Hi Everyone,

Long Story Short, 10TB (10240GB) drive is inaccessible with no backup.

I'm not sure how long the drive has been inaccessible but I was told it was last accessed in the fall of 2021. At first it was appearing in Windows as RAW but somewhere along the lines with VMWare support and Microsoft support it's now showing up as two Unallocated sections of 2048GB and 8192GB.

After finding testdisk and trying a quick scan and deep scan I didn't see the missing partition.

I would really like to try and recovery the data from this drive so is there any recommended steps to just creating a new Basic NTFS disk with a partition that uses the entire drive space?

The recommended procedure is to duplicate the drive using ddrescue as described in the manual.
But the first thing is to analyse the disk using smartmontools as decribed here:
viewtopic.php?f=5&t=10910

Macattack99 wrote: 29 Apr 2022, 16:28 I would really like to try and recovery the data from this drive so is there any recommended steps to just creating a new Basic NTFS disk with a partition that uses the entire drive space?

This is like poking in the fog.
If you want to restore partition data that way you need to replicate the creation of your faulty drive using another drive, the same model from the same maker. Otherwise your attempts will most likely fail.

Try out Photorec or a commercial solution that will analyse the remains of your data.

By the way, your case description is the smallest one I haver ever seen. The facts are

-10 TB drive
-something is raw

To give you and other readers an idea what might be necessary to know here is a copy of a list of questions. Not all questions apply in each case.

1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

Sorry about my first post, I didn't fully read the red forum rules.

1.Which operating systems can be booted from your computer where the incident happened?
The only operating system is Windows Server 2012 R2 from the C drive, this is a Virtual Machine.

2. Which version of Testdisk do you use?
I'm trying 7.2-WIP

3.Do you prevent/reduce write access to the failed drive/file system?
I don't think so but only server admins would have access to the drive through the server at this time.

5. Is the broken drive a drive where an operating system resides on or is it a data drive?
Data Drive

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
HDD

7. What is the size of your disk?
10TB

8. Who is the maker of your failed drive?
It's a virtual drive provisioned through VMWare

9. What is the model?
Part of a Storage array, there is no errors on the array.

11. If possible, provide a logfile from smartmontools!
=== START OF INFORMATION SECTION ===
Vendor: VMware
Product: Virtual disk
Revision: 2.0
Compliance: SPC-4
User Capacity: 10,995,116,277,760 bytes [10.9 TB]
Logical block size: 512 bytes
LU is thin provisioned, LBPRZ=1
Device type: disk
Local Time is: Wed May 04 19:02:36 2022 EDT
SMART support is: Unavailable - device lacks SMART capability.

=== START OF READ SMART DATA SECTION ===
Current Drive Temperature: 0 C
Drive Trip Temperature: 0 C

Error Counter logging not supported

Device does not support Self Test logging

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
Unsure as I didn't setup this system initially.

13. How many partitions have been on the broken drive, what was their size, what was their file system?
This was just viewed as one large drive in the OS I assume NTFS

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
Yes as Disk 1
10240.00GB

15. Is the partition scheme containing your partitions still visible?
Unknown
In DM the Disk was appearing as RAW now due to a change that's been made it's showing as two Unallocated partitions (2048.00 GB and 8192.00GB)

14. Describe the supposed event when your system went from "OK" to "broken"!
Unknown, it was just reported inaccessible and last reported working a few months before (due to COVID they haven't been using it much)

15. Is your disk showing signs of failures such as
No

16. Do you use encryption, if yes, which one?
No

Please post a Testdisk log file!
If I remember correctly there may be an issue with running in an virtualized environment. Try to run Testdisk from a live linux having access to the broken physical disk.