cgsecurity.org

My external HDD recently stopped being accessible via windows, and checkdisk indicated that it had "RAW" formatting. I am hoping to pull some files off of it before it completely dies. The drive is a Seagate Backup Plus 4TB model from about 10 years ago.

I ran testdisk and came across 2 issues. The first is that the 4TB drive only registers as 500GB. The second is that the default partition table for this drive, which almost certainly would have been an Intel type, is "None".

Can anything be done to pull my data off this drive now that the partition table is gone and some of the space is not registering? I'm not a very advanced user so I don't want to tinker with various settings without knowing what I am doing, in case it damages the files further.

Any help is appreciated.

Post your Testdisk log file, please.

Even when I zip it the file is too large, so here is the first part:

Fri May 6 19:29:44 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787029504
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=254822582272
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000575389696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500096303104
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 860 EVO 1TB, S/N:S599NE0MB22115V, FW:RVT03B6Q
Disk \\.\PhysicalDrive1 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SAMSUNG SSD PM830 2.5" 7mm 256GB, S/N:S0TZNSAD203050, FW:CXM03D1Q
Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate One Touch HDD, S/N:00000000NABNETTH, FW:1707
Drive G: - 500 GB / 465 GiB - CHS 976750592 1 1, sector size=512 - ATA ST4000DM000-1F21, S/N:Z3009TJJ, FW:CC51

Partition table type defaults to None
Drive G: - 500 GB / 465 GiB - ATA ST4000DM000-1F21
Partition table type: None

Interface Advanced
file_win32_pread(536,7,buffer,976750465(976750465/0/1)) read err: read after end of file
P Unknown 0 976750591 976750592
Change partition type:
P Unknown 0 976750591 976750592
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
P Unknown 0 976750591 976750592

Analyse Drive G: - 500 GB / 465 GiB - CHS 976750592 1 1
Current partition structure:
P Unknown 0 976750591 976750592

After this portion, there are a lot of repeating lines that look like this, just with different values:
search_part()
Drive G: - 500 GB / 465 GiB - CHS 976750592 1 1
file_win32_pread(536,8,buffer,79(79/0/1)) read err: read after end of file
file_win32_pread(536,1,buffer,19(19/0/1)) read err: read after end of file
file_win32_pread(536,1,buffer,66(66/0/1)) read err: read after end of file
file_win32_pread(536,1,buffer,87(87/0/1)) read err: read after end of file

I disconnected the HDD and reconnected it and now it is registering all 4TB, I will follow the tutorial on your wiki and see what progress I can make.

EDIT - it also defaulted to the Intel type of partition. Could 3.5/4 TB not appearing and then appearing be indicative of hardware degradation?

EDIT 2 - the quick search found no partitions in the default intel format and the log is 2.4 million KB and cannot be opened, it seemed that every single line indicated that there was an error reading the data.

Please post your smartmontools log file:

viewtopic.php?f=5&t=10910

Afterwards you might have to take a decision to either duplicate the drive as described in the manual or to consult with a professional recovery service.

Here is the log. I made sure to use disk management to get the right drive letter/number and confirmed the serial number on the drive.

Having at least 528 unreadable sectors you should duplicate the drive using ddrescue as described in the manual. Afterwards use Testdisk to try to look into your raw partition. If that fails, use Photorec or some other software on the duplicate.

If I am going to use ddrescue on a 4TB drive, will I need a full 4TB on another drive to copy the data? Can I split the process up into chunks?

BrendonM wrote: 10 May 2022, 17:57 If I am going to use ddrescue on a 4TB drive, will I need a full 4TB on another drive to copy the data? Can I split the process up into chunks?

Yes. If you duplicate your disk into a file you will need a little bit more for the file system overhead.
You can start and stop the duplicating process at will if you use a logfile.

What type of chunks are you referring to?

By chunks, I just meant possibly splitting the contents of it into portions since my largest storage device is another 4TB drive; I don't have anything large enough to hold a 4TB copy of my dying HDD.