cgsecurity.org

Posted: **22 May 2022, 22:40**

1)I need some help, but I am wondering if the app isn't designed for 18TB drives? see below.

2) I have two 18YB drives I put in a vertical dock to USB 3.0, was copying media files from 2 8TB drives over to one 18TB. Everything was golden until I had a stick of memory go bad. The system was unstable and difficult to troubleshoot. I was getting driver power state failure BSOD on windows 11 (build 22621) The error took me down many other paths over a week of debugging, until I removed a memory stick and still had an issue, put 2nd one in by itself and my system was solid again. Go figure. Well, at one point I did a directory for the 1st 18TB drive, and it gave me the contents of the 2nd 18TTB drive! I figure it got corrupted during the many reboots/hangs/BSOD that was happening previously. I have tried 3 other well-respected recovery tools, one was able to recover 4 TB of the 11TB of files, half missing filenames, and NO directory structure. I lost an untold amount of home videos, photos of my kids growing up, etc. I HAD some backups, but as this was a clean-up effort, to begin with, I made the mistake of clearing out some backups for the room, etc.

here is the screen I am referring to in #1
It counted up to 1186951168 out of 1186951168, then kept going..

Trying to recover all files from 18TB drive.

The software counted up to 1186951168, but then went into a overflow(?) display?
TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sde - 16 TB / 14 TiB - CHS 1945332 255 63
Partition Start End Size in sectors
2 P MS Data 32768 31251755007 31251722240 [Basic data partition]

2056192000rc4581888923205632/1186951168
increments like this:
2068578304rc4581888923205632/1186951168
2070740992rc4581888923205632/1186951168
2071789568rc4581888923205632/1186951168
etc
Stop

1) Is this normal? when will it be done?

Posted: **22 May 2022, 22:59**

Use the most recent version 7.2-WIP of Testdisk.
You can upload screenshots using the attachments tab on the bottom of the page.

Posted: **22 May 2022, 23:08**

I downloaded it two(3?) days ago, so a new release that fast.

I will download 7.2 is it known to fix this issue, or just suggesting using current version?

P.S. I added the reason for putting the question under filesystem repair in the original post.

Posted: **22 May 2022, 23:26**

Trying the GPS recovery (windows 11)
from page 23 section 7.4 recovery

Boot sector Status: OK Backup boot sector Status: OK Sectors are identical.
A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable.

-> repair MFT
output:

MFT and MFT mirror are bad. Failed to repair them.

from 7.6 repair boot partition:
ok -> rebuild BS

Now I am back to where the app was running for over 12 hrs but based on older version, I stopped it. Here is where it stands now:

Search mft 589824/31251722240

any other advice?

Posted: **23 May 2022, 23:12**

It is still testing.. 24 hours later..

Posted: **24 May 2022, 19:20**

Windows 11 system, build 22621. The system was sold for the last 3 years. I purchased two 18TB drives to replace two 8Tb drives. New drives are attached via a vertical USB dock, which virtualized the first 8 bits of the HD identifier, which I think goes into what happened. The first symptom was "driver power state failure BSOD". During troubleshooting, USB ports stop recognizing what is plugged in. Tried every known fix found on the internet (updating mobo drivers, turning off put to sleep on USB hubs, etc.)

Right before the 18Tb drive went haywire, my second 18TB drive went offline yet doing a directory was showing the empty contents but under the drive letter of the (now corrupt) drive. I suspect the MFT tables for each drive got cross-linked? I diagnosed all these problems when swapping memory sticks, one kept causing mob to report q 27, which is a memory error. The memory sticks are being RMAed.

with good memory running, now I am trying to recover the 18Tb drive. A chkdsk on the drive

"Insufficient storage available to create either the shadow copy storage file or other shadow copy data.Unable to determine volume version and state. CHKDSK aborted."
Drive shows 0 bytes available, but it was 18TB with approx 9TB used.
trying to open in windows:

w:\ is not accessible.
The disk structure is corrupted and unreadable"

I have tried 3 other well-respected recovery tools, one was able to recover 4 TB of the 11TB of files, half missing filenames, and NO directory structure.

Testdisk 7.2 checking shows:

Boot sector Status: OK Backup boot sector Status: OK Sectors are identical.
A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable.

-> repair MFT
output:

MFT and MFT mirror are bad. Failed to repair them.

from 7.6 repair boot partition:
ok -> rebuild BS

This seems to be uncharted territory, but surely there is a way to recover. It seems all I need is to perhaps set up volume shadow copy to use another drive to store a snapshot of the drive and chkdsk can repair the drive to at least a working state. Or should I try anything else first?

I am trying to use rebuildBS recovery, but the scanning is taking days to complete
thanks for ANY guidance, questions, or suggestions.
cheers!

Posted: **24 May 2022, 22:06**

There is no need to repost your contribution accross the forum!

cocokola wrote: 24 May 2022, 19:20 Windows 11 system, build 22621. The system was sold for the last 3 years.

"The system was sold for the last 3 years.". Incomprehensible.

I purchased two 18TB drives to replace two 8Tb drives. New drives are attached via a vertical USB dock, which virtualized the first 8 bits of the HD identifier,

"vertical USB dock, which virtualized the first 8 bits of the HD identifier,"
Sorry I don't understand what that should mean. Well being aware that I might be missing some essential knowledge, I am slowling getting the feeling that your case can only be a top-notch (big $$$) lab.

which I think goes into what happened. The first symptom was "driver power state failure BSOD". During troubleshooting, USB ports stop recognizing what is plugged in. Tried every known fix found on the internet (updating mobo

"mobo". Gamer speak is discouraging me. Why spending time on someone who does not even has the time to write full words?

drivers, turning off put to sleep on USB hubs, etc.)

Right before the 18Tb drive went haywire, my second 18TB drive went offline yet doing a directory was showing the empty contents but under the drive letter of the (now corrupt) drive. I suspect the MFT tables for each drive got cross-linked? I diagnosed all these problems when swapping memory sticks, one kept causing mob

The mob is in jail and can't report.

to report q 27, which is a memory error. The memory sticks are being RMAed.

with good memory running, now I am trying to recover the 18Tb drive. A chkdsk on the drive

"Insufficient storage available to create either the shadow copy storage file or other shadow copy data.Unable to determine volume version and state. CHKDSK aborted."
Drive shows 0 bytes available, but it was 18TB with approx 9TB used.
trying to open in windows:

w:\ is not accessible.
The disk structure is corrupted and unreadable"

I have tried 3 other well-respected recovery tools, one was able to recover 4 TB of the 11TB of files, half missing filenames, and NO directory structure.

Testdisk 7.2 checking shows:

Boot sector Status: OK Backup boot sector Status: OK Sectors are identical.
A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable.

-> repair MFT
output:

MFT and MFT mirror are bad. Failed to repair them.

from 7.6 repair boot partition:
ok -> rebuild BS

This seems to be uncharted territory, but surely there is a way to recover. It seems all I need is to perhaps set up volume shadow copy to use another drive to store a snapshot of the drive and chkdsk can repair the drive to at least a working state. Or should I try anything else first?

Instead of playing around with all features you should have simple let your machine complete the scan using 7.2-WIP. There is no 7.2 version, by the way. Then you would simply try to look into each partition found using using the p-key ("list files"). If that fails you would run deep search. If that fails you would run any other recovery software or Photorec.

I am trying to use rebuildBS recovery, but the scanning is taking days to complete
thanks for ANY guidance, questions, or suggestions.

The text that you copied somewhere out of Testdisk messages is confusing me. That is why I subtly explained to you how to upload screenshots. You did not get the message. Generally you should write your postings more carefully. Issues about a "GPS recovery" should be posted in a geo caching forum. If this is meant to be something different, write that correctly. Typically such postings as yours are disregarded. Cross-reading the forum will quickly teach you how to describe an incident correctly.

Posted: **31 May 2022, 23:36**

I am blind. I was an active directory architect. I don't claim to be an expert with this, but I used to build PCs in the 90's for businesses, and recovery was a service I provided. Having said that I gather you had a bad day.

I can't do some things you take for granted. Clicking on the Image icon adds IMG tags, can't just upload a screenshot and insert it.

I got a new hard drive dock which works much better and replaced the bad memory. I have the problem described here: https://superuser.com/questions/1309502 ... it-as-ntfs
with the exception that chkdsk fails stating there is no room on the drive.

Testdisk now states boot/backup boot sector are ok but corrupt. MFT and mirror are bad, failed to repair. Scanning the data finally where it will be able to finish. It kept crashing/running.

BTW testdisk shows v7.1 is latest, posted years ago, but when you download it is 7.2. Go figure.

24 hours later it is 50% done. I pray to god it actually stops this time at 312517222240.

Posted: **02 Jun 2022, 17:33**

I do appreciate the software, not once did I complain, I was simply pointing out opportunities for improvement. I will use normal speech and not formal writing. TB = terabytes . # = number , p.s. = Postscript, ssd = solid-state drive, OBS is . I reserve the right to speak/write what I wish, as I am an individual.

So the software still has other bugs.

Run # 9, the scan I discussed above ran for 40 hours and my system started shutting down apps, apparently, the log file grew to over a terabyte and filled up my 2TB system drive on SSD.

so I killed it, moved the app to my second 18TB drive, and started over. AGAIN

Started run #10. 14+ hours later and it, well, "finished" as far as the count goes. but is STILL RUNNING, as I initially stated in the original thread which received no replies in days; further, I posted on the other topic thinking it would be a partition recovery, but now it is data recovery, hence this posting.

Here is a link to a video of it going over the limit: https://youtu.be/Ja16iVxvEZo sorry about the quality. First time using OBS Studio. I am attaching a screenshot of the current status that is easier to see. If you watch closely, you can see the app get to 1,186,951,169 and keep going. It happens when the cursor moves back and forth between numbers.

It would sure be helpful to add commas. Will there be a 7.3 eventually? there seem to be some helpful changes. For what it is worth, I am a long-time programmer/automation expert. So I understand the use of the terminal screen.

So my only question is: now what do I do? The last time this ran for days, kept on going. which it is.
Here are the contents of the log file:

Code: Select all

Wed Jun  1 18:41:03 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)     **wrong, is windows 11
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=16000900661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=16000900661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=3000592979968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999003189248
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8001545043968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=8001427603456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=8001545043968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=16000881786880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=16000881786880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=3000380633088
Hard disk list
Disk \\.\PhysicalDrive0 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWN180, S/N:8731K3IKFP9E, FW:GX2M
Disk \\.\PhysicalDrive1 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWN180, S/N:X72PK1EMFP9E, FW:GX2M
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWG180, S/N:X030A0MVFBEG, FW:0603
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Sabrent Rocket 4.0 Plus, S/N:6479_A747_E020_07A9., FW:RKT4P1.2
Disk \\.\PhysicalDrive4 - 16 TB / 14 TiB - CHS 1945332 255 63, sector size=512 - WDC WD16 1KRYZ-01AGBB0, S/N:20211000000001F0, FW:01.0
Disk \\.\PhysicalDrive5 - 16 TB / 14 TiB - CHS 1945332 255 63, sector size=512 - TOSHIBA MG08ACA16TE, S/N:20211000000001F1, FW:0102
Disk \\.\PhysicalDrive6 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20160807007384F, FW:5438

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive5 - 16 TB / 14 TiB - TOSHIBA MG08ACA16TE
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=31251759103 (expected 31251759103)
hdr_lba_start=34
hdr_lba_end=31251759070
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 2 P MS Data                    32768 31251755007 31251722240 [Basic data partition]
     NTFS, blocksize=4096, 16 TB / 14 TiB

ntfs_boot_sector
 2 P MS Data                    32768 31251755007 31251722240 [Basic data partition]
     NTFS, blocksize=4096, 16 TB / 14 TiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size           31251722240
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
 2 P MS Data                    32768 31251755007 31251722240 [Basic data partition]
     NTFS, blocksize=4096, 16 TB / 14 TiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size           31251722240
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

p.s. On this phpBB, the color set makes the 'attachment' tab look pressed as opposed to Options, according to my wife. It did not register as clickable on the narrator.

Posted: **02 Jun 2022, 21:18**

cocokola wrote: 02 Jun 2022, 17:33 I do appreciate the software, not once did I complain, I was simply pointing out opportunities for improvement. I will use normal speech and not formal writing. TB = terabytes . # = number , p.s. = Postscript, ssd = solid-state drive, OBS is . I reserve the right to speak/write what I wish, as I am an individual.

So the software still has other bugs.

And where is the documentation of the bugs you were faced with?

Run # 9, the scan I discussed above ran for 40 hours and my system started shutting down apps, apparently, the log file grew to over a terabyte and filled up my 2TB system drive on SSD.

After 40 hours you deleted the result of an analysis without looking at it? Being as experienced as an "active directory architect" I would have expected you to take a look at the file. This is weird.

so I killed it, moved the app to my second 18TB drive, and started over. AGAIN

Started run #10. 14+ hours later and it, well, "finished" as far as the count goes. but is STILL RUNNING, as I initially stated in the original thread which received no replies

Talking about bugs without documentation, talking about a "original thread" without posting a link to it makes helping you kind of difficult.

in days; further, I posted on the other topic thinking it would be a partition recovery, but now it is data recovery, hence this posting.

Here is a link to a video of it going over the limit: https://youtu.be/Ja16iVxvEZo sorry about the quality. First time using OBS Studio. I am attaching a screenshot of the current status that is easier to see. If you watch closely, you can see the app get to 1,186,951,169 and keep going. It happens when the cursor moves back and forth between numbers.

It would sure be helpful to add commas.

Not really. The information you need is if you can access the content of a partition. The counter does not help you directly.

Will there be a 7.3 eventually?

You were always ignoring my comments about names of Testdisk versions. Although I told you that you are using version 7.2-WIP you are ignoring it talking about version 7.2. Have a look at the log that you posted down below, it says 7.2-WIP.

https://www.cgsecurity.org/wiki/TestDisk_Download
There is a link to a GIT directory that shows you the naming scheme.
Look here:
https://git.cgsecurity.org/cgit/testdisk/log/?ofs=1000
You are using a very recent version of Testdisk.

there seem to be some helpful changes.

For what it is worth, I am a long-time programmer/automation expert. So I understand the use of the terminal screen.

I don't believe you. No programmer deletes a log that took 40h to generate without looking at it. Telling me that you are a programmer suggests me that you should be able to open such a large file using a hex editor which cannot be expected from an average user.

So my only question is: now what do I do? The last time this ran for days, kept on going. which it is.

I gave you all necessary instructions and won't repeat them. If you ignore my short comments then I have to assume that you are even not a programmer because a programmer is giving more attention to my few details.

cgsecurity.org

testdisk Weird output with 18TB drives, recovery question

testdisk Weird output with 18TB drives, recovery question

Re: testdisk Weird output with 18TB drives

Re: testdisk Weird output with 18TB drives, recovery question

Re: testdisk Weird output with 18TB drives, recovery question

Re: testdisk Weird output with 18TB drives, recovery question

partition "insufficient storage for shadow copy..

Re: partition "insufficient storage for shadow copy..

Re: testdisk Weird output with 18TB drives, recovery question

Re: testdisk Weird output with 18TB drives, recovery question

Re: testdisk Weird output with 18TB drives, recovery question