Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
fallofrome
Posts: 3
Joined: 28 May 2022, 00:12

Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

#1 Post by fallofrome »

Hello,

I'm helping out a friend with a very old Western Digital Mybook with a 1.5TB hard disk in it. I've removed the hard disk from the enclosure and hooked it up to my own machine, I've made no writes to the drive or modified in any way besides some scans. I've taken a bit-bit backup using DiskDrill (not sure if this is an approved piece of software by this community)

I've run PhotoRec however many of the file names are jumbled and the file extensions have changed. My friend is looking for Mp3s and Video files and some word/Excel docs however these things don't seem to be there, just lots and lots of WD junk

I've run Testdisk and it has resulted in the following output:

Thu May 26 18:30:47 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000752599040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999610646528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2198917349376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000750501888
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - WDC WD15EADS-11P8B2, S/N:WD-WMAVU3132666, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:S1F01BRJ, FW:CC4C
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Sabrent Rocket 4.0 1TB, S/N:6479_A735_A227_C89A., FW:RKT401.2
Disk \\.\PhysicalDrive3 - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WD My Passport 2626, S/N:WX72D611NPRP, FW:1034

Partition table type defaults to Intel
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - WDC WD15EADS-11P8B2
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
BAD_RS LBA=1382834856 6881919
check_part_i386 failed for partition type 06
FAT16 >32M 86077 124 40 302799 44 51 3481633902
This partition ends after the disk limits. (start=1382834856, size=3481633902, end=4864468757, disk end=2930277168)
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1500 GB / 1397 GiB) seems too small! (< 2490 GB / 2319 GiB)
The following partition can't be recovered:
FAT16 >32M 86077 124 40 302799 44 51 3481633902

Results

interface_write()

No partition found or selected for recovery
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

#2 Post by recuperation »

Have you run a deep analysis?

I've run PhotoRec however many of the file names are jumbled and the file extensions have changed.
For technical reasons modern office formats like docx, xlsx will appear as zip files.
I can't imagine how "jumbled file names" look like.
Top
fallofrome
Posts: 3
Joined: 28 May 2022, 00:12

Re: Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

#3 Post by fallofrome »

Thank you for the response!

I'm going to kick off a Deep Analysis

The files list looks roughly like this:

d----- 5/27/2022 8:25 AM f2929102728
-a---- 5/27/2022 2:01 AM 2147483648 f1155880990.avi
-a---- 5/27/2022 2:09 AM 2995133261 f1232997748.swf
-a---- 5/27/2022 2:14 AM 2941427933 f1289459625.ab
-a---- 5/27/2022 12:11 AM 11 f14038121.php
-a---- 5/27/2022 12:23 AM 2402261920 f145718946.dad
-a---- 5/27/2022 12:31 AM 995552440 f242851416.swf
-a---- 5/27/2022 12:35 AM 2878884750 f281846167.swf
-a---- 5/27/2022 5:37 AM 88 f2928911660.inf
-a---- 1/22/2010 8:30 AM 3707904 f2928911664_Unlock_exe
-a---- 10/31/2009 5:28 AM 765952 f2928918920.exe
-a---- 1/21/2010 4:11 PM 3325440 f2928922108.exe
-a---- 5/27/2022 5:37 AM 426 f2928923158.png
-a---- 5/27/2022 5:37 AM 212 f2928928616.lnk
-a---- 8/3/2004 11:01 PM 23503872 f2928928620_setup_exe
-a---- 1/21/2010 4:11 PM 212992 f2928974540_EraseDrive_exe
-a---- 8/3/2004 11:01 PM 47393280 f2928974956_setup_exe
-a---- 5/27/2022 5:37 AM 318 f2929068340.xml
-a---- 11/2/2006 1:05 AM 80896 f2929068543_SETUPAPI_DLL
-a---- 5/27/2022 5:37 AM 36744 f2929068703.bmp
-a---- 5/27/2022 5:37 AM 2998 f2929068786.ico
-a---- 8/22/2008 7:19 PM 655360 f2929068807_DIFxAppA_dll
-a---- 8/22/2008 7:19 PM 99840 f2929070112_DIFxApp_dll
-a---- 5/27/2022 5:37 AM 318 f2929070333.ico
-a---- 5/27/2009 2:58 AM 27136 f2929070344.dll
-a---- 5/27/2022 5:37 AM 9513 f2929070398.txt
-a---- 5/27/2022 5:37 AM 40297 f2929070437.cab
-a---- 5/27/2022 5:37 AM 36744 f2929070716.bmp
-a---- 8/22/2008 5:57 PM 303104 f2929070815_DIFxAppA_dll
-a---- 8/22/2008 5:57 PM 72192 f2929071431_DIFxApp_dll
-a---- 11/2/2006 12:33 AM 77312 f2929071609_SETUPAPI_DLL
-a---- 5/27/2009 2:58 AM 27136 f2929071761.dll
-a---- 5/27/2022 5:37 AM 9061 f2929071816.txt
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

#4 Post by recuperation »

As Photorec is the tool of last resort you should have started your recovery using Testdisk. You should have searched for partitions and should have checked the results found by looking inside using the p-key ("list files").
If that search fails the next logical step is to use any other recovery software and/or Photorec.
Photorec does not try to interpret any metadata and relies strictly on the content of data found. File names are assigned a number based on the location they were found on disc and/or file name information within data. File extensions may change due to the fact that some file types share the same identifier and are not identified in more detail.
In terms of Photorec they belong to the same family.
Top
fallofrome
Posts: 3
Joined: 28 May 2022, 00:12

Re: Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55

#5 Post by fallofrome »

Yes, thank you for the response. I've read other posts and am aware of the process PhotoRec uses to recover files and the reason why things come out as "gibberish".

The deep scan ran and the result is much the same:

"The hard disk (1500 GB / 1397 GiB) seems too small! (< 2490 GB / 2319 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in Sectors
> FAT16 >32M 86077 124 40 302799 44 51 3481633902
Top
Locked

Return to “Filesystem repair”