Western Digital 1.5TB - Partition sector doesn't have the endmark 0xAA55
Posted: 28 May 2022, 00:17
Hello,
I'm helping out a friend with a very old Western Digital Mybook with a 1.5TB hard disk in it. I've removed the hard disk from the enclosure and hooked it up to my own machine, I've made no writes to the drive or modified in any way besides some scans. I've taken a bit-bit backup using DiskDrill (not sure if this is an approved piece of software by this community)
I've run PhotoRec however many of the file names are jumbled and the file extensions have changed. My friend is looking for Mp3s and Video files and some word/Excel docs however these things don't seem to be there, just lots and lots of WD junk
I've run Testdisk and it has resulted in the following output:
Thu May 26 18:30:47 2022
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000752599040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999610646528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2198917349376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000750501888
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - WDC WD15EADS-11P8B2, S/N:WD-WMAVU3132666, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:S1F01BRJ, FW:CC4C
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Sabrent Rocket 4.0 1TB, S/N:6479_A735_A227_C89A., FW:RKT401.2
Disk \\.\PhysicalDrive3 - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WD My Passport 2626, S/N:WX72D611NPRP, FW:1034
Partition table type defaults to Intel
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - WDC WD15EADS-11P8B2
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
BAD_RS LBA=1382834856 6881919
check_part_i386 failed for partition type 06
FAT16 >32M 86077 124 40 302799 44 51 3481633902
This partition ends after the disk limits. (start=1382834856, size=3481633902, end=4864468757, disk end=2930277168)
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1500 GB / 1397 GiB) seems too small! (< 2490 GB / 2319 GiB)
The following partition can't be recovered:
FAT16 >32M 86077 124 40 302799 44 51 3481633902
Results
interface_write()
No partition found or selected for recovery
I'm helping out a friend with a very old Western Digital Mybook with a 1.5TB hard disk in it. I've removed the hard disk from the enclosure and hooked it up to my own machine, I've made no writes to the drive or modified in any way besides some scans. I've taken a bit-bit backup using DiskDrill (not sure if this is an approved piece of software by this community)
I've run PhotoRec however many of the file names are jumbled and the file extensions have changed. My friend is looking for Mp3s and Video files and some word/Excel docs however these things don't seem to be there, just lots and lots of WD junk
I've run Testdisk and it has resulted in the following output:
Thu May 26 18:30:47 2022
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000752599040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999610646528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2198917349376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000750501888
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - WDC WD15EADS-11P8B2, S/N:WD-WMAVU3132666, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:S1F01BRJ, FW:CC4C
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Sabrent Rocket 4.0 1TB, S/N:6479_A735_A227_C89A., FW:RKT401.2
Disk \\.\PhysicalDrive3 - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WD My Passport 2626, S/N:WX72D611NPRP, FW:1034
Partition table type defaults to Intel
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - WDC WD15EADS-11P8B2
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
BAD_RS LBA=1382834856 6881919
check_part_i386 failed for partition type 06
FAT16 >32M 86077 124 40 302799 44 51 3481633902
This partition ends after the disk limits. (start=1382834856, size=3481633902, end=4864468757, disk end=2930277168)
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1500 GB / 1397 GiB) seems too small! (< 2490 GB / 2319 GiB)
The following partition can't be recovered:
FAT16 >32M 86077 124 40 302799 44 51 3481633902
Results
interface_write()
No partition found or selected for recovery