cgsecurity.org

I was able to back some of my files off the drive but not currently working to get the drives visible again under windows.
The drives are 2 WD Black 4TB raid with 0 just for storage. Currently getting this message when I try to Rebuild my NTFS

"A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable."

Am I missing a step or can it even be made visable again?

Please describe your RAID setup and post your testdisk log file.

how do i get the Log file? (the one in the folder maybe?) Just 2 wd blacks in raid 0. The files are still on it.

When starting Testdisk select the creation of a log file that will be located in the Testdisk folder then.

When using a RAID there are different sources it can originate from. There are external boxes providing hardware RAID functions. That RAID appears as one disk under your operating system. "Windows" - Which windows by the way? - provides the possibility of creating a software RAID. I have never used one and need to see how such a RAID appears in your system on device level. I guess, your "windows" shows both physical drives but not a virtual one.

Furthermore you do not document your case.

To give you an idea what to report, cross-read the forum or the following list:

1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

Sat Jun 4 19:14:04 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=8001569161216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999545969152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000381018112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=8001550286848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524288000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000186314752
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDS100T1X0E-00AFY0, S/N:E823_8FA6_BF53_0001_001B_448B_4128_E09B., FW:614600WD
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDS200T1X0E-00AFY0, S/N:E823_8FA6_BF53_0001_001B_448B_4547_A5E3., FW:614600WD
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63, sector size=512 - Intel Raid 0 Volume, S/N:Volume1, FW:1.0.00
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WDS100T2B0A-00SM50, S/N:190441448307, FW:401000WD
Disk \\.\PhysicalDrive4 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WDS100T2B0A-00SM50, S/N:20308D803229, FW:415000WD
Drive G: - 524 MB / 500 MiB - CHS 16000 2 32, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - Intel Raid 0 Volume
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Bad sector count.
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63
BAD_RS LBA=3896592099 3643482
check_part_i386 failed for partition type 01
FAT12 242551 163 16 506447 106 51 4239485685
BAD_RS LBA=2242001601 15265737
check_part_i386 failed for partition type 04
FAT16 <32M 674256 215 9 765643 124 55 1468126469
file_win32_pread(608,2,buffer,2743162879(972802/10/8)) read err: read after end of file

Results
L FAT12 242551 163 16 506447 106 51 4239485685
L FAT16 <32M 674256 215 9 765643 124 55 1468126469
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 242551 0 1 765643 254 63 8403489045
5 L FAT12 242551 163 16 506447 106 51 4239485685
6 L FAT16 <32M 674256 215 9 765643 124 55 1468126469

search_part()
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63
BAD_RS LBA=3896592099 3643482
check_part_i386 failed for partition type 01
FAT12 242551 163 16 506447 106 51 4239485685
BAD_RS LBA=3638419937 2604377
check_part_i386 failed for partition type 01
FAT12 226481 42 27 313553 13 11 1398809838
BAD_RS LBA=3442611589 13666001
check_part_i386 failed for partition type 07
HPFS - NTFS 214292 168 26 306554 145 40 1482187596
BAD_RS LBA=2152598932 13626029
check_part_i386 failed for partition type 06
FAT16 >32M 401342 111 6 668683 144 41 4294835280
BAD_RS LBA=2220753922 10265534
check_part_i386 failed for partition type 01
FAT12 405584 226 21 494357 57 50 1426127628
BAD_RS LBA=2045251490 16327559
check_part_i386 failed for partition type 0B
FAT32 394660 93 28 657802 38 48 4227372786
BAD_RS LBA=2307327763 15669583
check_part_i386 failed for partition type 01
FAT12 410973 219 18 625793 38 40 3451071920
BAD_RS LBA=1664869104 13669594
check_part_i386 failed for partition type 0E
FAT16 LBA 638332 1 54 781973 236 3 2307607420
BAD_RS LBA=2242001601 15265737
check_part_i386 failed for partition type 04
FAT16 <32M 674256 215 9 765643 124 55 1468126469
NTFS at 972801/200/7
filesystem size 15628027904
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 972801 200 7 15628027904 [Storage]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7452 GiB
file_win32_pread(608,2,buffer,2743162879(972802/10/8)) read err: read after end of file

Results
HPFS - NTFS 2 10 9 972801 200 7 15628027904 [Storage]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7452 GiB
HPFS - NTFS 214292 168 26 306554 145 40 1482187596
FAT12 226481 42 27 313553 13 11 1398809838
FAT12 242551 163 16 506447 106 51 4239485685
FAT32 394660 93 28 657802 38 48 4227372786
FAT16 >32M 401342 111 6 668683 144 41 4294835280
FAT12 405584 226 21 494357 57 50 1426127628
FAT12 410973 219 18 625793 38 40 3451071920
FAT16 LBA 638332 1 54 781973 236 3 2307607420
FAT16 <32M 674256 215 9 765643 124 55 1468126469
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 1 232 40 972801 200 7 15628029952
5 L HPFS - NTFS 2 10 9 972801 200 7 15628027904 [Storage]

interface_write()

No partition found or selected for recovery


dir_partition inode=5
HPFS - NTFS 2 10 9 972801 200 7 15628027904 [Storage]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7452 GiB
Directory /
5 dr-xr-xr-x 0 0 0 31-May-2022 20:07 .
5 dr-xr-xr-x 0 0 0 31-May-2022 20:07 ..
40 dr-xr-xr-x 0 0 0 8-May-2022 10:24 $RECYCLE.BIN
39 dr-xr-xr-x 0 0 0 14-May-2022 16:44 My Documents
199271 dr-xr-xr-x 0 0 0 9-Mar-2022 16:57 Program Files
36 dr-xr-xr-x 0 0 0 20-Aug-2020 16:18 System Volume Information
133400 dr-xr-xr-x 0 0 0 8-May-2022 10:59 msdownld.tmp
20 -r--r--r-- 0 0 112 30-May-2022 14:03 bootTel.dat

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Analyse Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Bad sector count.
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 8001 GB / 7452 GiB - CHS 972802 255 63
file_win32_pread(608,2,buffer,2743162879(972802/10/8)) read err: read after end of file
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

I can see the drive in disk management but says raw and needs to be format.

1.Which operating systems can be booted from your computer where the incident happened?
List them all! Windows 10
happened when installed new Rma Motherboard

2. Which version of Testdisk do you use?
7.2
3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no] no

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?
just data
6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
HDD
7. What is the size of your disk?
each is 4tb
8. Who is the maker of your failed drive?
Western Digital
9. What is the model?
WD Black
10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
Naked
11. If possible, provide a logfile from smartmontools!
Instructions: Added
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
I can not remember but I am guessing MBR
13. How many partitions have been on the broken drive, what was their size, what was their file system?
just 1 8tb NTFS
14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
nope
15. Is the partition scheme containing your partitions still visible?
if i can see it in testdisk and its files then Yes
14. Describe the supposed event when your system went from "OK" to "broken"!
Installed New but same motherboard.
15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

? Nope

16. Do you use encryption, if yes, which one?
Nope
17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

When you replaced your motherboard by a new motherboard of the same model it might be that you did not clone the RAID settings that you had set on the old motherboard.

The safest way in your case is to use the ability of Testdisk to copy the content to another drive or another drive array. There is a function that is triggered using the key "p" ("list files") that helps you to explore the content of your partition that you labeled as "Storage". The log file suggests that it works because the content of your root directory is being listed successfully in your log file. Inside the p-function you have choices to select and copy.

If your motherboard allows the creation of an additional RAID 0 consisting of two drives you could create a new, a second RAID, partition and format the second one and copy the content of the old RAID onto the new one.
When creating, partitioning and formating your new RAID, disconnect your old RAID.
Keep in mind that a RAID 0 doubles the risk of data loss.

So no way to get it showing up again? Never had to back up the raid files. Going from old MB to this new one before rma everything worked flawless. Its only when I did it to new rma one.

There is no common standard how to write RAID information on drives on top of partition information. RAID repair is not part of Testdisk:
https://www.cgsecurity.org/wiki/TestDisk

Your motherboard manufacturer and Intel are your primary source of help for your problem.

There are lots of software vendors of products that offer RAID recovery - not repair.
If you want your RAID to be repaired ask a professional recovery lab. I guess it will be more expensive than the proposed solution.
You were lucky that Testdisk found your information.

"Never had to back up the raid files."