cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Recovering a deleted partition (one encrypted)

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=12042

Page 1 of 1

Recovering a deleted partition (one encrypted)

Posted: 09 Jun 2022, 07:09
by erw1
My filesystem was corrupted in such a way I could login, but was only able to use the command line. So I installed an upgraded OS (from Linux Mint 19 to 23). To do so I wrote the reboot iso image to an external drive (below, sdc), and launched the reboot from there. The end result is: the old partition is gone. It had three partitions containing data: Vol1 (unknown file format), Vol2 (ext4 / encrypted) and Vol3 (ext4). Only Vol1 and Vol2 contain critical data. Is there anyway I can recover this data, how would I go about it? Please mind that I'm a below average geek when it comes to hardware and such. I'm posting this in parallel to reading about Step by Step guide, should the specifics of my case warrant special care.

Code: Select all

$ lsblk
NAME                MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                   8:0    0 298.1G  0 disk  
├─sda1                8:1    0   512M  0 part  /boot/efi
├─sda2                8:2    0     1K  0 part  
├─sda5                8:5    0   731M  0 part  /boot
└─sda6                8:6    0 296.9G  0 part  
  └─sda6_crypt      253:0    0 296.9G  0 crypt 
    ├─vgmint-root   253:1    0 295.9G  0 lvm   /
    └─vgmint-swap_1 253:2    0   976M  0 lvm   [SWAP]
sdc                   8:32   0 931.5G  0 disk  
├─sdc1                8:33   0     2G  0 part  
└─sdc2                8:34   0   3.9M  0 part
Here's a snapshot of gnome-disk-utility 3.36.3's dashboard.

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
Partition Start End Size in sectors
>P FAT12 0 10 11 0 137 9 8000 [EFI System Partiti
P NTFS 0 32 33 35160 213 54 564856825 [Vol1]
P NTFS 838 122 38 851 58 24 204800
P NTFS 851 58 24 863 249 10 204800
P HFS+ 4790 202 53 5723 114 55 14983104
P NTFS 6017 98 18 27783 148 61 349673984
P HFS 28832 100 2 29354 146 39 8388866
P HFS+ 31453 157 61 32386 69 63 14983104
P HFS+ 32386 71 2 33318 238 4 14983104
P NTFS 35160 213 54 70321 140 12 564856825
P Linux LUKS 70604 13 2 70604 78 2 4096

Structure: Ok.


Keys T: change type, P: list files,
Enter: to continue
FAT12, blocksize=2048, 4096 KB / 4000 KiB

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
Analyse cylinder 57249/121596: 47%

  ext4                 18608  43 36 20566  42 60   31455232
  ext4                 18608  45 38 20566  44 62   31455232
  ext4                 18608  47 40 20566  47  1   31455232
  ext4                 18608  49 10 20566  48 34   31455232
  ext4                 18608  50 35 20566  49 59   31455232
  ext4                 18608  51 60 20566  51 21   31455232
  ext4                 18608  54 55 20566  54 16   31455232
  ext4                 18608  56 49 20566  56 10   31455232
  ext4                 18608  58 51 20566  58 12   31455232
  ext4                 18608  62 39 20566  61 63   31455232
  ext4                 18608  64  1 20566  63 25   31455232
  ext4                 18608  71 24 20566  70 48   31455232
  ext4                 18608  72 25 20566  71 49   31455232
  ext4                 18608  71 24 20566  70 48   31455232
n] [EFISECTOR]

Re: Recovering a deleted partition (one encrypted)

Posted: 09 Jun 2022, 18:07
by recuperation
You are currently analysing the broken disk. Wait for the analysis to finish and use the p-key ("read files") to see if any of the partitions found contains readable content you are looking for. You started Testdisk in MBR mode. If your drive was partitioned under the GPT scheme I would rerun the analysis in GPT mode or just copying the content of found partitions to another drive.
If the analysis does not provide the content you are looking for you can continue with the deep search. Otherwise you Photorec or commercial recovery software.

Re: Recovering a deleted partition (one encrypted)

Posted: 10 Jun 2022, 07:05
by erw1
You started Testdisk in MBR mode.
What makes you say so? The first code snippet shows eleven lines preceded by 'P'. Aren't these 11 partitions? That's not possible under MBR. Besides, there weren't 11 partitions. There were 3 that I created, Vol 1,2 (encrypted),3. I think I chose the default 'no partition'. Continued here (not sure it was a good idea to start a new thread, moderator please advise as necessary).

Re: Recovering a deleted partition (one encrypted)

Posted: 10 Jun 2022, 09:25
by recuperation
erw1 wrote: 10 Jun 2022, 07:05
You started Testdisk in MBR mode.
What makes you say so?
Your screen is filled with found partitions in CHS (cylinder, head, sector) adresses.

The first code snippet shows eleven lines preceded by 'P'. Aren't these 11 partitions?
Did I question that?
That's not possible under MBR.
Of course it is. ;) I am not aware of any limit.

Besides, there weren't 11 partitions.
It's good that you know! Testdisk can't really tell you if you crushed the partition table. It presents you possible partitions based on data that look like the boot sector of a partition and you have to verify those proposals.

There were 3 that I created, Vol 1,2 (encrypted),3. I think I chose the default 'no partition'.
Do you mean "none" as selected in the following picture?

partition_table_type.png
partition_table_type.png (15.2 KiB) Viewed 3579 times

If you had three partitions you must have had a partition table when running windows. "None" is wrong in your case.

Re: Recovering a deleted partition (one encrypted)

Posted: 10 Jun 2022, 12:15
by erw1
I'm beginning to understand there are three different words for a given partition type, that is, MBR=Windows=Intel, and one can deduce it is the choice that has been made to run the analysis based on "Your screen is filled with found partitions in CHS (cylinder, head, sector) adresses." This level of guesswork maybe suitable for some people, but for me it just contributes to a feeling of helplessness. Is it such hardship for the software developer, to add "You are running Analysis using partition table type=..."? In case it sparks any comment towards the resolution of my problem, here's the new analysis (the third) that I started x hours ago. It was before going to bed, and I don't remember what partition type it is. The log file is 207GB in size, which is insane.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
Partition Start End Size in sectors
D EFI System 640 8639 8000 [EFI System Partition] [NO NAME]
>D MS Data 2048 564858872 564856825 [Vol1]
D MS Data 13470193 13674992 204800
D MS Data 13674992 13879791 204800
D Mac HFS 76964128 91947231 14983104
D MS Data 96669296 446343279 349673984
D Mac HFS 463192381 471581246 8388866
D Mac HFS 505302396 520285499 14983104
D Mac HFS 520285564 535268667 14983104
D MS Data 564858872 1129715696 564856825
P Linux filesys. data 1134254080 1134258175 4096







Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS found using backup sector, blocksize=4096, 289 GB / 269 GiB
Update: here are the first 200 lines:

Code: Select all

$ cat testdisk.log | head -n 200


Fri Jun 10 00:34:47 2022
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.4.0-91-generic (#102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop0 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST320LT007-9ZV142, S/N:W0Q4V9V5, FW:0004LVM1
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0820, FW:1012
Disk /dev/mapper/sda6_crypt - 318 GB / 296 GiB - 622557184 sectors, sector size=512
Disk /dev/mapper/vgmint-root - 317 GB / 295 GiB - 620453888 sectors, sector size=512
Disk /dev/mapper/vgmint-swap_1 - 1023 MB / 976 MiB - 1998848 sectors, sector size=512
Disk /dev/dm-0 - 318 GB / 296 GiB - 622557184 sectors, sector size=512
Disk /dev/dm-1 - 317 GB / 295 GiB - 620453888 sectors, sector size=512
Disk /dev/dm-2 - 1023 MB / 976 MiB - 1998848 sectors, sector size=512

Partition table type (auto): None
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0820
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=4153407 (expected 1953458175)
hdr_lba_start=64
hdr_lba_end=4153354
hdr_lba_table=12
hdr_entries=208
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
 2 P MS Data                      640       8639       8000 [ISOHybrid1] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=4153407 (expected 1953458175)
hdr_lba_start=64
hdr_lba_end=4153354
hdr_lba_table=12
hdr_entries=208
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
 2 P MS Data                      640       8639       8000 [ISOHybrid1] [NO NAME]
Backup partition structure
partition_save

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
FAT12 at 0/10/11
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-6
FAT2 : 7-12
start_rootdir : 13
Data : 45-7996
sectors : 8000
cluster_size : 4
no_of_cluster : 1988 (2 - 1989)
fat_length 6 calculated 6
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 0/10/11
     EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
NTFS at 851/58/24
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 13470193   13674992     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 851/58/24
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 13674992   13879791     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB

HFS+ magic value at 4790/202/53
part_size 14983104
     Mac HFS                 76964128   91947231   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
NTFS at 6017/98/18
filesystem size           349673984
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=49494679552, part_size=179033079808, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 6017/98/18
filesystem size           349673984
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 96669296  446343279  349673984
     NTFS, blocksize=4096, 179 GB / 166 GiB

LVM magic value at 28778/170/54

LVM magic value at 28831/41/46

HFS magic value at 28832/100/2
part_size 8388866
     Mac HFS                463192381  471581246    8388866
     HFS blocksize=16777216, 4295 MB / 4096 MiB

HFS+ magic value at 31453/157/61
part_size 14983104
     Mac HFS                505302396  520285499   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB

HFS+ magic value at 32386/71/2
part_size 14983104
     Mac HFS                520285564  535268667   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
NTFS at 35160/213/54
filesystem size           564856825
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048  564858872  564856825 [Vol1]
     NTFS found using backup sector, blocksize=4096, 289 GB / 269 GiB
NTFS at 35160/213/54
filesystem size           564856825
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                564858872 1129715696  564856825
     NTFS, blocksize=4096, 289 GB / 269 GiB

     Linux filesys. data   1134254080 1134258175       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
check_FAT: Bad jump in FAT partition
file_pread(5,16,buffer,1522137168(94748/167/28)) read err: Partial read
file_pread(5,16,buffer,1522137184(94748/167/44)) read err: Input/output error
file_pread(5,1,buffer,1522137184(94748/167/44)) read err: Input/output error
file_pread(5,1,buffer,1522137185(94748/167/45)) read err: Input/output error
file_pread(5,1,buffer,1522137186(94748/167/46)) read err: Input/output error
file_pread(5,1,buffer,1522137187(94748/167/47)) read err: Input/output error
file_pread(5,1,buffer,1522137188(94748/167/48)) read err: Input/output error
file_pread(5,16,buffer,1522137189(94748/167/49)) read err: Input/output error
file_pread(5,1,buffer,1522137189(94748/167/49)) read err: Input/output error
file_pread(5,16,buffer,1522137190(94748/167/50)) read err: Input/output error
file_pread(5,1,buffer,1522137190(94748/167/50)) read err: Input/output error
file_pread(5,16,buffer,1522137191(94748/167/51)) read err: Input/output error
file_pread(5,1,buffer,1522137191(94748/167/51)) read err: Input/output error
file_pread(5,16,buffer,1522137192(94748/167/52)) read err: Input/output error
file_pread(5,1,buffer,1522137192(94748/167/52)) read err: Input/output error
file_pread(5,1,buffer,1522137193(94748/167/53)) read err: Input/output error
file_pread(5,1,buffer,1522137194(94748/167/54)) read err: Input/output error
file_pread(5,1,buffer,1522137195(94748/167/55)) read err: Input/output error
file_pread(5,1,buffer,1522137196(94748/167/56)) read err: Input/output error
file_pread(5,1,buffer,1522137197(94748/167/57)) read err: Input/output error
file_pread(5,16,buffer,1522137198(94748/167/58)) read err: Input/output error
file_pread(5,1,buffer,1522137198(94748/167/58)) read err: Input/output error
file_pread(5,1,buffer,1522137199(94748/167/59)) read err: Input/output error
file_pread(5,16,buffer,1522137200(94748/167/60)) read err: Input/output error

Re: Recovering a deleted partition (one encrypted)

Posted: 10 Jun 2022, 16:07
by recuperation
erw1 wrote: 10 Jun 2022, 12:15 I'm beginning to understand there are three different words for a given partition type, that is, MBR=Windows=Intel,
No. The menu is about to select the partition table type that was used. A partition table keeps track of locations, lengths and types of partitions.
In the old MBR scheme the type no. 7 was used by Microsoft for NTFS partitions but it could have different meanings as well:

https://en.wikipedia.org/wiki/Partition_type
and one can deduce it is the choice that has been made to run the analysis based on "Your screen is filled with found partitions in CHS (cylinder, head, sector) adresses."
In a GPT partition table there are no triplets in CHS-style anymore. A sector is determined by just one number.
This level of guesswork maybe suitable for some people, but for me it just contributes to a feeling of helplessness.
I am sorry for that but Testdisk is a professional tool not aiming at computer starters. There is no beautiful graphical user interface taking you by the hand. But in a world with internet you can research things and terms that you do not understand and in this area for instance you get good answers even if you are only looking at Wikipedia.
Is it such hardship for the software developer, to add "You are running Analysis using partition table type=..."?
Yes it is. The programmer has a job, has a family and makes this software available for you for free, providing the whole sourcecode enabling you to examine what he programmed. Furthermore, this software is available on eight different platforms in a total of 3 families of operating systems.
As the source code is open for you can add your desired function to it.

If you feel uncomfortable with Testdisk you might try out any commercial solution - nobody forces you to use Testdisk.
In case it sparks any comment towards the resolution of my problem, here's the new analysis (the third) that I started x hours ago. It was before going to bed, and I don't remember what partition type it is. The log file is 207GB in size, which is insane.
Log files are typically much smaller than that, maybe some kBytes or even some 10kBytes. Testdisk fails to read sectors. Your disk is broken. Instead of stressing the disk using Testdisk you should have checked the SMART parameters:

viewtopic.php?f=5&t=10910

Then you should have decided to either bring your drive to a professional recovery service or trying to recover yourself. In the latter case you would have tried to duplicate the disk using ddrescue as described in the manual and rechecked the SMART parameters after the duplication process.

Given the hugh number of failed read efforts I recommend you consulting a professional recovery lab instead of continuing to stress your drive.

Re: Recovering a deleted partition (one encrypted)

Posted: 22 Jun 2022, 03:37
by erw1
I was giving earnest feedback as a self declared novice, but I've only succeeded in rubbing you the wrong way. I'm sorry about that. However, I must point tout that:

"I am sorry for that but Testdisk is a professional tool not aiming at computer starters. "

is contradicted by this page that says:
TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.

Re: Recovering a deleted partition (one encrypted)

Posted: 22 Jun 2022, 04:21
by erw1
In the latter case you would have tried to duplicate the disk using ddrescue as described in the manual and rechecked the SMART parameters after the duplication process.
So I did up to checking SMART, below. I'm getting a clicking sound with this backup disk, though.

Code: Select all

$ sudo smartctl -a /dev/sdc
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.4.0-120-generic] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Device Model:     WDC WD10SDRW-34A0XS0
LU WWN Device Id: 5 0014ee 2bd5e8337
Firmware Version: 01.01A01
User Capacity:    1,000,171,331,584 bytes [1.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Form Factor:      2.5 inches
Device is:        Not in smartctl database [for details use: -P showall]
ATA Version is:   ACS-3 T13/2161-D revision 5
SATA Version is:  SATA 3.1, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Tue Jun 21 23:17:24 2022 EDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x00)	Offline data collection activity
					was never started.
					Auto Offline Data Collection: Disabled.
Self-test execution status:      (   0)	The previous self-test routine completed
					without error or no self-test has ever 
					been run.
Total time to complete Offline 
data collection: 		(10800) seconds.
Offline data collection
capabilities: 			 (0x51) SMART execute Offline immediate.
					No Auto Offline data collection support.
					Suspend Offline collection upon new
					command.
					No Offline surface scan supported.
					Self-test supported.
					No Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (   2) minutes.
Extended self-test routine
recommended polling time: 	 ( 189) minutes.
SCT capabilities: 	       (0x7035)	SCT Status supported.
					SCT Feature Control supported.
					SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   200   200   051    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0027   175   164   021    Pre-fail  Always       -       2250
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       47
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x002e   200   200   000    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   100   100   000    Old_age   Always       -       65
 10 Spin_Retry_Count        0x0032   100   253   000    Old_age   Always       -       0
 11 Calibration_Retry_Count 0x0032   100   253   000    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       35
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       26
193 Load_Cycle_Count        0x0032   200   200   000    Old_age   Always       -       378
194 Temperature_Celsius     0x0022   112   098   000    Old_age   Always       -       31
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0032   200   200   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0030   100   253   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0008   100   253   000    Old_age   Offline      -       0

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minu

Code: Select all

$ sudo badblocks -v /dev/sdc
Checking blocks 0 to 976729087
Checking for bad blocks (read-only test): 
done                                                 
Pass completed, 0 bad blocks found. (0/0/0 errors)

Re: Recovering a deleted partition (one encrypted)

Posted: 22 Jun 2022, 06:37
by recuperation
Acccording to your smartmontools log file your drive is fairly new (has run only 65 hours) and I don't see any alarming figures.
When looking up your drive model I found out it has an USB interface. Ebay seems to be filled up with with repaired candidates of this drive type.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited