cgsecurity.org

I have conduct a quick search and found the only partition avaiable. I checked and all files are there. trying to write does not do anithing, it states " reboot needed for changes to take effect" but after reboot nothing has happened.
What I am missing? Is this the correct procedure to recover a partition?
Note: it's an external HDD

Sun Jun 26 16:28:54 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, June 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999538088960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM010-2EP102, S/N:ZN1T99CC, FW:CC46
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000P5SSD8, S/N:0000_0000_0000_0001_00A0_7521_30B7_A15A., FW:P4CR311
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:F27302080805102

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]

search_part()
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(400,16,buffer,158(0/2/33)) read err: read after end of file
file_win32_pread(400,1,buffer,160(0/2/35)) read err: read after end of file
file_win32_pread(400,16,buffer,3119(0/49/33)) read err: read after end of file
file_win32_pread(400,1,buffer,3120(0/49/34)) read err: read after end of file
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem needs to be repaired.


dir_partition inode=5
* HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 19-Feb-2021 15:48 .
5 dr-xr-xr-x 0 0 0 19-Feb-2021 15:48 ..
40 dr-xr-xr-x 0 0 0 14-Dec-2019 19:00 $RECYCLE.BIN
423040 dr-xr-xr-x 0 0 0 14-Dec-2019 20:05 LAUREA STUFANIA
410024 dr-xr-xr-x 0 0 0 10-Dec-2019 23:01 Matteo documenti
472256 dr-xr-xr-x 0 0 0 19-Jan-2021 20:14 P30 STEFI
475587 dr-xr-xr-x 0 0 0 19-Jan-2021 20:01 P30 STEGI
35 dr-xr-xr-x 0 0 0 7-Jul-2017 00:11 System Volume Information
376287 dr-xr-xr-x 0 0 0 16-Dec-2019 22:55 The Bunker
19 dr-xr-xr-x 0 0 0 19-Feb-2021 22:13 found.000
368072 dr-xr-xr-x 0 0 0 11-Dec-2019 21:26 inge
48 dr-xr-xr-x 0 0 0 9-Dec-2019 21:31 stefy I
385086 dr-xr-xr-x 0 0 0 9-Aug-2019 15:24 stefy II
383612 dr-xr-xr-x 0 0 0 22-Sep-2018 18:21 stefy III
385314 dr-xr-xr-x 0 0 0 28-Jul-2020 21:27 stefy IV
373812 dr-xr-xr-x 0 0 0 19-Jan-2016 19:44 stefy V
376256 dr-xr-xr-x 0 0 0 15-Dec-2019 22:36 tech
366617 dr-xr-xr-x 0 0 0 11-Dec-2019 20:49 teo il picio
423174 dr-xr-xr-x 0 0 0 4-Jan-2020 17:45 the dumpster
39 -r--r--r-- 0 0 1772495 8-May-2014 02:54 TOSHIBA CANVIO BASICS.PDF
376255 -r--r--r-- 0 0 29 7-Nov-2016 22:01 autorun.inf
43 -r--r--r-- 0 0 9662 29-Dec-2015 14:37 stefy.ico
43 -r--r--r-- 0 0 26 29-Dec-2015 14:37 stefy.ico:Zone.Identifier
46 -r--r--r-- 0 0 15798 29-Dec-2015 14:34 stefy.jpg

interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]

interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

DucaDiMonteSberna wrote: 26 Jun 2022, 15:49 I have conduct a quick search and found the only partition avaiable. I checked and all files are there. trying to write does not do anithing, it states " reboot needed for changes to take effect" but after reboot nothing has happened.

You missed to describe the status quo. What exactly do you expect to happen? I can't understand why so many people believe I have a crystal ball.

What I am missing? Is this the correct procedure to recover a partition?
Note: it's an external HDD

Sun Jun 26 16:28:54 2022
Command line: TestDisk

...
NTFS filesystem needs to be repaired.
...

You might require running the chkdsk command but because of your missing problem description this is only a guess. As you can't reverse the actions of chkdsk I recommend duplicating the drive using ddrescue as described in the manual.
The safest way is to try to copy the content to another drive from within Testdisk.

Have a look at the blueish list of questions to get an idea what should be contained in an incident description:
viewtopic.php?t=12055

1.Which operating systems can be booted from your computer where the incident happened?
none, i just use it for storage

2. Which version of Testdisk do you use?
7.2

3.Do you prevent/reduce write access to the failed drive/file system?
no

4. If yes, how is that done?
/

5. Is the broken drive a drive where an operating system resides on or is it a data drive?
data drive

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
hdd

7. What is the size of your disk?
1tb

8. Who is the maker of your failed drive?
toshiba

9. What is the model?


10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
housing + cable

11. If possible, provide a logfile from smartmontools!
Instructions:
/

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
mbr

13. How many partitions have been on the broken drive, what was their size, what was their file system?
1 single partition

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
yes

15. Is the partition scheme containing your partitions still visible?
diskmanagement sees one partition as "RAW"

14. Describe the supposed event when your system went from "OK" to "broken"!
I was copying files between 2 external HDDs, lost both of them

15. Is your disk showing signs of failures such as
-clicking noises yes


16. Do you use encryption, if yes, which one?
no

17. If you use encryption, what is the scope?
/

I was expecting after the write that the unit was repaired and be able to be read again, but is not. What write MBR was supposed to do?

DucaDiMonteSberna wrote: 30 Jun 2022, 12:46 9. What is the model?

I can't understand why people fail to give necessary information even when being asked explicitly.

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
housing + cable

Unsufficient answer.

11. If possible, provide a logfile from smartmontools!
Instructions:

Very useful in this case where the drive is making strange clicking noises.

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
mbr

13. How many partitions have been on the broken drive, what was their size, what was their file system?
1 single partition

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
yes

15. Is the partition scheme containing your partitions still visible?
diskmanagement sees one partition as "RAW"

14. Describe the supposed event when your system went from "OK" to "broken"!
I was copying files between 2 external HDDs, lost both of them

15. Is your disk showing signs of failures such as
-clicking noises yes


16. Do you use encryption, if yes, which one?
no

17. If you use encryption, what is the scope?
/

I was expecting after the write that the unit was repaired and be able to be read again, but is not. What write MBR was supposed to do?

Writing the MBR that includes partition table data only makes lost partitions visible again.
The clicking noises suggest duplicating the drive using ddrescue as described in the manual and rescuing from that physically healthy copy.