cgsecurity.org

Posted: **20 Aug 2022, 20:58**

wanted to see if you could advise. It has been difficult not to reboot for two weeks straight so the disk analysis can finish. I am 62% completed after 7 days, my initial estimate was 11 days but it looks like I was off by a bit.

In any case, here are the warning shown thus far (see screenshot)

This is the 14Tb drive chkdsk refuses to run (no space) and shows as RAW. Fire recovery restores partial files.

Any advice or thoughts to improve my odds? thank you very much.

Posted: **21 Aug 2022, 08:47**

0. Please provide your Testdisk logfile.

1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished

booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer

(p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT,

Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get

information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

Posted: **24 Aug 2022, 21:44**

0.

Code: Select all


Thu Aug 11 16:59:13 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=16000900661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=16000900661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=3000592979968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999003189248
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8001545043968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524288000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=524288000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=8001427603456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=8001545043968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=16000881786880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=16000881786880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=3000380633088
Hard disk list
Disk \\.\PhysicalDrive0 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWN180, S/N:8731K3IKFP9E, FW:GX2M
Disk \\.\PhysicalDrive1 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWN180, S/N:X72PK1EMFP9E, FW:GX2M
Disk \\.\PhysicalDrive2 - 16 TB / 14 TiB - CHS 1945332 255 63, sector size=512 - WDC WD161KRYZ-01AGBB0, S/N:4ZG54RWV, FW:01.01H01
Disk \\.\PhysicalDrive3 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWG180, S/N:X030A0MVFBEG, FW:0603
Disk \\.\PhysicalDrive4 - 16 TB / 14 TiB - CHS 1945332 255 63, sector size=512 - TOSHIBA MG08ACA16TE, S/N:6180A08DFVGG, FW:0102
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Sabrent Rocket 4.0 Plus, S/N:6479_A747_E020_07A9., FW:RKT4P1.2
Disk \\.\PhysicalDrive6 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20160807007384F, FW:5438
Drive G: - 524 MB / 500 MiB - CHS 16000 2 32, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive4 - 16 TB / 14 TiB - TOSHIBA MG08ACA16TE
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=31251759103 (expected 31251759103)
hdr_lba_start=34
hdr_lba_end=31251759070
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                    32768 31251755007 31251722240
     NTFS, blocksize=4096, 16 TB / 14 TiB

Analyse Disk \\.\PhysicalDrive4 - 16 TB / 14 TiB - CHS 1945332 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=31251759103 (expected 31251759103)
hdr_lba_start=34
hdr_lba_end=31251759070
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                    32768 31251755007 31251722240

search_part()
Disk \\.\PhysicalDrive4 - 16 TB / 14 TiB - CHS 1945332 255 63
NTFS at 2/10/9
filesystem size           31251722240
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=16777216, part_size=16000881786880, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 2/10/9
filesystem size           31251722240
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                    32768 31251755007 31251722240
     NTFS, blocksize=4096, 16 TB / 14 TiB
file_win32_pread(668,11,buffer,1186988026(1945332/8/15)) read err: read after end of file
file_win32_pread(668,8,buffer,1186988029(1945332/8/18)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988020(1945332/8/9)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988021(1945332/8/10)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988022(1945332/8/11)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988023(1945332/8/12)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988024(1945332/8/13)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988026(1945332/8/15)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988028(1945332/8/17)) read err: read after end of file
file_win32_pread(668,14,buffer,1186988030(1945332/8/19)) read err: read after end of file

Results
   P MS Data                    32768 31251755007 31251722240
     NTFS, blocksize=4096, 16 TB / 14 TiB

interface_write()
 1 P MS Data                    32768 31251755007 31251722240

1. Win 11 pro build 22621.ni_release220506-1250, I have several VMs with access including Uduntu 2022-6-13, windows 10
2. 7.2_WIP July 2022 (downloaded latest 10 days ago, still running. shows 91% complete (I think see attachments
3. I did not, but the system is showing RAW and read only from windows so YES
4. None of the above. See #3
5.Data drive
6. HDD
7. 16TB
8. Toshiba Enterprise MG series
9. MG08ACA16TE
10. Naked as a jailbird
11.

Code: Select all

smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w11-b22622] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Toshiba MG08ACA... Enterprise Capacity HDD
Device Model:     TOSHIBA MG08ACA16TE
Serial Number:    6180A08DFVGG
LU WWN Device Id: 5 000039 af8cb3e3a
Firmware Version: 0102
User Capacity:    16,000,900,661,248 bytes [16.0 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    7200 rpm
Form Factor:      3.5 inches
Device is:        In smartctl database 7.3/5319
ATA Version is:   ACS-3 T13/2161-D revision 5
SATA Version is:  SATA 3.3, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Wed Aug 24 15:08:00 2022 CDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x84)	Offline data collection activity
					was suspended by an interrupting command from host.
					Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0)	The previous self-test routine completed
					without error or no self-test has ever 
					been run.
Total time to complete Offline 
data collection: 		(  120) seconds.
Offline data collection
capabilities: 			 (0x5b) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					Offline surface scan supported.
					Self-test supported.
					No Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (   2) minutes.
Extended self-test routine
recommended polling time: 	 (1444) minutes.
SCT capabilities: 	       (0x003d)	SCT Status supported.
					SCT Error Recovery Control supported.
					SCT Feature Control supported.
					SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000b   100   100   050    Pre-fail  Always       -       0
  2 Throughput_Performance  0x0005   100   100   050    Pre-fail  Offline      -       0
  3 Spin_Up_Time            0x0027   100   100   001    Pre-fail  Always       -       8135
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       3736
  5 Reallocated_Sector_Ct   0x0033   100   100   010    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000b   100   100   050    Pre-fail  Always       -       0
  8 Seek_Time_Performance   0x0005   100   100   050    Pre-fail  Offline      -       0
  9 Power_On_Hours          0x0032   094   094   000    Old_age   Always       -       2733
 10 Spin_Retry_Count        0x0033   100   100   030    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       31
 23 Helium_Condition_Lower  0x0023   100   100   075    Pre-fail  Always       -       0
 24 Helium_Condition_Upper  0x0023   100   100   075    Pre-fail  Always       -       0
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       1
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       15
193 Load_Cycle_Count        0x0032   100   100   000    Old_age   Always       -       3788
194 Temperature_Celsius     0x0022   100   100   000    Old_age   Always       -       28 (Min/Max 16/45)
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0032   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0030   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       21
220 Disk_Shift              0x0002   100   100   000    Old_age   Always       -       118751234
222 Loaded_Hours            0x0032   098   098   000    Old_age   Always       -       1194
223 Load_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
224 Load_Friction           0x0022   100   100   000    Old_age   Always       -       0
226 Load-in_Time            0x0026   100   100   000    Old_age   Always       -       535
240 Head_Flying_Hours       0x0001   100   100   001    Pre-fail  Offline      -       0

SMART Error Log Version: 1
ATA Error Count: 21 (device log contains only the most recent five errors)
	CR = Command Register [HEX]
	FR = Features Register [HEX]
	SC = Sector Count Register [HEX]
	SN = Sector Number Register [HEX]
	CL = Cylinder Low Register [HEX]
	CH = Cylinder High Register [HEX]
	DH = Device/Head Register [HEX]
	DC = Device Command Register [HEX]
	ER = Error register [HEX]
	ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 21 occurred at disk power-on lifetime: 2680 hours (111 days + 16 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  84 41 38 cd 59 54 40  Error: ICRC, ABRT at LBA = 0x005459cd = 5528013

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 10 38 be 59 54 40 00  10d+19:58:00.204  READ FPDMA QUEUED
  60 10 30 fb 59 54 40 00  10d+19:58:00.204  READ FPDMA QUEUED
  60 10 28 2c 5a 54 40 00  10d+19:58:00.204  READ FPDMA QUEUED
  60 10 20 9e 61 54 40 00  10d+19:58:00.204  READ FPDMA QUEUED
  60 10 18 ae 59 54 40 00  10d+19:58:00.204  READ FPDMA QUEUED

Error 20 occurred at disk power-on lifetime: 2663 hours (110 days + 23 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  84 41 d0 4b e7 80 40  Error: ICRC, ABRT at LBA = 0x0080e74b = 8447819

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 10 d0 3c e7 80 40 00  10d+02:56:23.095  READ FPDMA QUEUED
  60 10 c8 ae ee 80 40 00  10d+02:56:23.095  READ FPDMA QUEUED
  60 10 c0 be e6 80 40 00  10d+02:56:23.095  READ FPDMA QUEUED
  60 10 b8 fb e6 80 40 00  10d+02:56:23.095  READ FPDMA QUEUED
  60 10 b0 2c e7 80 40 00  10d+02:56:23.094  READ FPDMA QUEUED

Error 19 occurred at disk power-on lifetime: 2657 hours (110 days + 17 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  84 41 08 9d 4f e8 40  Error: ICRC, ABRT at LBA = 0x00e84f9d = 15224733

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 10 08 8e 4f e8 40 00   9d+20:46:30.317  READ FPDMA QUEUED
  60 10 f8 cb 4f e8 40 00   9d+20:46:30.317  READ FPDMA QUEUED
  60 10 f0 fc 4f e8 40 00   9d+20:46:30.317  READ FPDMA QUEUED
  60 10 e8 6e 57 e8 40 00   9d+20:46:30.317  READ FPDMA QUEUED
  60 10 e0 7e 4f e8 40 00   9d+20:46:30.317  READ FPDMA QUEUED

Error 18 occurred at disk power-on lifetime: 2621 hours (109 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  84 41 10 5a e8 63 40  Error: ICRC, ABRT at LBA = 0x0063e85a = 6547546

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 10 10 4b e8 63 40 00   8d+08:46:27.553  READ FPDMA QUEUED
  60 10 08 7c e8 63 40 00   8d+08:46:27.553  READ FPDMA QUEUED
  60 10 f8 ee ef 63 40 00   8d+08:46:27.553  READ FPDMA QUEUED
  60 10 f0 fe e7 63 40 00   8d+08:46:27.552  READ FPDMA QUEUED
  60 10 e8 3b e8 63 40 00   8d+08:46:27.552  READ FPDMA QUEUED

Error 17 occurred at disk power-on lifetime: 2602 hours (108 days + 10 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  84 41 68 fa 6a 5b 40  Error: ICRC, ABRT at LBA = 0x005b6afa = 5991162

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 10 68 eb 6a 5b 40 00   7d+13:24:56.666  READ FPDMA QUEUED
  60 10 60 1c 6b 5b 40 00   7d+13:24:56.666  READ FPDMA QUEUED
  60 10 58 8e 72 5b 40 00   7d+13:24:56.665  READ FPDMA QUEUED
  60 10 50 9e 6a 5b 40 00   7d+13:24:56.665  READ FPDMA QUEUED
  60 10 48 db 6a 5b 40 00   7d+13:24:56.665  READ FPDMA QUEUED

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Completed without error       00%      1148         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

11.5 HDD device firmware (latest as of 2022/8/24) 0102
12. GPT
13. Two partitions as far as I know, but this drive is crazy weird. What I initially configured was one GPT partition. Windows shows 16mb unallocated, second partition 14901.98 GB RAW Healthy NTFS GPT
14. yes.
15 yes
14 #2 - Put two 16TB drives on USB 3.0 docking station. copied files from smaller drives to new drives. Memory stick went bad, caused system hangs other issues. Once I got that corrected, identified windows saw drive as RAW , checkdsk refuses to run (states 0 space available)
15 #2 - no physical issues
16. no bitlocker or other encryption
17. n/a

Still seeing the weird status, but finally figured out there is an updated % provided it is at 91% and still running..

Posted: **24 Aug 2022, 21:48**

Attachments were not shown, re-uploading.

Posted: **25 Aug 2022, 08:42**

It looks like your disk once fell down and now it is running at a tenth of its possible speed.
Therefore I would duplicate the drive using ddrescue as described in the manual.

I don't understand the role of the "Memory Stick" that you mentioned.

Posted: **26 Aug 2022, 16:55**

Drive was brand new, and never fell physically.
Your question was what happened to cause the problem. I had a stick of RAM go bad, causing BSOD reboots randomly for a week until I diagnosed the RAM was bad.

Any experience with mismatch heads/cylinder errors or bad jumps in the FAT partition?

the last screen looks like garbage info.

I am broke. best thing I can do is buy a new drive for up to 30 days then return it. I am broke. My experience with warranty repairs form Toshiba is data is lost unless I spend a fortune, or it will take more than 26 days (time to duplicate, redupe)

thank you for your expertise.
-Rob

Posted: **26 Aug 2022, 17:23**

cocokola wrote: 26 Aug 2022, 16:55 Drive was brand new, and never fell physically.

Your drive recorded a shock. It does not tell you when that shock happened.

Your question was what happened to cause the problem. I had a stick of RAM go bad, causing BSOD reboots randomly for a week until I diagnosed the RAM was bad.

Any experience with mismatch heads/cylinder errors or bad jumps in the FAT partition?

You can ignore it as your operating system does not use CHS-adressing for reading and writing sectors.

the last screen looks like garbage info.

I am broke. best thing I can do is buy a new drive for up to 30 days then return it. I am broke. My experience with warranty repairs form Toshiba is data is lost unless I spend a fortune, or it will take more than 26 days (time to duplicate, redupe)

thank you for your expertise.
-Rob

Check the partition list for readable content, even if everything looks like garbage.

Rob, I have no idea why people buy those large drives! In case of recovery of a maybe defective drive you need another one to generate a physical clone and a third one as a duplicate of the 2nd one. Why not 2 x 8 TB or 4 x 4TB?

Posted: **27 Aug 2022, 14:07**

You aren't wrong. I bought two 16TB drives for that reason, but the second drive now has partially recovered data. My data is prior DAW and video work

Are you aware of any way or tool to "look for path or directory named xxxxx" scans? Cheers. I donated a minuscule $4 euro, it is all I can afford, but I will contribute again when I can.
cheers.

PS love the questions, hope that helps I gather you caught the numbering needs updated.

Posted: **27 Aug 2022, 15:17**

You can try out anything that supports NTFS. As opposed to the armageddon search that Photorec undertakes assuming all metadata being gone, any recovery software that does not just copies the strategy of Photorec but is examining metadata remains can do the job - as long as there are still usable remains existing. I guess those vendors all offer tryout modes.

Posted: **18 Sep 2022, 23:58**

I am borrowing a drive large enough to make a 1to1 copy with dd-rescue-gui. The copy is going to take ~2 days. You said my drive was reporting a drop, I looked and didn't see that listed anywhere. Where did I miss it? thanks

cgsecurity.org

Scanning HD 6 of 11 days remaining. weird errors

Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors

Re: Scanning HD 6 of 11 days remaining. weird errors