Recovering an EXT4 filesystem within a 1 TB HDD detected as 7 TB!! Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
amlopezalonso
Posts: 2
Joined: 05 Nov 2022, 21:30

Recovering an EXT4 filesystem within a 1 TB HDD detected as 7 TB!!

#1 Post by amlopezalonso »

Hi,

I own a 1 TB, data-only, internal HDD which I replaced for a 2 TB unit. When I plugged the old HDD into an USB HDD reader in order to transfer the data back to the new unit I was surprised the OS (Debian 11) was unable to recognize / mount the single EXT4 partition in the disk. Before continue I must precise that the old disk holds some "special" data along with regular files/directories:
So I'm aiming to recover the partition table (if lost) and get the OS to recognize and mount the EXT4 filesystem.

Further investigation with gdisk showed the following (interesting parts in bold):
Warning: Partition table header claims that the size of partition table
entries is 0 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.
Warning: Partition table header claims that the size of partition table
entries is 0 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.

Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present

Found invalid GPT and valid MBR; converting MBR to GPT format
in memory.

Warning! Secondary partition table overlaps the last partition by
1709333071 blocks!

You will need to delete this partition or resize it in another utility.
Disk /dev/sdf: 244190646 sectors, 931.5 GiB
Model: 003-1SB102
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): 0B823749-13F7-4A4E-A8C4-F4F507A94A79
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 5
First usable sector is 6, last usable sector is 244190640
Partitions will be aligned on 256-sector boundaries
Total free space is 2042 sectors (8.0 MiB)

Number Start (sector) End (sector) Size Code Name
1 2048 1953523711 7.3 TiB 8300 Linux filesystem
So I decided to give testdisk a try (never used it before) and started a Quick Search upon an Intel/PC disk (according to the MBR statement above). The final list showed a bunch (7-8) of swap partitions (which I assumed to be the above-said swapfiles and the main reason of the fake 7.3 TB figure) and a couple of Linux partitions, one of them being an EXT4 and the other, biggest, being strangely recognized as XFS (or so I interpreted). Hitting "p" in both of them did not show any file at all.

As I feel the EXT4 partition was not as big as I expected to be I didn't commanded to write anything and I chose to perform a Deeper Search just in case which is taking place right now.

So I just wanted to beg for some guidance in how to proceed just in case I'm not in the right path.

Regards,
Antonio

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering an EXT4 filesystem within a 1 TB HDD detected as 7 TB!!

#2 Post by recuperation »

What is the USB HDD Reader (maker, model)?
How does the drive behaves when you connect it directly to a SATA port of your computer?

amlopezalonso
Posts: 2
Joined: 05 Nov 2022, 21:30

Re: Recovering an EXT4 filesystem within a 1 TB HDD detected as 7 TB!!

#3 Post by amlopezalonso »

Thank you so much for pointing this out: it was all due to some kind of incompatibility of the HDD reader indeed! As soon as I reconnected the HDD to an inner SATA port it was inmediately recognized.

For the record, here goes the HDD reader info, which had no problem reading other SATA devices but this one was specifically strange being a relatively old disk model --Barracuda ST1000DM003-1SB102 (+4 years old)--:

All In 1 HDD Docking (Model 875)

And according to lsusb command output:

Code: Select all

ID 152d:2338 JMicron Technology Corp. / JMicron USA Technology Corp. JM20337 Hi-Speed USB to SATA & PATA Combo Bridge
I wish to take this opportunity to congratulate you for this amazing set of tools!

Kind regards,
Antonio

Locked