Broken partition after cancelling Acronis True Image's Survival Kit creation Topic is solved

[randomuser]

Hello. I need help. I accidentally corrupted my drive and its partition no longer opens.

Here's how it happened:
Today I made a misfortunate decision to update Acronis True Image, which I utterly despite yet continue to use for some reason. I wanted to make a bootable flash drive with its HDD tools to do some work on unrelated hard drives, and the older version I had installed wasn't recognizing the drives, so I opted to update. After installing the update, I went searching through this [s]bloatware[/s] feature rich application for the option of making a bootable media. And I stumbled across something called Acronis Survival Kit. I looked at the splash screen describing what it was, and concluded that it wasn't what I was looking for, and clicked Cancel.

Except the button that I thought was "Cancel" (located in the spot where Cancel is usually placed) turned out to be, in fact, "Create".

I immediate cancelled the process that started. But it just kept going, doing god knows what, but definitely not cancelling.

While waiting for it to cancel, I accidentally glanced at the list of drives, and with terror I realized that True Image was creating that Survival Kit, whatever it is, not on the flash drive, but on my 4 TB external drive full of data. And the drive was no longer openable.

I panicked. I thought it was formatting my hard drive and creating a bootable whatever instead of everything that was on the hard drive. In trying to salvage what I still can, I closed True Image (I doubt it affected anything, it does its bloatware jobs through services), and, just to be extra sure that it stopped doing whatever it was doing, I rebooted the PC (gracefully).

The hard drive still doesn't open.

Here's what I currently have:
As I understand now, after googling, what Survival Kit creation was really doing, is moving some data away from the beginning of the drive, in order to free up 2 GB of space for a bootable partition. If I hadn't interrupted the process, I would've ended up with a normal drive with all data intact, just with 2 GB less space.

But because I interrupted the process, it's now broken.

My current situation is this:

Upon opening the drive in TestDisk, I see only one partition:

Code: Select all

     Partition                  Start        End    Size in sectors
 1 * HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]

The drive label is correct.

I clock [Quick search].

Code: Select all

Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
     Partition               Start        End    Size in sectors
>L HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]

If I try to press P to list files, I get

Code: Select all

Can't open filesystem. Filesystem seems damaged.

If I continue and do a [Deeper search], it finds another partition:

Code: Select all

Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
Analyse cylinder    36/60799: 00%
HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]
HPFS - NTFS             32 162  3 60832 162  2  976752000

It seems like it was in the process of creating that second partition with 2 GB offset, but didn't finish it.
I stop the deep search and I get this result:

Code: Select all

Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63

The hard disk (4000 GB / 3726 GiB) seems too small! (< 4002 GB / 3728 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  HPFS - NTFS             32 162  3 60832 162  2  976752000

The size is 2 GB bigger than the size of the drive. Or, rather, the partition is NOT bigger - it's exactly the same 4 TB. But because it was offset by 2 GB (and the size wasn't subsequently reduced by 2 GB) it now looks as if it spans from 2 GB to 4002 GB, instead of from 0 to 4000 GB as it originally was.

What can I do? I don't want to damage the drive further. I would like to make an image of the drive and experiment on it (I have the space for it, although I'm not sure if I have the time, but that's another story...), but I don't know what software to use for it: the most common suggestion i see is ddrescue, but it's a unix tool, and I'm on windows. I'm afraid of touching anything right now that would alter the real drive.

I would like to restore the filesystem as a whole, if at all possible. Selective file recovery (e.g. PhotoRec) doesn't work for me, as most data on that drive wasn't in popular formats (jpg, mp4 etc). I can accept partial data loss, if it was overwritten by that 2nd partition's filetable, and I likewise can accept the loss of those initial 2 GB - I have backups of what was on that drive, but they're woefully outdated.

Here's the full log:

Code: Select all

Tue Jan 17 12:21:25 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, November 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000395698176
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000787025920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=4000787025920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=498716896768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1258290151424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=718273511424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=23827841024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=576716800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=4000776192000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=4000776192000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=10000695033856
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 850 EVO 500GB, S/N:S2R9NX0J525347D, FW:EMT02B6Q
Disk \\.\PhysicalDrive1 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - ST10000NM0086-2AA101, S/N:ZA2AM0KE, FW:SN05
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512 - Intel Raid 1 Volume, S/N:Data RAID, FW:1.0.
Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 60800 255 63, sector size=4096 - Samsung D3 Station, S/N:00000000011E0A49, FW:0202
Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63, sector size=4096 - Samsung D3 Station, S/N:00000000011E0A49, FW:0202
Drive R: - 4000 GB / 3726 GiB - CHS 60800 255 63, sector size=4096 - Samsung D3 Station, S/N:00000000011E0A49, FW:0202
Drive S: - 4000 GB / 3726 GiB - CHS 60800 255 63, sector size=4096 - Samsung D3 Station, S/N:00000000011E0A49, FW:0202

Partition table type (auto): Intel
Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - Samsung D3 Station
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
 1 * HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]

search_part()
Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
NTFS at 0/1/2
filesystem size           976752000
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB

Results
   L HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             0   1  1 60800   1  1  976752001
 5 L HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]

search_part()
Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
NTFS at 0/1/2
filesystem size           976752000
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB
NTFS at 32/162/3
filesystem size           976752000
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS             32 162  3 60832 162  2  976752000
     NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=524288, size=976752000, end=977276287, disk end=976754645)
Search for partition aborted
Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (4000 GB / 3726 GiB) seems too small! (< 4002 GB / 3728 GiB)
The following partition can't be recovered:
     HPFS - NTFS             32 162  3 60832 162  2  976752000
     NTFS, blocksize=4096, 4000 GB / 3726 GiB

Results
   L HPFS - NTFS              0   1  2 60800   1  1  976752000 [BACKUP A]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.  

[recuperation]

As your description already shows that Testdisk can't open the partitions found and Photorec is no choice you should contact Acronis.
If that does not work try third party recovery programs.

I would like to restore the filesystem as a whole, if at all possible.

Leaving aside Testdisk none of the commercial recovery programs repairs your broken disk.
They only recover data to another location which is a wise choice.

[randomuser]

Thanks for the response. I know it's a lost cause to expect the drive itself to be repaired back to the functioning state. By "restore filesystem" I meant restoring the original file structure so I can at least see the filenames, directories, so that I can more conveniently copy them to another drive. but I don't know if True Image has succeeded in relocating the file table to that 2 GB offset or not, and I can't attempt to view it in TestDisk, because it reports the aforementioned error of "The hard disk (4000 GB / 3726 GiB) seems too small! (< 4002 GB / 3728 GiB)".

Is there some way to edit that partition (without writing it to disk) to make it 3998 GB in size, which would hopefully allow TestDisk to examine its file table?

And what tools can I use on windows to make an image of the drive?

I did try Photorec after I posted this topic, and I was impressed with the number of filetypes it can attempt to recover. Perhaps I might be able to salvage the data that way, but digging through 4 TB of nameless files will be a laborious process, so for now I'm treating it as my last resort. I'd like to explore other options for now, if there are any.

[recuperation]

Thanks for the response. I know it's a lost cause to expect the drive itself to be repaired back to the functioning state. By "restore filesystem" I meant restoring the original file structure so I can at least see the filenames, directories, so that I can more conveniently copy them to another drive. but I don't know if True Image has succeeded in relocating the file table to that 2 GB offset or not, and I can't attempt to view it in TestDisk, because it reports the aforementioned error of "The hard disk (4000 GB / 3726 GiB) seems too small! (< 4002 GB / 3728 GiB)".

Is there some way to edit that partition (without writing it to disk) to make it 3998 GB in size, which would hopefully allow TestDisk to examine its file table?

Testdisk allows you to access found partitions that are not listed in the partition table, see:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

And what tools can I use on windows to make an image of the drive?

Before using ddrescue I used Acronis Disk Director but that is likely to fail with dammaged disks.

I did try Photorec after I posted this topic, and I was impressed with the number of filetypes it can attempt to recover. Perhaps I might be able to salvage the data that way, but digging through 4 TB of nameless files will be a laborious process, so for now I'm treating it as my last resort. I'd like to explore other options for now, if there are any.

[randomuser]

Testdisk allows you to access found partitions that are not listed in the partition table, see:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I already followed that guide and I described my results in the original post. I cannot preview files from the second partition (found via deep search) because the settings of that partition are incorrect: its size wasn't adjusted down to account for the partition now starting from a different offset, and to TestDisk it seems as if the partition bounds exceed the physical size of the drive.

Code: Select all

Disk \\.\PhysicalDrive4 - 4000 GB / 3726 GiB - CHS 60800 255 63

The hard disk (4000 GB / 3726 GiB) seems too small! (< 4002 GB / 3728 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  HPFS - NTFS             32 162  3 60832 162  2  976752000

[recuperation]

Please post a complete Testdisk logfile.

[randomuser]

I did, in the original post.

[randomuser]

Feel free to close this thread, it's no longer relevant. I studied how NTFS works and wrote a program that rescued all my files considering my specific circumstances: some files were at offset 0, and some were already moved to offset 2GB, and I'm basically checking both offsets for a valid file signature and extracting from there. MFT remained perfectly intact, this allowed me to make my own filesystem browser, and from there it was just a matter of traversing every folder and restoring the files that differed from my old backup.

[recuperation]

Congratulations!
That is a very impressive result.

Your thread was still scheduled for an answer but I didn't have the time and did easier threads first.