cgsecurity.org

Posted: **28 Mar 2023, 02:58**

Description of the problem:
I've tried to analyse my 2 TB Hard drive with TestDisk during the night and my computer was turn off when I woke up.
I've tried a second time in the morning and my computed crashed during the analysing again.

I have also tried to "RebuildBS" and the same thing happened while the software was analysing my hard drive.

Code: Select all

Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-9YN164

Question:
Is this a bug when a disk is too big or am I doing something wrong? Anything else I can try?
(Nothing else was running on my computer at the time and I have 32 gb of ram, so I do not suspect my ram was overloaded but neither can I confirm.)

Proof that files still exists:
I know for a facts that my files are still recoverable, I was able to found them with a freemium tool.
The table partition is clearly corrupted.

Main boot sector corrupted:
Also, the main boot sector was corrupted.
I was able to fix the main boot sector with the backup boot sector with TestDisk, but the disk is still not readable.

Next steps:
I've heard that the linux version of TestDisk use a more robust NTFS library.
I will try to redo an analyse with a Live Linux distribution with TestDisk, I'll update in a few hours if this work.

Posted: **28 Mar 2023, 07:33**

Irrsinn wrote: 28 Mar 2023, 02:58 Description of the problem:
I've tried to analyse my 2 TB Hard drive with TestDisk during the night and my computer was turn off when I woke up.

Unsufficient problem description.

I've tried a second time in the morning and my computed crashed during the analysing again.

I have also tried to "RebuildBS" and the same thing happened while the software was analysing my hard drive.
Code: Select all
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-9YN164

I don't see any value in posting one line from a full log file - you certainly understand the German proverb:
"Wasch mir den Pelz aber mach mich nicht nass."

Question:
Is this a bug

One never kows.

when a disk is too big or am I doing something wrong? Anything else I can try?

Deliver a detailed problem description in your native language including a full Testdisk log file. Do me a favor: Instead of two people talking bad English together I recommend you posting in the German part of the forum.

(Nothing else was running on my computer at the time and I have 32 gb of ram, so I do not suspect my ram was overloaded but neither can I confirm.)

Proof that files still exists:
I know for a facts that my files are still recoverable, I was able to found them with a freemium tool.
The table partition is clearly corrupted.

That is what you pretend without any proof.

Main boot sector corrupted:
Also, the main boot sector was corrupted.
I was able to fix the main boot sector with the backup boot sector with TestDisk, but the disk is still not readable.

Next steps:
I've heard that the linux version of TestDisk use a more robust NTFS library.

Where did you hear that? I never did.

I will try to redo an analyse with a Live Linux distribution with TestDisk, I'll update in a few hours if this work.

Posted: **28 Mar 2023, 20:55**

Thank you Recuperation for the quick reply.
I was only trying to explain my problem in a concise way. Something I find it best to only post the important information but I get your point.
I didn't feel the need to post actual "proof" of my sayings since I'm not a newbie, I have studied in this, I know how a computer and a disk works.
Yes, I do not know how TestDisk fully works, but I understand what I am doing.
I will try to explain the problem with more details.

Btw, my native language is not English and I only speak a bit of German sadly. Irrsinn is my gamertag and I used it since it easy for me to remember as a username.
I didn’t read myself and certainly I should have. I was in a hurry and I am sorry for that.
That being said, I do not think you are bad at writing english and I really hope that I am not either for my sake xD (no harm done).
I would like to stay on the English forum, since I prefer English to communicate.

Code: Select all

[b]Main boot sector corrupted:[/b]
Also, the main boot sector was corrupted.
I was able to fix the main boot sector with the backup boot sector with TestDisk, but the disk is still not readable.

[b]Next steps:[/b]
I've heard that the linux version of TestDisk use a more robust NTFS library.

Where did you hear that? I never did.

Here the proof: viewtopic.php?t=2042 cgrenier said that.

I was transferring files on my HDD the other day and the morning after the disk was not accessible.
When I try to access the disk in Windows Explorer, I got the message "The disk structure is corrupted and unreadable".

In the Disk Management, my disk filesystem is now RAW (it was NTFS before).

Here the Windows error in the Event Manager:

Code: Select all

A corruption was discovered in the file system structure on volume F:.

The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x1000000000000.  The name of the file is "<unable to determine file name>".

The device is: ST2000DM001-9YN164 https://www.disctech.com/Seagate-Barrac ... T2000DM001

I was unable to do an "Analyse" and a "RebuildBS" with my computer on Windows 11.
Here the log after the Analyse of TestDisk 7.2 stopped (or crashed) and my computer rebooted:

Code: Select all

Mon Mar 27 02:19:26 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=499392764928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=499431505920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396321280
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000MX500SSD1, S/N:2219E62E53E8, FW:M3CR043
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 860 EVO 500GB, S/N:S598NJ0N337795H, FW:RVT04B6Q
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-9YN164, S/N:Z1E0211B, FW:CC96
Disk \\.\PhysicalDrive3 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - CT500P1SSD8, S/N:0000_0000_0000_0001_00A0_7520_E28D_0F1D., FW:P3CR013

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - ST2000DM001-9YN164
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
Invalid NTFS or exFAT boot
 1 * HPFS - NTFS              0   1  1 243201   0 63 3907024065
 1 * HPFS - NTFS              0   1  1 243201   0 63 3907024065

My computer was rebooting too with RebuildBS. I also tried with TestDisk 7.1

I tried yesterday on "ALT Linux Rescue" and TestDisk didn't stopped after the "RebuildBS" (sorry for the bad quality):

: 20230328_135151.jpg (128.27 KiB) Viewed 10313 times

As I said before, the main boot sector was bad. I was able to fix it with the backup boot sector.
This was done the day before I took this picture.

Now I think I'm just at that point where I need to rescue my files on a new HDD.
If you think there is something I could try to repair my disk, I would gladly accept your help.

Posted: **28 Mar 2023, 22:54**

Irrsinn wrote: 28 Mar 2023, 20:55 Thank you Recuperation for the quick reply.
I was only trying to explain my problem in a concise way. Something I find it best to only post the important information but I get your point.
I didn't feel the need to post actual "proof" of my sayings since I'm not a newbie, I have studied in this, I know how a computer and a disk works.

I have no crystal ball and I can't rely on what people consider important to mention or not regardless of their self estimation of their abilities.
Testdisk runs on multiple platforms and you did not even bother to mention the operating system used in your first posting - you are clearly overestimating my supernatural abilities.

Next steps:
I've heard that the linux version of TestDisk use a more robust NTFS library. [/code]

Where did you hear that? I never did.

Here the proof: viewtopic.php?t=2042 cgrenier said that.

People who have studied know that providing sources of information is essential for scientific work. A statement of Christophe Grenier himself has a different value than any third party statement.
I did not know this and have to verify this issue as this could cause different behaviour under different platforms.
Use a pendrive linux of your choice to exclude a broken Windows 11 installation or a difference in the code base as a possible reason for a crash.

I tried yesterday on "ALT Linux Rescue" and TestDisk didn't stopped after the "RebuildBS" (sorry for the bad quality):
20230328_135151.jpg

As I said before, the main boot sector was bad. I was able to fix it with the backup boot sector.
This was done the day before I took this picture.

Now I think I'm just at that point where I need to rescue my files on a new HDD.

That is pretty wrong. Testdisk is crashing and you have not seen any of your files in Testdisk.
Read here:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

If you can't list your files there is nothing to save with Testdisk and you will need to return to your "freemium" product.

As you have studied computers and know how a disk works I will ask you a question:

Could you imagine what else could make Testdisk crash apart from any bug?

Posted: **30 Mar 2023, 19:08**

I have no crystal ball and I can't rely on what people consider important to mention or not regardless of their self estimation of their abilities.
Testdisk runs on multiple platforms and you did not even bother to mention the operating system used in your first posting - you are clearly overestimating my supernatural abilities.

I indeed forgot to mention that, and perhaps other information.
I was pretty busy lately, I should have taken the time to write a proper post instead of wasting your time. Sorry again for that.
I'm using Windows 11 Home, 22H2, OS build 22621.1413.

That is pretty wrong. Testdisk is crashing and you have not seen any of your files in Testdisk.
Read here:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I have already done that sadly.
I bought a new 2 TB disk to transfer my data.
I'm going to give a try to PhotoRec since most of my files where videos, photos, songs (mostly flacs). I had some old C++ projects in there but too bad.

Could you imagine what else could make Testdisk crash apart from any bug?

Tricky question

Could be hardware, firmware or at the software level. Could be anything really. And you are right, I shouldn't have made the quick assumption that it could be the software or the RAM usage.
It was not meant to insult you or this project. You are really helpful, and so is TestDisk.
I'll try to reproduce the problem once my data is recovered.
Maybe I can find the crash or error log and any other useful information. If that's the case, I'll open an Issue on GitHub with a proper report.
Thank you for the help.

Posted: **30 Mar 2023, 21:49**

Irrsinn wrote: 30 Mar 2023, 19:08 Read here:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I have already done that sadly.
I bought a new 2 TB disk to transfer my data.
I'm going to give a try to PhotoRec since most of my files where videos, photos, songs (mostly flacs). I had some old C++ projects in there but too bad.

Photorec is the tool of last resort if others fail. Your freemium product can have better recovery results if it finds the remains of metadata.

Could you imagine what else could make Testdisk crash apart from any bug?
Tricky question
Could be hardware, firmware or at the software level. Could be anything really. And you are right, I shouldn't have made the quick assumption that it could be the software or the RAM usage.

Your disk could have caused the breakdown.
That's why my standard recommendation is a no-brainer. Check the SMART parameters:

viewtopic.php?f=5&t=10910

Duplicate the drive using ddrescue as described in the manual!
This way you end up with a hopefully complete copy of your disk that has no physical errors and you can try out any recovery software against that sample.
If the source has been dammaged you are better off making a second copy for tryouts and you can simple use the first copy to recreate the second copy without touching a possibly broken source disk.

cgsecurity.org

Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Re: Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Re: Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Re: Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Re: Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS

Re: Corrupted raw 2 TB disk - computer crashing during analysing and RebuildBS