cgsecurity.org

Posted: **29 May 2023, 10:30**

Hello...
From the moment my cat ate the power cord of my external hard drive, I lost its partition, looking like this in Windows 10:

: 2023-05-29_06h18_59.png (6.45 KiB) Viewed 11693 times

So, I lost the partition of my hd, where, although it shows me 2 partitions, I only had 1, in NTFS format...

Searching the internet, I found your tool and when running it, it showed me the following:

: 2023-05-29_06h23_47.png (21.75 KiB) Viewed 11693 times

I completely disassembled the hard drive from the case and I'm using it connected directly to my pc's motherboard, despite the error shown, and is it possible to recover without losing my data? How should I do?

Anyway, press "A", I have the following information:

: 2023-05-29_06h32_39.png (17.42 KiB) Viewed 11693 times

A big hug from Brazil...

Posted: **29 May 2023, 10:53**

Please upload your pictures to this site.

Posted: **29 May 2023, 11:06**

recuperation wrote: 29 May 2023, 10:53 Please upload your pictures to this site.

Sorry...
How site, please?
Thanks...

Posted: **29 May 2023, 12:39**

This website.
Use the attachment tab near the left corner on the bottom of the screen.

Thank you!

Posted: **29 May 2023, 19:12**

Running tool again, I receive this information:

: 2023-05-29_15h10_57.png (21.45 KiB) Viewed 11692 times

Suggestions?

Posted: **30 May 2023, 19:47**

tops wrote: 29 May 2023, 10:30 Hello...
From the moment my cat ate the power cord of my external hard drive, I lost its partition, looking like this in Windows 10:
...
I completely disassembled the hard drive from the case and I'm using it connected directly to my pc's motherboard, despite the error shown, and is it possible to recover without losing my data? How should I do?

Replace the cord or repair it and leave the disk in its original setting in the external enclosure.
As your disk is bigger than 2 TB there is a high chance that your enclosure contains some additional interface that is effectively changing the logical sector size at the interface.

Follow the steps outlined in
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
including quick search and deep search and post your Testdisk log file.

Apart from this issue I am wondering what made your cat so hungry that it ate your power cord!

Posted: **31 May 2023, 13:00**

Hi Grenier,
Thanks for support, sorry for delay...

I redid the tests suggested by you and the results remain the same...

Follow the print and send the log below.. I initially did the quick search...

: 2023-05-31_08h57_12.png (21.44 KiB) Viewed 11582 times

: 2023-05-31_09h53_39.png (15.85 KiB) Viewed 11578 times

: 2023-05-31_09h56_14.png (17.39 KiB) Viewed 11576 times

I will run deep search now...

My cat is just 2 months old ... as I have a desktop cabinet, he likes to stay on top because it's warm, but when I saw him, he already had the handle in his mouth, gnawing .. lol!

Log generate of quick search:

Code: Select all



Wed May 31 02:40:51 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320071851520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=449406910976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000203091968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000200994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=320069435392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=320070483968
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS541010A7E630, S/N:S0E001SSH6ZDLK, FW:SE0OA4A0
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM024 HN-M101MBB, S/N:S32SJ5CG309663, FW:2BA30003
Disk \\.\PhysicalDrive2 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HD322HJ, S/N:S1RLJ50S462989, FW:1AC01113
Disk \\.\PhysicalDrive3 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HD322HJ, S/N:S1RLJ50S462980, FW:1AC01113
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:S1F10GTN, FW:CC9F
Disk \\.\PhysicalDrive5 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-1CH162, S/N:Z1D6KYBE, FW:CC47
Disk \\.\PhysicalDrive6 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 980 500GB, S/N:0025_38D3_1144_411C., FW:3B4QFXO7
Disk \\.\PhysicalDrive7 - 8589 MB / 8192 MiB - CHS 1044 255 63, sector size=512 - Msft Virtual Disk, FW:1.0

Partition table type defaults to EFI GPT
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - ST3000DM001-9YN166
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
No partition is bootable

Posted: **01 Jun 2023, 00:15**

The deep search prints...

: 2023-05-31_20h10_42.png (21.44 KiB) Viewed 11536 times

: 2023-05-31_20h11_35.png (15.85 KiB) Viewed 11536 times

: 2023-05-31_20h13_10.png (16.58 KiB) Viewed 11536 times

And the log of deep search...

Code: Select all



Wed May 31 02:40:51 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320071851520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=449406910976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000203091968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000200994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=320069435392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=320070483968
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS541010A7E630, S/N:S0E001SSH6ZDLK, FW:SE0OA4A0
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM024 HN-M101MBB, S/N:S32SJ5CG309663, FW:2BA30003
Disk \\.\PhysicalDrive2 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HD322HJ, S/N:S1RLJ50S462989, FW:1AC01113
Disk \\.\PhysicalDrive3 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HD322HJ, S/N:S1RLJ50S462980, FW:1AC01113
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:S1F10GTN, FW:CC9F
Disk \\.\PhysicalDrive5 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-1CH162, S/N:Z1D6KYBE, FW:CC47
Disk \\.\PhysicalDrive6 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 980 500GB, S/N:0025_38D3_1144_411C., FW:3B4QFXO7
Disk \\.\PhysicalDrive7 - 8589 MB / 8192 MiB - CHS 1044 255 63, sector size=512 - Msft Virtual Disk, FW:1.0

Partition table type defaults to EFI GPT
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - ST3000DM001-9YN166
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
No partition is bootable

search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
file_win32_pread(564,16,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,1,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,16,buffer,52628940(3276/0/1)) read err: read after end of file
file_win32_pread(564,3,buffer,52628956(3276/0/17)) read err: read after end of file
file_win32_pread(564,16,buffer,52629505(3276/8/62)) read err: read after end of file
file_win32_pread(564,1,buffer,52629505(3276/8/62)) read err: read after end of file
file_win32_pread(564,14,buffer,52629506(3276/8/63)) read err: read after end of file
BAD_RS LBA=4452868912 7103049
check_part_i386 failed for partition type 04
     FAT16 <32M           277178  68 59 371226   8  8 1510877290
This partition ends after the disk limits. (start=4452868912, size=1510877290, end=5963746201, disk end=5860533168)
file_win32_pread(564,16,buffer,2237657151(139287/182/31)) read err: read after end of file
file_win32_pread(564,1,buffer,2237657151(139287/182/31)) read err: read after end of file
file_win32_pread(564,16,buffer,2237659152(139287/214/16)) read err: read after end of file
file_win32_pread(564,16,buffer,2237706303(139290/197/43)) read err: read after end of file
file_win32_pread(564,16,buffer,2237706319(139290/197/59)) read err: read after end of file
file_win32_pread(564,1,buffer,2237706319(139290/197/59)) read err: read after end of file
file_win32_pread(564,16,buffer,2329466896(145002/155/2)) read err: read after end of file
file_win32_pread(564,1,buffer,2329466896(145002/155/2)) read err: read after end of file
file_win32_pread(564,16,buffer,2329467006(145002/156/49)) read err: read after end of file
file_win32_pread(564,1,buffer,2329467006(145002/156/49)) read err: read after end of file
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (3000 GB / 2794 GiB) seems too small! (< 3053 GB / 2843 GiB)
The following partition can't be recovered:
     FAT16 <32M           277178  68 59 371226   8  8 1510877290

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
file_win32_pread(564,16,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,1,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,16,buffer,52628939(3275/254/63)) read err: read after end of file
file_win32_pread(564,16,buffer,52628940(3276/0/1)) read err: read after end of file
file_win32_pread(564,16,buffer,52628941(3276/0/2)) read err: read after end of file
file_win32_pread(564,1,buffer,52628952(3276/0/13)) read err: read after end of file
file_win32_pread(564,3,buffer,52628953(3276/0/14)) read err: read after end of file
file_win32_pread(564,3,buffer,52628956(3276/0/17)) read err: read after end of file
file_win32_pread(564,16,buffer,52629503(3276/8/60)) read err: read after end of file
file_win32_pread(564,16,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,1,buffer,52629504(3276/8/61)) read err: read after end of file
file_win32_pread(564,1,buffer,52629505(3276/8/62)) read err: read after end of file
file_win32_pread(564,14,buffer,52629506(3276/8/63)) read err: read after end of file
BAD_RS LBA=4452868912 7103049
check_part_i386 failed for partition type 04
     FAT16 <32M           277178  68 59 371226   8  8 1510877290
This partition ends after the disk limits. (start=4452868912, size=1510877290, end=5963746201, disk end=5860533168)
file_win32_pread(564,16,buffer,2237657151(139287/182/31)) read err: read after end of file
file_win32_pread(564,1,buffer,2237657151(139287/182/31)) read err: read after end of file
file_win32_pread(564,16,buffer,2237659152(139287/214/16)) read err: read after end of file
file_win32_pread(564,16,buffer,2237662805(139288/17/15)) read err: read after end of file
file_win32_pread(564,1,buffer,2237662805(139288/17/15)) read err: read after end of file
file_win32_pread(564,16,buffer,2237706303(139290/197/43)) read err: read after end of file
file_win32_pread(564,16,buffer,2237706319(139290/197/59)) read err: read after end of file
file_win32_pread(564,1,buffer,2237706319(139290/197/59)) read err: read after end of file
file_win32_pread(564,16,buffer,2237837808(139298/245/4)) read err: read after end of file
file_win32_pread(564,16,buffer,2329466896(145002/155/2)) read err: read after end of file
file_win32_pread(564,1,buffer,2329466896(145002/155/2)) read err: read after end of file
file_win32_pread(564,16,buffer,2329467006(145002/156/49)) read err: read after end of file
file_win32_pread(564,1,buffer,2329467006(145002/156/49)) read err: read after end of file
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (3000 GB / 2794 GiB) seems too small! (< 3053 GB / 2843 GiB)
The following partition can't be recovered:
     FAT16 <32M           277178  68 59 371226   8  8 1510877290

Results

interface_write()
 
No partition found or selected for recovery

Honestly, I'm desperate...

Posted: **02 Jun 2023, 16:59**

Running new tests...

I remounted my hard disk in your original case...

I could see that apparently my partition was changed to raw by the windows disk manager and testdisk is informing it as gpt in the log...

quicksearch is very slow - now we are running it via usb 3.0, even so, it is very slow, but I'm in no hurry, I'll wait until the end of the scan, because talking to a colleague who has already recovered data in this exact scenario, he told me said that the chances of finding the files are huge, but you need to be patient because on a 3 terabyte disk, it will take a few days to search for everything...

Fingers crossed, it will work!

When it's all over, I'll post the images and logs...

Posted: **03 Jun 2023, 22:01**

ALL FILES ARE RESCUE WITH SUCESS!!

I will buy a new Hard Disk to save my files!

cgsecurity.org

WD External Hard Drive Recovery Help

WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help

Re: WD External Hard Drive Recovery Help