Quick search result: unkown partition and filesystem damaged

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Drum8579
Posts: 3
Joined: 27 Jul 2023, 11:09

Quick search result: unkown partition and filesystem damaged

#1 Post by Drum8579 »

I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT. Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.

Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.

I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new? But since it is short, I will post it as text.

Yes, I know I made some mistakes, more on that later.

These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.

In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.

I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032

Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.

Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.

And, right now I am scared, and this is why I decided to wrote this post.

Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?

What can I do? Should I stop Photorec, and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?

UPDATE: Photorec is finished. I am not able to locate Photorec's logfile. It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?

If I have missed any critical information you need, please let me know and I try to provide it.

Testdisk LOGFILE:

Mon Jul 24 22:55:31 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000591900160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248871410688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000574672896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=240038969344
Hard disk list
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00DC0B0, S/N:WD-WCC1T1520050, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA HDWD130, S/N:X7HYG4XAS, FW:MX6OACF0
Disk \\.\PhysicalDrive2 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SUV500240G, S/N:50026B76830BAA16, FW:003056RI
Disk \\.\PhysicalDrive3 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 970 EVO Plus 250GB, S/N:0025_3856_91B3_C054., FW:2B2QEXM7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - WDC WD30EZRX-00DC0B0
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860531054 (expected 5860531054)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=5860531054
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=5860531022
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT

search_part()
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
file_win32_pread(544,11,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,11,buffer,5860531053(364801/47/28)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531048(364801/47/23)) read err: read after end of file
file_win32_pread(544,3,buffer,5860531054(364801/47/29)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531052(364801/47/27)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531043(364801/47/18)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531044(364801/47/19)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531045(364801/47/20)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531046(364801/47/21)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531049(364801/47/24)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531051(364801/47/26)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531053(364801/47/28)) read err: read after end of file

Results
interface_load
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63 Mon Jul 24 22:08:16 2023
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
0 0000 0000 00 00 00 00 00 00 00 00
2 P Unknown 264192 5860532223 5860268032
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00

interface_write()
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.

recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Quick search result: unkown partition and filesystem damaged

#2 Post by recuperation »

Drum8579 wrote: 27 Jul 2023, 12:21 I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT.
GPT is the name of the partition table scheme, NTFS is the file system of one partition listed in this scheme. It may very well be the only one.

Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.

Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.

I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new?
No, you failed to look to the left hand side at the bottom of the page.

But since it is short, I will post it as text.

Yes, I know I made some mistakes, more on that later.

These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.

In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.

I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032

Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.

Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.

And, right now I am scared, and this is why I decided to wrote this post.

Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?
Running Testdisk and Photorec simultaneously is a pretty bad idea because you are inducing a lot of head movement on a possible dammaged disk.
What can I do? Should I stop Photorec,
Yes.
and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?

UPDATE: Photorec is finished. I am not able to locate Photorec's logfile.
It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.

It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?
Check the SMART parameters,
viewtopic.php?f=5&t=10910

post the smartmontools log file here, duplicate the disk if necessary using ddrescue as described in the Testdisk manual.
Do not run Testdisk and Photorec simultaneously. Read the manual and the instructions on this site.
Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
Connect everything and start Testdisk thereafter. Do not manipulate the log file. Instead provice a authentic one here.
Put your logfile between the following code markers: Wait for a response in this forum after having posted the smartmontools report.
Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.

Drum8579
Posts: 3
Joined: 27 Jul 2023, 11:09

Re: Quick search result: unkown partition and filesystem damaged

#3 Post by Drum8579 »

No, you failed to look to the left hand side at the bottom of the page.
I did, and there was only "options". Now, I can see both "Options" and "Attachments", so I attached the logs. I also see that now I am not inside the new users group in this forum.
It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.
I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.
Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
It is the PhysicalDrive0, the Western Digital.
Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.
I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.

This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:
Right now I am at this stage
Right now I am at this stage
Screenshot 2023-07-27 195224.png (28.15 KiB) Viewed 14799 times
Smartmontools report as I am only allowed to attach 3 files:

Code: Select all

smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w10-b19045] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Western Digital Green
Device Model:     WDC WD30EZRX-00DC0B0
Serial Number:    WD-WCC1T1520050
LU WWN Device Id: 5 0014ee 25e3ad489
Firmware Version: 80.00A80
User Capacity:    3 000 591 900 160 bytes [3,00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Device is:        In smartctl database 7.3/5319
ATA Version is:   ACS-2 (minor revision not indicated)
SATA Version is:  SATA 3.0, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Thu Jul 27 19:30:22 2023 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x84)	Offline data collection activity
					was suspended by an interrupting command from host.
					Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0)	The previous self-test routine completed
					without error or no self-test has ever 
					been run.
Total time to complete Offline 
data collection: 		(42000) seconds.
Offline data collection
capabilities: 			 (0x7b) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					Offline surface scan supported.
					Self-test supported.
					Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (   2) minutes.
Extended self-test routine
recommended polling time: 	 ( 421) minutes.
Conveyance self-test routine
recommended polling time: 	 (   5) minutes.
SCT capabilities: 	       (0x70b5)	SCT Status supported.
					SCT Feature Control supported.
					SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   200   200   051    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0027   174   170   021    Pre-fail  Always       -       6258
  4 Start_Stop_Count        0x0032   086   086   000    Old_age   Always       -       14652
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x002e   200   200   000    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   075   075   000    Old_age   Always       -       18444
 10 Spin_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
 11 Calibration_Retry_Count 0x0032   100   100   000    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   097   097   000    Old_age   Always       -       3588
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       146
193 Load_Cycle_Count        0x0032   154   154   000    Old_age   Always       -       138663
194 Temperature_Celsius     0x0022   118   107   000    Old_age   Always       -       32
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0032   200   200   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0030   200   200   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       1
200 Multi_Zone_Error_Rate   0x0008   200   200   000    Old_age   Offline      -       0

SMART Error Log Version: 1
ATA Error Count: 1
	CR = Command Register [HEX]
	FR = Features Register [HEX]
	SC = Sector Count Register [HEX]
	SN = Sector Number Register [HEX]
	CL = Cylinder Low Register [HEX]
	CH = Cylinder High Register [HEX]
	DH = Device/Head Register [HEX]
	DC = Device Command Register [HEX]
	ER = Error register [HEX]
	ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 1 occurred at disk power-on lifetime: 2002 hours (83 days + 10 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  04 61 00 53 4f c2 e0  Device Fault; Error: ABRT

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  b0 d8 00 00 4f c2 e0 08      00:00:11.935  SMART ENABLE OPERATIONS
  91 00 3f 00 00 00 ef 08      00:00:11.935  INITIALIZE DEVICE PARAMETERS [OBS-6]
  c6 00 10 00 00 00 e0 08      00:00:11.289  SET MULTIPLE MODE
  91 00 3f 00 00 00 ef 08      00:00:11.287  INITIALIZE DEVICE PARAMETERS [OBS-6]
  10 00 00 00 00 00 e0 08      00:00:11.284  RECALIBRATE [OBS-4]

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Aborted by host               10%     18391         -
# 2  Short offline       Aborted by host               10%     18390         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

Attachments
photorec.zip
Photorec log
(214 Bytes) Downloaded 208 times
testdisk.log
testdisk log
(4.28 KiB) Downloaded 213 times

recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Quick search result: unkown partition and filesystem damaged

#4 Post by recuperation »

Drum8579 wrote: 27 Jul 2023, 19:03
No, you failed to look to the left hand side at the bottom of the page.
I did, and there was only "options". Now, I can see both "Options" and "Attachments", so I attached the logs. I also see that now I am not inside the new users group in this forum.
Thank you for letting me know! You are right, I can confirm that behaviour using a new login.
It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.
I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.
That should be it, sorry!
Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
It is the PhysicalDrive0, the Western Digital.
Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.
I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.
Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.

This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:

Screenshot 2023-07-27 195224.png

Smartmontools report as I am only allowed to attach 3 files:
Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?

Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.

Drum8579
Posts: 3
Joined: 27 Jul 2023, 11:09

Re: Quick search result: unkown partition and filesystem damaged

#5 Post by Drum8579 »

Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.
Now I understand why you thought that I altered the log, I have to say that. I wish I can give you an explanation. I am just embarrassed (I am not sure this is the right word for this, probably not), because I have no way to prove, and I understand that every evidence is against me.
Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?
This is a desktop PC, and an internal drive, it is inside the case, directly connected to the motherboard, via SATA. As far as I know SATA3, this is about a 3 years old computer.
Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.
It says "can't open filesystem. Filesystem seems damaged."

And inside the log it just repeats:
Failed to startup volume: Invalid argument.

Locked