I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT. Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.
Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.
I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new? But since it is short, I will post it as text.
Yes, I know I made some mistakes, more on that later.
These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.
In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.
I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032
Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.
Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.
And, right now I am scared, and this is why I decided to wrote this post.
Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?
What can I do? Should I stop Photorec, and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?
UPDATE: Photorec is finished. I am not able to locate Photorec's logfile. It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?
If I have missed any critical information you need, please let me know and I try to provide it.
Testdisk LOGFILE:
Mon Jul 24 22:55:31 2023
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000591900160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248871410688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000574672896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=240038969344
Hard disk list
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00DC0B0, S/N:WD-WCC1T1520050, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA HDWD130, S/N:X7HYG4XAS, FW:MX6OACF0
Disk \\.\PhysicalDrive2 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SUV500240G, S/N:50026B76830BAA16, FW:003056RI
Disk \\.\PhysicalDrive3 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 970 EVO Plus 250GB, S/N:0025_3856_91B3_C054., FW:2B2QEXM7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - WDC WD30EZRX-00DC0B0
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860531054 (expected 5860531054)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=5860531054
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=5860531022
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT
search_part()
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
file_win32_pread(544,11,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,11,buffer,5860531053(364801/47/28)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531048(364801/47/23)) read err: read after end of file
file_win32_pread(544,3,buffer,5860531054(364801/47/29)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531052(364801/47/27)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531043(364801/47/18)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531044(364801/47/19)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531045(364801/47/20)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531046(364801/47/21)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531049(364801/47/24)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531051(364801/47/26)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531053(364801/47/28)) read err: read after end of file
Results
interface_load
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63 Mon Jul 24 22:08:16 2023
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
0 0000 0000 00 00 00 00 00 00 00 00
2 P Unknown 264192 5860532223 5860268032
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
interface_write()
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Quick search result: unkown partition and filesystem damaged
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 2767
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Quick search result: unkown partition and filesystem damaged
GPT is the name of the partition table scheme, NTFS is the file system of one partition listed in this scheme. It may very well be the only one.Drum8579 wrote: ↑27 Jul 2023, 12:21 I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT.
No, you failed to look to the left hand side at the bottom of the page.
Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.
Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.
I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new?
Running Testdisk and Photorec simultaneously is a pretty bad idea because you are inducing a lot of head movement on a possible dammaged disk.
But since it is short, I will post it as text.
Yes, I know I made some mistakes, more on that later.
These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.
In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.
I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032
Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.
Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.
And, right now I am scared, and this is why I decided to wrote this post.
Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?
Yes.What can I do? Should I stop Photorec,
It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?
UPDATE: Photorec is finished. I am not able to locate Photorec's logfile.
Check the SMART parameters,
It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?
viewtopic.php?f=5&t=10910
post the smartmontools log file here, duplicate the disk if necessary using ddrescue as described in the Testdisk manual.
Do not run Testdisk and Photorec simultaneously. Read the manual and the instructions on this site.
Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
Connect everything and start Testdisk thereafter. Do not manipulate the log file. Instead provice a authentic one here.
Put your logfile between the following code markers:
Code: Select all
Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.
Re: Quick search result: unkown partition and filesystem damaged
I did, and there was only "options". Now, I can see both "Options" and "Attachments", so I attached the logs. I also see that now I am not inside the new users group in this forum.No, you failed to look to the left hand side at the bottom of the page.
I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.
It is the PhysicalDrive0, the Western Digital.Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.
This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:
Smartmontools report as I am only allowed to attach 3 files:
Code: Select all
smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w10-b19045] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Western Digital Green
Device Model: WDC WD30EZRX-00DC0B0
Serial Number: WD-WCC1T1520050
LU WWN Device Id: 5 0014ee 25e3ad489
Firmware Version: 80.00A80
User Capacity: 3 000 591 900 160 bytes [3,00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Device is: In smartctl database 7.3/5319
ATA Version is: ACS-2 (minor revision not indicated)
SATA Version is: SATA 3.0, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is: Thu Jul 27 19:30:22 2023 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
General SMART Values:
Offline data collection status: (0x84) Offline data collection activity
was suspended by an interrupting command from host.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (42000) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 421) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x70b5) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail Always - 0
3 Spin_Up_Time 0x0027 174 170 021 Pre-fail Always - 6258
4 Start_Stop_Count 0x0032 086 086 000 Old_age Always - 14652
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail Always - 0
7 Seek_Error_Rate 0x002e 200 200 000 Old_age Always - 0
9 Power_On_Hours 0x0032 075 075 000 Old_age Always - 18444
10 Spin_Retry_Count 0x0032 100 100 000 Old_age Always - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age Always - 0
12 Power_Cycle_Count 0x0032 097 097 000 Old_age Always - 3588
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age Always - 146
193 Load_Cycle_Count 0x0032 154 154 000 Old_age Always - 138663
194 Temperature_Celsius 0x0022 118 107 000 Old_age Always - 32
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age Always - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 200 200 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 1
200 Multi_Zone_Error_Rate 0x0008 200 200 000 Old_age Offline - 0
SMART Error Log Version: 1
ATA Error Count: 1
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.
Error 1 occurred at disk power-on lifetime: 2002 hours (83 days + 10 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 61 00 53 4f c2 e0 Device Fault; Error: ABRT
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
b0 d8 00 00 4f c2 e0 08 00:00:11.935 SMART ENABLE OPERATIONS
91 00 3f 00 00 00 ef 08 00:00:11.935 INITIALIZE DEVICE PARAMETERS [OBS-6]
c6 00 10 00 00 00 e0 08 00:00:11.289 SET MULTIPLE MODE
91 00 3f 00 00 00 ef 08 00:00:11.287 INITIALIZE DEVICE PARAMETERS [OBS-6]
10 00 00 00 00 00 e0 08 00:00:11.284 RECALIBRATE [OBS-4]
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Aborted by host 10% 18391 -
# 2 Short offline Aborted by host 10% 18390 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
- Attachments
-
- photorec.zip
- Photorec log
- (214 Bytes) Downloaded 236 times
-
- testdisk.log
- testdisk log
- (4.28 KiB) Downloaded 235 times
-
- Posts: 2767
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Quick search result: unkown partition and filesystem damaged
Thank you for letting me know! You are right, I can confirm that behaviour using a new login.
That should be it, sorry!I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.
Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.It is the PhysicalDrive0, the Western Digital.Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.
Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?
This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:
Screenshot 2023-07-27 195224.png
Smartmontools report as I am only allowed to attach 3 files:
Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.
Re: Quick search result: unkown partition and filesystem damaged
Now I understand why you thought that I altered the log, I have to say that. I wish I can give you an explanation. I am just embarrassed (I am not sure this is the right word for this, probably not), because I have no way to prove, and I understand that every evidence is against me.Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.
This is a desktop PC, and an internal drive, it is inside the case, directly connected to the motherboard, via SATA. As far as I know SATA3, this is about a 3 years old computer.Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?
It says "can't open filesystem. Filesystem seems damaged."Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.
And inside the log it just repeats:
Failed to startup volume: Invalid argument.