cgsecurity.org

I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT. Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.

Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.

I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new? But since it is short, I will post it as text.

Yes, I know I made some mistakes, more on that later.

These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.

In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.

I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032

Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.

Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.

And, right now I am scared, and this is why I decided to wrote this post.

Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?

What can I do? Should I stop Photorec, and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?

UPDATE: Photorec is finished. I am not able to locate Photorec's logfile. It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?

If I have missed any critical information you need, please let me know and I try to provide it.

Testdisk LOGFILE:

Mon Jul 24 22:55:31 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000591900160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248871410688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000574672896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=240038969344
Hard disk list
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00DC0B0, S/N:WD-WCC1T1520050, FW:80.00A80
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA HDWD130, S/N:X7HYG4XAS, FW:MX6OACF0
Disk \\.\PhysicalDrive2 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SUV500240G, S/N:50026B76830BAA16, FW:003056RI
Disk \\.\PhysicalDrive3 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 970 EVO Plus 250GB, S/N:0025_3856_91B3_C054., FW:2B2QEXM7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - WDC WD30EZRX-00DC0B0
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860531054 (expected 5860531054)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=5860531054
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=5860531021
hdr_lba_table=5860531022
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT

search_part()
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63
file_win32_pread(544,11,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,11,buffer,5860531053(364801/47/28)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531048(364801/47/23)) read err: read after end of file
file_win32_pread(544,3,buffer,5860531054(364801/47/29)) read err: read after end of file
file_win32_pread(544,8,buffer,5860531052(364801/47/27)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531043(364801/47/18)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531044(364801/47/19)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531045(364801/47/20)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531046(364801/47/21)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531047(364801/47/22)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531049(364801/47/24)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531051(364801/47/26)) read err: read after end of file
file_win32_pread(544,14,buffer,5860531053(364801/47/28)) read err: read after end of file

Results
interface_load
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63 Mon Jul 24 22:08:16 2023
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
0 0000 0000 00 00 00 00 00 00 00 00
2 P Unknown 264192 5860532223 5860268032
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00

interface_write()
0 0000 0000 00 00 00 00 00 00 00 00
0 0000 0000 00 00 00 00 00 00 00 00
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.

Drum8579 wrote: 27 Jul 2023, 12:21 I am sorry if my technical terms are not 100% accurate, English is not my native lanugage. Where I am not sure I try to mark with a question mark. I had an internal 3TB HDD gone RAW, "suddenly", as usual. As far as I know, this is a "simple" NTFS partition, maybe called GPT.

GPT is the name of the partition table scheme, NTFS is the file system of one partition listed in this scheme. It may very well be the only one.

Formatted under Windows 10 a few years ago. Shame on me, but I was thought just to do next-next-next, and I can use the disk. And so I did without a problem.

Sadly, I asked a "tech-savvy" (former, after this stunt...) friend to help me out, because I don't even know what data are on these disk. What I know: it is not "mission-critical", but rather a "nice-to-have". This disk is NOT a boot disk, and as far as I remember never was.

I tried to attach the log files, but I don't have an option next to "Options", called "Upload attachment", as I saw on other phpBB forums. I guess this is because of my account is new?

No, you failed to look to the left hand side at the bottom of the page.

But since it is short, I will post it as text.

Yes, I know I made some mistakes, more on that later.

These steps were NOT done by me, I try to remember what my friend did:
He loaded up testdisk_win.exe, choose the correct disk.
I think he choose "Advanced", then "Load Backup", and then "write", and restarted my machine.
Sadly, he was too quick, and I do not know if he changed anything like primary, or deleted, the type, or anything.
After restart my disk is now "Unallocated". My friend said, this should not happen, and he can't help me anymore, and not talks to me anymore.

In windows disk management software my only option is to make a "New Simple Volume", and I guess this would rewrite the partition table(?), so I didn't do it.

I went to the Wiki, and this forum to help me.
After reading the step-by-step, and multiple forum posts, I did a quick search on the disk. I made a mistake here, and overwrote the logfile. I am sorry. After about 40 hours, it showed "nothing", as in... It did not show any particion? I hope this is the correct term.
I read on this forum (mistake number two, I forgot to save the post, and now I am unable to find it), I should try to load the backup again first, than, if it is "empty" as well, I should try Deeper Search.
After I choose "Load Backup", it showed me two values:
1 P Unknown 34 262177 262144
2 P Unknown 264192 5860532223 5860268032

Which, to me, it seems correct. As far as I understand, the first partition is a "technical" one, containing some "metadata"(?) the operating system needs about the disk, partition type, and etc. And since I only created one ~3TB partition, I think it is correct in sector size.

Again, I can't provide you my source, and I am sorry about that, but I read I should change the type to "MS Data", since it was formatted and used under Windows 10, then hit "P" to list files. Doing this provides me the error, that the filesystem is damaged. This same post mentioned if this happens, I should try PhotoRec. Testdisk is still opened and running, and I am not sure how to go back to do a deeper search.

And, right now I am scared, and this is why I decided to wrote this post.

Photorec is still running at the moment, it is at Pass 1, about 20% (based on the number after "Reading sector"). I know it can (should?will?) do more passes. It looks like this will take also a lot of hours (right now is says 17h42m05, but the countdown is not one second by one second, and slowing down, and I guess this is for only Pass 1), but I want to be prepared. Until this moment it is only recovered one "tx?" file. Anyone has an idea how long a pass take, and how many passed are there?

Running Testdisk and Photorec simultaneously is a pretty bad idea because you are inducing a lot of head movement on a possible dammaged disk.

What can I do? Should I stop Photorec,

Yes.

and somehow I can "save" my disk with Testdisk? As a "non-tech savvy" guy, to me it looks like the disk is fine, just somehow the OS does not recognise it correctly, and maybe I should choose something else in Testdisk to fix it. I could be wrong here. Am I?

UPDATE: Photorec is finished. I am not able to locate Photorec's logfile.

It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.

It was only able to restore one ini file, from an "EFI GPT" partition. What else can I try?

Check the SMART parameters,
viewtopic.php?f=5&t=10910

post the smartmontools log file here, duplicate the disk if necessary using ddrescue as described in the Testdisk manual.
Do not run Testdisk and Photorec simultaneously. Read the manual and the instructions on this site.
Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.
Connect everything and start Testdisk thereafter. Do not manipulate the log file. Instead provice a authentic one here.
Put your logfile between the following code markers: Wait for a response in this forum after having posted the smartmontools report.
Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.

No, you failed to look to the left hand side at the bottom of the page.

I did, and there was only "options". Now, I can see both "Options" and "Attachments", so I attached the logs. I also see that now I am not inside the new users group in this forum.

It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.

I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.

Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.

It is the PhysicalDrive0, the Western Digital.

Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.

I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.

This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:
Smartmontools report as I am only allowed to attach 3 files:

Drum8579 wrote: 27 Jul 2023, 19:03

No, you failed to look to the left hand side at the bottom of the page.

I did, and there was only "options". Now, I can see both "Options" and "Attachments", so I attached the logs. I also see that now I am not inside the new users group in this forum.

Thank you for letting me know! You are right, I can confirm that behaviour using a new login.

It is labeled Photorec.ses and should be located in the folder containing both Testdisk and Photorec executables.

I could only find a Photorec.se2. The forum says it is not supported, so I created a zip file, and uploaded that.

That should be it, sorry!

Do name the broken drive. I can't foresee which one(s) of your possible three disks is broken.

It is the PhysicalDrive0, the Western Digital.

Do not cut that reports into pieces or stick something together like you have probably done the Testdisk log file.

I did not cut any report, and did not stick something together. Why would I do that? I don't understand that much of the log to alter it. And if I alter the log, noone can help me. I simply opened the file, hit ctrl-a, ctrl-c, and ctrl-v here. Can we just assume I did not alter it, because that would be absolutely against my interest? How can I prove that the log is authentic? Everything is connected as is.

Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.

This is what I meant by "testdisk is still running". The quick search was finished. I did not quit this, because I don't know if I close this window I have to do the 40+ hours quick search again, or not:

Screenshot 2023-07-27 195224.png

Smartmontools report as I am only allowed to attach 3 files:

Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?

Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.

Testdisk lists all disks when being started. In your case they were ranging from 0 to 3. Suddenly another physical drive (number 4) appears not being listed at the beginning of the log. There is no explanation for that.

Now I understand why you thought that I altered the log, I have to say that. I wish I can give you an explanation. I am just embarrassed (I am not sure this is the right word for this, probably not), because I have no way to prove, and I understand that every evidence is against me.

Your smartmontools report does not exhibit any nasty surprise. The time that Testdisk needed appears high, if it was searching in a linear manner 3 TB in 40 hours yield 20 MB / sec which is low. How did you connect it?

This is a desktop PC, and an internal drive, it is inside the case, directly connected to the motherboard, via SATA. As far as I know SATA3, this is about a 3 years old computer.

Anyway, the next step is to use the "p"-key ("list files") to see if Testdisk can decode the content of that partition.

It says "can't open filesystem. Filesystem seems damaged."

And inside the log it just repeats:
Failed to startup volume: Invalid argument.