cgsecurity.org

Hi cgsecurity community!

The situation:

• I have a 4TB Western Digital external drive with a single partition, it was formated exFAT.
• It was used as a data storage device, on Windows, with occasional write some more reads, and basically no delete.
• It is about 4 years old, it was last used a few weeks ago when it worked well, and when I tried it a few days ago, Windows saw the partition as RAW, so I could not get any data off.

Desired outcome:

• I want to recover any and all data possible. A small portion was unfortunately not backed up, so that is the main priority.
• If the drive could be saved, great, but it is a secondary target.

Steps tried:

• I tried using recuva, with no success.
• Then I found your tools, and started with testdisk, trying to see if the boot sector was damaged and could be recovered as per the manual:

• Disk /dev/sdd - 4000 GB / 3725 GiB - CHS 486397 255 63
  Partition Start End Size in sectors
  1 P MS Data 2048 7813967871 7813965824
  Boot sector
  Bad: can't read exFAT boot record.
  Backup boot record
  exFAT OK

• When I tried to backup the uncorrupted BS I got an error message:

  Write error: Can't overwrite exFAT main boot record

• Then I also tried to use PhotoRec to recover the files from the disc and get them written to another external drive.
• I let it running through the night and around one third of the sectors it gave me a bad sector error message and this stopped the process.
• I then checked here and found the following post from 2016. This suggests using GNU ddrescue to clone the disk and then run your tools on the new disk.
• viewtopic.php?p=20418&hilit=Write+error ... ord#p20418

From the above it seems I have a corrupted disk with bad sectors, including the sectors containing the main partition table. Based on the above my best guess is to run GNU ddrescue then try restore the boot and copy the files or if that does not work, try using the photorec utility. I am only posting as the advice is from 2016 so I wanted to ask: based on the above are there better approaches since then?

Thank you in advance.

When dealing with bad sectors the first thing to do is to check the SMART parameters to learn about the state of health of your disk. Depending on the result you would then either consult a professional lab or trying to recover stuff yourself.
Self recovery would require running ddrescue as described in the manual. This duplication process would provide you with an image on a disk device with no physical errors (every sector will be readable) only containing logical errors in the duplicate at the location where the original sector was unreadable.

From my experience bad sectors seem to grow like an avalanche. Fooling around with various software on a possibly broken disk will worsen its health state.

Hi recuperation, hi cgsecurity community,

First of all thanks for the previous help, I am trying to continue further with this topic, I have added the additional steps I tried and my new questions.

Here is the status and the steps I have taken:

• I have a 4TB Western Digital external drive with a single partition, it was formated exFAT, used for data storage and became unreadable by Windows.
• I am trying to recover the data from it, however the data is not worth the cost of professional recovery services, so I am trying to get something back with the homemade options.
• I tried using recuva, with no success, then testdisk, that has found a backup bootsector, but could not restore it to the main bootsector.
• I tried using smartmontools on the damaged 4TB dirve however I could not get any results, SMART info was not accessible.
• Based on the previous advice, I have used ddrescue, which could copy most sectors from the device to another 5TB drive (did not have another 4TB so could only make it work like this). As per this there are no bad sectors either, just around 3GBs that cannot be read. Please see the screenshot of both the resulting command line and the recovery map attached.

  

  ddrescueCommandLine.png (238.11 KiB) Viewed 18350 times

  

  ddrescueRecoveryMap.png (33.28 KiB) Viewed 18350 times

• Then I tried using TestDisk on the 5TB disk that was the copy of the originally problematic disk, to restore the boot sector on the new disk or recover files. I did not manage to find a correct 4TB boot record, so I could not recover the partition as per section 9 of the testdisk.pdf, thus I could also not list files from the drive. I have also tried to recover files with the section 8 steps of testdisc, however I had no option to undelete only an option to create a disk image, and I do not know if that would be helpful given that this is already a copy.
• Then I tried using PhotoRec (windows GUI version) on the 5TB disk. This was more successfull compared to the previous trial on the 4TB disk, as the tool started recovering multiple files. As we are talking about 4TBs of data, having many duplicates, with most filenames and all folder structure missing, afterwork is still quite challenging, so I am looking for a better solve if possible. Also my recovery stalled at around 20%.

My current questions:

• So based on the above, do you have an idea of what might be the problem with the original disk and if I have a better way of fixing it then what I tried? (By fixing it I mean recovering the data either from the original or the 5TB copy.)
• If the way to go is the PhotoRec, is there a way to recover filenames, folderstructure, and maybe to filter out files that were already recovered? I did not find anything I can use in the guide, maybe a Linux batch for finding duplicates of images, but I have a lot more files with divers formats.
• With PhotoRec, progress was quite fast, the first 20% was recovered in about 8 hours, however then the tool seemed to have stopped or stalled at least and not recovered anything new for over a day, at which point I have stopped it. Any idea what might be the reason? Also is there a way to continue the recovery from the last tried point like with ddrescue? I have read yes in the guide but when I tried recovery again it started from the very beginning and I could not find any options in the windows GUI version. Should I use the commandline version?

Thank you in advance.

Please post your TestDisk logfile!

Using ddrescue was the right thing to do.
When duplicating the disk onto a bigger disc using ddrescue, it is a good idea to complete delete the clone target before filling it with zeros. This will prevent confusing TestDisk and other recovery software to interpret invalid content in the last TB of your target disk.

As you definitively have a broken source disk you should duplicate your clone again to have a clean second clone of your broken source.
You can use the second clone to play around without worries.
If you do something wrong with the second clone you can clone the first clone to the second one again.
This will be pretty fast as you do not face delays due to unreadable sectors.

As for your smartmontools failure, read my posting here:

viewtopic.php?f=5&t=10910

You bought a an external disk with a size of 4 TB which is beyond the 2 TB boundary for the MBR partitioning schema with sectors having a size of 512 bytes.
As you got the disk with an enclosure from the manufacturer, chances are high that it contains some electronics emulating a sector size of 4096 bytes.
This will allow to use MBR as a partition scheme for greater compatibility. Without emulating electronics, MBR can only address 2 TB with disks using a sector size of 512 bytes and the rest of space will be unusable under windows.

If you partitioned and formated your disk yourself try to remember if you used MBR or GPT.
You should provide TestDisk with the correct partitioning scheme when being asked.

My current questions:

So based on the above, do you have an idea of what might be the problem with the original disk and if I have a better way of fixing it then what I tried?
(By fixing it I mean recovering the data either from the original or the 5TB copy.)

You have unreadable sectors. A smartmontools report would deliver more information. Using ddrescue was a good idea.

Keeping your ddrescue logfile enables to continue the recovery in the future.
In the mean time you should not modifiy your first clone.
I would rerun ddrescue so that it takes care of the unrecovered area if you are not in a hurry. Transfer speed will guide you a little bit. Due to the number of read retries by the firmware of your disk the transfer speed can drop dramatically.

If the way to go is the PhotoRec, is there a way to recover filenames, folderstructure, and maybe to filter out files that were already recovered?

No, not with PhotoRec is the tool of last resort. PhotoRec is a kind of generic method to recovery file data in a smart way but requires files to be stored unfragmented on the disk.
Between the defined and limited repair abilities of TestDisk and the recovery abilities of PhotoRec is a big gap that you can fill with commercial recovery tools.
This gap requires file system specific recovery code.
If such tools cannot provide file names and folder structure at all, there is no need to pay for them because PhotoRec is assumably still the best tool for the "Mad Max" scenario when everything is broken.

I did not find anything I can use in the guide, maybe a Linux batch for finding duplicates of images,

Sorry, finding duplicates is completely out of scope of data recovery software.

but I have a lot more files with divers formats.
With PhotoRec, progress was quite fast, the first 20% was recovered in about 8 hours, however then the tool seemed to have stopped or stalled at least and not recovered anything new for over a day, at which point I have stopped it. Any idea what might be the reason?

Have you run PhotoRec against your defective cloning source? This would be a bad idea as you would have stressed a broken disk.
Furthermore PhotoRec does not deal with unreadable sectors. Ddrescue deals with that.

Also is there a way to continue the recovery from the last tried point like with ddrescue? I have read yes in the guide but when I tried recovery again it started from the very beginning and I could not find any options in the windows GUI version. Should I use the commandline version?

The command line version asks you if the program should continue with an already existing recovery.
Maybe the GUI-version did not see the PhotoRec.ses or it got lost (using a linux USB pen drive?).

If you partitioned and formated your disk yourself, try to buy that external disk again, zero out the disk and redo that partitioning and formating procedure or note the parameters if the disk came the way you used it. There is a backup function for the partition structure in TestDisk that will export that information in a readable text file.
Using some of those hex editors around which translate sector content into user-readable information (for partition tables and boot sectors) you could try to insert that information into your second duplicate.
You are on your own as this is beyond the scope of TestDisk support. You find enough free information about MBR and GPT. There is a open documentation of EXFAT by Microsoft. There is a forensic book by Brian Carrier on file systems.

One issue to overcome is that your target disk most likely has sectors with a size of 512 bytes. Your ddrescue duplicate residing on your target disk has information about a sector size of most likely 4096 bytes. Under linux this can be overcome with the losetup command and creating a virtual device. Under Windows you either have an expensive disk with a sector size of 4096 bytes or have used ddrescue to clone into a file (which requires a disk with a capacity of slighty more than 4 TB) and have some file mounting software which mounts your cloned target file as a device assuming a sector size of 4096 bytes.

Modified 10.1.2024 23:17 MEZ