Exernal USB Harddrive accidently destroyed with timemaschine

How to use TestDisk to recover lost partition
Post Reply
Message
Author
HOLSCH
Posts: 4
Joined: 06 Sep 2012, 07:21

Exernal USB Harddrive accidently destroyed with timemaschine

#1 Post by HOLSCH » 07 Sep 2012, 00:09

Dear Testdisk developer and support team,

I do have an external harddrive, which I accidentily choosed for MAC Timemaschine.
The Partition is now HFS I'm pretty sure that it was Fat32 before. And only had one partition.
when I do a deep scan to find the old partition it only recognizes HFS Filesystem.

Could someone please have a look?

Here'S the log (I used the newest 6.14)

Thank you so much

regards

HOLSCH

Thu Sep 6 22:36:18 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=62906941440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=97124106240
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - TOSHIBA MK1661GSYFN, FW:MD000D
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HCS5C1050CLA382

Partition table type (auto): EFI GPT
Disk /dev/sdb - 500 GB / 465 GiB - Hitachi HCS5C1050CLA382
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 60801 80 63 976773167
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 60801 80 63 976773167

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFSX magic value at 32/0/1
part_size 976101344
HFS 32 0 1 60791 127 8 976101344
HFSX blocksize=4096, 499 GB / 465 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HFS 32 0 1 60791 254 63 976109400
HFSX blocksize=4096, 499 GB / 465 GiB

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFSX magic value at 32/0/1
part_size 976101344
HFS 32 0 1 60791 127 8 976101344
HFSX blocksize=4096, 499 GB / 465 GiB

HFS magic value at 1473/79/15
part_size 327942146
HFS 1473 79 15 21886 195 7 327942146 [GQUURLD:.#
]
HFS blocksize=50331648, 167 GB / 156 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
HFS 32 0 1 60791 254 63 976109400
HFSX blocksize=4096, 499 GB / 465 GiB
HFS 1473 79 15 21886 227 37 327944192 [GQUURLD:.#
]
HFS blocksize=50331648, 167 GB / 156 GiB

interface_write()
1 P HFS 1473 79 15 21886 227 37 327944192 [GQUURLD:.#
]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63

HFS magic value at 1473/79/15
Current partition structure:
1 P HFS 1473 79 15 21886 227 37 327944192 [GQUURLD:.#
]
No partition is bootable

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFSX magic value at 32/0/1
part_size 976101344
HFS 32 0 1 60791 127 8 976101344
HFSX blocksize=4096, 499 GB / 465 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HFS 32 0 1 60791 254 63 976109400
HFSX blocksize=4096, 499 GB / 465 GiB

interface_write()
1 * HFS 32 0 1 60791 254 63 976109400



Fri Sep 7 00:26:09 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=62906941440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=97124106240
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=167907426304
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - TOSHIBA MK1661GSYFN, FW:MD000D
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HCS5C1050CLA382

Partition table type (auto): EFI GPT
Disk /dev/sdb - 500 GB / 465 GiB - Hitachi HCS5C1050CLA382
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63

HFS magic value at 1473/79/15
Current partition structure:
1 P HFS 1473 79 15 21886 227 37 327944192 [GQUURLD:.#
]
No partition is bootable

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

HFSX magic value at 32/0/1
part_size 976101344
HFS 32 0 1 60791 127 8 976101344
HFSX blocksize=4096, 499 GB / 465 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HFS 32 0 1 60791 254 63 976109400
HFSX blocksize=4096, 499 GB / 465 GiB

interface_write()
1 * HFS 32 0 1 60791 254 63 976109400

Sponsored links

HOLSCH
Posts: 4
Joined: 06 Sep 2012, 07:21

Re: Exernal USB Harddrive accidently destroyed with timemasc

#2 Post by HOLSCH » 07 Sep 2012, 00:45

I did some deeper investigation and read something about the disk geometry.

This is what I found in the Hitachi OEM Specification, as I do have the Feeling, the geometry is not correctly identified

This comes from TestDisk:
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HCS5C1050CLA382
The Geometry from Hitachi, please see the attached Screenshot
9.3 Sector Addressing Mode
All addressing of data sectors recorded on the device's media is by a logical sector address. The logical CHS
address for HDS7210xxCLA3yz / HUA7220xxCLA33z / HCS5C10xxCLA382 / HCS7210xxCLA3y2 /
HDS5C10xxCLA382 is different from the actual physical CHS location of the data sector on the disk media. All
addressing of data sectors recorded on the device's media.
HDS7210xxCLA3yz / HUA7220xxCLA33z / HCS5C10xxCLA382 / HCS7210xxCLA3y2 /
HDS5C10xxCLA382 support both Logical CHS Addressing Mode and LBA Addressing Mode as the sector
addressing mode.
The host system may select either the currently selected CHS translation addressing or LBA addressing on a
command-by-command basis by using the L bit in the DEVICE/HEAD register. So a host system must set the L
bit to 1 if the host uses LBA Addressing mode.
9.3.1 Logical CHS Addressing Mode
The logical CHS addressing is made up of three fields: the cylinder number, the head number and the sector
number. Sectors are numbered from 1 to the maximum value allowed by the current CHS translation mode but
can not exceed 255(0FFh). Heads are numbered from 0 to the maximum value allowed by the current CHS
translation mode but can not exceed 15(0Fh). Cylinders are numbered from 0 to the maximum value allowed by
the current CHS translation mode but cannot exceed 65535(0FFFFh).
When the host selects a CHS translation mode using the INITIALIZE DEVICE PARAMETERS command, the
host requests the number of sectors per logical track and the number of heads per logical cylinder. The device
then computes the number of logical cylinders available in requested mode.
The default CHS translation mode is described in the Identify Device Information. The current CHS translation
mode also is described in the Identify Device Information.
9.3.2 LBA Addressing Mode
Logical sectors on the device shall be linearly mapped with the first LBA addressed sector (sector 0) being the
same sector as the first logical CHS addressed sector (cylinder 0, head 0, sector 1). Irrespective of the logical
CHS translation mode currently in effect, the LBA address of a given logical sector does not change. The
following is always true:
LBA = ( (cylinder * heads_per_cylinder + heads)
* sectors_per_track ) + sector - 1
where heads_per_cylinder and sectors_per_track are the current translation mode values.
On LBA addressing mode, the LBA value is set to the following register.
Device/Head <--- LBA
bits
27-24
Cylinder High <--- LBA
bits
23-16
Cylinder Low <--- LBA
bits
15- 8
Sector Number <--- LBA
bits
7- 0
Attachments
hitachi.jpg
hitachi.jpg (216.84 KiB) Viewed 1904 times

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Exernal USB Harddrive accidently destroyed with timemasc

#3 Post by Fiona » 07 Sep 2012, 08:11

Did you try to select partition table type Intel for your external disk?
Might be possible that the manufacturer did preformat your disk using intel.

Fiona

HOLSCH
Posts: 4
Joined: 06 Sep 2012, 07:21

Re: Exernal USB Harddrive accidently destroyed with timemasc

#4 Post by HOLSCH » 07 Sep 2012, 11:45

Hi Fiona,

yes, I did. I'm pretty sure, that the Filesystem was Fat32 as it was possible to see the data on both systems (MAC/PC)
It seems, that Timemaschine created the HFS Filesystem on the Drive which is now empty and did not show any data.

Is it the correct approach, to change Geometry settings in the tool with the Data from the Harddisk Vendor?
I'm not sure, why the Testdisk tool shows 255 Head instead of the 16 reported by Hitachi.

(BTW: When I change the geometry to 16 Heads, it shows wrong Harddisk size (IT's a 500GB Hitachi)

Thank you very much for your help

I really do appreciate it

regards

HOLSCH

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Exernal USB Harddrive accidently destroyed with timemasc

#5 Post by Lito » 08 Sep 2012, 07:38

@Holsch: looking at your logs, it seems to me that the program identified two disks correctly:

One disk of 160 GB Toshiba (most likely a laptop)
One disk of 500 GB Hitachi (partitioned in two: C: and D:)

I only could guess that disk of 500 GB had Windows installed. Forgive me if i am wrong, but a disk of that size most likely has been formatted as NTFS. The partition is far too big to a reliable FAT32 partition.

Looking again at your log, it loks like to me, that you did not choose Intel partition type. It seems that the program was left in the first choice of the list (default). The program points correctly at the type of partition, at the end of execution.

The picture from Hitachi, seems to be wrong. If you look carefully at the data in the table, it gives the same values for both disks. The only difference is in the value for the size.

I guess that the program could not find a drive E:\ because there is not such a drive. The sintax of the last command line prompts is different from what the program churns out automatically. I do not know the reason, but if you were looking for a Hitachi disk of some 500 GB, has not been destroyed and is looking at you in wait.

If i was you i would start retrieving and saving data files, and then i would have a disk ready to be wiped, formatted and reuse. Good luck in your quest.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests