Recovering a partition from a drive that stopped working after a few weeks of disuse?

[ryutis]

A few weeks ago I suffered a catastrophic Windows failure and decided to just leave the machine alone for a while. Last night I pulled the drives out and was able to access all of them (currently on OSX and using an NTFS driver but I have a Windows VM set up as well) except one, it refuses to connect. OSX says it can't recognize the disk though it recognizes the container (but no partitions appear) and Windows' Disk Management says the drive is 'dynamic' and 'invalid'. The drive is a ""1TB"" (931GB) WD10EZEX-00BN5A0 and it was working flawlessly before the Windows installation on my other drive kicked the bucket though the drive was always around 99.99% full but it never seemed to complain. I've booted up testdisk, selected the drive > Intel > Analyse > Quick Search and it seems to find my old partition (with its actual name) after just a few seconds. If I stop the scan after that it tells me that it can't be recovered. What do?

[recuperation]

Please continue the recovery process using deep search as described here:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

[ryutis]

Please continue the recovery process using deep search as described here:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I already ran it under the Windows VM but I was tired and didn't think about saving the logs, here's the screenshot of what it found after the deep search. Currently running it again, saving logs this time in case they're useful. Unfortunately I still got that same error after that first deep scan so I can't proceed with the rest of the recovery.

[ryutis]

It completed again. Here's the log.

Code: Select all

Mon Nov 20 05:20:44 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=274877906944
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=274322161664
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\H:
Hard disk list
Disk \\.\PhysicalDrive0 - 274 GB / 256 GiB - CHS 33418 255 63, sector size=512 - Parallels Virtual NVMe Disk, S/N:AD41_6D90_6813_CF4F_80FC_14F6_65F0_B8CA.
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EZEX-00BN5A0, S/N:000000125326, FW:01.0

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - WDC WD10 EZEX-00BN5A0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1 121601  48 31 1953523057
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 63/221/31
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 121664 181 53 1953517568 [Games]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1026048, size=1953517568, end=1954543615, disk end=1953525168)
BAD_RS LBA=4730476522 14920069
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA            294458 138 59 346310 109 31  833000526
This partition ends after the disk limits. (start=4730476522, size=833000526, end=5563477047, disk end=1953525168)
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1000 GB / 931 GiB) seems too small! (< 2848 GB / 2652 GiB)
The following partitions can't be recovered:
     HPFS - NTFS             63 221 31 121664 181 53 1953517568 [Games]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
     FAT32 LBA            294458 138 59 346310 109 31  833000526

Results

interface_write()
 
No partition found or selected for recovery

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 63/188/61
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=524287488, part_size=1000200994816, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 63/221/30
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 30    1024000
     NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 121664 181 53 1953517568 [Games]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1026048, size=1953517568, end=1954543615, disk end=1953525168)
Search for partition aborted
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
     HPFS - NTFS             63 221 31 121664 181 53 1953517568 [Games]
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000
     NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

   P HPFS - NTFS              0  32 33    63 221 30    1024000
     NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P HPFS - NTFS              0  32 33    63 221 30    1024000
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

[ryutis]

Nope, still trying to get it to work. Someone suggested installing it back in the original machine but it's not possible at this moment.

[ryutis]

Still stuck. Any suggestions?

[recuperation]

You might have unreadable sectors.
Check your SMART parameters and publish your logfile here:
viewtopic.php?f=5&t=10910

It might be necessary to duplicate your drive using ddrescue as described in the manual.

If Testdisk can't help you reading the duplicate you would need to try commercial third party software.

[ryutis]

You might have unreadable sectors.
Check your SMART parameters and publish your logfile here:
viewtopic.php?f=5&t=10910

It might be necessary to duplicate your drive using ddrescue as described in the manual.

If Testdisk can't help you reading the duplicate you would need to try commercial third party software.

Hello, thanks for the help. I've attached the logfiles - diskutil lists the disk under two names so I did both and named the files accordingly. /dev/disk2s1 was the one labeled 'Windows_LDM'
I've tried using both a Sabrent and UGREEN SATA to USB 3 adapters if that matters at all - both are powered by an external power supply of course.
Should I skip straight to ddrescue? I think I might've accidentally created a new partition with testdisk the very first time I booted it up and scanned the drive.

[recuperation]

I can't find any source of physical dammage in your logfiles.
As there may be some now missing electronics in your enclosure for sector size emulation you should rerun Testdisk with the disk being put in the enclosure. If that fails use Photorec or a third party tool.

[ryutis]

I can't find any source of physical dammage in your logfiles.
As there may be some now missing electronics in your enclosure for sector size emulation you should rerun Testdisk with the disk being put in the enclosure. If that fails use Photorec or a third party tool.

Alright, I guess installing the drive back in the original motherboard was inevitable.
I'll let you know if anything changes once I've installed it back on the original motherboard and installed a copy of Windows on another drive, thanks for the help.
Hope the drive just works again, if it doesn't I need to run a deep scan with testdisk again and hope it says it can recover the partition, right?