After Deep search impossible to recover partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pollyargue
Posts: 2
Joined: 07 Dec 2023, 09:42

After Deep search impossible to recover partition

#1 Post by pollyargue »

One of two partitions (a 4T partition) on a 5T external hard disk suddenly appears as raw. I launched testdisk and tried to follow all the instructions but my pc still wants to format it.
I got this log but i cannot seem to decipher it.
It is the PhysicalDrive2 WD My Passport 2627 in the log
I was wondering if there is any possibility of recover it or it is lost forever.

Code: Select all


Wed Sep 27 06:13:30 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=5000947302400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000752599040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=215247349248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=645280038912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396059136
filewin32_getfilesize(\\.\F:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1068785205248
filewin32_getfilesize(\\.\H:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=3932158951424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=37535875072
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM 003-1ER162, S/N:Z4Y3SQRG, FW:CC45
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EFRX-68EUZN0, S/N:WD-WMC4M1436700, FW:80.0
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63, sector size=512 - WD My Passport 2627, S/N:WX92D909SAFJ, FW:4008
Disk \\.\PhysicalDrive3 - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WD Elements 25A3, S/N:WCC7K6XT02T9, FW:1021

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - WD My Passport 2627
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=9767475199 (expected 9767475199)
hdr_lba_start=34
hdr_lba_end=9767475166
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

search_part()
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=1068785205248, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1068786253824, part_size=3932158951424, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=9767473151, size=9767471104, end=19534944254, disk end=9767475200)
file_win32_pread(468,11,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,11,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,8,buffer,9767475195(607997/53/52)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475188(607997/53/45)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475189(607997/53/46)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475190(607997/53/47)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475191(607997/53/48)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475194(607997/53/51)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475198(607997/53/55)) read err: read after end of file
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (5000 GB / 4657 GiB) seems too small! (< 10001 GB / 9314 GiB)
The following partition can't be recovered:
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB

Results
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
Invalid partition structure.

Analyse Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=9767475199 (expected 9767475199)
hdr_lba_start=34
hdr_lba_end=9767475166
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

search_part()
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=1068785205248, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1068786253824, part_size=3932158951424, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=9767473151, size=9767471104, end=19534944254, disk end=9767475200)
file_win32_pread(468,11,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,11,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,8,buffer,9767475195(607997/53/52)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475188(607997/53/45)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475189(607997/53/46)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475190(607997/53/47)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475191(607997/53/48)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475194(607997/53/51)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475198(607997/53/55)) read err: read after end of file
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (5000 GB / 4657 GiB) seems too small! (< 10001 GB / 9314 GiB)
The following partition can't be recovered:
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB

Results
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB

interface_write()
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

search_part()
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=1068785205248, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1068786253824, part_size=3932158951424, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=9767473151, size=9767471104, end=19534944254, disk end=9767475200)
file_win32_pread(468,2,buffer,9767475199(607997/53/56)) read err: read after end of file
Search for partition aborted
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (5000 GB / 4657 GiB) seems too small! (< 10001 GB / 9314 GiB)
The following partition can't be recovered:
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB

Results
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB

interface_write()
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

interface_write()
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

interface_write()
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]
simulate write!

Analyse Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=9767475199 (expected 9767475199)
hdr_lba_start=34
hdr_lba_end=9767475166
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048 2087473151 2087471104 [Lab_1T]
 2 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]

search_part()
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=1068785205248, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1068786253824, part_size=3932158951424, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=9767473151, size=9767471104, end=19534944254, disk end=9767475200)
file_win32_pread(468,11,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,11,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,8,buffer,9767475195(607997/53/52)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475188(607997/53/45)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475189(607997/53/46)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475190(607997/53/47)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475191(607997/53/48)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475194(607997/53/51)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475198(607997/53/55)) read err: read after end of file
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (5000 GB / 4657 GiB) seems too small! (< 10001 GB / 9314 GiB)
The following partition can't be recovered:
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB

Results
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=1068785205248, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB

HFS magic value at 6169/196/30
part_size 25198594
     Mac HFS                 99117362  124315955   25198594
     HFS blocksize=16777216, 12 GB / 12 GiB

HFS magic value at 6169/196/32
part_size 25198594
     Mac HFS                 73918772   99117365   25198594
     HFS found using backup sector!, 12 GB / 12 GiB
     BeFS                   381986444 29627721008588427 29627720626601984 [5OOeU
Y25FJWFBlBnmHopD9SRpF5ilM]
     BeFS blocksize=33554432, 15169392 TB / 13796482 TiB
This partition ends after the disk limits. (start=381986444, size=29627720626601984, end=29627721008588427, disk end=9767475200)
     BeFS                   458889708 35913386721984491 35913386263094784 [<2+1,7.PTBVD1\4);>$M8.O T*8]
     BeFS blocksize=262144, 18387653 TB / 16723473 TiB
This partition ends after the disk limits. (start=458889708, size=35913386263094784, end=35913386721984491, disk end=9767475200)
     BeFS                   458897764 35913386721992547 35913386263094784 [<2+1,7.PTBVD1\4);>$M8.O T*8]
     BeFS blocksize=262144, 18387653 TB / 16723473 TiB
This partition ends after the disk limits. (start=458897764, size=35913386263094784, end=35913386721992547, disk end=9767475200)

SYSV4 Marker at 42409/112/57

recover_sysv4
       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown                681307697 52764486384 52083178688 [¸Ê%–7]
     SysV4, 26 TB / 24 TiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster
NTFS at 129939/49/30
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/30
filesystem size           2087471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473151 4174944254 2087471104
     NTFS, blocksize=4096, 1068 GB / 995 GiB
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1068786253824, part_size=3932158951424, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 129939/49/31
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown               2221641369 4021419486 1799778118
     FATX, 921 GB / 858 GiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown               2474219011 8263057842738690 8263055368519680
     WBFS, 4230684 TB / 3847785 TiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Unusual, only one FAT
FAT16 at 156867/175/5
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 1-194
FAT2 : 1-194
start_rootdir : 195
Data : 197-99138
sectors : 99139
cluster_size : 2
no_of_cluster : 49471 (2 - 49472)
fat_length 194 calculated 194
heads/cylinder 16 (FAT) != 255 (HD)

FAT16 at 156867/175/5
     MS Data               2520079384 2520178522      99139
     FAT16, blocksize=1024, 50 MB / 48 MiB
check_FAT: Bad jump in FAT partition
check_FAT: Unusual, only one FAT
FAT16 at 163827/85/31
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 1-189
FAT2 : 1-189
start_rootdir : 190
Data : 192-96553
sectors : 96554
cluster_size : 2
no_of_cluster : 48181 (2 - 48182)
fat_length 189 calculated 189
heads/cylinder 16 (FAT) != 255 (HD)

FAT16 at 163827/85/31
     MS Data               2631886140 2631982693      96554
     FAT16, blocksize=1024, 49 MB / 47 MiB
FAT12 at 163920/198/35
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 163920/198/35
     MS Data               2633387308 2633390187       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     BeFS                  2640548513 18729702183375520 18729699542827008 [6Tzl1I5vILMTjhsJFZCsmuK1BIXg1gn3]
     BeFS blocksize=4096, 9589606 TB / 8721696 TiB
This partition ends after the disk limits. (start=2640548513, size=18729699542827008, end=18729702183375520, disk end=9767475200)
check_FAT: Bad number of sectors per cluster

LVM magic value at 208001/147/27
check_FAT: Bad jump in FAT partition
FAT12 at 262613/207/47
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 262613/207/47
     MS Data               4218890932 4218893811       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 262613/252/62
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 262613/252/62
     MS Data               4218893782 4218896661       2880 [TEST]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 277259/13/23
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 277259/13/23
     MS Data               4454166676 4454169555       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
check_FAT: Bad jump in FAT partition

HFS magic value at 478565/169/10
part_size 31245329
     Mac HFS               7688157381 7719402709   31245329
     HFS blocksize=262144, 15 GB / 14 GiB

HFS magic value at 478565/169/12
part_size 31245329
     Mac HFS               7656912056 7688157384   31245329
     HFS found using backup sector!, 15 GB / 14 GiB

cramfs Marker at 483298/14/16

recover_cramfs
     Linux filesys. data   7764183267 7770984638    6801371 [‡¼¬ÿûo‚ìðË¥fà ]
     cramfs, 3482 MB / 3320 MiB

cramfs Marker at 483298/14/17

recover_cramfs
     Linux filesys. data   7764183268 7770984639    6801371 [‡¼¬ÿûo‚ìðË¥fà ]
     cramfs, 3482 MB / 3320 MiB

HFS magic value at 497766/151/12
part_size 16875522
     Mac HFS               7996620314 8013495835   16875522 [ÿÿûo‚ìðË¥fà ]
     HFS blocksize=16777216, 8640 MB / 8240 MiB

HFS magic value at 497766/151/14
part_size 16875522
     Mac HFS               7979744796 7996620317   16875522 [ÿÿûo‚ìðË¥fà ]
     HFS found using backup sector!, 8640 MB / 8240 MiB
NTFS at 607996/243/55
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS found using backup sector, blocksize=4096, 3932 GB / 3662 GiB
NTFS at 607996/243/55
filesystem size           7679997952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767471103 17447469054 7679997952
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
This partition ends after the disk limits. (start=9767471103, size=7679997952, end=17447469054, disk end=9767475200)
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 607997/21/24
filesystem size           9767471104
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=9767473151, size=9767471104, end=19534944254, disk end=9767475200)
file_win32_pread(468,11,buffer,9767475195(607997/53/52)) read err: read after end of file
file_win32_pread(468,8,buffer,9767475194(607997/53/51)) read err: read after end of file
file_win32_pread(468,8,buffer,9767475198(607997/53/55)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475187(607997/53/44)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475188(607997/53/45)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475189(607997/53/46)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475190(607997/53/47)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475191(607997/53/48)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475192(607997/53/49)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475194(607997/53/51)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475196(607997/53/53)) read err: read after end of file
file_win32_pread(468,14,buffer,9767475198(607997/53/55)) read err: read after end of file
Disk \\.\PhysicalDrive2 - 5000 GB / 4657 GiB - CHS 607997 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (5000 GB / 4657 GiB) seems too small! (< 18387654 TB / 16723473 TiB)
The following partitions can't be recovered:
     BeFS                   381986444 29627721008588427 29627720626601984 [5OOeU
Y25FJWFBlBnmHopD9SRpF5ilM]
     BeFS blocksize=33554432, 15169392 TB / 13796482 TiB
     BeFS                   458889708 35913386721984491 35913386263094784 [<2+1,7.PTBVD1\4);>$M8.O T*8]
     BeFS blocksize=262144, 18387653 TB / 16723473 TiB
     BeFS                   458897764 35913386721992547 35913386263094784 [<2+1,7.PTBVD1\4);>$M8.O T*8]
     BeFS blocksize=262144, 18387653 TB / 16723473 TiB
     BeFS                  2640548513 18729702183375520 18729699542827008 [6Tzl1I5vILMTjhsJFZCsmuK1BIXg1gn3]
     BeFS blocksize=4096, 9589606 TB / 8721696 TiB
     MS Data               9767471103 17447469054 7679997952
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
     MS Data               9767473151 19534944254 9767471104
     NTFS, blocksize=4096, 5000 GB / 4657 GiB

Results
     MS Data                     2048 2087473151 2087471104 [Lab_1T]
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data                     2048 9767473151 9767471104 [Lab_1T]
     NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
     Mac HFS                 73918772   99117365   25198594
     HFS found using backup sector!, 12 GB / 12 GiB
     Mac HFS                 99117362  124315955   25198594
     HFS blocksize=16777216, 12 GB / 12 GiB
     MS Data               2087473151 4174944254 2087471104
     NTFS, blocksize=4096, 1068 GB / 995 GiB
     MS Data               2087473152 9767471103 7679997952 [Privato_4T]
     NTFS, blocksize=4096, 3932 GB / 3662 GiB
     MS Data               2520079384 2520178522      99139
     FAT16, blocksize=1024, 50 MB / 48 MiB
     MS Data               2631886140 2631982693      96554
     FAT16, blocksize=1024, 49 MB / 47 MiB
     MS Data               2633387308 2633390187       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     MS Data               4218890932 4218893811       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     MS Data               4218893782 4218896661       2880 [TEST]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     MS Data               4454166676 4454169555       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     Mac HFS               7656912056 7688157384   31245329
     HFS found using backup sector!, 15 GB / 14 GiB
     Mac HFS               7688157381 7719402709   31245329
     HFS blocksize=262144, 15 GB / 14 GiB
     Linux filesys. data   7764183267 7770984638    6801372 [‡¼¬ÿûo‚ìðË¥fà ]
     cramfs, 3482 MB / 3320 MiB
     Linux filesys. data   7764183268 7770984639    6801372 [‡¼¬ÿûo‚ìðË¥fà ]
     cramfs, 3482 MB / 3320 MiB
     Mac HFS               7979744796 7996620317   16875522 [ÿÿûo‚ìðË¥fà ]
     HFS found using backup sector!, 8640 MB / 8240 MiB
     Mac HFS               7996620314 8013495835   16875522 [ÿÿûo‚ìðË¥fà ]
     HFS blocksize=16777216, 8640 MB / 8240 MiB

interface_write()
 
No partition found or selected for recovery

interface_write()
 1 P MS Data               2087473152 9767471103 7679997952 [Privato_4T]
Top
recuperation
Posts: 3027
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: After Deep search impossible to recover partition

#2 Post by recuperation »

pollyargue wrote: 11 Dec 2023, 15:31 One of two partitions (a 4T partition) on a 5T external hard disk suddenly appears as raw. I launched testdisk and tried to follow all the instructions
"tried to follow all the instructions" is not a case description. That sentence is not helpful at all as it is not as specific as required.
but my pc still wants to format it.
I got this log but i cannot seem to decipher it.
You don't have to. Follow this guide:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
Do not forget to use the p-key "list files" to see if TestDisk shows you missing content.
If that guide fails, try a deep search.
If that fails as well use Photorec or any commercial software.
It is the PhysicalDrive2 WD My Passport 2627 in the log
I was wondering if there is any possibility of recover it or it is lost forever.
I am wondering, too, as I don't own a crystal ball.
Top
pollyargue
Posts: 2
Joined: 07 Dec 2023, 09:42

Re: After Deep search impossible to recover partition

#3 Post by pollyargue »

Thanks for the help,
Follow this guide:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
Do not forget to use the p-key "list files" to see if TestDisk shows you missing content.
If that guide fails, try a deep search.
I had alreadyb followed the instructions and tried the deep search

I will try again and thanks for the suggestion of at least trying to recover something with photo rec
Top
Locked

Return to “Partition Recovery”