cgsecurity.org

I am using TestDisk to recover a corrupted partition table on a 4TB drive. I saw that TestDisk can also copy files it finds, so I selected the top level directories and started copying them to another drive as backup before trying to recover the partition. But it has now copied more than 4.9TB of data and still going. How is this possible, from a drive that is only 4TB?

What is contained on that disk?

I can't find your case description.

I had a file server with these drives:

750 WD Black HDD (boot drive running Ubuntu 20.04)
2 x 4TB HGST HDD HDN724040ALE640
2 x 8TB Toshiba HDD HDWR480

The 4 large drives are configured in a Snapraid array and served over my LAN via Samba. The array serves as a backup location for my other computers (photos, home videos, financial documents, etc.) and serves media files (TV shows and movies).

A few days ago, the 750 GB WD drive died. It can no longer be detected by BIOS. It is very old drive (> 15 yrs old), so failure was not unexpected; the only important thing on there is the Snapraid configuration and Samba configuration. When the drive failed, I always thought I could just get a new drive and redo the configurations. That's what I was about to do when I also discovered that, for unknown reason, one of the HGST HDD and one of the Toshiba HDD lost their partition tables. When I booted up with live Linux USB distro, the partition manager showed they each had only a 2TB partition. The 2TB partition suggests that somehow MBR was being applied instead of GPT. I have no idea what might have happened here nor why only those two drives were affected.

Here is when I used TestDisk to try to restore the partition tables. While investigating, but not writing the partition table yet, I discovered TestDisk had the capability to restore files it sees, so I decided to copy the directories containing the media files (since I already had the original copies of the other files, but media files were not backed up and the only version were on these drives). I first worked on the 4TB drive and started the copy to an empty 8TB drive I had fortunately just bought for unrelated purpose. When the copy reached > 4TB of data I was mystified. It kept going and I stopped it when it reached 5TB because I figure something's not right. How can more than 4TB of data be restored from a 4TB drive?

These were the steps I took in TestDisk (version 7.1):

testdisk /dev/sda
Selected [EFI GPT]
Selected [Analyse]
Selected [Quick Search]

It found the partition and I selected [P: list files]
I selected the media file directories and the destination directory and started the copy.

Please post your log file using the latest TestDisk version 7.2-WIP.