cgsecurity.org

Hello everyone,

My 320GB Hitachi 2.5" drive become Raw due to a connection failure.
I found "Testdisk" after searching in internet and I hope this can help me fix the issue.
I never write anything once it became Raw, but I was used the image making function of Testdisk to make a spare copy of it.
Then I read through the forum here and learn to use Recuva to read the data.
However, I still hope to fix this hdd and see if I can read it all again with the correct directories and the filenames. Because it contains a lot of data and the directories is difficult to repair.

I used Testdisk after Recuva, but don't know what's the next step to take for fixing it.


It shows an "Intel" partition table type. But it shows no partition is bootable.




I tried to "List" the hdd, and the filesystem can't be opened. "


I checked the "Boot" option, and it shows boot sector and backup boot sector identical.


I hope to fix it as the original status with the hdd can be read with all the correct directories. I don't know if it can be achievable but I did not write anything since it becomes Raw.

Thank you very much indeed if anyone can help on this topic.

Please upload your pictures to this site. Your image links are all broken.
Please post your TestDisk-logfile as well.

Are you affiliated with Recuva?

Hello Recuperation,

Glad to receive your reply.
Here is the log file I copied and also the photo again :

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Failed to open ntfs attribute: No such file or directory.
Failed to open ntfs attribute: No such file or directory.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511003590656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=320070288384
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - KBG50ZNV512G KIOXIA, S/N:0000_0000_0000_0000_8CE3_8E10_005D_0A2F., FW:HP01AN00
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HTS545032B9A300, S/N:000012345678, FW:0100

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 320 GB / 298 GiB - Hitachi HTS545032B9A300
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 38912 254 63 625137282 [Lacie]
NTFS, blocksize=4096, 320 GB / 298 GiB
Not an exFAT boot sector.

1 P HPFS - NTFS 0 1 1 38912 254 63 625137282 [Lacie]
NTFS, blocksize=4096, 320 GB / 298 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 38912 254 63 625137282 [Lacie]
NTFS, blocksize=4096, 320 GB / 298 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open ntfs attribute: No such file or directory.
Failed to open ntfs attribute: No such file or directory.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 1 1 38912 254 63 625137282 [Lacie]
NTFS, blocksize=4096, 320 GB / 298 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 38912 254 63 625137282 [Lacie]
NTFS, blocksize=4096, 320 GB / 298 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

https://flic.kr/p/2pP4WPr
https://flic.kr/p/2pP685M
https://flic.kr/p/2pNYiWY
https://flic.kr/p/2pNYiXp
https://flic.kr/p/2pP685w

Hope the photos are OK.

I'm just luckily find the Testdisk to solve my Raw, and going through some post I know there's a stuff call Recuva, it's no way I'm affiliated with any software, but this hard drive is very important to me.

Thank you.

I used Testdisk to create an image file and store it somewhere else.
Then I tried Photorec but it does not help on the file directories and folder.
The remaining options are Rebuild BS and Repair MFT for me?

Thank you.

Unfortunately you never uploaded your pictures to this website - something I asked you for.

Azuma wrote: 09 May 2024, 05:20 I used Testdisk to create an image file and store it somewhere else.
Then I tried Photorec but it does not help on the file directories and folder.
The remaining options are Rebuild BS and Repair MFT for me?

Thank you.

No, the procedure is diffent. You are supposed to check the partitions that TestDisk finds during quick search or better deep search if they contain readable content:
https://www.cgsecurity.org/wiki/Data_Recovery_Examples

Unfortunately you did not describe how your disk was partitioned before the incident happened. A boot sector repair or MFT repair might be necessary on the repair way.

Furthermore your TestDisk image file only contains one partition and not the content of the complete disk that typically contains a partition table.

If TestDisk fails, use third party software. In the worst case use PhotoRec as last line of defense. It's way of operation though exclude recovery of folder structures and file name recovery is the exception.

Hello Recuperation,

Thanks for reply. I'm uploading 6 images here, my external hdd contains only 1 partition.

Regarding this:
Furthermore your TestDisk image file only contains one partition and not the content of the complete disk that typically contains a partition table.
-- I do not know how to show then content or the partition table.

Please see the photos which are in 2 replies.
Thank you.

3 more photos:

The last picture in your posting shows the word "list". Select this function to try if the content is readable.

Hello again Recuperation,

Glad to hear from you again.
I tried the "List" option before, and it shows the message:
Can't open filesystem. Filesystem seems damaged.

That is the second last photo I attached.
Thanks.

Hi Recuperation,

I tried the following again:
Advanced >> List >> showing - Can't open filesystem, Filesystem seems damaged.

Advanced >> Boot >> List >> showing - Can't open filesystem, Filesystem seems damaged.

Both "List" option shows the same result.
Thanks.