Hello friends,
after a weekend we found that our 5,5 TB storage turned from NTFS to RAW. It's a Windows 2016 server connected via iSCSI to QNAP TS-859U+. Chkdsk recognizes NTFS and the volume label correctly, reports a corrupted master file table, but it's unable to recover it and aborts. I also tried to follow a guide I found here (posted by cgrenier) where a user had similar problem. The procedure was this:
Run TestDisk, Create a log file, select /dev/sdd, EFI GPT, Analyse, Quick Search, Write, confirm, Quit
If it doesn't solve the problem, run testdisk again, choose Append, /dev/sdd, EFI GPT, Analyze, Quit and post the new testdisk.log file
Even after a reboot there's no change, so I'm pasting the log here, maybe a skilled person would be able to see some abnormalities. I'm sure I dont.
Tue Jun 11 02:19:19 2024
Command line: TestDisk
TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=136365211648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=5954929164288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135667072000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=5954792849408
Hard disk list
Disk \\.\PhysicalDrive0 - 136 GB / 127 GiB - CHS 16578 255 63, sector size=512 - Msft Virtual Disk, FW:1.0
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63, sector size=512 - QNAP iSCSI Storage, S/N:96d8cbe9-37fd-487f-ade1-64974c887364, FW:4.0
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - QNAP iSCSI Storage
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11630721023 (expected 11630721023)
hdr_lba_start=34
hdr_lba_end=11630720990
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
search_part()
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63
NTFS at 16/113/34
filesystem size 11630454784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=5954792849408, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size 11630454784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
NTFS, blocksize=4096, 5954 GB / 5545 GiB
file_win32_pread(584,11,buffer,11630721018(723978/229/22)) read err: read after end of file
file_win32_pread(584,8,buffer,11630721021(723978/229/25)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721012(723978/229/16)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721013(723978/229/17)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721014(723978/229/18)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721015(723978/229/19)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721016(723978/229/20)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721018(723978/229/22)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721020(723978/229/24)) read err: read after end of file
file_win32_pread(584,14,buffer,11630721022(723978/229/26)) read err: read after end of file
Results
P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
NTFS, blocksize=4096, 5954 GB / 5545 GiB
interface_write()
1 P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
write!
No extended partition
You will have to reboot for the change to take effect.
TestDisk exited normally.
Tue Jun 11 02:29:49 2024
Command line: TestDisk
TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=136365211648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=5954929164288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135667072000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=5954792849408
Hard disk list
Disk \\.\PhysicalDrive0 - 136 GB / 127 GiB - CHS 16578 255 63, sector size=512 - Msft Virtual Disk, FW:1.0
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63, sector size=512 - QNAP iSCSI Storage, S/N:96d8cbe9-37fd-487f-ade1-64974c887364, FW:4.0
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - QNAP iSCSI Storage
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11630721023 (expected 11630721023)
hdr_lba_start=34
hdr_lba_end=11630720990
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
Backup partition structure
partition_save
search_part()
Disk \\.\PhysicalDrive1 - 5954 GB / 5545 GiB - CHS 723978 255 63
NTFS at 16/113/34
filesystem size 11630454784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=5954792849408, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size 11630454784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
NTFS, blocksize=4096, 5954 GB / 5545 GiB
file_win32_pread(580,11,buffer,11630721018(723978/229/22)) read err: read after end of file
file_win32_pread(580,8,buffer,11630721021(723978/229/25)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721012(723978/229/16)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721013(723978/229/17)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721014(723978/229/18)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721015(723978/229/19)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721016(723978/229/20)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721018(723978/229/22)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721020(723978/229/24)) read err: read after end of file
file_win32_pread(580,14,buffer,11630721022(723978/229/26)) read err: read after end of file
Results
P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
NTFS, blocksize=4096, 5954 GB / 5545 GiB
interface_write()
1 P MS Data 264192 11630718975 11630454784 [BRQSVBACKUP]
simulate write!
TestDisk exited normally.
Any help will be much appreciated.
Thank you in advance
Regards
Martin
QNAP iSCSI NTFS storage - RAW
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 3026
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: QNAP iSCSI NTFS storage - RAW
I don't know where "here is.666diablo wrote: 11 Jun 2024, 01:44 Hello friends,
after a weekend we found that our 5,5 TB storage turned from NTFS to RAW. It's a Windows 2016 server connected via iSCSI to QNAP TS-859U+. Chkdsk recognizes NTFS and the volume label correctly, reports a corrupted master file table, but it's unable to recover it and aborts. I also tried to follow a guide I found here
I don't understand why this recipe should resolve your problem.(posted by cgrenier) where a user had similar problem. The procedure was this:
Run TestDisk, Create a log file, select /dev/sdd, EFI GPT, Analyse, Quick Search, Write, confirm, Quit
If it doesn't solve the problem, run testdisk again, choose Append, /dev/sdd, EFI GPT, Analyze, Quit and post the new testdisk.log file
TestDisk shows read errors.Even after a reboot there's no change, so I'm pasting the log here, maybe a skilled person would be able to see some abnormalities. I'm sure I dont.
For a quick disk check please post your smartmontools log file:
viewtopic.php?f=5&t=10910
It might be necessary to duplicate your disk using ddrescue as described in the manual.