cgsecurity.org

I had two 10 TB disks in a RAID1 array inside a TS231U-C enclosure. This was configured for hardware RAID and I wanted to retire the array and take out the two disks, keeping one copy of the data on one disk, and using the other disk for other applications. I foolishly thought I should change the enclosure from RAID1 mode to "no raid" mode, which to me would mean both disks would appear to the OS, and each disk would retain the partition and filesystem information as before. However, the TS231U-C kindly decided to wipe the partition information when converting to "no raid". Why it would do this is anyone's guess. Yes, this is my own fault, but as a result of this experience I cannot suggest or recommend these kind of hardware RAID enclosures in general, and this one in particular.

So now I have a 10 TB disk with no partition table. The previous partitioning was simple, just a single partition formatted as NTFS.

Running testdisk on this disk fails to recover the partition. However, after running the quick and subsequent deeper searches, the software reports that "the following partitions cannot be recovered". However, the partition listed is exactly the one that I need to recover. The list of "valid" partitions does not contain any partitions from the disk. The disk size is correctly reported, as well as I can tell anyway, it shows "10 TB" as expected.

My questions for the forum are:

What is wrong exactly with the partition that cannot be recovered?

If they point to sectors outside the size of the disk, is there any way to truncate them to the disk size?

For a scenario such as mine, can anyone suggest how I could apply a "default" partition to the disk and see if it contains any files? This would be simply equal to the partition that would be created if I was to use a partition manager such as "gnome-disks" or "fdisk" and make a single partition on the disk. I understand exactly why testdisk works the way it does, but if there existed a utility that would simply "guess" at basic partition structures for a given disk it might be a fast and effective way to recover partitions. Any thoughts or suggestions on this?

Thank you for your help.

B89wa6DWHXda wrote: 12 Feb 2025, 11:12 I had two 10 TB disks in a RAID1 array inside a TS231U-C enclosure. This was configured for hardware RAID and I wanted to retire the array and take out the two disks, keeping one copy of the data on one disk, and using the other disk for other applications. I foolishly thought I should change the enclosure from RAID1 mode to "no raid" mode, which to me would mean both disks would appear to the OS, and each disk would retain the partition and filesystem information as before. However, the TS231U-C kindly decided to wipe the partition information when converting to "no raid". Why it would do this is anyone's guess. Yes, this is my own fault, but as a result of this experience I cannot suggest or recommend these kind of hardware RAID enclosures in general, and this one in particular.

So now I have a 10 TB disk with no partition table. The previous partitioning was simple, just a single partition formatted as NTFS.

Running testdisk on this disk fails to recover the partition. However, after running the quick and subsequent deeper searches, the software reports that "the following partitions cannot be recovered". However, the partition listed is exactly the one that I need to recover. The list of "valid" partitions does not contain any partitions from the disk.

Didn't you say there was just one single partition?

The disk size is correctly reported, as well as I can tell anyway, it shows "10 TB" as expected.

My questions for the forum are:

What is wrong exactly with the partition that cannot be recovered?

I don't know.

If they point to sectors outside the size of the disk, is there any way to truncate them to the disk size?


For a scenario such as mine, can anyone suggest how I could apply a "default" partition to the disk and see if it contains any files? This would be simply equal to the partition that would be created if I was to use a partition manager such as "gnome-disks" or "fdisk" and make a single partition on the disk. I understand exactly why testdisk works the way it does, but if there existed a utility that would simply "guess" at basic partition structures for a given disk it might be a fast and effective way to recover partitions. Any thoughts or suggestions on this?

Thank you for your help.

You don't understand why TestDisk works the way it does.
If TestDisk had found a partition it would have listed it for you and depending on the file system and TestDisk abilities it would have offered you to list the files and folders inside.
Do not try to outsmart TestDisk.
Guessing is no fast and effective way to recover partitions.
Use any partition editor to create partitions as you like - I am not aware of a partition editor inside of TestDisk.

There are other tools that claim to recover RAID remains.
If that fails ask Silverstonetek for a specification of their on-disk layout.
If that fails you would have to reverse engineer their format.
You would zero out two disks and configure them as RAID 1. Then you would analyze, which sectors changed, most likely at the beginning of your disks.
You would then partition the disk, analyzing again.
At this moment you should get an idea where your device places the beginning of a partition.
Your 10TB most likely used the GPT partition table scheme, for testing you would need two disk bigger than 2,3 TB to enforce the use of GPT because you don't know if your enclosure might act differently depending on the disk size.

Please post your log file.

Thank you for replying.

I will need to re-run the searches with the logging enabled, and since they take >24 hours for each one it will be some days before I can post it.

To respond to your questions:

The RAID1 array was set up with a single partition formatted to NTFS.

When running the search the software reports that three partitions cold not be recovered, one of which is the 10TB NTFS partition that I believe I want. My question is why are these partitions non-recoverable? Do they point to blocks outside the disk?

When inspecting the list of "found" partitions there are about 100 of them. None of them are NTFS. None of them are larger than 300 GB give or take. Many of them are file containers on the disk, such as disk images and disk files from virtual machines. Most of them are false matches, which when scanning 10TB of mixed data is not surprising at all. None of this is unexpected behaviour, it is just frustrating that the 10TB NTFS partition is not on the list.

I am not trying to outthink testdisk. I simply want to know when it reports that a partition cannot be recovered, *why* is it saying that? Does the log file contain more information here than the interface?

As for "guessing" the point I am raising is that in 90% of cases most people apply a simple single partition to a disk using whatever defaults are chosen for them. Again, in 90% of cases this would just be the Windows Disk Management tool or the popular Linux tools such as gnome-disks or fdisk. The point I was making is that testdisk could have an additional mode, which would be to approach the disk as if it were creating partitions using defaults and to then create them and check the partition for a valid filesystem. Doing this would be much faster than running the scans, and in 90% of cases this would work. Obviously if it doesn't work then running the scans would be the logical next step as it is currently. However, I obviously do not know how many partitions being recovered are these "simple" and "standard" arrangements, and if it was only 5% of cases then implementing this feature would be a complete waste of time.

Your suggestion of investigating the exact behaviour of the Silverstone RAID enclosure is a good one. I have contacted their technical support but no reply, and I'll have to assume that they won't tell me anything of use. However, I do have spare 3TB disks that I can use to create an array, take an image, release the array, take an image, and compare. That's a great idea, and if necessary, I'll do it. But first, I want to find out why the actual partition I want cannot be recovered and if that can be tweaked at all by adjusting the disk geometry and even editing the data on disk to offset or shrink the partition to within the disk size and see what that gives me. Alternatively, it would be great if testdisk could "read" a partition that is mismatched to the hardware and just return null data for blocks that point to outside the physical disk. However, I don't know if that would bring any benefits, probably not...

B89wa6DWHXda wrote: 13 Feb 2025, 09:56 Thank you for replying.

I will need to re-run the searches with the logging enabled, and since they take >24 hours for each one it will be some days before I can post it.

To respond to your questions:

The RAID1 array was set up with a single partition formatted to NTFS.

When running the search the software reports that three partitions cold not be recovered, one of which is the 10TB NTFS partition that I believe I want. My question is why are these partitions non-recoverable? Do they point to blocks outside the disk?

What would you think about as a forum supporter if people ask you the same question again?

When inspecting the list of "found" partitions there are about 100 of them. None of them are NTFS. None of them are larger than 300 GB give or take. Many of them are file containers on the disk, such as disk images and disk files from virtual machines. Most of them are false matches, which when scanning 10TB of mixed data is not surprising at all. None of this is unexpected behaviour, it is just frustrating that the 10TB NTFS partition is not on the list.

I am not trying to outthink testdisk.

Of course you do. It's because you judge TestDisk on assumptions what happened when you destroyed your data when fooling around with your external box.
The first time you failed with your assumptions is when you were modifying the settings of your black box expecting a result based on your assumptions.
That does not make your box as bad one as opposed to what you said about "...not recommend..."

I simply want to know when it reports that a partition cannot be recovered, *why* is it saying that? Does the log file contain more information here than the interface?

It was not a smart decision by you to disable logging. I can't compensate your sudden impatience by foreseeing the content of your log file.

As for "guessing" the point I am raising is that in 90% of cases most people apply a simple single partition to a disk using whatever defaults are chosen for them. Again, in 90% of cases this would just be the Windows Disk Management tool or the popular Linux tools such as gnome-disks or fdisk. The point I was making is that testdisk could have an additional mode, which would be to approach the disk as if it were creating partitions using defaults and to then create them and check the partition for a valid filesystem. Doing this would be much faster than running the scans, and in 90% of cases this would work.

It's funny how people repeatedly want TestDisk to be modified just to solve their specific personal problems. I have given you a recipe to achieve this without using TestDisk which is way beyond supporting the TestDisk package. If you don't understand it, have somebody else working the recipe.

Obviously if it doesn't work then running the scans would be the logical next step as it is currently. However, I obviously do not know how many partitions being recovered are these "simple" and "standard" arrangements, and if it was only 5% of cases then implementing this feature would be a complete waste of time.

That is utter nonsense. If the partition is there, as you are assuming, TestDisk will find it. If it is not there, an additional "guess my partition location" function won't help you any further.

Your suggestion of investigating the exact behaviour of the Silverstone RAID enclosure is a good one. I have contacted their technical support but no reply, and I'll have to assume that they won't tell me anything of use. However, I do have spare 3TB disks that I can use to create an array, take an image, release the array, take an image, and compare. That's a great idea, and if necessary, I'll do it. But first, I want to find out why the actual partition I want cannot be recovered and if that can be tweaked at all by adjusting the disk geometry

Another false assumption of you. You will have to learn about MBR, GPT and LBA adressing to understand - I won't teach you storage here.

and even editing the data on disk to offset or shrink the partition to within the disk size and see what that gives me.

As I already told you before, use a partition editor and you are free to enter whatever you want.

Alternatively, it would be great if testdisk could "read" a partition that is mismatched to the hardware and just return null data for blocks that point to outside the physical disk. However, I don't know if that would bring any benefits, probably not...

This statement outlines that you judge TestDisk and are claiming stuff without having any experience with TestDisk.

As for your rudly repeating "Why...?" question which I answered already stating that I don't know, you are free to learn C and to look into the source code to find out.
I don't program in C but sometimes I look in there. That takes time and patience.

With regards to your contribution I remind you of the words of former US president Kennedy:

Do not think about what TestDisk can do for you, think about what you can do for TestDisk!

Wow, I've never met someone so jaded about what they are doing. Why are you even posting here?

"What would you think about as a forum supporter if people ask you the same question again?"

What are you talking about?

The main question I am asking is: when testdisk runs its scan and then reports "the following partitions cannot be recovered" what is the technical reason for it stating that?

I asked that question and you said "I don't know". It was unclear to me why you said that, so I asked the question a second time and you made your glib comment.

If you don't know the answer to a question like this then why are you even posting to the forum?

I will repeat my question in case there is someone else out there who can help. When testdisk states that a partition cannot be recovered, what is the technical reason for this? If there are multiple reasons, what are they?

Am more than happy to look at the code if that is the only place the answer can be found.

"It's funny how people repeatedly want TestDisk to be modified just to solve their specific personal problems."

BTW, it's not funny. The reason people do this is because they are desperate. They have lost data, or are close to losing data, and they are trying anything they can to get it back. If you think that's funny, then I don't think you are a very nice person.

B89wa6DWHXda wrote: 13 Feb 2025, 21:35 "It's funny how people repeatedly want TestDisk to be modified just to solve their specific personal problems."

BTW, it's not funny. The reason people do this is because they are desperate. They have lost data, or are close to losing data, and they are trying anything they can to get it back. If you think that's funny, then I don't think you are a very nice person.

If my car is broken down I am free to contact a professional car workshop and have my car repaired. I don't go there and try to convince them to repair my car for free.
Whe are living in a service economy where you can buy recovery services from a professional recovery lab.
I wonder what my dentist will say when I want my teeth to be repaired without me paying for it.

In economics there is this "Make or buy" saying. Luckily we have a choice. We don't have to become car mechanics or dentists or data recovery experts. We can buy those services.

You express yourself as if your life and or welfare depends on a TestDisk update - obviously one just for you. It doesn't. There is RAID-specific recovery software around.
But you have to pay for that software.

But you neither want to make (learning storage yourself and recover data) nor you want to buy. You - are dishonest by pretending how your personal TestDisk update will solve the problems of others.

Everyone who has a car has to be able to afford to pay for the petrol. Anybody who buys a computer has to be able to pay for an external disk enclosure for

BACKUPS!

I never mention this word in this forum, because BACKUPS is the term used by malicious people to torture poor deplorable data loosers in forums all around the internet - "Restore your backup" they say - what a useful hint!

If you don't use backups, you have to live with the consequences of a data loss.

Luckily there is not only commercial data recovery software around, there is a free and open source called TestDisk from an author that abstains from charging you for countless hours of ongoing work starting maybe twenty years ago.

Requesting free additional service from an individual who is already providing you with free software products by means of a really bad cover story is a little bit bold, unfortunately, to express it in a polite way.

When I said "it is funny" the adjective really was an euphemism for dishonest, bold and rude.
TestDisk is not your last line of defense.

Feel free to call me "not a nice person".

B89wa6DWHXda wrote: 13 Feb 2025, 21:34 Wow, I've never met someone so jaded about what they are doing. Why are you even posting here?

I don't know. One morning I woke up and the colour of my name changed. I learned that I had gotten admin rights in this forum. It fell right out of the sky - who knows why.

"What would you think about as a forum supporter if people ask you the same question again?"

What are you talking about?

The main question I am asking is: when testdisk runs its scan and then reports "the following partitions cannot be recovered" what is the technical reason for it stating that?

I asked that question and you said "I don't know". It was unclear to me why you said that,

That is funny. ThYou are not my boss. You have no right claim an explanation why I don't know. But even if I knew, I don't have to tell you. TestDisk did not work for you. Neither Christophe Grenier nor me is obliged to explain you why it did not work. Be pragmatic - try out the next (commercial) tool, they typically have free tryout modes.

so I asked the question a second time and you made your glib comment.

If you don't know the answer to a question like this then why are you even posting to the forum?

I don't know.

I will repeat my question in case there is someone else out there who can help. When testdisk states that a partition cannot be recovered, what is the technical reason for this? If there are multiple reasons, what are they?

Feel free to repeat it again and again.

Am more than happy to look at the code if that is the only place the answer can be found.

I am looking forward to hearing your detailed explanation.

Well this place is a complete waste of time.

Cannot recommend that anyone bothers to post here. The person who has responded to my questions has been nothing but condescending, rude, and horrid.

As for the person who's posted here, go and get some help. You have mental issues.