cgsecurity.org

Hi all,

I’ll try to keep it concise. I have two 12 TB NAS HDDs in an Orico 2-bay JBOD enclosure, used as a backup target for StableBit DrivePool configured with duplication to both disks. Backup was mostly automatic, and I only checked it occasionally (roughly once a month).

Today I discovered that the two drives are not readable. MiniTool Partition Wizard reports the filesystem as OTHER.

Here’s what I’ve tried so far:

TestDisk 7.3-WIP – I attempted to recover the MBR/boot sector.

Before running TestDisk:

Backup boot sector: Status OK Sectors are not identical
After using TestDisk to copy the backup boot sector over the main boot sector:

Boot sector: Status OK Backup boot sector: Status OK Sectors are identical
I also changed the partition type to NTFS using TestDisk. MiniTool Partition Wizard now shows the partition type as NTFS.

Current behavior:

Windows File Explorer assigns a drive letter, but the partition size is not recognized and I cannot browse or access any files.

I have removed the drive from the Orico enclosure and I am now using a different 1-bay enclosure. I initially thought the Orico enclosure might be the problem, but it isn’t. All files and the entire folder structure are visible via recovery software such as EaseUS Data Recovery Wizard.

The drives were previously part of a StableBit DrivePool backup setup, so the data may be stored in PoolPart folder structures and I can see it via EaseUS data recovery wizard. Its there.

The disks are visible in Disk Management, but still appear as unrecognized / RAW.

When I try to quickscan using testdisk_win.exe it's stuck at 99% with looks like an extra cylinder count:

Its saying:

Disk \\.\PhysicalDrive2 - 12TB / 10TiB - CH5 1458933 255 63
Analyse cylinder 1458933/1458932: 99%

MS Data 2848 23437768672 23437766625
MS Data 2079 23437768783 23437766625
MS Data 23437768783 46875535327 23437766625

And I can't click stop. ESC doesn't do anything. When I click X to close the window it takes another 5 seconds to do it. This is quick scan. I can't even get to the deep scan. Should I leave it for hours and wait?

I’m wondering if anyone has suggestions on what I could try next to regain access to the files without losing data.

Thanks in advance for any advice!



TestDisk LOG:

Tue Nov 4 11:56:36 2025 Command line: TestDisk TestDisk 7.3-WIP, Data Recovery Utility, September 2025 Christophe GRENIER <grenier@cgsecurity.org> https://www.cgsecurity.org OS: Windows 8 (9200) Compiler: GCC 12.4, Cygwin32 3003.3 ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=512110190592 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=12000138624512 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511553044480 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=512108789760 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=12000136527872 Hard disk list Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - NVMe CL1-3D512-Q11 NVMe SSSTC 512GB, S/N:38F6_0156_30E8_16C0., FW:22321116 Disk \\.\PhysicalDrive1 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - NVMe BM9C1 Samsung 512GB, S/N:0025_3879_41B0_EF6D., FW:67430709 Disk \\.\PhysicalDrive2 - 12 TB / 10 TiB - CHS 1458933 255 63, sector size=512 - Seagate Expansion HDD, S/N:0000000000002HC0, FW:0003 Partition table type (auto): EFI GPT Disk \\.\PhysicalDrive2 - 12 TB / 10 TiB - Seagate Expansion HDD Partition table type: EFI GPT Interface Advanced hdr_size=92 hdr_lba_self=1 hdr_lba_alt=23437770751 (expected 23437770750) hdr_lba_start=34 hdr_lba_end=23437770718 hdr_lba_table=2 hdr_entries=128 hdr_entsz=128 check_part_gpt failed for partition 1 P MS Data 2048 23437768703 23437766656 [Basic data partition] 1 P MS Data 2048 23437768703 23437766656 [Basic data partition] gpt_change_part_type Change partition type: 1 P MS Data 2048 23437768703 23437766656 [Basic data partition] Change partition type: 1 P NTFS 2048 23437768703 23437766656 [Basic data partition] ntfs_boot_sector 1 P MS Data 2048 23437768703 23437766656 [Basic data partition] NTFS at 0/32/33 Info: size boot_sector 1962930145, partition 1962930176 filesystem size 4196945173078214977 23437766625 sectors_per_cluster 133 32 mft_lcn 160618196281190402 5780 mftmirr_lcn 13359365344649591654 1 clusters_per_mft_record 0 -10 clusters_per_index_record 102 -12 Boot sector Status: Bad Backup boot sector Status: OK Sectors are not identical. A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable. copy backup boot sector over boot sector ntfs_boot_sector 1 P MS Data 2048 23437768703 23437766656 [Basic data partition] NTFS at 0/32/33 Info: size boot_sector 1962930145, partition 1962930176 NTFS at 0/32/33 Info: size boot_sector 1962930145, partition 1962930176 filesystem size 23437766625 sectors_per_cluster 32 mft_lcn 5780 mftmirr_lcn 1 clusters_per_mft_record -10 clusters_per_index_record -12 Boot sector Status: OK Backup boot sector Status: OK Sectors are identical. A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable.

======================
TestDisk LOG (rewriten by chatGPT)
======================

Date: Tue Nov 4 11:56:36 2025
Program: TestDisk 7.3-WIP (September 2025)
Author: Christophe GRENIER <grenier@cgsecurity.org>
Website: https://www.cgsecurity.org

OS: Windows 8 (Build 9200)
Compiler: GCC 12.4 (Cygwin32 3003.3)

Libraries:
ext2fs: 1.45.3
ntfs: available
reiserfs: none
ewf: 20140608
curses: ncurses 6.1

----------------------
Detected Disks
----------------------

PhysicalDrive0:
Size: 512 GB / 476 GiB
Sector size: 512
Model: NVMe CL1-3D512-Q11 NVMe SSSTC 512GB
Serial: 38F6_0156_30E8_16C0
Firmware: 22321116

PhysicalDrive1:
Size: 512 GB / 476 GiB
Sector size: 512
Model: NVMe BM9C1 Samsung 512GB
Serial: 0025_3879_41B0_EF6D
Firmware: 67430709

PhysicalDrive2:
Size: 12 TB / 10 TiB
Sector size: 512
Model: Seagate Expansion HDD
Serial: 0000000000002HC0
Firmware: 0003

Logical Drives:
C: 511,553,044,480 bytes
D: 512,108,789,760 bytes
F: 12,000,136,527,872 bytes

----------------------
Analyzed Disk
----------------------

Disk: \\.\PhysicalDrive2 - Seagate Expansion HDD
Partition Table Type: EFI GPT

GPT Header:
hdr_size = 92
hdr_lba_self = 1
hdr_lba_alt = 23437770751 (expected 23437770750)
hdr_lba_start = 34
hdr_lba_end = 23437770718
hdr_lba_table = 2
hdr_entries = 128
hdr_entsz = 128

check_part_gpt failed for partition 1

Partition 1:
Type: MS Data
Start: 2048
End: 23437768703
Size (in sectors): 23437766656
Label: [Basic data partition]

Partition type changed:
From: MS Data
To: NTFS

----------------------
NTFS Boot Sector
----------------------

Partition 1:
Start: 2048
End: 23437768703
Size: 23437766656 sectors
Label: [Basic data partition]

NTFS at 0/32/33:
Size boot_sector: 1962930145
Partition size: 1962930176
Filesystem size: 23437766625
Sectors per cluster: 32
MFT LCN: 5780
MFTMirr LCN: 1
Clusters per MFT record: -10
Clusters per index record: -12

Boot sector status: Bad
Backup boot sector status: OK
Sectors are not identical.

Action:
Copy backup boot sector over main boot sector

After repair:
Boot sector status: OK
Backup boot sector status: OK
Sectors are identical.

Note:
A valid NTFS Boot sector must be present in order to access any data,
even if the partition is not bootable.

======================
End of Log
======================

Please post your original log file, not an AI output. You can attach it to your post.
If you want to post it within your posting, put it between the code markers using the "</>" button.
Your log file content looks scrambled as you created it using an UNIX-type operating system which uses the LF-character at the end of the line. You can convert this file to the Windows world type by using the free and open source editor Notepad++. Withing Notepad++ use the menu "Edit" followed by "EOL Conversion", select Windows CR LF then.

Dammage in logical structures may have been caused by hardware issues. To exclude or reduce the possibility of that scenario, post your smartmontools logfile as described here:
viewtopic.php?f=5&t=10910

You have to create one SMART log files for each disk.

When dealing with the ORICO enclosure, read your manual to learn how to override the JBOD for SMART purposes to see both disks within the enclosure.
If that is not possible, remove the disks from the enclosure and attach each of them directly to a computer or attach each disk one by one using a a docking station,p.e..

Depending on the result it might be necessary to clone both disks using ddrescue as described in the manual.

Please explain/correct your contradicting statements:

I have two 12 TB NAS HDDs in an Orico 2-bay JBOD enclosure.

versus

I have removed the drive from the Orico enclosure and I am now using a different 1-bay enclosure.

If a case description contains such serious errors, the report instantaneously looses credibility. Proof-reading of case description is necessary.

Your enclosure turns your two 12 TB disks into a virtual 24 TB disk.
To make TestDisk operate correctly you need to run it against that virtual 24 TB disk - your Orico enclosure.
What you did instead is as if you had cutted a 24 TB disk in half.
TestDisk involves checking on-disk logical structures and they are referring to that 24 TB disk.

StableBit DrivePool configured with duplication to both disks.

This statement is confusing. According to my understanding of JBOD your computer only sees one big 24 TB disk. How come you are expressing yourself as if both disks within your enclosure can be adressed individually by your computer?