Partition issues with 3TB drive - newbe

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#11 Post by gdoran »

Did the boot sector diag and rebuild. After rebooting, Disk Managemet still shows two partitions, unallocated.


Fri Oct 5 12:31:58 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-01T21:55:20
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000256503808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308556070912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2982248448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000120639488
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST3320413AS, S/N:2020202020202020202020205636584d53324833, FW:JC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 1, FW:0001
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364760 255 63, sector size=512 - BUFFALO HD-WLU3/R1 2, FW:0001
Drive D: - 2982 MB / 2844 MiB - CHS 711 64 32, sector size=2048 - TSSTcorp DVD+-RW TS-H653H, FW:D800

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - BUFFALO HD-WLU3/R1 1
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5859875983 (expected 5859875983)
hdr_lba_start=34
hdr_lba_end=5859875950
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

ntfs_boot_sector
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 5859610624
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 5859610624
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

Directory /
5 dr-xr-xr-x 0 0 0 14-Sep-2012 13:24 .
5 dr-xr-xr-x 0 0 0 14-Sep-2012 13:24 ..
3312 dr-xr-xr-x 0 0 0 7-Sep-2012 17:15 $RECYCLE.BIN
40 dr-xr-xr-x 0 0 0 10-Sep-2012 11:53 August-2012-pt2
39 dr-xr-xr-x 0 0 0 7-Sep-2012 07:52 New Directory
7147 dr-xr-xr-x 0 0 0 20-Sep-2012 09:50 September-2012
36 dr-xr-xr-x 0 0 0 21-Sep-2012 16:55 System Volume Information
filesystem size 5859610624
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

ntfs_boot_sector
2 P MS Data 264192 5859874815 5859610624 [Basic data partition] [HD-WLU3]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 5859610624
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#12 Post by gdoran »

I went into Advanced, Type, Partiton type shows up as MS Data, NTFS. What should do next?

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#13 Post by gdoran »

I went into the Check MFT. It says MFT and MFT mirrow are bad. Failed to repair them.

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Partition issues with 3TB drive - newbe

#14 Post by dragonfly41 »

Read last post here ...

http://forum.cgsecurity.org/phpBB3/file ... t1383.html

if testdisk can't repair MFT it is recommended on the testdisk wiki that you try commercial recovery software.

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#15 Post by gdoran »

Thank you for your advise. I am kinda curious though, I am able to list directory properly and files do seem to be accurate. Not many files on disk, just real big ones, around 470GB. Would you be able to give any light to the subject? FYI, in the Boot sector rebuild, itit shows Extrapolated boot sector and current bot sector are different.

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Partition issues with 3TB drive - newbe

#16 Post by dragonfly41 »

Repeat advice .. try RecoverMyFiles in evaluation mode (no purchase)

Using commercial software in evaluation mode as suggested will not recover files (for free) but might give some clues on whether they can ever be recovered (with testdisk or other approach).

In the longer run it is quicker to do that early on rather than long debates in forums.

Gather your forensic evidence from multiple sources.

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#17 Post by gdoran »

RecoverMyFiles sees the drive out there, 1,584,789 ATAPI(SCSI) drive with no label. Also tried NTFS walker, didn't recognise it being NTFS.

gdoran
Posts: 13
Joined: 01 Oct 2012, 23:19

Re: Partition issues with 3TB drive - newbe

#18 Post by gdoran »

GPartD shows two partition device, one a Unknown file system, 128 Mib with msftres as flags and a seoncd partion, file system ntfs, 2.73 TB. the second partition is showsing a warning, .dev/sdb2 doesn't exist. Error 2" failed to check /dev/sdb2 mount state: No such file or direcgtory. Probaly /etc/mtab is missing, it's too risky to continue.
The first partition also shows up with a error. unble to detect the file system. Possible reasons are: File system is damaged. The file system is known to gpartd, there is no file system availabe, Teh device entry /dev/sdb1 is missing.

Locked