In future, I will backup my backups

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
transhumanist
Posts: 1
Joined: 31 Oct 2012, 08:25

In future, I will backup my backups

#1 Post by transhumanist »

So I have a 1TB Maxtor OneTouch USB external hard disk, which has for the past four years been a totally reliable piece of kit. It was divided into a ~8GB NTFS partition (used as a direct image of my old laptop's hard disk, and labelled C BACKUP) and the rest as one large partition, just under 1TB (labelled Monolith, because the disk looks rather like one) - pretty sure this was also NTFS.

I seem to recall that said large partition had to be hosted inside some other type of partition, or something like that, because of its size, but I'm by no means certain - as mentioned, this was set up about 4 years ago. For most of its life, the disk has been attached to a Windows XP laptop; a few months ago said laptop was replaced with a Win7 one.

Yesterday, the disk suddenly made a grinding noise and then briefly went almost silent (it's now back to its usual whirr). I tried to access a file on the large partition and was told the drive was corrupted or inaccessible, so I ran a Windows disk check, which dismounted the partition, scanned for several hours, and then crashed (possibly without remounting it again?). I rebooted and since then, the large partition has been totally invisible; the drive letter (E:) is still visible in Windows Explorer, but the label is missing and any attempt to access it gets 'The file or directory is corrupted or unreadable'. (The smaller partition appears fine.)

I ran TestDisk overnight and got this result from the deep search: http://imgur.com/08sMJ - which was not terribly reassuring. On review though, the testdisk.log file (pasted below) does contain several references to the partition labelled 'Monolith', so I'm still hoping that it's still there in some sense.

In addition to quite a lot of work-related data (most of which is recoverable/reproducible in one sense or another) the disk held the only remaining copy (since my ancient desktop machine died a couple of years back) of about 15 years' worth of my personal archives, projects, photos, logs of chat conversations with a dear friend who passed away some time ago... most of which is irreplaceable.

Can anyone help?

testdisk.log:

Code: Select all

Tue Oct 30 16:09:03 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=103134789632
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=8422686720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=991779554304
file_pread(4,1,buffer,250083854(15566/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG MZMPA128HMFU, S/N:0S5RYNBA0A2936, FW:AXM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Maxtor OneTouch, S/N:2HA45WT4, FW:0125

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - Maxtor OneTouch
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 120577/0/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
 1 * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
 2 P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/1/1
filesystem size           1937069442
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               48
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS, 991 GB / 923 GiB
NTFS at 120577/0/1
filesystem size           16450560
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               1028156
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS, 8422 MB / 8032 MiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525313(121601/83/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525441(121601/85/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525569(121601/87/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525697(121601/89/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS, 991 GB / 923 GiB
   P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS, 8422 MB / 8032 MiB

interface_write()
 1 * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
 2 P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/1/1
filesystem size           1937069442
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               48
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS, 991 GB / 923 GiB
BAD_RS LBA=815578204 9909575
file_pread(5,3,buffer,815578204(318116/189/54)) lseek err Invalid argument
file_pread(5,1,buffer,815578204(318116/189/54)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           318116 189 54 475903 185 62 2534847912
This partition ends after the disk limits. (start=815578204, size=2534847912, end=3350426115, disk end=1953536130)
NTFS at 120576/254/63
filesystem size           1937069442
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               48
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS found using backup sector!, 991 GB / 923 GiB
NTFS at 120577/0/1
filesystem size           16450560
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               1028156
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS, 8422 MB / 8032 MiB
NTFS at 121600/254/63
filesystem size           16450560
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               1028156
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS found using backup sector!, 8422 MB / 8032 MiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525313(121601/83/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525441(121601/85/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525569(121601/87/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525697(121601/89/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3914 GB / 3645 GiB)
The following partition can't be recovered:
     FAT16 >32M           318116 189 54 475903 185 62 2534847912
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS, 991 GB / 923 GiB
   P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS, 8422 MB / 8032 MiB

interface_write()
 1 * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
 2 P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 120577/0/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
 1 * HPFS - NTFS              0   1  1 120576 254 63 1937069442 [Monolith]
     NTFS, 991 GB / 923 GiB
 2 P HPFS - NTFS          120577   0  1 121600 254 63   16450560 [C BACKUP]
     NTFS, 8422 MB / 8032 MiB

TestDisk exited normally.
Top
Locked

Return to “Partition Recovery”