Yet another 3TB HDD fail

[zomzom]

My WD 3TB HDD has failed after 425 hours of operation. I was connecting it via docking station which has eSata and USB 3.0, I was mainly using eSata because of higher transfer speeds.
Once I looked for size of one folder on that HDD and Windows showed 0 Bytes, I have reconnected HDD and after that I could no longer access my files. I have found that I am not the only one who faced with this problem, for example here.

HDD: GPT, NTFS, 1 big partition; it was filled up to about 2-2.2TB, mainly with large (10-30GB) files. No OS was installed on it.
System: Win7, 64bit.

When I connect HDD, Windows asks me to format it. Of course, I don't do it.


Windows recognizes it as 3TB unformatted drive.


I was hoping that R-Studio will help me out. But it found only the last few copied files. All the other files (notice that it found more than 10 mil of files; the max number of files that could be in HDD is around 1000) were wrongly identified.


S.M.A.R.T. shows no problems. LifeGuard (WD utility for HDDs) as well.


When I connect HDD via eSata TestDisk sees only 800GB.


But when I connect it via USB 3.0 TestDisk sees 3TB.


And here are some other print screen of TestDisk.




Quick Search is very slow. It takes 1 second to analyze 1 segment, in other words it will take over 4 days to analyse this HDD. And yes, I run TestDisk as administrator.

So, what should I do next? Please help!

[zomzom]

Some updates:
1 update. To do a Quick Search I have used a Live CD. TestDisk was able to recognize 3 TB plugged via eSata. The speed of Quick Search was almost 10 times faster. So here are the results:



TestDisk has found 5 HFS partitions, while there should be only 1 NTFS.

I have run gdisk as well, here some results:

root@PartedMagic:~# gdisk /dev/sdc
GPT fdisk (gdisk) version 0.8.5

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present

Found valid GPT with protective MBR; using GPT.

Warning! Secondary partition table overlaps the last partition by
4294966385 blocks!
Try reducing the partition table size by 17179865540 entries.
(Use the 's' item on the experts' menu.)

Command (? for help): i
Partition number (1-2): 1
Partition GUID code: E3C9E316-0B5C-4DB8-817D-F92DF00215AE (Microsoft reserved)
Partition unique GUID: 24CFA9CF-E448-4D4C-A118-AB52891AA286
First sector: 34 (at 17.0 KiB)
Last sector: 262177 (at 128.0 MiB)
Partition size: 262144 sectors (128.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'Microsoft reserved partition'

Command (? for help): i
Partition number (1-2): 2
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: 99E5BE9C-DF3B-4135-A733-2040953ADD25
First sector: 264192 (at 129.0 MiB)
Last sector: 5860532223 (at 2.7 TiB)
Partition size: 5860268032 sectors (2.7 TiB)
Attribute flags: 0000000000000000
Partition name: 'Basic data partition'

And here is what fdisk has to say about this HDD:

Disk /dev/sdc: 3000.6 GB, 3000592982016 bytes
256 heads, 63 sectors/track, 363376 cylinders, total 5860533168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdc1 1 4294967295 2147483647+ ee GPT
Partition 1 does not start on physical sector boundary.

Update 2. And I am almost sure I found what has caused all this trouble. In short, crappy Intel AHCI driver that does not support more than 2 TB. More about it here. This also explains why under Windows TestDisk didn't show 3 TB size when HDD was connected via eSata. By the way, my current driver version is 8.9.8.

Is there anything I can do to recover my lost data?

[Fiona]

Is your disk an external disk?
Did you remove it from its enclosure?
Your partition ist still in your GUID partition table.
That's why a boot sector diagnose would be recommended first.
Info will follow.

Fiona

[zomzom]

My disk is internal (WD 3TB RED).
I use HDD docking station (SATDOCKU3E) to connect it to my laptop.

How to do a boot sector diagnose?
Also, how to make a proper copy of current disk? I will get another exactly the same disk soon. How to be sure that my current system will not corrupt already corrupted data while making bit-by-bit copy, if you know what I mean?

[zomzom]

If "boot sector diagnose" means doing these steps ([Create] -> Select disk -> [Proceed] -> Select partition table (GPT in my case) -> [Advanced] -> Select partition (2nd in my case) -> [Type] -> [Proceed] -> Select partition type (NTFS in my case) -> [Proceed] -> [Boot] -> [Dump]) then here is the result:





I have tried using Backup boot sector (I have cloned my hdd and I am not using hdd that has failed) but system was still not able to access data and offered to format disk.

[cgrenier]

Please run TestDisk, Advanced, select the partition, Boot, List.
If you can see your files, choose BackupBS, confirm, Quit and restart your computer.

[zomzom]

Thank you for your response. I have done what you have suggested and got "No file found".


There was stored some mkv files on that disk, so I have done a hex (low level) search within disk and found many entries which makes me think that there is still a chance to recover data. Question is why none of my tested professional recovery programs cannot find more than last 6 files I have copied to that disk?

[zomzom]

It is sad that there is no one here to help.

[biotank]

I had the same issue with you, and I send email to another guy regarding retrieve partitions, but he suggest me it's more of the file system issue not partition issue. his page can be find here http://www.rodsbooks.com/gdisk/

I am still trying to see which data recovery software can get me the best result, will let you know when I try them.

[zomzom]

Thanks for your response. Yes, it is file structure problem, $MFT and $MFTMirr are damaged (or overwritten) and most probably big disk fragmentation. These two issues causes recovery software to no be able to do any recovery. I have tried over 15 different professional and semi-professional recovery programs and all of the have failed.