cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Windows requires format but can access data.

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=2027

Page 1 of 1

Windows requires format but can access data.

Posted: 28 Feb 2013, 20:02
by gridl0ck
Hey guys,

I have a Lacie 1TB external USB hard drive consisting of 2x500gb samsungs inside. When I tried to connect it to the computer windows was asking for it to be formatted. I got hold of a commercial program and managed to pull off my main documents and photos. However I still have around 400GB of data on it which I could do with. I don't have enough space on my PC to copy it all over as I have copied around 200GB already.

I don't think there is a problem with the filesystem and think it may be to do with the boot sector. Is it possible to repair the boot sector/partition using testdisk? I have read some tutorials but none that tackle my one since I have 2x500gbs in raid 0. Any help on how to get windows to recognise the drive normally would be much appreciated. Thank you.

Re: Windows requires format but can access data.

Posted: 01 Mar 2013, 07:53
by Fiona
Boot sector could be repaired.
I'd need infos from testdisk analyse to judge it.
You can copy and paste the content of the testdisk.log or upload a screen from TestDisk / Analyse.

Fiona

Re: Windows requires format but can access data.

Posted: 02 Mar 2013, 11:59
by gridl0ck
Hi Fiona thank you for the reply/ I have done an analyse and attached the info here:

Sat Mar 2 10:56:31 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-02-11T11:20:27
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=1000215724032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=160041885696
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=1000215724032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=152546042880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=160031015424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7484972544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000210466304
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
filewin32_getfilesize(\\.\J:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\J:
filewin32_getfilesize(\\.\L:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\L:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\L:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD1600BB-00GUA0, S/N:4457572d414d394c303232323332 038 0 0 0 0, FW:08.02D08
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST3160021A, S/N:4a34305339585250202020202020202020202020, FW:8.11
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121602 255 63, sector size=512 - SAMSUNG HD501LJ

Partition table type (auto): Intel
Disk /dev/sdg - 1000 GB / 931 GiB - SAMSUNG HD501LJ
Partition table type: Intel

Analyse Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
No partition is bootable

search_part()
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/1/1
filesystem size 1953536067
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122096004
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,11,buffer,1953546366(121602/162/31)) lseek err Invalid argument
file_pread(6,1,buffer,1953546366(121602/162/31)) lseek err Invalid argument
file_pread(6,2,buffer,1953548288(121602/192/63)) lseek err Invalid argument
file_pread(6,14,buffer,1953548290(121602/193/2)) lseek err Invalid argument
file_pread(6,3,buffer,1953548304(121602/193/16)) lseek err Invalid argument
file_pread(6,3,buffer,1953548351(121602/193/63)) lseek err Invalid argument
file_pread(6,8,buffer,1953548367(121602/194/16)) lseek err Invalid argument
file_pread(6,11,buffer,1953548414(121602/194/63)) lseek err Invalid argument
file_pread(6,2,buffer,1953550336(121602/225/32)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]

search_part()
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/1/1
filesystem size 1953536067
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122096004
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Re: Windows requires format but can access data.

Posted: 02 Mar 2013, 12:58
by Fiona
Start TestDisk, confirm at create a log with enter and select your affected disk.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
Confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild your BS will be in progress.
Normally, it takes some minutes.
If it's finished, please post the infos or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, did you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

Infos will follow.

Fiona

Re: Windows requires format but can access data.

Posted: 02 Mar 2013, 21:12
by gridl0ck
Hi this is the log:
After I done the rebuild I was able to etner List and it showed something weird which I have attatched.
The drive is still not able to be accessed through windows :(

Sat Mar 2 20:03:07 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-02-11T11:20:27
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000215724032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000215724032
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=152546042880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=160031015424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7484972544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000210466304
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
filewin32_getfilesize(\\.\J:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\J:
filewin32_getfilesize(\\.\L:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\L:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\L:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD1600BB-00GUA0, S/N:4457572d414d394c303232323332 038 0 0 0 0, FW:08.02D08
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST3160021A, S/N:4a34305339585250202020202020202020202020, FW:8.11
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63, sector size=512 - SAMSUNG HD501LJ

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - SAMSUNG HD501LJ
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 121601 254 63 1953536067 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 1953536067
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122096004
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Re: Windows requires format but can access data.

Posted: 04 Mar 2013, 09:22
by Fiona
Extrapolated and current boot secotor are identical indicates that your file system is damaged.
A safe solution might be datarecovery software.
PhotoRec can help, but it doesn't keep file names and directories.
In case you could test a trial of commercial software to check your files, file names and directories.
Chddsk is a utility to have a try to repair a file system but it's not intended to recover data.

Fiona
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited