HFS+ and NTFS on same disk, "harddisk seems too small"

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

HFS+ and NTFS on same disk, "harddisk seems too small"

#1 Post by waenc »

Hi,

I am attempting to recover the partitions from an external hard drive that I was experiencing problems with. The disk originally came packaged as a WD MyBook 2TB. I was experiencing I/O errors and random disconnections, so I moved the disk to a new USB enclosure. I then cloned the disk to a second 2TB external drive using

Code: Select all

./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
The original disk was formatted to contain NTFS and HFS+ filesystems, with the basic layout shown in the image below (HFS+ would be the larger partition) Image

I have attempted to run testdisk, from a Windows machine, on the copied disk several times, with little success. After selecting a media and choosing to "Proceed," I am given "Hint: EFI GPT partition table has been detected." Originally, I selected "Mac" partition table type and performed a quick search because I need to recover the HFS+ partition. In general, it was finding DOS_FAT_32 partitions, but, in the end, it gave me errors such as "the harddisk seems too small!" I tried a deeper search. During the deeper search (10+ days in), the computer was forced to restart and all progress was lost, and I don't think I have the logs for that.

The next time I started, I chose selected "EFI GPT" partition map because that was given in the hint. After the quick search, I received the following result Image

After the deeper search, I was given similar results ImageImage

In general, the .log tends to contain a lot of "lseek err Invalid argument" lines. I am wondering if I am experiencing problems because I did not write zeros (or anything else) to error locations when I ran ddrescue.

At this point, I cannot continue with trial-and-error attempts that take 20+ days to complete a quick and deeper search. Any help would be greatly appreciated.

Thank you,
-Weston

Log below. It may contain several sessions because I may have chosen to append the log. (note that I had to remove many lines similar to "file_pread(5,1,buffer,3907031077(243201/111/20)) lseek err Invalid argument" due to character limits. I simply filled in "..." where these were removed.)

Code: Select all


Mon Feb 18 12:08:55 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249957008384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=150110994432
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ST3250318AS, FW:CC45
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, FW:CC4B

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Mac

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/41
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=0-16/3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/41
     DOS_FAT_32                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

SYSV4 Marker at 27894/26/45

recover_sysv4
     Unknown                448118792  448118791          0 [dÅMï]
     SysV4, 0 B
Partition not added.
SIGHUP detected! TestDisk has been killed.



Thu Feb 21 17:30:03 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249957008384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=150110994432
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ST3250318AS, FW:CC45
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, FW:CC4B

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Mac
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Mac

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/41
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=0-16/3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/41
     DOS_FAT_32                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
   P DOS_FAT_32                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()
   P DOS_FAT_32                    40     409639     409600 [EFI]
simulate write!
Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
check_part_gpt failed for partition
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
No HFS or HFS+ structure
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/41
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=0-16/3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/41
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
Search for partition aborted

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
simulate write!

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
check_part_gpt failed for partition
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
No HFS or HFS+ structure
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/41
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=0-16/3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/41
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
Unknown XFS version 8

XFS Marker at 3904/159/2

recover_xfs
     MS Data                 62727778 7517553074689534 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
This partition ends after the disk limits. (start=62727778, size=3034296220, end=3097023998, disk end=3907029168)
check_FAT: Bad number of sectors per cluster
     Unknown                133059115 1559136519 1426077405
     FATX, 730 GB / 680 GiB
Partition not added.

SYSV4 Marker at 27894/26/45

recover_sysv4
     Unknown                448118792  448118791          0 [dÅMï]
     SysV4, 0 B
Partition not added.
Unknown XFS version 8

XFS Marker at 40120/104/19

recover_xfs
     MS Data                644534370 7517553656496126 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
This partition ends after the disk limits. (start=644534370, size=3034296220, end=3678830590, disk end=3907029168)
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
     Unknown                982217174 5223262373 4241045200
     FATX, 2171 GB / 2022 GiB
Partition not added.
check_FAT: Bad jump in FAT partition

LVM magic value at 75559/32/4
     Unknown               1384089756 3702476804 2318387049
     FATX, 1187 GB / 1105 GiB
Partition not added.

recover_JFS: s_blocksize=196443832
recover_JFS: s_size 535055705
recover_JFS: s_fsckpxd.len:15216469
recover_JFS: s_logpxd.len:15197852
recover_JFS: part_size 3891592015
     MS Data               1412936130 31569183161232657 31569181748296527
     JFS 333442950, blocksize=196443832, 16163421 TB / 14700545 TiB
This partition ends after the disk limits. (start=1412936130, size=3891592015, end=1009560849, disk end=3907029168)

HFS+ magic value at 243199/190/44
part_size 9396
     Mac HFS               3907003948 3907013343       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB
file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,3907029170(243201/81/3)) lseek err Invalid argument
file_pread(5,1,buffer,3907029171(243201/81/4)) lseek err Invalid argument
...
file_pread(5,1,buffer,3907031077(243201/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,3907031078(243201/111/21)) lseek err Invalid argument
file_pread(5,1,buffer,3907031079(243201/111/22)) lseek err Invalid argument
file_pread(5,1,buffer,3907031080(243201/111/23)) lseek err Invalid argument
file_pread(5,11,buffer,3907029158(243201/80/54)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031081(243201/111/24)) lseek err Invalid argument
file_pread(5,4,buffer,3907029166(243201/80/62)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031082(243201/111/25)) lseek err Invalid argument
file_pread(5,11,buffer,3907029160(243201/80/56)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031083(243201/111/26)) lseek err Invalid argument
file_pread(5,6,buffer,3907029166(243201/80/62)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031084(243201/111/27)) lseek err Invalid argument
file_pread(5,4,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,3907031085(243201/111/28)) lseek err Invalid argument
file_pread(5,11,buffer,3907029163(243201/80/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031086(243201/111/29)) lseek err Invalid argument
file_pread(5,1,buffer,3907029174(243201/81/7)) lseek err Invalid argument
...
file_pread(5,1,buffer,3907029254(243201/82/24)) lseek err Invalid argument
file_pread(5,11,buffer,3907029294(243201/83/1)) lseek err Invalid argument
file_pread(5,1,buffer,3907031217(243201/113/34)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 16163421 TB / 14700546 TiB)
The following partitions can't be recovered:
     MS Data                 62727778 7517553074689534 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
     MS Data                644534370 7517553656496126 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
     MS Data               1412936130 31569183161232657 31569181748296527
     JFS 333442950, blocksize=196443832, 16163421 TB / 14700545 TiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS               3907003948 3907013343       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB


dir_partition inode=0
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=2(0x2), pos=6374
Directory /

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS               3907003948 3907013343       9396

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/41
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
FAT differs, FAT sectors=0-16/3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/41
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 0/0/47
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/47
     EFI System                    46     409645     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 7/109/32
part_size 3907029160
     Mac HFS                   119353 3907148512 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119353, size=3907029160, end=3907148512, disk end=3907029168)

HFS+ magic value at 7/109/34

HFS+ magic value at 7/111/27
part_size 3907029160
     Mac HFS                   119474 3907148633 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119474, size=3907029160, end=3907148633, disk end=3907029168)

HFS+ magic value at 7/111/29

HFS+ magic value at 7/113/38
part_size 3907029160
     Mac HFS                   119611 3907148770 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119611, size=3907029160, end=3907148770, disk end=3907029168)

HFS+ magic value at 7/113/40

HFS+ magic value at 7/115/17
part_size 3907029160
     Mac HFS                   119716 3907148875 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119716, size=3907029160, end=3907148875, disk end=3907029168)

HFS+ magic value at 7/115/19

HFS+ magic value at 7/116/35
part_size 3907029160
     Mac HFS                   119797 3907148956 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119797, size=3907029160, end=3907148956, disk end=3907029168)

HFS+ magic value at 7/116/37

HFS+ magic value at 7/117/61
part_size 3907029160
     Mac HFS                   119886 3907149045 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=119886, size=3907029160, end=3907149045, disk end=3907029168)

HFS+ magic value at 7/117/63

HFS+ magic value at 7/120/33
part_size 3907029160
     Mac HFS                   120047 3907149206 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120047, size=3907029160, end=3907149206, disk end=3907029168)

HFS+ magic value at 7/120/35

HFS+ magic value at 7/123/21
part_size 3907029160
     Mac HFS                   120224 3907149383 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120224, size=3907029160, end=3907149383, disk end=3907029168)

HFS+ magic value at 7/123/23

HFS+ magic value at 7/125/8
part_size 3907029160
     Mac HFS                   120337 3907149496 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120337, size=3907029160, end=3907149496, disk end=3907029168)

HFS+ magic value at 7/125/10

HFS+ magic value at 7/128/36
part_size 3907029160
     Mac HFS                   120554 3907149713 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120554, size=3907029160, end=3907149713, disk end=3907029168)

HFS+ magic value at 7/128/38

HFS+ magic value at 7/130/55
part_size 3907029160
     Mac HFS                   120699 3907149858 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120699, size=3907029160, end=3907149858, disk end=3907029168)

HFS+ magic value at 7/130/57

HFS+ magic value at 7/132/34
part_size 3907029160
     Mac HFS                   120804 3907149963 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120804, size=3907029160, end=3907149963, disk end=3907029168)

HFS+ magic value at 7/132/36

HFS+ magic value at 7/134/5
part_size 3907029160
     Mac HFS                   120901 3907150060 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=120901, size=3907029160, end=3907150060, disk end=3907029168)

HFS+ magic value at 7/134/7

HFS+ magic value at 7/136/40
part_size 3907029160
     Mac HFS                   121062 3907150221 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121062, size=3907029160, end=3907150221, disk end=3907029168)

HFS+ magic value at 7/136/42

HFS+ magic value at 7/139/28
part_size 3907029160
     Mac HFS                   121239 3907150398 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121239, size=3907029160, end=3907150398, disk end=3907029168)

HFS+ magic value at 7/139/30

HFS+ magic value at 7/141/39
part_size 3907029160
     Mac HFS                   121376 3907150535 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121376, size=3907029160, end=3907150535, disk end=3907029168)

HFS+ magic value at 7/141/41

HFS+ magic value at 7/143/42
part_size 3907029160
     Mac HFS                   121505 3907150664 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121505, size=3907029160, end=3907150664, disk end=3907029168)

HFS+ magic value at 7/143/44

HFS+ magic value at 7/145/5
part_size 3907029160
     Mac HFS                   121594 3907150753 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121594, size=3907029160, end=3907150753, disk end=3907029168)

HFS+ magic value at 7/145/7

HFS+ magic value at 7/148/57
part_size 3907029160
     Mac HFS                   121835 3907150994 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=121835, size=3907029160, end=3907150994, disk end=3907029168)

HFS+ magic value at 7/148/59

HFS+ magic value at 7/153/15
part_size 3907029160
     Mac HFS                   122108 3907151267 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122108, size=3907029160, end=3907151267, disk end=3907029168)

HFS+ magic value at 7/153/17

HFS+ magic value at 7/154/41
part_size 3907029160
     Mac HFS                   122197 3907151356 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122197, size=3907029160, end=3907151356, disk end=3907029168)

HFS+ magic value at 7/154/43

HFS+ magic value at 7/156/44
part_size 3907029160
     Mac HFS                   122326 3907151485 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122326, size=3907029160, end=3907151485, disk end=3907029168)

HFS+ magic value at 7/156/46

HFS+ magic value at 7/158/63
part_size 3907029160
     Mac HFS                   122471 3907151630 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122471, size=3907029160, end=3907151630, disk end=3907029168)

HFS+ magic value at 7/159/2

HFS+ magic value at 7/160/26
part_size 3907029160
     Mac HFS                   122560 3907151719 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122560, size=3907029160, end=3907151719, disk end=3907029168)

HFS+ magic value at 7/160/28

HFS+ magic value at 7/161/28
part_size 3907029160
     Mac HFS                   122625 3907151784 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122625, size=3907029160, end=3907151784, disk end=3907029168)

HFS+ magic value at 7/161/30

HFS+ magic value at 7/164/8
part_size 3907029160
     Mac HFS                   122794 3907151953 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122794, size=3907029160, end=3907151953, disk end=3907029168)

HFS+ magic value at 7/164/10

HFS+ magic value at 7/165/58
part_size 3907029160
     Mac HFS                   122907 3907152066 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122907, size=3907029160, end=3907152066, disk end=3907029168)

HFS+ magic value at 7/165/60

HFS+ magic value at 7/166/60
part_size 3907029160
     Mac HFS                   122972 3907152131 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=122972, size=3907029160, end=3907152131, disk end=3907029168)

HFS+ magic value at 7/166/62

HFS+ magic value at 7/169/40
part_size 3907029160
     Mac HFS                   123141 3907152300 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=123141, size=3907029160, end=3907152300, disk end=3907029168)

HFS+ magic value at 7/169/42

HFS+ magic value at 7/171/43
part_size 3907029160
     Mac HFS                   123270 3907152429 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=123270, size=3907029160, end=3907152429, disk end=3907029168)

HFS+ magic value at 7/171/45
Unknown XFS version 8

XFS Marker at 3904/159/2

recover_xfs
     MS Data                 62727778 7517553074689534 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
This partition ends after the disk limits. (start=62727778, size=3034296220, end=3097023998, disk end=3907029168)
check_FAT: Bad number of sectors per cluster
     Unknown                133059115 1559136519 1426077405
     FATX, 730 GB / 680 GiB
Partition not added.

SYSV4 Marker at 27894/26/45

recover_sysv4
     Unknown                448118792  448118791          0 [dÅMï]
     SysV4, 0 B
Partition not added.
Unknown XFS version 8

XFS Marker at 40120/104/19

recover_xfs
     MS Data                644534370 7517553656496126 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
This partition ends after the disk limits. (start=644534370, size=3034296220, end=3678830590, disk end=3907029168)
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
     Unknown                982217174 5223262373 4241045200
     FATX, 2171 GB / 2022 GiB
Partition not added.
check_FAT: Bad jump in FAT partition

LVM magic value at 75559/32/4
     Unknown               1384089756 3702476804 2318387049
     FATX, 1187 GB / 1105 GiB
Partition not added.

recover_JFS: s_blocksize=196443832
recover_JFS: s_size 535055705
recover_JFS: s_fsckpxd.len:15216469
recover_JFS: s_logpxd.len:15197852
recover_JFS: part_size 3891592015
     MS Data               1412936130 31569183161232657 31569181748296527
     JFS 333442950, blocksize=196443832, 16163421 TB / 14700545 TiB
This partition ends after the disk limits. (start=1412936130, size=3891592015, end=1009560849, disk end=3907029168)

HFS+ magic value at 243199/190/44
part_size 9396
     Mac HFS               3907003948 3907013343       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB

HFS+ magic value at 243199/190/46
part_size 9396
     Mac HFS               3906994556 3907003951       9396
     HFS+ found using backup sector!, 4810 KB / 4698 KiB

HFS+ magic value at 243200/84/49
part_size 9396
     Mac HFS               3907013340 3907022735       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB

HFS+ magic value at 243200/84/51
part_size 9396
     Mac HFS               3907003948 3907013343       9396
     HFS+ found using backup sector!, 4810 KB / 4698 KiB
file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,3907029170(243201/81/3)) lseek err Invalid argument
file_pread(5,1,buffer,3907029171(243201/81/4)) lseek err Invalid argument
...
file_pread(5,1,buffer,3907031079(243201/111/22)) lseek err Invalid argument
file_pread(5,1,buffer,3907031080(243201/111/23)) lseek err Invalid argument
file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031081(243201/111/24)) lseek err Invalid argument
file_pread(5,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,3907031082(243201/111/25)) lseek err Invalid argument
file_pread(5,11,buffer,3907029160(243201/80/56)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3907031083(243201/111/26)) lseek err Invalid argument
file_pread(5,3,buffer,3907029169(243201/81/2)) lseek err Invalid argument
...
file_pread(5,1,buffer,3907029304(243201/83/11)) lseek err Invalid argument
file_pread(5,1,buffer,3907031217(243201/113/34)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 16163421 TB / 14700546 TiB)
The following partitions can't be recovered:
     Mac HFS                   119353 3907148512 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   119474 3907148633 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   119611 3907148770 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   119716 3907148875 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   119797 3907148956 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   119886 3907149045 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120047 3907149206 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120224 3907149383 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120337 3907149496 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120554 3907149713 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120699 3907149858 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120804 3907149963 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   120901 3907150060 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121062 3907150221 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121239 3907150398 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121376 3907150535 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121505 3907150664 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121594 3907150753 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   121835 3907150994 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122108 3907151267 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122197 3907151356 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122326 3907151485 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122471 3907151630 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122560 3907151719 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122625 3907151784 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122794 3907151953 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122907 3907152066 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   122972 3907152131 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   123141 3907152300 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     Mac HFS                   123270 3907152429 3907029160
     HFS+ blocksize=4096, 2000 GB / 1863 GiB
     MS Data                 62727778 7517553074689534 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
     MS Data                644534370 7517553656496126 7517553011961756 [ê¼ÄB
²N]
     XFS 6.2+ - bitmap version blocksize=2522989141, 3848987 TB / 3500633 TiB
     MS Data               1412936130 31569183161232657 31569181748296527
     JFS 333442950, blocksize=196443832, 16163421 TB / 14700545 TiB

Results
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
     EFI System                    46     409645     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
     Mac HFS               3906994556 3907003951       9396
     HFS+ found using backup sector!, 4810 KB / 4698 KiB
     Mac HFS               3907003948 3907013343       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB
     Mac HFS               3907013340 3907022735       9396
     HFS+ blocksize=2048, 4810 KB / 4698 KiB


dir_partition inode=0
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=2(0x2), pos=6374
Directory /


dir_partition inode=0
     EFI System                    46     409645     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
FAT: cluster=2(0x2), pos=6380
Directory /
gpt_change_part_type
Change partition type:
     Mac HFS               3906994556 3907003951       9396
     HFS+ found using backup sector!, 4810 KB / 4698 KiB
Change partition type:
     HFS+                  3906994556 3907003951       9396
     HFS+ found using backup sector!, 4810 KB / 4698 KiB

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#2 Post by waenc »

I tried an "Intel" partition table type with no success, though it went much faster.

I thought this part looked hopeful because it looks correct:
Current partition structure:
1 P EFI GPT 0 0 2 25 127 14 409639

Bad relative sector.
No HFS or HFS+ structure
2 P HFS 25 127 15 224946 227 25 3613362176
2 P HFS 25 127 15 224946 227 25 3613362176

Bad relative sector.
Invalid NTFS or EXFAT boot
3 P HPFS - NTFS 224947 4 18 243196 247 59 293185536
3 P HPFS - NTFS 224947 4 18 243196 247 59 293185536
Whole log below.

Code: Select all


Mon Mar 18 14:44:04 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249957008384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=150110994432
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ST3250318AS, FW:CC45
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, FW:CC4B

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
BAD_RS LBA=409640 16450559
check_part_i386 failed for partition type AF
check_part_i386 failed for partition type 07
Current partition structure:
 1 P EFI GPT                  0   0  2    25 127 14     409639

Bad relative sector.
No HFS or HFS+ structure
 2 P HFS                     25 127 15 224946 227 25 3613362176
 2 P HFS                     25 127 15 224946 227 25 3613362176

Bad relative sector.
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          224947   4 18 243196 247 59  293185536
 3 P HPFS - NTFS          224947   4 18 243196 247 59  293185536
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,15,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#3 Post by waenc »

reading around, i see that the WD MyBook could be hardware encrypted. should i put it back in the original enclosure? i was unable to clone the disk with dd_rescue from that enclosure because it would disconnect within minutes.
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#4 Post by waenc »

I returned the original drive to the original WD enclosure. When I open disk utility, I get this message:
Image
I chose not to initialize, and you can see that it shows as 1826.99 GB unallocated.

When I ran TestDisk, I chose to analyze as "EFI GPT" as suggested by the hint. I get "Bad GPT partition, invalid signature. Trying alternate GPT," which gives the really nice looking partition table:

1 P EFI System 40 409639 409600 [EFI System Partition]
No HFS or HFS+ structure
2 P Mac HFS 409640 3613771815 3613362176 [Untitled]
2 P Mac HFS 409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 3614035968 3906961407 292925440 [WINDOWS]
3 P MS Data 3614035968 3906961407 292925440 [WINDOWS]

The search got stuck on cylinder 20, and I had to force TestDisk to close through task manager.

When I run Western Digital Lifeguard's quick test, I get error message "Quick Test on drive 2 did not complete! Status code = 07 (Failed read test element), Failure Checkpoint = 97 (Unknown Test) SMART self-test did not complete on drive 2!"

I could really use a look at this, if anyone can spare it. Thanks.

*NOTE: This last post is from the original drive in the original enclosure. In previous posts, I was using a clone of the original that was made while the original was in an alternate enclosure.

Code: Select all


Tue Mar 19 18:53:35 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-03-10T16:32:17
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=81351671808
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=414257291264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=251525693440
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST750LX003-1AC154, S/N:2020202020202020202020203257303057315146, FW:SM12
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1130, S/N:WCAZA0898641, FW:1014

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Book 1130
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=3906963455
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=3906963423
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
check_part_gpt failed for partition
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Bad GPT partition, invalid signature.
Trying alternate GPT
 1 P EFI System                    40     409639     409600 [EFI System Partition]
No HFS or HFS+ structure
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
 1 P EFI System                    40     409639     409600 [EFI System Partition]
No HFS or HFS+ structure
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#5 Post by waenc »

I am still having problems.

I tried different USB cables on the original hard drive in the original WB My Book enclosure. This did not change anything. I bought a new circuit board, with an identical part number, off of eBay and tried that as well. This still has not helped.

Testdisk continues to hang on cylinder 20. A sample log of this is given below.

Code: Select all

Fri Apr 26 13:21:02 2013
Command line: TestDisk

Failed to startup volume: Invalid argument.
TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249957008384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=31457280
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ST3250318AS, FW:CC45
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1130, FW:1016
Drive F: - 31 MB / 30 MiB - CHS 7 64 32, sector size=2048 - WD Virtual CD 1130, FW:1016

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Book 1130
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=3906963455
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=3906963423
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Bad GPT partition, invalid signature.
Trying alternate GPT
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
     HFS+ blocksize=4096, 1850 GB / 1722 GiB
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
gpt_change_part_type
Change partition type:
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Change partition type:
 3 P NTFS                  3614035968 3906961407  292925440 [WINDOWS]

 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
filesystem size           15225305011584682651 1
sectors_per_cluster       253 0
mft_lcn                   1736225331 0
mftmirr_lcn               2180104641 0
clusters_per_mft_record   -90 0
clusters_per_index_record -37 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=3906963455
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=3906963423
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Bad GPT partition, invalid signature.
Trying alternate GPT
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   409640 3613771815 3613362176 [Untitled]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]
 3 P MS Data               3614035968 3906961407  292925440 [WINDOWS]

search_part()
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
file_pread(5,16,buffer,326306(20/79/30)) ReadFile The semaphore timeout period has expired.

file_pread(5,16,buffer,326307(20/79/31)) ReadFile The semaphore timeout period has expired.

file_pread(5,16,buffer,326308(20/79/32)) ReadFile The semaphore timeout period has expired.
It goes on with this "file_pread(....." for many many lines before it was forcibly quit.

When I tried to repair the MBR overnight, it generated a log file that is +29 GB in size and cannot be opened by any word processing programs. When I returned it only showed me the standard "Boot sector Status: Bad - Backup boot sector Status: Bad" screen that precedes the repair.

What I don't understand is why I did not encounter as many problems when the hard drive was in an alternate enclosure. I have tried changing all parts besides the drive itself.

I think my next effort will be to attempt to copy the original hard drive (from its original enclosure) to a new one. When I did this before, I had the hard drive in an alternate enclosure that did not have WD decryption.

If anyone has any other advice, I would be grateful. Thanks.
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#6 Post by waenc »

so ddrescue went nuts and i have no idea what is going on with it.

Image
Top
Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#7 Post by Lito »

Try running ddrescue as root.
If running from the recommended Knoppix CD/DVD you can try first to update
sudo apt-get update

to sync with the relevant servers,
then install gnu ddrescue if it did not come with your disk (you can check that online)
with apt-get install or following the advise in this page:

http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

If you need to clean the disk for the clone first, you could use the free MiniTool
Partition Wizard CD from:
http://www.partitionwizard.com/download.html

Best of luck
Top
waenc
Posts: 7
Joined: 18 Mar 2013, 17:23

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#8 Post by waenc »

I just repeated this as Administrator using Cygwin 1.7 (downloaded a few days ago) in Windows XP, and it behaved the same way. Administrator would be the same thing as root, correct?

I also tried with OSX console ddrescue 1.16. It got to the same location (167051 kb) before it started encountering errors. It did not jump quickly to the 2000GB error size as it did on Cygwin. Instead, it slowed down and actually resolved a few small blocks after the first error. I had to stop it because the computer was not attached to power, but I may try to keep going with the OSX console later.

I wrote 1s or 0s to the disk I am copying to with OSX disk utility. I'm assuming this would have cleaned it well before starting.
Top
Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: HFS+ and NTFS on same disk, "harddisk seems too small"

#9 Post by Lito »

Yes you are correct. To get to the Administrator account in XP, press F8 as soon as the machine approaches the end of POST (before Windows starts to boot). Start Windows in safe mode. Then you will see the Administrator account. If you don't you can get to it through the Control Panel, User Accounts.
Sorry I thought your picture of the shell was from Linux. In any case you do not need to install Cygwin to run TestDisk under Windows. I think it does that on its own. Mind you, you were running ddrescue.
If you take a closer look at the instructions about running gnu ddrescue under Knoppix, no split is indicated as one of the switches, the first time you run it, if I remember correctly. The second time is runned with switches to indicate retry once over the bad sectors, or something like that. You are probably right to have a go running it from the Mac's OS.

Have a look a the las part of this post. Might be of help:

http://forum.cgsecurity.org/phpBB3/post5467.html#p5467

This Fedora version comes with all the tools needed:

http://spins.fedoraproject.org/security/#downloads

There a list of all the tools for this security spin in the same site.

Best of luck
Top
Locked

Return to “Partition Recovery”