cgsecurity.org

Good Morning, (at least my time),

My name is Craig. I have a 2tb external hd that Windows stated needed to be formatted. I ran TestDisk. Unfortunately, the TestDisk log file was corrupted, so I am unable to post it.

I have rebooted the Ubuntu Rescue Remix CD that I am using and am running TestDisk again.

In the first batch of analyses, TestDisk reported both:

1) sector doesn't have the endmark 0xAA55

and

2) no partition recoverable


Ideas?

I am running TestDisk again now, but it may be about 10 hours before I have more log data to post.

Thanks,

Craig

Evening,

I have a log to post. The 2tb disk has or had 1 NTFS partition in its most recent incarnation, and that is the partition that I would like to recover or more correctly, be able to access again. I should mention that, while this log does not show it, I also ran analyses after changing the disk head geometry from 255 to 240 and then 16. Both of the results were different but also stated that 'no partition was recoverable'. This most recent analysis was processed in TestDisk run in Windows.

Here is the most recent log:

-----------------------------------------------------------------------------------------------------------------------------------------

Fri Mar 29 08:10:52 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=120031543296
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=120031543296
file_pread(4,1,buffer,234452609(14593/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,234452609(14593/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - TOSHIBA MK1237GSX, S/N:9 87FHOHSS, FW:DL13
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - TOSHIBA MK1237GSX, S/N:9 87TJL2TE, FW:DL13
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ZALMAN , FW:0000

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ZALMAN
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
BAD_RS LBA=2344428926 3092673
check_part_i386 failed for partition type 0B
FAT32 145933 242 36 255240 209 29 1756014870
This partition ends after the disk limits. (start=2344428926, size=1756014870, end=4100443795, disk end=3907040130)
BAD_RS LBA=2229051226 5881470
check_part_i386 failed for partition type 01
FAT12 138752 5 32 264523 17 18 2020511858
This partition ends after the disk limits. (start=2229051226, size=2020511858, end=4249563083, disk end=3907040130)
BAD_RS LBA=3286134445 7011084
check_part_i386 failed for partition type 07
HPFS - NTFS 204552 104 14 247931 98 63 696883307
This partition ends after the disk limits. (start=3286134445, size=696883307, end=3983017751, disk end=3907040130)
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,7,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(6,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(6,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(6,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(6,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(6,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2175 GB / 2026 GiB)
The following partitions can't be recovered:
FAT12 138752 5 32 264523 17 18 2020511858
FAT32 145933 242 36 255240 209 29 1756014870
HPFS - NTFS 204552 104 14 247931 98 63 696883307

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
BAD_RS LBA=2344428926 3092673
check_part_i386 failed for partition type 0B
FAT32 145933 242 36 255240 209 29 1756014870
This partition ends after the disk limits. (start=2344428926, size=1756014870, end=4100443795, disk end=3907040130)
BAD_RS LBA=2229051226 5881470
check_part_i386 failed for partition type 01
FAT12 138752 5 32 264523 17 18 2020511858
This partition ends after the disk limits. (start=2229051226, size=2020511858, end=4249563083, disk end=3907040130)
BAD_RS LBA=3286134445 7011084
check_part_i386 failed for partition type 07
HPFS - NTFS 204552 104 14 247931 98 63 696883307
This partition ends after the disk limits. (start=3286134445, size=696883307, end=3983017751, disk end=3907040130)
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2175 GB / 2026 GiB)
The following partitions can't be recovered:
FAT12 138752 5 32 264523 17 18 2020511858
FAT32 145933 242 36 255240 209 29 1756014870
HPFS - NTFS 204552 104 14 247931 98 63 696883307

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.


------------------------------------------------------------------------------------------------------------------------------------------

Please advise as to the next course of action that I should take.

Thanks,

Craig

I tried to run Spi**ite and it locked up at about 26% and continued to lock up if I restarted at a location after the original location that it locked up.

So, I thought I would explain how my drive got messed up.

I placed the drive in new external 2 drive dock. The dock has RAID settings which include JBoD and Dual.

I incorrectly inset the dock to JBoD instead of dual, settings explained here:

http://superuser.com/questions/397923/j ... difference


This is how the partition table god messed up, I think. The dock treated the disks as 1 'volume'.

The drive is not a boot drive, it should just be 1 main NTFS partition with data. I'd like to keep the data if possible.

Knowing this and the information from the TestDisk scan, is thereany possible hope of saving the data? Does someone have a next step I can try?

Thanks,

Craig