Page 1 of 1

First experience with Testdisk. Help Appreciated

Posted: 14 Apr 2013, 15:54
by roguefire
I have an internal 3TB HDD on my windows 7 machine. I was transferring a large amount of data from an external HDD overnight. When I came back to my computer, windows had automatically updated and restarted by computer. As a result, my internal 3TB HDD now shows as RAW and I cannot recover the partition.

I have tried to follow the instruction on website to the best of my ability, but I am still stuck. I do not know what the next step should be. These are the steps I have taken.

First, ran teskdisk using NTFS.

Code: Select all


Fri Apr 12 21:58:58 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256066453504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=801569726464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=500074283008
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256066453504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=801569726464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500074283008
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255959498752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500105217024
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=500073234432
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
file_pread(4,1,buffer,500135579(31131/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1565566379(97451/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(8,1,buffer,976719869(60797/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31131 255 63, sector size=512 - Intel Raid 0 Volume, S/N:Asus0, FW:1.0.
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM 001-9YN166, S/N:1W0FWT38, FW:CC4B
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD25 00JS-60NCB1, S/N:W -DCWNA4K872912, FW:10.0
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00KS-00MNB0, S/N:W -DCWNA1U460918, FW:07.0
Disk /dev/sde - 500 GB / 465 GiB - CHS 60797 255 63, sector size=512 - WD My Passport 0730, S/N:WXH1A61T3024, FW:1016

Partition table type (auto): EFI GPT
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM 001-9YN166
Partition table type: Intel
file_pread(5,1,buffer,1565566379(97451/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 801 GB / 746 GiB - CHS 97452 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97452 255 63
BAD_RS LBA=638165379 2185217
file_pread(5,3,buffer,638165379(307073/78/17)) lseek err Invalid argument
file_pread(5,1,buffer,638165379(307073/78/17)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                307073  78 17 450210 162 12 2299501193
This partition ends after the disk limits. (start=638165379, size=2299501193, end=2937666571, disk end=1565566380)
file_pread(5,2,buffer,1565566976(97452/9/30)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(97452/9/30)) lseek err Invalid argument
file_pread(5,8,buffer,1565566380(97452/0/1)) lseek err Invalid argument
file_pread(5,8,buffer,1565566388(97452/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,1565566396(97452/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,1565566443(97452/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,1565566459(97452/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,1565566506(97452/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,1565568428(97452/32/33)) lseek err Invalid argument
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97452 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (801 GB / 746 GiB) seems too small! (< 3703 GB / 3448 GiB)
The following partition can't be recovered:
     FAT12                307073  78 17 450210 162 12 2299501193

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97452 255 63
BAD_RS LBA=638165379 2185217
file_pread(5,3,buffer,638165379(307073/78/17)) lseek err Invalid argument
file_pread(5,1,buffer,638165379(307073/78/17)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                307073  78 17 450210 162 12 2299501193
This partition ends after the disk limits. (start=638165379, size=2299501193, end=2937666571, disk end=1565566380)
file_pread(5,2,buffer,1565566976(97452/9/30)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(97452/9/30)) lseek err Invalid argument
file_pread(5,1,buffer,1565566379(97451/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1565566380(97452/0/1)) lseek err Invalid argument
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97452 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (801 GB / 746 GiB) seems too small! (< 3703 GB / 3448 GiB)
The following partition can't be recovered:
     FAT12                307073  78 17 450210 162 12 2299501193

Results

interface_write()
 
No partition found or selected for recovery
Second, I ran test disk using EFI GPT.

Code: Select all


Sat Apr 13 10:59:21 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256066453504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=801569726464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=500074283008
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256066453504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=801569726464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500074283008
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255959498752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500105217024
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=500073234432
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
file_pread(4,1,buffer,500135579(31131/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1565566379(97451/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(8,1,buffer,976719869(60797/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31131 255 63, sector size=512 - Intel Raid 0 Volume, S/N:Asus0, FW:1.0.
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM 001-9YN166, S/N:1W0FWT38, FW:CC4B
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD25 00JS-60NCB1, S/N:W -DCWNA4K872912, FW:10.0
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00KS-00MNB0, S/N:W -DCWNA1U460918, FW:07.0
Disk /dev/sde - 500 GB / 465 GiB - CHS 60797 255 63, sector size=512 - WD My Passport 0730, S/N:WXH1A61T3024, FW:1016

Partition table type (auto): EFI GPT
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM 001-9YN166
Partition table type: EFI GPT
file_pread(5,1,buffer,1565566379(97451/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1565565871 (expected 1565565871)
hdr_lba_start=34
hdr_lba_end=1565565838
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
check_part_gpt failed for partition
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]
I am confused as to which mode to even begin the analyze in. I hope someone can help me. I have many years worth of precious photos I'd like to save.

Thanks alot.