cgsecurity.org

Hello Everyone,

I am new here and in dire need of some help from the experienced people in this group.
I was reformatting a bunch of re-writable dvds and inadvertently formatted my external
hard drive. I stopped and canceled the process within a minute after realizing what I
did but I am now in a position of being unable to recover the information on the drive.
I have about 1.5 TB of family pictures, personal files, music, and video on this hard
drive that I need to recover. The family pictures, personal files are irreplaceable!

That's where you incredibly smart individuals in this group come in. Fiona? Remy?
I've seen you help others and would greatly appreciate any help you could provide.

I am using TestDisk 6.14-WIP 32 bit version on Windows 7.

The hard drive in question is an Hitachi Easy Device 2TB hard drive.
I started TestDisk, created a new log file, and the first screen shows:

>Disk /dev/sda - 640 GB / 596 GiB - Toshiba MK6461GSYN
>Disk /dev/sdb - 2000 GB / 1863 GiB - Hitachi Easy Device
Drive C: - 107 GB / GB / 100 GiB
Drive D: - 510 GB/ 475 Gib

I selected the Hitachi drive and on the next screen I selected "Intel".

On the next screen I saw this:

>Disk /dev/sdb - 2000 GB / 1863 GiB - Hitachi Easy Device
CHS 243201 255 63 - sector size-512

Next I selected "Analyse" and the screen showed this:

>Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 2432014 255 63
Current partition structure:
Partition Start End Size in sectors

Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 243200 254 62 3907024001
1 P HPFS - NTFS 0 1 1 243200 254 62 3907024001
No partition is bootable

Next I select "Quick Search"

After quick search, the screened showed this:

>Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 2432014 255 63

The harddisk (2000 GB / 1863 GiB) seems too small! (< 4692 GB / 4370 GiB>)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS -NTFS 385000 53 50 570513 90 61 2980268688

This is where I now sit. I feel sick to my stomach.

Does this mean I am totally screwed???

Fiona? Remy? Others? Can you please help me out here? I am truly desperate!!!

James

Hello again,

I've replied to my own post to provide some more information which
might help in ascertaining if and how I may recover my lost partition.

I am using Windows 7 Home Premium 64 bit version
I am using TestDisk 6.14-WIP 32 bit version as suggested in forums.

Here are relevant screen grabs of:

Windows 7 Computer Management:
QuickDiskInfo:
In the next post I will post the TestDisk screen grabs.

James

Hello Once Again,

Here are the relevant TestDisk screen grabs:
I hope these three screen grabs, along with the previous
two screen grabs above, provide enough information for
whoever chooses to help me out.

The next post will contain the last TestDisk screenshot
plus the results of the quick search analysis from the
testdisk.log file.

James

Alrighty then,

Here's the last two TestDisk screen grab:
--------------------------------------------------------------------
and last but not least, the results from the TestDisk Log:

Wed Apr 24 11:00:18 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-22T08:36:13
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107376947200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=510660706304
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396288512
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - TOSHIBA MK6461GSYN, S/N:2020202020202020202032205131503338305447, FW:MH000C
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Hitachi Easy Device
Drive C: - 107 GB / 100 GiB - CHS 13054 255 63, sector size=512
Drive D: - 510 GB / 475 GiB - CHS 62084 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - Hitachi Easy Device
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=62
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 243200 254 62 3907024001
1 P HPFS - NTFS 0 1 1 243200 254 62 3907024001
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
BAD_RS LBA=1890061092 15915040
file_pread(5,1,buffer,1890061092(385000/53/50)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 385000 53 50 570513 90 61 2980268688
This partition ends after the disk limits. (start=1890061092, size=2980268688, end=575362483, disk end=3907029168)
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,15,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4692 GB / 4370 GiB)
The following partition can't be recovered:
HPFS - NTFS 385000 53 50 570513 90 61 2980268688

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
BAD_RS LBA=1890061092 15915040
file_pread(5,1,buffer,1890061092(385000/53/50)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 385000 53 50 570513 90 61 2980268688
This partition ends after the disk limits. (start=1890061092, size=2980268688, end=575362483, disk end=3907029168)
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4692 GB / 4370 GiB)
The following partition can't be recovered:
HPFS - NTFS 385000 53 50 570513 90 61 2980268688

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()

No partition found or selected for recovery

-------------------------------------------------------------------------
Well, now that I've got all this posted, I'll be patiently waiting
for a reply from whoever decides to help me out with this thing.
Rest assured, I'm patient and willing to wait a looong time in
order to get help from you fine folks because that hard drive
has irreplaceable photos and files that I must absolutely get.

Finally, I would like to also mention there are probably over
a million files on my hard drive in hundreds of different
directories. So if you thing any commercial recovery software
would do a better job than test disk, please feel free to point
me in the direction of any of the ones you consider best.

Money is no object when it comes to recovering this hard drive.

Thanks in advance for any help you can provide.

Cheers!!!

James