Raid0 partition found but not recovered Topic is solved

[vsix]

Hi,

I'm having some troubles with my Raid0. After a motherboard swap, my Raid0 failed (non-member disk). So I found an how-to topic on another forum that tell to wipe Raid0 array and recreate it with the same config and then use Tesdisk to recover the vanished partition. But after following those steps, TestDisk found my lost partition but can't recover it... What am I missing? You think I have to swipe my HDD order to recover this partition?

PS : Sorry for my English (I'm French )

[vsix]

Testdisk throws me this error when using the detected geometry (486398 cylinders) :





So I decided to modify the geometry, and after setting the number of cylinders at 486401 I was able to list all my datas. I've saved the most important, but can't write the partition anymore...









I've about 3To on this raid, so I can't save the whole datas on an external drive... Is there any solution to retreive my original partition on my raid?

[Fiona]

Was your disk before a GPT (GUID partition table) disk or an Intel MBR disk builded on 4 KB sectors?
To support disks larger the 2.2 TB you should normally use GPT.
If you recreated your array exactly like before, then it should be possible to use testdisk to get your partition back.
But it might be possible that you must check your disk in your disk management console.
If you watch your disk, in your disk management console at the left side there is that little square.
There you can find a description like basic means it's an intel MBR disk.
If there is a description like GPT you can use testdisk to write your partition to your GUID partition table.
Often windows reports a GPT disk false.
If there is a false description like basic and it's GPT, you should right click in that left little square to figure out, do you have a GPT disk or a basic.
If there is a description like convert to basic, then there ist no further action required.
Only if you see something like convert to GPT, you should do that.
Even just check it and if you are unsure, please let me know.
Some background processes like antivirus can prevent you from writing to your partition table.
In case, you should disable background processes using msconfig.

Fiona

[vsix]

Thanks for the answer, I will check that in few hours and get result back here .
So, partition geometry (start : 264192 - end : 7814045695) doesn't shock you?

EDIT : Can't get the type of the disk on my disk management. The partition is not initialized, should I initialize it to a GPT partition like Windows is asking me?

[Fiona]

So, partition geometry (start : 264192 - end : 7814045695) doesn't shock you?

Nope, not really!
GPT-disks have no geometry that's why size, start and end of your partition is counted in sectors.
But it looks confusing, because your disk is displayed in cylinder size.
Standard Intel MBR, one cylinder might be approximate 8 MB.

[vsix]

Oh ok.

EDIT : Can't get the type of the disk on my disk management. The partition is not initialized, should I initialize it to a GPT partition like Windows is asking me?

Should I do this?

[Fiona]

Yes, you should initialize your disk in your disk management console.
Windows only writes 4 bytes to yur GUID partition table.
It's absolutely required since W2k, so that windows can handle your disk.
Afterwards you can run testdisk to have a try to find your partition.
In some cases if you create a GPT-disk, it might be possible that windows creates a volume also.
Please don't format it and let me know.
If you format it, then it might be possible that you override your previous file system.
Partitions could be MS Reserved and MS Data.
MS Data is your important partition.
If you got both partitions unformatted, please let me know.
In case you can run a boot sector diagnose instead of a whole diagnose through analyse.
If your initialized disk is still unallocated (empty) you can run a normal diagnose like Analyse, Quick Search and if nothing is be found, Deeper Search also.
A tip is, if TestDisk finds an appropriate partition (if you recognize it through your label), you can press F (upper case) to jump to the end of the partition.
So it will save time not to scan your whole disk.

Fiona

[vsix]

I've initialized my disk to GPT-disk. My disk is always unallocated so I ran an Analyse in Testdisk which found my MS Data partition. But it's always the same problem when I try to write, I get a Partition write error.

I decided to test it with selectioning Intel partition. Partition found, listing OK, and writing the partition works but when I rebooted my PC I found a black screen... It persists until I reset my raid0 array another time...

What is going wrong with this partition?

[Fiona]

Would it be possible that you copy and paste the content of your testdisk.log?
Also a screen from your disk management console is appreciated.
Would it be possible to right click your left little square of your disk in the disk management console?
Another screenshot would be appreciated also.

Fiona

[vsix]

Here is the logfile :

Code: Select all

Thu May  2 20:23:31 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-28T20:31:57
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000762036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000762036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=59652440064
filewin32_getfilesize(\\.\D:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-AGILITY3, S/N:OCZ-19NOFOE0T48NAI75, FW:2.25
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486398 255 63, sector size=512 - Intel Raid 0 Volume, S/N:Stockage, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - Intel Raid 0 Volume
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814032064 (expected 7813988351)
hdr_lba_start=34
hdr_lba_end=7814032031
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                   264192 7814045695 7813781504 [Stockage]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
New geometry
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63 sector_size=512

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814032064 (expected 7814032064)
hdr_lba_start=34
hdr_lba_end=7814032031
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   264192 7814045695 7813781504 [Stockage]

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 2/181/28
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                    43560     248359     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size           7813781504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814045695 7813781504 [Stockage]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,8,buffer,3519078400(486401/216/24)) lseek err Invalid argument
file_pread(5,1,buffer,3519078400(486401/216/24)) lseek err Invalid argument
file_pread(5,15,buffer,3519078401(486401/216/25)) lseek err Invalid argument
file_pread(5,3,buffer,3519078416(486401/216/40)) lseek err Invalid argument
file_pread(5,3,buffer,3519078463(486401/217/24)) lseek err Invalid argument
file_pread(5,8,buffer,3519078479(486401/217/40)) lseek err Invalid argument
file_pread(5,11,buffer,3519078526(486401/218/24)) lseek err Invalid argument
file_pread(5,2,buffer,3519080448(486401/248/56)) lseek err Invalid argument

Results
   P MS Data                    43560     248359     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P MS Data                   264192 7814045695 7813781504 [Stockage]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB


dir_partition inode=5
   P MS Data                   264192 7814045695 7813781504 [Stockage]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 22-Apr-2013 23:26 .
       5 dr-xr-xr-x     0      0         0 22-Apr-2013 23:26 ..
      35 dr-xr-xr-x     0      0         0 18-Aug-2011 16:15 $RECYCLE.BIN
  106907 dr-xr-xr-x     0      0         0  9-Sep-2012 20:16 Adobe CS6 Master Collection
   25180 dr-xr-xr-x     0      0         0  9-Sep-2012 20:45 Backup DD
   25641 dr-xr-xr-x     0      0         0 21-Apr-2013 23:32 MSOCache
  119064 dr-xr-xr-x     0      0         0  6-Oct-2011 22:18 Norton Backups
   27022 dr-xr-xr-x     0      0         0 21-Apr-2013 23:32 Program Files
   26593 dr-xr-xr-x     0      0         0 27-Jan-2013 02:37 Program Files (x86)
   77394 dr-xr-xr-x     0      0         0 16-Mar-2012 20:32 TomTom
     223 dr-xr-xr-x     0      0         0 18-Sep-2011 21:24 Users
  119065 dr-xr-xr-x     0      0         0  6-Oct-2011 22:02 VProRecovery
      38 dr-xr-xr-x     0      0         0 18-Aug-2011 16:49 msdownld.tmp
      39 dr-xr-xr-x     0      0         0 21-Apr-2013 14:19 uTorrent Downloads
   25619 -r--r--r--     0      0 710799701 21-Jan-2013 12:46 DUMP1d7e.tmp
   25991 -r--r--r--     0      0  66060288  1-Oct-2012 18:49 Photoshop Temp5499022912
  118417 -r--r--r--     0      0    904704  1-Dec-2006 22:37 msdia80.dll
   23724 -r--r--r--     0      0 8260939776 23-Apr-2013 19:23 pagefile.sys

interface_write()
 1 P MS Data                    43560     248359     204800
 2 P MS Data                   264192 7814045695 7813781504 [Stockage]
write!
file_pwrite(5,32,buffer,3519064736(486400/254/31)) seek err Invalid argument

Partition: Write error

TestDisk exited normally.

And the disk management screenshots :