Need help recovery 3Tb NTFS partition

How to use TestDisk to recover lost partition
Post Reply
Message
Author
Ultreme
Posts: 5
Joined: 15 May 2013, 14:18

Need help recovery 3Tb NTFS partition

#1 Post by Ultreme » 15 May 2013, 14:26

Hi,

I have formatted my external drive by error. It's a WD My Book 3Tb and had previously only one NTFS partition of 2.7Tb. It is now formatted with FAT32.

I have run Testdisk Analyse, quick search and deep search but cannot find my files.

What can i do ?

Thanks for your help.

Here's below the logfile of Testdisk :



Tue May 14 22:14:38 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=159671910400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000557895680
filewin32_getfilesize(\\.\F:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\F:
file_pread(4,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,732563999(45599/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - INTEL SSDSA2CW160G3, S/N:CVPR14510A7J160DGN, FW:4PC10362
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019
Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - WD My Book 1140
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45599 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
No partition is bootable
Computes LBA from CHS for Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45600 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45600 255 63
FAT32 at 0/4/5
FAT1 : 32-22399
FAT2 : 22400-44767
start_rootdir : 44768 root cluster : 2
Data : 44768-732558079
sectors : 732558080
cluster_size : 32
no_of_cluster : 22891041 (2 - 22891042)
fat_length 22368 calculated 22355

FAT32 at 0/4/5
FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
FAT32, 3000 GB / 2794 GiB
file_pread(5,1,buffer,732558337(45599/165/8)) lseek err Invalid argument
file_pread(5,1,buffer,732558338(45599/165/9)) lseek err Invalid argument
file_pread(5,2,buffer,732558343(45599/165/14)) lseek err Invalid argument
file_pread(5,2,buffer,732558345(45599/165/16)) lseek err Invalid argument
file_pread(5,3,buffer,732558351(45599/165/22)) lseek err Invalid argument
file_pread(5,1,buffer,732558592(45599/169/11)) lseek err Invalid argument

Results
* FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
FAT32, 3000 GB / 2794 GiB

interface_write()
1 * FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45600 255 63
FAT32 at 0/4/5
FAT1 : 32-22399
FAT2 : 22400-44767
start_rootdir : 44768 root cluster : 2
Data : 44768-732558079
sectors : 732558080
cluster_size : 32
no_of_cluster : 22891041 (2 - 22891042)
fat_length 22368 calculated 22355

FAT32 at 0/4/5
FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
FAT32, 3000 GB / 2794 GiB
file_pread(5,1,buffer,732558337(45599/165/8)) lseek err Invalid argument
file_pread(5,1,buffer,732558338(45599/165/9)) lseek err Invalid argument
file_pread(5,2,buffer,732558343(45599/165/14)) lseek err Invalid argument
file_pread(5,2,buffer,732558345(45599/165/16)) lseek err Invalid argument
file_pread(5,3,buffer,732558351(45599/165/22)) lseek err Invalid argument
file_pread(5,1,buffer,732558592(45599/169/11)) lseek err Invalid argument

Results
* FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
FAT32, 3000 GB / 2794 GiB


dir_partition inode=0
* FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
FAT32, 3000 GB / 2794 GiB
FAT: cluster=2(0x2), pos=45024
Directory /
3 drwxr-xr-x 0 0 0 14-May-2013 22:06 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:26 _325270_
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:26 636f3d04e33f6261e123574a
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:30 MSI2d9a7.tmp
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:30 _562641_
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:30 2c058c3f830d37e51498f6cb8d
X 162 drwxr-xr-x 0 0 131072 15-May-2013 05:30 MSI2d9bf.tmp
X 162 drwxr-xr-x 0 0 131072 15-May-2013 05:30 MSI2d9d6.tmp
X 5 drwxr-xr-x 0 0 131072 15-May-2013 05:30 MSI33fc9.tmp

interface_write()
1 * FAT32 LBA 0 4 5 45599 165 6 732558080 [New Volume]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Need help recovery 3Tb NTFS partition

#2 Post by Fiona » 15 May 2013, 17:34

There is still an NTFS-partition using your whole space in your partition table available.
Would it be possible to make a boot sector diagnose?
I'd like to see, will your data be listed or not?
But don't use write in TestDisk and don't change anything else to your disk.
Reason is, your disk should be a GPT disk to support partitions larger than 2.2 TB?

Start TestDisk, confirm at create a log with enter and select your affected disk.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
Confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild your BS will be in progress.
Normally, it takes some minutes.
If it's finished, please post the infos or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, do you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

Info will follow.

Fiona

Ultreme
Posts: 5
Joined: 15 May 2013, 14:18

Re: Need help recovery 3Tb NTFS partition

#3 Post by Ultreme » 15 May 2013, 18:17

Thanks for your help. I remember when I got the drive, Windows properties was reporting the drive as MBR. It seems that Western Digital use some kind of trick to make drive larger than 2.2Tb in MBR.

I did what you ask, but the List command did nothing. It was like I didn't execute it.



Here's the logfile :



Wed May 15 09:41:50 2013
Command line: TestDisk

Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=159671910400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000557895680
filewin32_getfilesize(\\.\F:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\F:
file_pread(4,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,732563999(45599/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - INTEL SSDSA2CW160G3, S/N:CVPR14510A7J160DGN, FW:4PC10362
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019
Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096 - WD My Book 1140, S/N:WMC1T1372329, FW:1019

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - WD My Book 1140
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
filesystem size 8589934593 1
sectors_per_cluster 32 0
mft_lcn 393217 0
mftmirr_lcn 0 0
clusters_per_mft_record 0 0
clusters_per_index_record -66 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/Output error.
Failed to startup volume: Input/Output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/Output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/Output error.
Failed to startup volume: Input/Output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/Output error.
rebuild_NTFS_BS
mft at 366279039, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 4096

mft at 786432, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 4096
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 732558080 8589934593
sectors_per_cluster 1 32
mft_lcn 786432 393217
mftmirr_lcn 2 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 -66
Extrapolated boot sector and current boot sector are different.
filesystem size 732558080 8589934593
sectors_per_cluster 1 32
mft_lcn 786432 393217
mftmirr_lcn 2 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 -66
Not an exFAT boot sector.
filesystem size 732558080 8589934593
sectors_per_cluster 1 32
mft_lcn 786432 393217
mftmirr_lcn 2 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 -66
Not an exFAT boot sector.
filesystem size 732558080 8589934593
sectors_per_cluster 1 32
mft_lcn 786432 393217
mftmirr_lcn 2 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 -66

ntfs_boot_sector
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
filesystem size 8589934593 1
sectors_per_cluster 32 0
mft_lcn 393217 0
mftmirr_lcn 0 0
clusters_per_mft_record 0 0
clusters_per_index_record -66 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Need help recovery 3Tb NTFS partition

#4 Post by Fiona » 15 May 2013, 19:06

TestDisk didn't find any boot sector during searching for a file system and files.
Might be possible that your partition in your partition table doesn't match.
Chkdsk is a utility to have a try to repair a file system but it's not intended to recover data.
It can increase damage, that's why it's on your own risk.
To have a try to find a partition containing your data, you should run Deeper Search.
If more partitions are found, please mark them and press p to have a try to list your files!
Please upload a log again!
A tip is, if testdisk finds any partition with your label, you can press F (upper case) to jump to the end to the partition.
It can save time, scanning a large disk.

Fiona

Ultreme
Posts: 5
Joined: 15 May 2013, 14:18

Re: Need help recovery 3Tb NTFS partition

#5 Post by Ultreme » 15 May 2013, 19:21

Hi, thanks again.

I've already did the deap search. It's in the first log I've post. It only find the new FAT32 partition.

Maybe I don't understand well what you want me to do.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Need help recovery 3Tb NTFS partition

#6 Post by Fiona » 15 May 2013, 20:25

Sry for my bad explanation.
Your try to diagnose your boot sector, testdisk reported that the file system is damaged.
Info:
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/Output error.
Your're right, I checked your log in your first post and you were already running Deeper Search.

Normally a disk larger than 2.2 TB should be a GPT-disk.
In your diagnose, you used intel partition table.
Do you have any idea, how your disk was previously partitioned?
Has it been a GPT disk or an Intel MBR disk?
Using disks larger than 2.2 TB as an Intel- MBR disk is not supported and can cause loss of data.

If you make a diagnose using Intel MBR and your disk is a GPT-disk, it might be possible that testdisk doesn't find your partition because Intel MBR searches partition in Cylinders and not sectors.

Please let me know, did you have previously an Intel-MBR or a GPT-disk.

Fiona

Ultreme
Posts: 5
Joined: 15 May 2013, 14:18

Re: Need help recovery 3Tb NTFS partition

#7 Post by Ultreme » 15 May 2013, 20:33

I'm pretty confident it was an Intel MBR disk. It seems Western Digital uses 4K LBA instead of 512bytes to be able to have 2.7tb MBR disk.

I have never reformated the drive since I bought it. I remember that Windows 7 x64 reported it as an MBR drive but the disk management utility had trouble showing the 2.7tb partition. I think it was reported as a 746Gb partition in that utility while Windows Explorer reported the 2.7Gb drive without problem.

thanks again.

Ultreme
Posts: 5
Joined: 15 May 2013, 14:18

Re: Need help recovery 3Tb NTFS partition

#8 Post by Ultreme » 16 May 2013, 18:04

I saw an older thread where the partition seems to have been rebuilt manually. Is this something I could do ?

http://forum.cgsecurity.org/phpBB3/reco ... d-t15.html

dwardlaw
Posts: 1
Joined: 19 May 2013, 13:27

Re: Need help recovery 3Tb NTFS partition

#9 Post by dwardlaw » 19 May 2013, 13:32

I have exactly the same problem with a 3TB Western Digital drive. I am getting a "Partition sector doesn't have the endmark 0xAA55". When analysing I get invalid FAT boot sector. I too am unsure on how to proceed.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests