External Raid 5 corrupted GPT

[terramonkey]

I'm really hoping someone can help me out here.

Two days ago I discovered a virus on my system and tried to remove it. Yesterday I noticed that my external raid 5 drive appears as "raw" in disk management :

and when I try to access the drive through explorer I get a message saying the drive needs formatting:



Motherboard is an Asus Crosshair IV Extreme with the latest bios (if that's relevant)
The strtech drive has 4x1.5 TB drives in Raid 5 and I'm using eSata to connect it to my computer.
I'm running 64 bit windows 7 ultimate
when I boot my computer the raid drive is listed as healthy in the post screens.
The Capacity seems right in Disk Management (4191.53GB - RAW Healthy (primary partition) and the drive letter is the same as it was before
I'm pretty sure it was formatted using GPT filesystem as it's such a large drive and I think windows 7 forced me to use that.

I haven't tried to reformat it or anything but I did have to reinstall the JMicron Sata controller after the virus infection.

Write Caching is enabled (well it is now but I'm not sure if It was before)
Better performance (default) is set under policies, again I'm not sure if this was the case before though.
The driver is listed as eSata-2ExternalRAID SCSI DIsk Device by microsoft version 6.1.7600.16385

I don't have access to another drive of similar capacity and as a student I can't really afford to buy one.

I'm running testdisk at the moment, so far after about two hours it's completed about 1%.. and some of the messages its come up with so far are:


Please can someone tell me if its possible to rebuild the GPT table so that I can access the files once more and if so... how?

Thanks in advance.

[Fiona]

Your disk appears as basic.
Should be GPT.
You should convert it.
If you write data above 2.2 TB it would be possible that Windows starts to overwrite data at the the beginning of your disk.
Please don't format your disk.
After converting, plaease set me a screenshot.

[terramonkey]

Thankyou for your reply.. when you say "convert it" what do you mean? Do I do that using windows disk management or something else?

I'm worried about doing anything destructive to the disk, as it has all my college work on it!

Sorry, Just being extra cautious!

[Fiona]

Sorry, Just being extra cautious!

It's in any case better and I can unterstand it.

I'm pretty sure it was formatted using GPT filesystem as it's such a large drive and I think windows 7 forced me to use that.

Intel MBR (your basic disk) is limited to 2.2 TB.
Using space beyond 2.2 TB reqires GPT.
Otherwise it can cause loss of data.
That's why i suggested to convert it.
Do you know exactly, how your disk were peviously partitionned?
Did you have more partitions on your disk?
Do I do that using windows disk management or something else?
In your disk management console, your HDD has at the left side that small quadrat, telling you that you have a basic disk.
Just right click it and in your context menu there should be an option "convert to GPT".
But until yet, don't change anything to your system if you're not sure.

In case, you can try Deeper Search.
But GPT has another structur.
So it might be possible that TestDisk scans each sector.
It can consume time.

Can you upload a screenshot from your current partition structur (partition table also?

[terramonkey]

Do you know exactly, how your disk were peviously partitionned?
Did you have more partitions on your disk?

It was one partition across the entire array, using GPT.


Can you upload a screenshot from your current partition structur (partition table also?

I am currently using an application called partitionguru to search for lost partitions, it keeps finding very small partitions, varying from 10mb-200mb, in either EXT3, Fat12 or Fat16 format but these are probably the remains of previous structures the disks had on them...

I've tried not to do anything that might corrupt the disks or the file structure any further, so have not attempted to do anything but read from the drive.

You said it may take some time... partitionguru has been running 2 days and so far has not found the large single parition... currently it's progress is about 410000 cylinders out of a total of 547185 cylinders..

I'm not good with linux, so if you can let me know in quite simple terms how to go about using testdisk to do what you said I'll do my best and post results back here asap... although I will now probably wait until partitionguru has finished its scan... i've let it run for 2 days so it seems silly to not let it finish, even though I have a feeling it won't find the main GPT partition...

[terramonkey]

Update:

PartitionGuru found the partition table:


However, before it will let me do anything with it, it's asking me to pay heaps of money!

The only problem is, I am a student and I cannot afford to pay for the license. is there any way to extract the details above and use tesdisk or something similar to repair the table?

if so, how?

[terramonkey]

[Fiona]

I didn't get any response from ozofmanson.
At least he was able to copy data.
From his first post;

I have even listed the files to make sure they are still there.

But I've no idea what he did?
In this case, he has had an option to backup his data first.

I've got another case, pretty similar to your one.
But he is a german.
And his RAID was much bigger, 10 TB (10 000 GB ).
Testdisk didn't work during the scan after probably half a day anymore;
http://forum.cgsecurity.org/phpBB3/down ... php?id=173
After Deeper Search there wasn't a useful result either;
http://forum.cgsecurity.org/phpBB3/down ... php?id=172

Then he converted to GPT and created a partition.
In TestDisk he used EFI GPT,
http://forum.cgsecurity.org/phpBB3/down ... php?id=231
His GIUD partition table looked like this (current partition structur);
http://forum.cgsecurity.org/phpBB3/down ... php?id=232
Then I decided to add NTFS filesystem to his important partition MS Data.
http://forum.cgsecurity.org/phpBB3/down ... php?id=236

There was no boot sector, that's why TestDisk didn't find something.
http://forum.cgsecurity.org/phpBB3/down ... php?id=238

I suggested to Rebuild his boot sectir using Rebuild BS;
http://forum.cgsecurity.org/phpBB3/down ... php?id=240
Then to use list;
http://forum.cgsecurity.org/phpBB3/down ... php?id=241
He wrote his boot sector and his data were available;
http://forum.cgsecurity.org/phpBB3/raid ... html#p1151

Only converting it back, is not intended to change anything to your underlying data.
But I assume you already converted it to a basic disk?
In this case if you're afraid of, you can use data recovery software and copy your data to another intact disk or partition.
There is something important, that you never format your disk.

[terramonkey]

Wow, that's a lot of information, not sure I understand it all!!

Having used the "partitionguru" software to scan the drive I can see that there is a working partition table at the end of the drive, which I assume is the "backup" of the original?

The file structure using that one seems to be ok.

My problem is, I don't know how to use Testdisk to find this backup without doing a full scan again (another three days or more) and then repair the original table using the backup table.

looking at the screenshot I last took, is there anyway to use the data on this screen to force testdisk to look at a specific area of the drive to find the backup table without having to do another full scan of the drive?

[Fiona]

Converting it back and creating an unformatted partition exactly like before takes seconds.
It can look like this screen;
http://forum.cgsecurity.org/phpBB3/down ... php?id=232
Through your incident, your disk is already converted to Intel.
Before it was GPT, like you already mentioned.
A boot sector diagnose doesn't take as long.
Then, I'd be able to set you each step for a boot sector diagnose.

If it doesn't work, you'll still have the possibility to use datarecovery software.