Dropped 3 TB WD MyBook Essential - drive size recoginized

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
subcollec
Posts: 1
Joined: 14 Jul 2013, 19:06

Dropped 3 TB WD MyBook Essential - drive size recoginized

#1 Post by subcollec »

Hello all,

I have a Western 3 tb Western Digital MyBook Essential drive that was dropped off of a desk while powered up and the file system became unreadable.

From what it says in the documentation, these drives are formatted as Fat32 for compatibility purposes. I don't recall ever seeing what it was actually formatted as. Basically, I'm not 100% sure what the file system details were previously. The drive was primarily used to back up files from 3 different Windows 7 and 8 machines.

I might have had about a tb or 1.5 tb of data on there. The drive has archives of music I've created and collected, old machine backups, and other important archives so I'm trying to carefully do all I can to restore it on my own first, and then I will look into paying for recovery service. Trying to learn this stuff also because I have friends and family who have drives that have become unreadable which they've set aside until they become rich enough to afford what they perceive it will cost them to recover their data.

I need some guidance. I don't know if I shot myself in the foot in what I've done so far, or if it is beyond repair through file system forensics. Any help appreciated!!!

The happening after the drop...

After seeing that the drive was no longer reading, I took the drive out of the MyBook case and tried it in external cases and then finally put it in a desktop (where it is now). Any which way it was installed, the drive would tick a couple times, continue to spin, but not ever pull up a directory.

At first, Windows Disk Manager only saw 2 TB. However, I ran a couple recovery scans with other software (yielding nothing) and mysteriously, DM started to see the full 3 TB which I understand as being the first sign that the disk is possibly recoverable without physical intervention.

I don't know if this is my undoing, but I accidentally clicked for DM to designate MBR and then I changed it to GPT in the process of trying to figure out what to do.

Finally, I ran Tesk Disk 6.14 and during the first phase of scanning, I saw the message...
check_FAT: Bad jump in FAT partition
... which gave me a little hope, because the old partition was potentially Fat32.

The log says this about it (full log will be at the end) ...
recover_sysv4
Unknown 1804021117 18435349084 16631327968 [ä4ƒhá]
SysV4, 8515 GB / 7930 GiB
Partition not added.
check_FAT: Bad jump in FAT partition
When first phase of scanning completed, I then saw this partition...
P Mac HFS 5860502436 5860513355 10920
HFS+ blocksize=2048, 5591 KB / 5460 KiB
I don't know if this is enough information to go on so far, but I started the next phase of scanning (deeper scan), which is currently running.

Here is the full log output so far after having run the first phase scan with deep scanning in progress, excluding information about the other drives...
Thu Jul 11 13:38:43 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jun 24 2013 18:54:38
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016

filewin32_getfilesize(\\.\X:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\X:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\X:
Hard disk list
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]

search_part()
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 112295/30/53

recover_sysv4
Unknown 1804021117 18435349084 16631327968 [ä4ƒhá]
SysV4, 8515 GB / 7930 GiB
Partition not added.
check_FAT: Bad jump in FAT partition

HFS+ magic value at 364799/103/13
part_size 10920
Mac HFS 5860502436 5860513355 10920
HFS+ blocksize=2048, 5591 KB / 5460 KiB
file_win32_pread(96,11,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(96,11,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(96,11,buffer,1565565870(364801/80/62)) read err: read after end of file
file_win32_pread(96,8,buffer,1565565865(364801/80/57)) read err: read after end of file
file_win32_pread(96,3,buffer,1565565871(364801/80/63)) read err: read after end of file
file_win32_pread(96,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(96,14,buffer,1565565870(364801/80/62)) read err: read after end of file

Results
P Mac HFS 5860502436 5860513355 10920
HFS+ blocksize=2048, 5591 KB / 5460 KiB

interface_write()
1 P Mac HFS 5860502436 5860513355 10920
Locked