Help - 2TB drive registered as 1TB raw Topic is solved

How to use TestDisk to recover lost partition
Locked
Message
Author
mostachio
Posts: 3
Joined: 31 Oct 2013, 22:28

Help - 2TB drive registered as 1TB raw

#1 Post by mostachio » 31 Oct 2013, 22:52

Hi,

This post is very similar to this one posted in 2012 - http://forum.cgsecurity.org/phpBB3/help ... -t325.html but I'm not sure the same instructions would apply to me, the layout of the drive seems a lot different (not meaning the size)...

I recently disconnected a hard drive by mistake that has my most important data on it. When reconnecting, the hdd has become RAW and scanning with testdisk reveals it as 1TB rather than the 2TB it is supposed to be. I've run a quick search and received the same message as the previous poster, I'm now running another one with the log but It currently appears as the following;

Image

I will post the log when It is done. I would really appreciate some help on this :)

Thank you

I'm running testdisk within windows 7 x64 & I have partedmagic on a usb if needed.

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help - 2TB drive registered as 1TB raw

#2 Post by Fiona » 01 Nov 2013, 08:43

Your case is probably different?
If your disk is a 2TB disk and recognized as 1 TB size means that your disk capacity recognition is probably wrong?
Did you check your disk like model and size in your devicemanager and disk management console?
Something similar might be this case?
http://forum.cgsecurity.org/phpBB3/mism ... n-t32.html
Although, in your case it looks somehow strange because it's exactly 1 TB?
Please don't use it until it's clearly determind that your firmware is affected!
Unnecessary modifying of firmware can increase damage.

Fiona

mostachio
Posts: 3
Joined: 31 Oct 2013, 22:28

Re: Help - 2TB drive registered as 1TB raw

#3 Post by mostachio » 01 Nov 2013, 09:11

Thanks for replying Fiona,

I think so, I could not find an option to list the files, I tried to follow your exact instructions, but because I could not list files, (Even after a deep search even though my partition shows as correct label etc)

(please excuse my noobness!! i'm so unknowledgeable about this kind of stuff it's not funny hehe)

Here is the result from testdisk;

Code: Select all


Fri Nov  1 10:30:07 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000227396608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=7927234560
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000227396608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=7927234560
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127928369152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7927202304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000227396608
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - OCZ-AGILITY4, S/N:434f2d5a374c49394e4d36333656345036335144, FW:1.5.2
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63, sector size=512 - ST2000DL004 HD204UI, S/N:32533748584a4430303235303432202020202020, FW:1AQ10001
Disk /dev/sdc - 7927 MB / 7560 MiB - CHS 963 255 63, sector size=512, S/N:AA00000000000485
Drive E: - 7927 MB / 7559 MiB - CHS 963 255 63, sector size=512, S/N:AA00000000000485

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - ST2000DL004 HD204UI
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907024896, end=3907026943, disk end=1953569134)
file_pread(5,2,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,1953570308(121604/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953570371(121604/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953570371(121604/33/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953570816(121604/40/37)) lseek err Invalid argument
file_pread(5,1,buffer,1953570816(121604/40/37)) lseek err Invalid argument
file_pread(5,1,buffer,1953570815(121604/40/36)) lseek err Invalid argument
file_pread(5,14,buffer,1953570817(121604/40/38)) lseek err Invalid argument
file_pread(5,3,buffer,1953570831(121604/40/52)) lseek err Invalid argument
file_pread(5,3,buffer,1953570878(121604/41/36)) lseek err Invalid argument
file_pread(5,8,buffer,1953570894(121604/41/52)) lseek err Invalid argument
file_pread(5,11,buffer,1953570941(121604/42/36)) lseek err Invalid argument
file_pread(5,2,buffer,1953572863(121604/73/5)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907024896, end=3907026943, disk end=1953569134)
file_pread(5,2,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,1953570308(121604/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953570371(121604/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953570371(121604/33/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953570816(121604/40/37)) lseek err Invalid argument
file_pread(5,1,buffer,1953570816(121604/40/37)) lseek err Invalid argument
file_pread(5,2,buffer,1953569219(121604/15/15)) lseek err Invalid argument
file_pread(5,2,buffer,1953569282(121604/16/15)) lseek err Invalid argument
file_pread(5,2,buffer,1953569345(121604/17/15)) lseek err Invalid argument
file_pread(5,1,buffer,1953570815(121604/40/36)) lseek err Invalid argument
file_pread(5,14,buffer,1953570817(121604/40/38)) lseek err Invalid argument
file_pread(5,3,buffer,1953570831(121604/40/52)) lseek err Invalid argument
file_pread(5,3,buffer,1953570878(121604/41/36)) lseek err Invalid argument
file_pread(5,8,buffer,1953570894(121604/41/52)) lseek err Invalid argument
file_pread(5,11,buffer,1953570941(121604/42/36)) lseek err Invalid argument
file_pread(5,2,buffer,1953572863(121604/73/5)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907024896, end=3907026943, disk end=1953569134)
file_pread(5,2,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,1953570307(121604/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,1953570815(121604/40/36)) lseek err Invalid argument
file_pread(5,1,buffer,1953570816(121604/40/37)) lseek err Invalid argument
file_pread(5,14,buffer,1953570817(121604/40/38)) lseek err Invalid argument
file_pread(5,3,buffer,1953570831(121604/40/52)) lseek err Invalid argument
file_pread(5,3,buffer,1953570878(121604/41/36)) lseek err Invalid argument
file_pread(5,8,buffer,1953570894(121604/41/52)) lseek err Invalid argument
file_pread(5,11,buffer,1953570941(121604/42/36)) lseek err Invalid argument
file_pread(5,2,buffer,1953572863(121604/73/5)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121604 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 243201  45 44 3907024896 [Media]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery
Device manager lists this as ST2000DL004 (Seagate 2tb)
Disk Management lists it exactly as 1TB too (or 931.53GB RAW)

Will check out that link, I really need to recover the data so i'm definately not going to try anything until i'm positive it's the right course of action.

Thank you again for the reply :)

mostachio
Posts: 3
Joined: 31 Oct 2013, 22:28

Re: Help - 2TB drive registered as 1TB raw  Topic is solved

#4 Post by mostachio » 02 Nov 2013, 06:28

Thank you THANK YOU, THANNNNNNNNNNKKKKKK YYYYYYYYYOOOOOOOOUUUUUUUUU!!!!!

So HDAT2 couldn't get that to work, The other prog had a prob with win 7 x64. I booted up testdisk in partedmagic. It detected things a lot differently. full 2000GB displaying everywhere no mention of a 1TB, so I backed up partition tabled and wrote that to disk. Now it is fully functioning as 2TB again and all my files are sssssssavvvveeeedddd!!!!

I have learnt my lesson... will not yank hdd out of docking bay anymore.. Thank you Fiona. You are truly an expert.

EDIT: ^^ So apparently, It wasn't the docking station that did it, It was inserting it back into the server it belongs to, I've recently modified it, installing a sata backplane, twin PSUs, etc, It holds 16 hard drives, and this is the only one it's done it with. I've tried a slot where it is ported to the motherboard (Gigabyte) and also a slot where it goes straight to RAID controller all with same result (at least I can fix it!) Even tried hot inserting it into a slot controlled by the raid controller and the same. At the moment, it's working fine. In my desktop.. But everytime i put it in the server, the partition tables get messed up. what weird behavior. Any ideas? (I know this is beyond the scope of testdisk, and you've helped so much. Thank you)

EDIT again..: And now it's going to RAW in the desktop, i'm backing everything up off it, and going to try fix this partition table error. I found a cg thread a while ago where you could delete MBR and partition table and force windows to rewrite it. Just trying to find this again...

Locked

Who is online

Users browsing this forum: No registered users and 1 guest