Corrupted Filesystem

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
woutgeo
Posts: 3
Joined: 15 Aug 2014, 08:48

Corrupted Filesystem

#1 Post by woutgeo »

First of all, a big thank you to everyone who offers help on this board. Not surprisingly, I'm in "that place" that we all tell ourselves we'll never be, with important data that hasn't been backed up and a dead/dying drive.

Here's my info:
Windows 7 with the OS on a SSD
The drive in question is my media drive
The drive shows up in BIOS (although there is a lag) and in Windows explorer. I can see the two folders ("Libraries", which has my media and "Programs", which has programs I don't use as often and/or don't require lots of computing power). If I try and open either folder Windows Explorer hangs.
My computer is also unhappy if I click on the start menu and then "All Programs" (this doesn't happen when the drive in question is disconnected).
Disk management says that the drive is healthy, but this is clearly not the case. I did get a message from Windows 2 days ago warning that the drive was failing and attempted to use windows to back up the drive, but the backup failed.

I then tried using xcopy in a command prompt to get the data moved. In my first attempt I managed to copy files TO the bad drive without a problem (the drive letters were different here than in explorer so I actually copied the wrong drive, fortunately it was a small drive that I use specifically for Adobe Lightroom), but when I then tried to copy files FROM the bad drive I got an I/O error.

I then downloaded and ran TestDisk.One thing I wasn't sure about is that disk management says that the disk partition is MBR and this wasn't one of the options and TestDisk's guess was GPT. I chose Intel/PC. The partition showed up, but when I went to look at files in the drive, I got the error "Can't open Filesystem. Filesystem seemed damaged." I'm attaching the log file.

Like anyone who makes the mistake of not backing up frequently enough, any help for next steps would be greatly appreciated. I will definitely try PhotoRec if that's where I'm at, but I'm an avid photographer and losing filenames will be a huge challenge as many of these files are linked to Adobe Lightroom/Photoshop metadata and edits (although, if it comes down to it, this would be better than nothing). Thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Corrupted Filesystem

#2 Post by Fiona »

Windows doesn't display a GPT-disk clearly.
In disk management console, the little square at the left side displays often basic disk instead of GPT.
Right click into the square will help.
If there is a description like convert to basic means that you have a GPT disk.
If the description is, convert to GPT, means that your disk is a basic disk.
Even if it's grayed out, because it's only possible to convert an unallocated disk.
Recent PC's and Notebooks are more and more based on UEFI and creating a GPT-disk automatically.
That's why it's difficult to judge.
Disk management says that the drive is healthy, but this is clearly not the case.
How is your disk listed in your disk management console?
Does your disk appear as RAW?
Might be possible that your file system or boot sector is damaged?
If you wrote into your file system using xcopy and your file system is damaged, partition recovery like testdisk wouldn't help.
In case you'll need datarecovery software.
If you'd like to recover directories, folder and file names, you should consider to test commercial datarecovery software as a trial first.

Fiona

woutgeo
Posts: 3
Joined: 15 Aug 2014, 08:48

Re: Corrupted Filesystem

#3 Post by woutgeo »

Here's the log that was produced.



Thu Aug 14 23:46:03 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-08-06T16:31:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255954255872
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1500299395072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1500296249344
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 52368 191 50, sector size=512 - SAMSUNG SSD 830 Series, S/N:30535a58454e4341333739343331202020202020, FW:CXM03B1Q
Disk /dev/sdb - 64 GB / 59 GiB - CHS 8270 240 63, sector size=512 - M4-CT064M4SSD2, S/N:3030303030303030313132323330313142303338, FW:070H
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - WDC WD1501FASS-00W2B0, S/N:2020202057202d444d5759413030333635343033, FW:05.01D05
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - WDC WD1501FASS-00W2B0, S/N:2020202057202d444d5759413030313637393336, FW:05.01D05

Partition table type (auto): Intel
Disk /dev/sdb - 64 GB / 59 GiB - M4-CT064M4SSD2
Partition table type: Intel

Analyse Disk /dev/sdb - 64 GB / 59 GiB - CHS 8270 240 63
Geometry from i386 MBR: head=240 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 8270 4 36 125040640
No partition is bootable

search_part()
Disk /dev/sdb - 64 GB / 59 GiB - CHS 8270 240 63
NTFS at 0/32/33
filesystem size 125040640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 8270 4 36 125040640
NTFS, blocksize=4096, 64 GB / 59 GiB
file_pread(5,2,buffer,125046784(8270/69/38)) lseek err Invalid argument
file_pread(5,1,buffer,125046784(8270/69/38)) lseek err Invalid argument
file_pread(5,8,buffer,125045504(8270/49/18)) lseek err Invalid argument
file_pread(5,1,buffer,125045504(8270/49/18)) lseek err Invalid argument
file_pread(5,8,buffer,125045632(8270/51/20)) lseek err Invalid argument
file_pread(5,8,buffer,125045760(8270/53/22)) lseek err Invalid argument
file_pread(5,8,buffer,125045888(8270/55/24)) lseek err Invalid argument
file_pread(5,8,buffer,125046016(8270/57/26)) lseek err Invalid argument
file_pread(5,8,buffer,125046144(8270/59/28)) lseek err Invalid argument
file_pread(5,8,buffer,125046272(8270/61/30)) lseek err Invalid argument
file_pread(5,8,buffer,125046400(8270/63/32)) lseek err Invalid argument
file_pread(5,8,buffer,125046528(8270/65/34)) lseek err Invalid argument
file_pread(5,8,buffer,125046656(8270/67/36)) lseek err Invalid argument
file_pread(5,1,buffer,125046783(8270/69/37)) lseek err Invalid argument
file_pread(5,1,buffer,125046784(8270/69/38)) lseek err Invalid argument
file_pread(5,14,buffer,125046785(8270/69/39)) lseek err Invalid argument
file_pread(5,3,buffer,125046799(8270/69/53)) lseek err Invalid argument
file_pread(5,3,buffer,125046846(8270/70/37)) lseek err Invalid argument
file_pread(5,8,buffer,125046862(8270/70/53)) lseek err Invalid argument
file_pread(5,11,buffer,125046909(8270/71/37)) lseek err Invalid argument
file_pread(5,2,buffer,125048831(8270/102/6)) lseek err Invalid argument
Warning: the current number of heads per cylinder is 240 but the correct value may be 255.

Results
* HPFS - NTFS 0 32 33 8270 4 36 125040640
NTFS, blocksize=4096, 64 GB / 59 GiB


dir_partition inode=5
* HPFS - NTFS 0 32 33 8270 4 36 125040640
NTFS, blocksize=4096, 64 GB / 59 GiB
Directory /
5 dr-xr-xr-x 0 0 0 14-Aug-2014 23:11 .
5 dr-xr-xr-x 0 0 0 14-Aug-2014 23:11 ..
6501 dr-xr-xr-x 0 0 0 30-Aug-2012 22:06 $RECYCLE.BIN
23140 dr-xr-xr-x 0 0 0 10-Aug-2014 20:23 Backups
37685 dr-xr-xr-x 0 0 0 12-Aug-2014 05:01 Lightroom 5 Camera Cache
50 dr-xr-xr-x 0 0 0 14-Aug-2014 09:10 Lightroom 5 Catalog Previews.lrdata
1824 dr-xr-xr-x 0 0 0 5-Feb-2014 18:27 Lightroom 5 Catalog Smart Previews.lrdata
11640 dr-xr-xr-x 0 0 0 16-Apr-2013 23:12 System Volume Information
18734 -r--r--r-- 0 0 269299712 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat
18734 -r--r--r-- 0 0 0 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat
18734 -r--r--r-- 0 0 0 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat
18734 -r--r--r-- 0 0 0 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat
18734 -r--r--r-- 0 0 0 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat
13423 -r--r--r-- 0 0 25136 14-Aug-2014 09:17 Lightroom 5 Catalog.lrcat-journal
13422 -r--r--r-- 0 0 74 14-Aug-2014 09:08 Lightroom 5 Catalog.lrcat.lock
303 -r--r--r-- 0 0 648192 26-Jan-2014 17:50 Temporary Import Data.db
305 -r--r--r-- 0 0 26312 26-Jan-2014 17:49 Temporary Import Data.db-journal

interface_write()
1 * HPFS - NTFS 0 32 33 8270 4 36 125040640
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): EFI GPT
Disk /dev/sdd - 1500 GB / 1397 GiB - WDC WD1501FASS-00W2B0
Partition table type: Intel

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
file_pread(7,16,buffer,0(0/0/1)) ReadFile The request could not be performed because of an I/O device error.

Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 182401 35 34 2930272256
No partition is bootable
Error reading bootsector: Invalid argument.
Failed to startup volume: Invalid argument.
Error reading bootsector: Invalid argument.
Error reading bootsector: Invalid argument.
Failed to startup volume: Invalid argument.
Error reading bootsector: Invalid argument.

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930272256
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 35 34 2930272256
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 182401 35 34 2930272256
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,1,buffer,2048(0/32/33)) ReadFile The request could not be performed because of an I/O device error.

Can't read exFAT boot sector.

* HPFS - NTFS 0 32 33 182401 35 34 2930272256
NTFS, blocksize=4096, 1500 GB / 1397 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 0 32 33 182401 35 34 2930272256

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930272256
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 35 34 2930272256
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,16,buffer,16064(0/254/63)) ReadFile The request could not be performed because of an I/O device error.

file_pread(7,16,buffer,18176(1/33/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(7,1,buffer,18176(1/33/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 182401 35 34 2930272256
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 182401 35 34 2930272256
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
file_pread(7,16,buffer,2048(0/32/33)) ReadFile The request could not be performed because of an I/O device error.

NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 182401 35 34 2930272256
No partition is bootable

woutgeo
Posts: 3
Joined: 15 Aug 2014, 08:48

Re: Corrupted Filesystem

#4 Post by woutgeo »

Fiona wrote:If there is a description like convert to basic means that you have a GPT disk.
If the description is, convert to GPT, means that your disk is a basic disk.
"Convert to Dynamic Disk" is an option and "Convert to GPT" is greyed out. Assuming this means mine is a GPT disk? Should I rerun TestDisk since I used the wrong input in the past?
How is your disk listed in your disk management console?
Not sure exactly what info you're looking for, but here is the info I see.
Volume->1.5TB Internal (E:)
Layout->Simple
Type->Basic
File Systen->NTFS
Status->Healthy (Primary Partition)

And then below...
Disk 3
Basic
1397.26GB
Online

But as I said before, if I right click "Convert to Dynamic Disk" is an option and "Convert to GPT" is greyed out.
Does your disk appear as RAW?
Sorry, don't know what this means.
Might be possible that your file system or boot sector is damaged?
I'm in no way an expert, but I doubt it's the boot sector since I can access files in other folders on the drive (albeit quite slowly). The folder with my photos is the only folder that is inaccessible. Is there a way to do a definitive test to see if the file system is corrupted?
If you wrote into your file system using xcopy and your file system is damaged, partition recovery like testdisk wouldn't help. In case you'll need datarecovery software.
Do you have any you recommend?

Thanks!

Locked