Recovering the MSR on GPT/NTFS RAID5 Array

[hachi]

I have recently recovered 3 partitions from a 3x2TB RAID5 array (thank you btw) with a quick scan using TestDisk, after the raid controller decided to trash the file system during an unrelated hardware upgrade.

The remaining issue now is it still hasn't found this 128MB system reserved partition, it did not show up among the sectors found during the initial scan, and the deep scanning takes a very long time for an array of this size so I wanted to check here first if there is some better way. How to find this and what should it look like if there is no standard file system on it?

this is a non-bootable RAID5 through ICH9, with GPT/NTFS format

[cgrenier]

Run TestDisk, Analyse, Quick Search, Stop, Deeper Search, wait at least until your 1.2TB partition is found and press Stop. Is the 128 MB partition listed ?

[hachi]

no trace of it, here is the log which shows only main partitions, they are always found right away

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000790347776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120033041920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000790347776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120033041920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=66239594496
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1333551693824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1333550645248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1333550645248
filewin32_getfilesize(\\.\Y:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\Y:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\Y:
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Intel Raid 5 Volume, S/N:v0-r5, FW:1.0.
Disk /dev/sdb - 120 GB / 111 GiB - CHS 15505 240 63, sector size=512 - WDC WD1200JB-00DUA3, S/N:4457572d414d4d43343137323930 037 0 0 0 0, FW:75.13B75

Partition table type (auto): EFI GPT
Disk /dev/sda - 4000 GB / 3726 GiB - Intel Raid 5 Volume
Partition table type: EFI GPT

Analyse Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814043647 (expected 7814043647)
hdr_lba_start=34
hdr_lba_end=7814043614
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   264192 2604857343 2604593152
 2 P MS Data               2604857344 5209448447 2604591104
 3 P MS Data               5209448448 7814039551 2604591104

search_part()
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size           2604593152
sectors_per_cluster       64
mft_lcn                   98304
mftmirr_lcn               1
clusters_per_mft_record   -10
clusters_per_index_record -12
NTFS part_offset=135266304, part_size=1333551693824, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           2604593152
sectors_per_cluster       64
mft_lcn                   98304
mftmirr_lcn               1
clusters_per_mft_record   -10
clusters_per_index_record -12
     MS Data                   264192 2604857343 2604593152
     NTFS, blocksize=32768, 1333 GB / 1241 GiB
NTFS at 162144/221/62
filesystem size           2604591104
sectors_per_cluster       64
mft_lcn                   98304
mftmirr_lcn               1
clusters_per_mft_record   -10
clusters_per_index_record -12
     MS Data                   266241 2604857344 2604591104
     NTFS found using backup sector, blocksize=32768, 1333 GB / 1241 GiB
NTFS at 162144/221/62
filesystem size           2604591104
sectors_per_cluster       64
mft_lcn                   98304
mftmirr_lcn               1
clusters_per_mft_record   -10
clusters_per_index_record -12
     MS Data               2604857344 5209448447 2604591104
     NTFS, blocksize=32768, 1333 GB / 1241 GiB
Search for partition aborted

Results
     MS Data                   264192 2604857343 2604593152
     NTFS, blocksize=32768, 1333 GB / 1241 GiB
     MS Data                   266241 2604857344 2604591104
     NTFS found using backup sector, blocksize=32768, 1333 GB / 1241 GiB
     MS Data               2604857344 5209448447 2604591104
     NTFS, blocksize=32768, 1333 GB / 1241 GiB

interface_write()
 
No partition found or selected for recovery