WD 2TB drive turns RAW, partition and RebuildBS failed,
Posted: 08 Dec 2014, 17:46
Hi
My WD 2TB USB 3.0 drive recently somehow turns RAW. The drive is initially format as NTFS and usually mounted and used under Linux.
I firstly tried analyse of testdisk to detect lost partition table, but with no luck, the testdisk find FAT12 partition only. After reading a lot of threads on this forum, I decide go for advances and manually change format to NTFS, but list files still failed. With confirm on Boot, testdisk figures out that my boot sector and its backup are damaged, which lead me to Rebuild BS. After waiting for almost a day, nothing change, Rebuild BS give me another fail. After that I tried another analyse, but the result is even more strange. Any idea?
I attached log file as followings.
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Sat Dec 6 09:23:26 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-23-generic (#36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012) x86_64
Compiler: GCC 4.4
Compilation date: 2014-11-13T19:10:45
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HDS721050CLA362, S/N:JPB530HN2AN5DB, FW:JP2OA39C
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - WD My Book 3.0 1123, FW:1006
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1140, FW:1003
Partition table type default to Intel
Disk /dev/sdc - 2000 GB / 1862 GiB - WD My Book 1140
Partition table type: None
Interface Advanced
P Unknown 0 0 1 243197 57 60 3906963456
Change partition type:
P NTFS 0 0 1 243197 57 60 3906963456
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 100 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 61 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 61 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.
P NTFS 0 0 1 243197 57 60 3906963456
Can't open filesystem. Filesystem seems damaged.
Analyse Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
Current partition structure:
P Unknown 0 0 1 243197 57 60 3906963456
search_part()
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
SYSV4 Marker at 21692/164/56
recover_sysv4
SysV 4 21692 164 56 21692 164 55 0 [Tí=öxÅ]
SysV4, 0 B
Partition not added.
Sys=0C 46156 15 14 304005 33 23 4142345329
FATX, 2120 GB / 1975 GiB
This partition ends after the disk limits. (start=741497098, size=4142345329, end=4883842426, disk end=3906963456)
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 109062/234/50
recover_sysv4
SysV 4 109062 234 50 547168691 74 36 8788512929792 [F÷ö€]
SysV4, 4499 TB / 4092 TiB
This partition ends after the disk limits. (start=1752095821, size=8788512929792, end=8790265025612, disk end=3906963456)
SYSV4 Marker at 146716/126/15
recover_sysv4
SysV 4 146716 126 15 146716 126 14 0 [êé7]
SysV4, 0 B
Partition not added.
Sys=0C 174172 196 4 419436 10 31 3940154470
FATX, 2017 GB / 1878 GiB
This partition ends after the disk limits. (start=2798085531, size=3940154470, end=6738240000, disk end=3906963456)
check_FAT: Bad jump in FAT partition
LVM magic value at 213413/150/28
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1862 GiB) seems too small! (< 4500 TB / 4093 TiB)
The following partitions can't be recovered:
Sys=0C 46156 15 14 304005 33 23 4142345329
FATX, 2120 GB / 1975 GiB
SysV 4 109062 234 50 547168691 74 36 8788512929792 [F÷ö€]
SysV4, 4499 TB / 4092 TiB
Sys=0C 174172 196 4 419436 10 31 3940154470
FATX, 2017 GB / 1878 GiB
Results
interface_write()
TestDisk exited normally.
My WD 2TB USB 3.0 drive recently somehow turns RAW. The drive is initially format as NTFS and usually mounted and used under Linux.
I firstly tried analyse of testdisk to detect lost partition table, but with no luck, the testdisk find FAT12 partition only. After reading a lot of threads on this forum, I decide go for advances and manually change format to NTFS, but list files still failed. With confirm on Boot, testdisk figures out that my boot sector and its backup are damaged, which lead me to Rebuild BS. After waiting for almost a day, nothing change, Rebuild BS give me another fail. After that I tried another analyse, but the result is even more strange. Any idea?
I attached log file as followings.
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Sat Dec 6 09:23:26 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-23-generic (#36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012) x86_64
Compiler: GCC 4.4
Compilation date: 2014-11-13T19:10:45
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HDS721050CLA362, S/N:JPB530HN2AN5DB, FW:JP2OA39C
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - WD My Book 3.0 1123, FW:1006
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1140, FW:1003
Partition table type default to Intel
Disk /dev/sdc - 2000 GB / 1862 GiB - WD My Book 1140
Partition table type: None
Interface Advanced
P Unknown 0 0 1 243197 57 60 3906963456
Change partition type:
P NTFS 0 0 1 243197 57 60 3906963456
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 100 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 61 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_boot_sector
P NTFS 0 0 1 243197 57 60 3906963456
filesystem size 4017377223096236722 17537237637257306048
sectors_per_cluster 61 200
mft_lcn 1596838857764493033 9988127914298301494
mftmirr_lcn 18431903474790528344 17537237637257306047
clusters_per_mft_record -16 54
clusters_per_index_record -88 107
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.
P NTFS 0 0 1 243197 57 60 3906963456
Can't open filesystem. Filesystem seems damaged.
Analyse Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
Current partition structure:
P Unknown 0 0 1 243197 57 60 3906963456
search_part()
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
SYSV4 Marker at 21692/164/56
recover_sysv4
SysV 4 21692 164 56 21692 164 55 0 [Tí=öxÅ]
SysV4, 0 B
Partition not added.
Sys=0C 46156 15 14 304005 33 23 4142345329
FATX, 2120 GB / 1975 GiB
This partition ends after the disk limits. (start=741497098, size=4142345329, end=4883842426, disk end=3906963456)
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 109062/234/50
recover_sysv4
SysV 4 109062 234 50 547168691 74 36 8788512929792 [F÷ö€]
SysV4, 4499 TB / 4092 TiB
This partition ends after the disk limits. (start=1752095821, size=8788512929792, end=8790265025612, disk end=3906963456)
SYSV4 Marker at 146716/126/15
recover_sysv4
SysV 4 146716 126 15 146716 126 14 0 [êé7]
SysV4, 0 B
Partition not added.
Sys=0C 174172 196 4 419436 10 31 3940154470
FATX, 2017 GB / 1878 GiB
This partition ends after the disk limits. (start=2798085531, size=3940154470, end=6738240000, disk end=3906963456)
check_FAT: Bad jump in FAT partition
LVM magic value at 213413/150/28
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1862 GiB) seems too small! (< 4500 TB / 4093 TiB)
The following partitions can't be recovered:
Sys=0C 46156 15 14 304005 33 23 4142345329
FATX, 2120 GB / 1975 GiB
SysV 4 109062 234 50 547168691 74 36 8788512929792 [F÷ö€]
SysV4, 4499 TB / 4092 TiB
Sys=0C 174172 196 4 419436 10 31 3940154470
FATX, 2017 GB / 1878 GiB
Results
interface_write()
TestDisk exited normally.