cgsecurity.org

Hello,
I need some help recovering my hard drive. I have a 240 GB solid state crucible as my boot/program drive, and a 1 TB Western Digital as my data drive. I also had the 1 TB drive formatted to boot, in case my solid state drive ever failed.

So yesterday the Western Digital data drive seems to have failed. Suddenly in Windows 8.1 it shows as a NTFS drive with zero capacity. If I double click on it, it asks me if I want to format (which I have not done).

I ran test disk, and everything appears to be fine. I did analyse, and then viewed the files. The Western Digital drive shows up with two partitions, one boot, and one Primary. The Primary partition looks like the right size, and all my files are there. I get structure OK, and both partitions are green. I save and exit. But when I reboot, the Western Digital drive still shows as zero capacity unformatted in Windows 8.1?

What am I missing?

Thanks, Greg

--log paste follows--


Mon Feb 2 18:27:38 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-01-19T21:26:37
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239687696384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999835041792
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-08M2NA0, S/N:WD-WCC3F3850409, FW:01.01A01
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD1, S/N:14190C200D61, FW:MU05

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EZEX-08M2NA0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 44/190/19
Current partition structure:
1 * HPFS - NTFS 0 32 33 44 190 18 716800
2 P HPFS - NTFS 44 190 19 121601 25 24 1952802816

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 716800
sectors_per_cluster 8
mft_lcn 29866
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 18 716800
NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size 1952802816
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 121601 25 24 1952802816
NTFS, blocksize=4096, 999 GB / 931 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 44 190 18 716800
NTFS, blocksize=4096, 367 MB / 350 MiB
P HPFS - NTFS 44 190 19 121601 25 24 1952802816
NTFS, blocksize=4096, 999 GB / 931 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 44 190 18 716800
2 P HPFS - NTFS 44 190 19 121601 25 24 1952802816
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Run "cmd" (right click run as administrator), "chkdsk /f d:" (replace d: by the correct drive letter)

should I dismount?

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>chkdsk /f f:
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process. Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N)

Hello, I still have not been able to recover my partition. I did checkdisk, and it did fix some errors. I reran testdisk and restarted, but I still cannot see my partition in Windows. I appreciate any help or advise that anyone can offer. Test
Disk log is below...


----
Thu Feb 5 22:34:44 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-01-19T21:26:37
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239687696384
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999835041792
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-08M2NA0, S/N:WD-WCC3F3850409, FW:01.01A01
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD1, S/N:14190C200D61, FW:MU05

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EZEX-08M2NA0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 44/190/19
Current partition structure:
1 * HPFS - NTFS 0 32 33 44 190 18 716800
2 P HPFS - NTFS 44 190 19 121601 25 24 1952802816

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 716800
sectors_per_cluster 8
mft_lcn 29866
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 18 716800
NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size 1952802816
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 121601 25 24 1952802816
NTFS, blocksize=4096, 999 GB / 931 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 44 190 18 716800
NTFS, blocksize=4096, 367 MB / 350 MiB
P HPFS - NTFS 44 190 19 121601 25 24 1952802816
NTFS, blocksize=4096, 999 GB / 931 GiB


dir_partition inode=5
P HPFS - NTFS 44 190 19 121601 25 24 1952802816
NTFS, blocksize=4096, 999 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 30-Jan-2015 16:57 .
5 dr-xr-xr-x 0 0 0 30-Jan-2015 16:57 ..
59 dr-xr-xr-x 0 0 0 19-Jun-2014 06:58 $Recycle.Bin
18872 dr-xr-xr-x 0 0 0 22-Aug-2013 09:45 Documents and Settings
115275 dr-xr-xr-x 0 0 0 20-Jun-2014 11:04 Intel
82507 dr-xr-xr-x 0 0 0 19-Jun-2014 08:00 NVIDIA
60 dr-xr-xr-x 0 0 0 22-Aug-2013 10:22 PerfLogs
61 dr-xr-xr-x 0 0 0 11-Sep-2014 20:02 Program Files
1948 dr-xr-xr-x 0 0 0 14-Jan-2015 09:37 Program Files (x86)
2004 dr-xr-xr-x 0 0 0 13-Oct-2014 22:55 ProgramData
89348 dr-xr-xr-x 0 0 0 11-Jan-2015 06:06 SteamLibrary
42467 dr-xr-xr-x 0 0 0 4-Feb-2015 17:11 System Volume Information
2121 dr-xr-xr-x 0 0 0 19-Jun-2014 06:58 Users
2173 dr-xr-xr-x 0 0 0 30-Jan-2015 14:03 Windows
89346 dr-xr-xr-x 0 0 0 4-Jan-2015 19:33 bf2
18866 -r--r--r-- 0 0 1 18-Jun-2013 07:18 BOOTNXT
112669 -r--r--r-- 0 0 189 20-Jun-2014 08:42 Install.log
108309 -r--r--r-- 0 0 282 20-Jun-2014 07:16 SSUUpdater.log
18871 -r--r--r-- 0 0 398356 18-Mar-2014 05:13 bootmgr
114897 -r--r--r-- 0 0 156 20-Jun-2014 11:05 csb.log
43 -r--r--r-- 0 0 6842257408 30-Jan-2015 14:03 hiberfil.sys
89908 -r--r--r-- 0 0 904704 1-Dec-2006 23:37 msdia80.dll
2364 -r--r--r-- 0 0 8589934592 30-Jan-2015 14:03 pagefile.sys
83763 -r--r--r-- 0 0 268435456 30-Jan-2015 14:03 swapfile.sys

interface_write()
1 * HPFS - NTFS 0 32 33 44 190 18 716800
2 P HPFS - NTFS 44 190 19 121601 25 24 1952802816
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

if you can see the files use this method with knoppix live-dvd. its quicker and easier using filemanager, like in windows with mouse.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html

i will dban the failing drive.

I'm not sure I understand what you are saying. Are you suggesting that I use a product called "knoppix live-dvd" and copy the files from the lost partition to some other storage device, rather than trying to recover the lost partition?

yes dont try to repair that partion. you can do that later when data is recovered with testdisk or knoppix live-dvd. the latter is easier maybe also quicker.
it would be interesting to see if testdisk can repair the problem but at the end you could have spent a lot of time with no success.
i still have a disk with overlapping partitions which still has hidden data which are not displayed in testdisk.
also knoppix cannot help here. maybe always when not displayed in testdisk knoppix cannot help.
so it would be wise to first check if display is possible in testdisk.
if nothing is possible i would try to restore with photorec. could need a lot of time. at my last knoppix restauration i could not restore 30 of 80gb video-data. could have do do with the fact that videos are severely defragged.