Moved HDD, massive issue

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pimfram
Posts: 1
Joined: 03 Feb 2015, 18:31

Moved HDD, massive issue

#1 Post by pimfram »

I had an external 4tb WD MyBook drive which had a problem with what I assumed was the USB controller so I put it into my computer as an internal drive. The problem is that Windows 8.1 sees the drive as RAW, and therefore cannot be used before being formatted. I've run TestDisk and all my files are accessible and non-corrupted. The drive is under warranty, though is likely void since I opened the enclosure, because I figured my odds of the drive booting fine were greater than the data I would have lost if I were to RTM the drive.

*EDIT: After a lot of research, it does appear there is an encryption-type issue when removing the USB interface which makes the drive essentially unfixable without formatting it. I'm in the process of backing up the data I care about and will simply wipe the rest and that will be that.

Image
Image
Image
Image
Image

I forgot to take a screenshot of the finished scan but I have a log.


Code: Select all

Mon Feb  2 16:31:31 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-01-19T21:26:37
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000753476096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000753476096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999835041792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=500093943808
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF605MH35TAUK, FW:ST6OA31B
Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0464172, FW:80.00A80

Partition table type (auto): Intel
Disk /dev/sdb - 4000 GB / 3725 GiB - WDC WD40EZRX-00SPEB0
Partition table type: Intel

Analyse Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   4  5 60799 163 36  976745984
 1 P HPFS - NTFS              0   4  5 60799 163 36  976745984
No partition is bootable

search_part()
Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           976745984
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               488372991
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,2,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,8,buffer,3519004416(486397/62/2)) lseek err Invalid argument
file_pread(5,1,buffer,3519004416(486397/62/2)) lseek err Invalid argument
file_pread(5,8,buffer,3519004544(486397/64/4)) lseek err Invalid argument
file_pread(5,1,buffer,3519004671(486397/66/5)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,14,buffer,3519004673(486397/66/7)) lseek err Invalid argument
file_pread(5,3,buffer,3519004687(486397/66/21)) lseek err Invalid argument
file_pread(5,3,buffer,3519004734(486397/67/5)) lseek err Invalid argument
file_pread(5,8,buffer,3519004750(486397/67/21)) lseek err Invalid argument
file_pread(5,11,buffer,3519004797(486397/68/5)) lseek err Invalid argument
file_pread(5,2,buffer,3519006719(486397/98/37)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]

search_part()
Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           976745984
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               488372991
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
BAD_RS LBA=2878537925 9688932
check_part_i386 failed for partition type 06
     FAT16 >32M           179180 178 12 232351 219 41  854194728
BAD_RS LBA=2688809428 10382571
check_part_i386 failed for partition type 06
     FAT16 >32M           167370 164 47 333814   0 21 2673912503
BAD_RS LBA=26150792 15814202
check_part_i386 failed for partition type 07
     HPFS - NTFS          268977  41  1 515268  63 12 3956666313
This partition ends after the disk limits. (start=4321118088, size=3956666313, end=8277784400, disk end=7813971633)
BAD_RS LBA=298521655 13690774
check_part_i386 failed for partition type 0E
     FAT16 LBA            285931 118  3 292927 240 24  112398448
file_pread(5,2,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,2,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,2,buffer,3519004337(486397/60/49)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,3519004337(486397/60/49)) ReadFile The drive cannot find the sector requested.

file_pread(5,2,buffer,3519004400(486397/61/49)) lseek err Invalid argument
file_pread(5,8,buffer,3519004416(486397/62/2)) lseek err Invalid argument
file_pread(5,2,buffer,3519004463(486397/62/49)) lseek err Invalid argument
file_pread(5,8,buffer,3519004544(486397/64/4)) lseek err Invalid argument
file_pread(5,1,buffer,3519004671(486397/66/5)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,14,buffer,3519004673(486397/66/7)) lseek err Invalid argument
file_pread(5,3,buffer,3519004687(486397/66/21)) lseek err Invalid argument
file_pread(5,3,buffer,3519004734(486397/67/5)) lseek err Invalid argument
file_pread(5,8,buffer,3519004750(486397/67/21)) lseek err Invalid argument
file_pread(5,11,buffer,3519004797(486397/68/5)) lseek err Invalid argument
file_pread(5,2,buffer,3519006719(486397/98/37)) lseek err Invalid argument
Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4000 GB / 3725 GiB) seems too small! (< 4238 GB / 3947 GiB)
The following partition can't be recovered:
     HPFS - NTFS          268977  41  1 515268  63 12 3956666313

Results
     HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
     FAT16 >32M           167370 164 47 333814   0 21 2673912503
     FAT16 >32M           179180 178 12 232351 219 41  854194728
     FAT16 LBA            285931 118  3 292927 240 24  112398448

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   4  5 60799 163 36  976745984
 1 P HPFS - NTFS              0   4  5 60799 163 36  976745984
No partition is bootable

search_part()
Disk /dev/sdb - 4000 GB / 3725 GiB - CHS 486397 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           976745984
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               488372991
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004699(486397/66/33)) lseek err Invalid argument
file_pread(5,2,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,1,buffer,3519004735(486397/67/6)) lseek err Invalid argument
file_pread(5,2,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,1,buffer,3519004762(486397/67/33)) lseek err Invalid argument
file_pread(5,8,buffer,3519004416(486397/62/2)) lseek err Invalid argument
file_pread(5,1,buffer,3519004416(486397/62/2)) lseek err Invalid argument
file_pread(5,8,buffer,3519004544(486397/64/4)) lseek err Invalid argument
file_pread(5,1,buffer,3519004671(486397/66/5)) lseek err Invalid argument
file_pread(5,1,buffer,3519004672(486397/66/6)) lseek err Invalid argument
file_pread(5,14,buffer,3519004673(486397/66/7)) lseek err Invalid argument
file_pread(5,3,buffer,3519004687(486397/66/21)) lseek err Invalid argument
file_pread(5,3,buffer,3519004734(486397/67/5)) lseek err Invalid argument
file_pread(5,8,buffer,3519004750(486397/67/21)) lseek err Invalid argument
file_pread(5,11,buffer,3519004797(486397/68/5)) lseek err Invalid argument
file_pread(5,2,buffer,3519006719(486397/98/37)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 486397  33 36 7813967872 [My Book]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
SIGHUP detected! TestDisk has been killed.
Top
Locked

Return to “Partition Recovery”