Does TestDisk support ReFS? And related issue

[skyypunk]

Using Intel RAID on a Z97 mobo, GPT, ReFS, 6x 3TB WD Red HDDs in RAID5

**Data would be annoying to lose (mainly because it took many days to load it up) but I have all of the original content I can put back on it. If I can recover the partition, that would be amazing I'd rather spend a day or two experimenting on recovery than loading a hundred discs back into my file server

Short backstory: Updated BIOS, and as always, switched the setting back to RAID, but for some reason this time half of my disks were listed as non-member disks I then started following instructions other people posted using TestDisk (which is awesome, by the way, thanks!)

I got to a point where it can see the partition, sort of...

DEFAULT:
Hint: EFI GPT partition table type has been detected.

Detected a partition table, which seems promising

Disk /dev/sdc - 15 TB / 13 TiB - CHS 1824005 255 63
Partition Start End Size in sectors
>P MS Data 7876608 19528951767 19521075160

NTFS, blocksize=4096, 9994 GB / 9308 GiB

Detects the partition (partially, it should be around 14tb), and it sees the correct partition name

A couple things: 1) It is showing it as 10tb partition, 2) It lists it as NTFS, 3) When I choose list files, it says

Can't open filesystem. Filesystem seems damaged.

I'm not sure if that's because it is actually damaged (which I could see, since the amount is low), or if it's because it is treating it as NTFS instead of ReFS.

Also - do I need to wait for the raid array to finish initializing again? I guess that could also be related to the issue

Thanks!

Edit:
I tried out PhotoRec and it almost immediately began finding files, so that seems like a good sign that the partition might be recoverable

[Fiona]

Until yet I didn't have a case with ReFS.
To figure out more, can you copy and paste the content of your testdisk.log?
For example exFAT uses a NTFS-partition but the file system and bootsector are exFAT.
Example:

ntfsexfat.png (13.46 KiB) Viewed 6196 times

Watch the boot sector and its backup.
If it'd be for sure that ReFS uses partition type 07 for NTFS you probably could write it into your partition table.
But only if it's necessary.
Your log file would be appreciated.

Fiona

[skyypunk]

Just a quick note in case you missed it in my first post (edited after to add it): PhotoRec was successfully recovering files from the drive, which seems promising

Here is the log file shortly after it finds a partition (analyzing as EFI GPT is very slow, it looks like it would take about 10 days to complete it after the partition was found):

Code: Select all

Wed May 27 20:50:23 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 2012 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-05-23T20:38:26
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=15002952007680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=15002952007680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119478943744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=239921528832
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512
Disk /dev/sdc - 15 TB / 13 TiB - CHS 1824005 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14525 255 63, sector size=512
Drive D: - 239 GB / 223 GiB - CHS 29168 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdc - 15 TB / 13 TiB
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 15 TB / 13 TiB - CHS 1824005 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 29302640639)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
check_part_gpt failed for partition
 2 P MS Data                   264192 29302636543 29302372352 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                   264192 29302636543 29302372352 [Basic data partition]
 2 P MS Data                   264192 29302636543 29302372352 [Basic data partition]

search_part()
Disk /dev/sdc - 15 TB / 13 TiB - CHS 1824005 255 63

LVM magic value at 186/94/37
NTFS at 490/75/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           2440134395
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
NTFS part_offset=4032823296, part_size=9994790481920, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 490/75/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           2440134395
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     MS Data                  7876608 19528951767 19521075160
     NTFS, blocksize=4096, 9994 GB / 9308 GiB
Search for partition aborted

Results
   P MS Data                  7876608 19528951767 19521075160
     NTFS, blocksize=4096, 9994 GB / 9308 GiB

interface_write()
 1 P MS Data                  7876608 19528951767 19521075160
simulate write!

TestDisk exited normally.

At this point I didn't write partition to disk, should I try that?

Thanks for your help!

[Fiona]

At this point I didn't write partition to disk, should I try that?

No, you shouldn't write that partition.
As I've mentioned above, I have no idea about ReFS.
That's why I'm trying to help as far as possible.

Just a quick note in case you missed it in my first post (edited after to add it): PhotoRec was successfully recovering files from the drive, which seems promising

Nope I didn't miss it.
But I'm trying to test, how far would testdisk be able to help you?
For example you were running testdisk quick serach.
Your found partition and your partition in your GUID partition table have both a different length.
You can compare it here:
Your current partition:
2 P MS Data 264192 29302636543 29302372352 [Basic data partition]
and your found partition as the result of Quick Search:
Results
P MS Data 7876608 19528951767 19521075160
NTFS, blocksize=4096, 9994 GB / 9308 GiB
As you already wrote it's a 10 TB partition and I assume that's probably not the correct one or wrong.
That's why you have not been able to list files.
Something to try would be to run testdisk / Advanced.
You should check your affected partition.
A screenshot would be appreciated.
If the menu List is available please have a try to list your files.
Confirm at the menu Boot and upload another screen shot.

Fiona

[skyypunk]

Something to try would be to run testdisk / Advanced.
You should check your affected partition.
A screenshot would be appreciated.
If the menu List is available please have a try to list your files.
Confirm at the menu Boot and upload another screen shot.

Sorry if I am misunderstanding - what should I do in the Advanced menu (screenshot below of when I choose Advanced)? And where is the Boot menu option?




Thanks!
-Doug

[Fiona]

TestDisk works dynamically.
For example, if you have a supported FAT or NTFS partition, testdisk will display the menu Boot.
If you have a Linux partition there will be the menu Superblock.
It looks like that ReFS is not supported?
That's why Boot is not available.
Even if PhotoRec can recover underlying data.

Fiona

[skyypunk]

Ah got it. That's unfortunate... thanks for your help in trying to figure it out though, very much appreciated!

[DrChiron]

Greetings:
I'm no expert, but I am observant.

The log posted by the OP included the following library that I presume was used to build TESTDISK:
"reiserfs lib: 0.3.1-rc8"
IIRC reiserfs is your ReFS filesysytem !

I do not know if this is of any help, but I felt it deserved mention.
Doc

[Fiona]

ReFS should probably become a successor of NTFS.
Info about ReFS:
https://technet.microsoft.com/en-us/lib ... 31724.aspx