No Files After Boot Sector Rebuild

[FerozXBL]

Hi All

First time using Testdisk to recover files after a power surge. I have a 3TB Drive of which 300GB was visible as RAW in device manager and the rest was not visible anywhere. The drive before the surge only had 1 primary partition. When trying to access the 300GB drive within windows, it asks me to format the drive.

After installing testdisk, it saw the drive as 3000GB/2794GiB. I selected it, did the Analysis and everything and selected P to list my files. At this point all the files I was looking for showed and i was able to copy them over to another directory. I only copied 1 file to test. After this I tried rebuilding the boot sector thinking this would allow me to access the drive with all the contents on it within windows but it did the exact opposite. I cannot access within windows and now when trying to access the files within testdisk it comes up as "Can't open filesystem. Filesystem seems damaged".

I have recorded the logs but have no idea where it saves for me to post the log file here.

I'm basically trying to get my files back that i could initially see. Is this still possible?

[Fiona]

Can you open your testdisk.log using a wordprocessor like Wordpad and copy and paste the content into your next post?
Also, you can zip your log file and upload it here too.

Fiona

[FerozXBL]

Thanks for your response Fiona. I've pasted below what i think is the log. However I have used testdisk again after and recorded that logs too so im not sure if testdisk overwrites the log file everytime.



Sat Jun 6 21:08:52 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000202043392
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=335439462400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=664656674816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199023255040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000200994816
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 129201 240 63, sector size=512
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive C: - 335 GB / 312 GiB - CHS 43330 240 63, sector size=512
Drive D: - 664 GB / 619 GiB - CHS 85856 240 63, sector size=512
Drive E: - 2199 GB / 2047 GiB - CHS 267349 255 63, sector size=512
Drive F: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Current partition structure:
1 * HPFS - NTFS 1 5 5 267350 94 7 4294967295 [Seagate Expansion Drive]

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 0
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 1 5 5 267350 94 7 4294967295 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results
* HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
1 * HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 0
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 1 5 5 267350 94 7 4294967295 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
BAD_RS LBA=257878841 1721160
check_part_i386 failed for partition type 0E
FAT16 LBA 283401 144 1 424190 235 1 2261781019
This partition ends after the disk limits. (start=4552846137, size=2261781019, end=6814627155, disk end=5860533168)
BAD_RS LBA=3553810299 5475797
check_part_i386 failed for partition type 0C
FAT32 LBA 221214 117 19 421147 49 48 3211919391
This partition ends after the disk limits. (start=3553810299, size=3211919391, end=6765729689, disk end=5860533168)
file_pread(5,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 3489 GB / 3249 GiB)
The following partitions can't be recovered:
FAT32 LBA 221214 117 19 421147 49 48 3211919391
FAT16 LBA 283401 144 1 424190 235 1 2261781019

Results
* HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
Not an exFAT boot sector.

* HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
SIGHUP detected! TestDisk has been killed.

[Fiona]

The size of your current partition is 2.2 TB and the size of your disk is 3 TB.
Did you use the whole space before or 2.2 TB only?

Results
* HPFS - NTFS 1 5 5 267350 94 8 4294967296 [Seagate Expansion Drive]
NTFS, blocksize=4096, 2199 GB / 2048 GiB

Intel-MBR only supports disks and partitions up to 2.2 TB.
Larger partitions can cause problems if you write over the limit of 2.2 TB.
Would it be possible that your previous partition used the whole disk space?

Fiona

[FerozXBL]

2.7TB was used before anything happened and the first time running through testdisk it showed me all my files of 2.7TB. Only After doing the boot sector rebuild it did it change to 2.2TB and no longer can I see any files.

[Fiona]

Maybe wrong partition table Type?
Your partition table type is Intel-MBR but should be GPT.
Advanced formatted disks with 4096 bytes sectors could support disks/partitions larger than 2.2 TB?
Do you have any idea about the sector size of your disk?
The sector size of your disk is recognized with 512 Bytes only?
If you have an internally disk, sector size of a disk could be emulated (512e).
Info:
https://msdn.microsoft.com/en-us/librar ... 85%29.aspx

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512

I assume your OS is Win7.
Did you install servicepack 1?
Looks like that your file system is damaged after reboot?

$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.

Fiona

[FerozXBL]

Maybe wrong partition table Type?
Your partition table type is Intel-MBR but should be GPT.
Advanced formatted disks with 4096 bytes sectors could support disks/partitions larger than 2.2 TB?
Do you have any idea about the sector size of your disk?
The sector size of your disk is recognized with 512 Bytes only?
If you have an internally disk, sector size of a disk could be emulated (512e).
Info:
https://msdn.microsoft.com/en-us/librar ... 85%29.aspx

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512

I assume your OS is Win7.
Did you install servicepack 1?
Looks like that your file system is damaged after reboot?

$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.

I have no idea what the sector size of disk is. Is there any way to find this out?
Yes i am running Windows 7 ultimate and no Im not aware of any service pack being installed. The drive was reading perfectly fine within testdisk before I did the boot sector rebuild. I could even retrieve all my files.

Is there any way to repair this issue im having with seeing my files again?
Fiona

[Fiona]

Please let me know your disk modell.
I'll have a try to check it.
Might be possible that you'll get some info about the sector size watching your disk label.
Of course I try to investigate what was the cause of your problem and looking for a possibilty to fix it.
That's why I'd like to exclude any other problem.
For example a bootsector doesn't decrease the size of your partition.
Partitions are in your partition table and is a part of the MBR.
Before it was 2.7 TB and now 2.199 TB.
So it looks like that after reboot the size of your partition got changed.
An Intel-MBR doesn't support it and it's possible after restart that your disk crashed.
Info:
http://knowledge.seagate.com/articles/e ... uage=en_US
http://www.pcworld.com/article/235088/e ... rives.html
Often it works for a while and it happens suddenly.
Of course I've checked your log file for a backup of your previous boot sector, but until yet I didn't find any.
Unfortunately I've no testdisk.log of your previous situation either.

Before we´re running any further diagnose you should have a look for support of disks larger than 2.2 TB.

Fiona

[FerozXBL]

Thanks. I appreciate your help.

So just to confirm, you dont want me to try anything further until you get back to me?

[Fiona]

The sector size of your disk should be 4096 Bytes ( 4k).
The only info I've found:
http://www.seagate.com/staticfiles/supp ... 686584.pdf
But is probably recognized as 512e Bytes (emulated)?
Can you repeat your dagnose running Intel?
Please note, it's only intended as a diagnose only.
You shouldn't use Write nor RepairMFT.
After running a diagnose, it should be considered to convert your disk to GPT to avoid further problems.

Important:
If your disk is still recognized with sector size 512 Bytes (it's described at the disk selection), you can use the menu Geometry to change the sector size to 4096 and run another diagnose.
If you open sector size, you can read at the bottom of the display "very dangerous".
As long as you don't use Write, nothing will be changed.
It's only a try to find different results and maybe a backup of your boot sector after Deeper Search?
If partitions are found, please have a try to list your files.
In case you can copy them.

Also some information about Intel Rapid Storage Technology (RST).
http://knowledge.seagate.com/articles/e ... uage=en_US
Did you have this driver running?
Please change only the sector size if it's still displayed with 512 Bytes!

Fiona