Write after Analyse problem?

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Anastaziel
Posts: 2
Joined: 15 Jan 2016, 01:13

Write after Analyse problem?

#1 Post by Anastaziel »

Hi,

My external WD Elements 5TB drive just died. I opened it, removed the drive, and hooked it up to the PC to see if I can retrieve the data. In Windows I saw the drive was listed as RAW. I had no idea what to do so through some tutorials I picked up TestDisk. This is what I did it using a live USB of the newest Ubuntu. I did not install the OS just booted from the USB:

I chose Intel partition (no idea if that was correct or not).

1. Run Analyse: I was able to see all the files listed after that. 1 partition. So I wrote it to the disk.
1.1. Restarted.
1.2. I tried to open the drive in a normal way. I found some files but some directories gave me a warning, when I tried to open them, that it could not display(?) all the files despite me being able to see all the files through TestDisk's Analyse.

2. Somewhere I saw that I should run Advanced - Boot. So I did. I was able to again see all the files through TestDisk but again I cannot see them all if I simply open the drive in Ubuntu and I still get the warning of missing files.

3. I ran Analyse again. Same result.

4. Ran the MBR Code command. Nothing changed.

5. Ran Analyse again. Nothing changed.

Never did a deeper scan.

Here is a screenshot I do not understand. In the attached picture at the bottom it says blocksize=4096, 2199GB / 2048 GiB. Why does it say that? I could not find what "Sector Size" to put.
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Write after Analyse problem?

#2 Post by Fiona »

Your disk should be GPT instead of Intel-MBR.
Intel-MBR supports only disks up to 2.2 TB.
In the attached picture at the bottom it says blocksize=4096, 2199GB / 2048 GiB.
Typically sign that your partition is only recognized as a 2.2 TB (2199 GB)-partition.
OlderOS's like WinXP etc.. can have trouble to handle it.
Often external large disks over 2.2 TB and 4k sectors are advanced formatted to bypass the 2.2 TB-Limit.
It can cause trouble.
Driver can be an issue too:
http://knowledge.seagate.com/articles/e ... uage=en_US
Although it's seagate related but it can affect WD too,
For example, when you build in your disk internally, 4 k sectors can be emulated as 5212 Bytes sectors, otherwise older computer can't boot from this disk.
Some info:
https://msdn.microsoft.com/en-us/librar ... 85%29.aspx
As far as I've seen, USB has much less trouble to recognize large disks than internally ones.
Can you attach your disk via USB and test your capacity again?

Fiona
Anastaziel
Posts: 2
Joined: 15 Jan 2016, 01:13

Re: Write after Analyse problem?

#3 Post by Anastaziel »

Hi Fiona,

Thank you for your reply. I just saw that the screenshot I tried to upload is not in my first post. I will try to upload it with this one.

I am not using Windows but Ubuntu 15.10 as a Live USB (so I do not install the OS just run it from the USB). In it I put the newest TestDisk. The "bad" HDD is plugged into my PC as I had to extract the HDD from its case. The case and its controller chip died. I do not have means to plug the HDD via USB.

The 2.2GB is show in TestDisk if I choose Intel partition and run Analyse. After Analyse finishes and I press P I can view all the files on the HDD. Above where the partitioned are listed I see Disk /dev/sda - 5000 GB / 4657 GiB. Which seems to be normal for a 5TB HDD.

But underneath where it says: Keys A: add partition ... and so one it says: NTFS, blocksize=4096, 2199GB / 2048 GiB. TestDisk finds all the files and I can copy them (I presume correctly) but it decides to write a wrong partition table at the end, a partition table that only indexes(?) 2048 GiB. I do not understand why?
Intel partition
Intel partition
1.png (54.92 KiB) Viewed 2368 times

Now, I tried your suggestion of using GPT partition instead. It does the same thing but it finds 2 partitions. 1 MS Data and 1 Mac HFS. The Data partition has all the files, again found correctly and I can copy them but it again says on the bottom that the HDD is only 2048 GiB despite finding the correct size at the top: Disk /dev/sda - 5001 GB / 4657GiB. Why would it find correctly the partition but decide to write the wrong one? If I select to proceed and write the partition information it says "Error".
GPT partition
GPT partition
2.png (56.05 KiB) Viewed 2368 times
Furthermore, If I set the blocksize to 516 using GPT partition it finds 3 partitions and it says the the 2 that are not data partitions are corrupted (do not really care about them).
Locked