cgsecurity.org

Posted: **09 Mar 2016, 04:46**

This is the preliminary report off gdisk. Apologies as I haven't had the time to run testdisk, so a full log won't be forth coming until the coming week. It's a 3TB drive and even with quickscan it would seem to take more than 24hrs so I am currently waiting for new hdd to arrive so that I can do a recovery dump with photorec/gparted etc before attempting testdisk in case it goes pear shaped.

Is this enough information to pinpoint the cause of the problem and if it's repairable?

Code: Select all

user@debian:~$ sudo gdisk /dev/sda
GPT fdisk (gdisk) version 1.0.1

Caution: invalid backup GPT header, but valid main header; regenerating
backup header from main header.

Caution! After loading partitions, the CRC doesn't check out!
Warning! Main and backup partition tables differ! Use the 'c' and 'e' options
on the recovery & transformation menu to examine the two tables.

Warning! One or more CRCs don't match. You should repair the disk!

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: damaged

****************************************************************************
Caution: Found protective or hybrid MBR and corrupt GPT. Using GPT, but disk
verification and recovery are STRONGLY recommended.
****************************************************************************

Warning! Secondary partition table overlaps the last partition by
18404680104996197575 blocks!
You will need to delete this partition or resize it in another utility.

Posted: **15 Mar 2016, 19:25**

Ok, some updates on my futile struggle

First testdisk scan didn't turn up anything.

Second scan after rebuilding the bootsector allowed me to view some information but it's still a mess and no access to partitions. MFT+backup is corrupt also. This is what I get - I couldn't find the full testdisk log in partedmagic

Code: Select all

Disk rescue2.dd - 3000 GB / 2794 GiB - CHS 364785 255 63
     Partition                  Start        End    Size in sectors
   P NTFS                     0   0  1 364784 207 31 5860268032

filesystem size           5860268032 18341069176930398147
sectors_per_cluster       8 167
mft_lcn                   786432 319895051
mftmirr_lcn               366266751 1646484757
clusters_per_mft_record   -10 48
clusters_per_index_record 1 -111
Extrapolated boot sector and current boot sector are different.

The harddisk (3000 GB / 2794 GiB) seems too small! (< 10085235 TB / 9172468 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   SysV 4               40644   7 63 23550024 184 43 2139335816118272 [M-6M-9M-h~I
   WBFS                 70378   2 17 2061066511 132 45 19697725041803264
   SysV 4               166653 233 53 944645961 244 51 15173060083712 [~^%>-u~A]
   SysV 4               255023 159 26 3155978142 189  8 1706664282554368 [^O JM-=8]
>  SysV 4               261672 211 12 87559327  98 35 1402436820480 [y~Km^L~D 

Disk rescue2.dd - 3000 GB / 2794 GiB - CHS 364785 255 63

     Partition               Start        End    Size in sectors
>P NTFS                     0   0  1 364784 207 31 5860268032
 P CramFS               252305 133 57 252502 218 15    3170119 [~@O/M-\^YbKM- M-~>M-0~KPM- )]
 P CramFS               252305 133 58 252502 218 16    3170119 [~@O/M-\^YbKM- M-~>M-0~KPM- )]

Write isn't available because the partition table type "None" has been selected.

gdisk

Code: Select all

Command (? for help): p
Disk rescue2.dd: 5860268032 sectors, 2.7 TiB
Logical sector size: 512 bytes
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 5860267998
Partitions will be aligned on 8-sector boundaries
Total free space is 1294838339 sectors (617.4 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1      1294838373      1940375238   307.8 GiB   8300  Linux filesystem
   2      1676881773      2934119958   599.5 GiB   8300  Linux filesystem
   3      4257924028      6695841663   1.1 TiB     8300  Linux filesystem
   4      1959818223      5544689613   1.7 TiB     8300  Linux filesystem

But then I tried chkdsk /f. It worked! It rebuilt the partition to a mountable state. But only managed to rebuild <10% of the file tree/directories.

R-studios recognizes 80% of the data, but again it could only retrieve <10% of the directory structure, so without all the necessary metadata the files are as good as useless.

: hddscan1 - Copy.png (25.54 KiB) Viewed 3846 times

Finally I was able to identify some missing root directory names under the 2nd MFT in the hex editor which doesn't show up anywhere else. If this is suppose to be the MFTmirr or the backup (correct me if I'm wrong, my understanding of ntfs data structure is very basic) is it possible to use it to rebuild by merging with or replacing the original MFT?

cgsecurity.org

corrupted partition table?

corrupted partition table?

Re: corrupted partition table?