3TB drive lost Topic is solved

How to use TestDisk to recover lost partition
Message
Author
strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

3TB drive lost

#1 Postby strongdc » 07 Jun 2012, 13:52

I have a 3TB WD Green internal HDD which i use as my data drive. I came home for the vacations, so brought the disk with me. However, when i plugged it in at home, showing "Unallocated".

the drive has only 1 partition.
Tried to analyse with Testdisk, but it cant find any partitions even in deeper search.
Upon entering into testdisk, and selecting Intel as type, it lists -

Code: Select all

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable









*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
>[Quick Search]  [ Backup ]
                            Try to locate partition



Any ideas to recover my partition?
Any help is greatly appreciated.


Some info about my setup -
Win 7 64bit
Core i5-750 @ 3.8GHz (overclocked)
ASUS P7P55D-e PRO
4GB DDR3 RAM - GSkill Eco 1600Mhz CL7
250GB Segate Barracuda - OS
1TB WD Black - Softwares
3TB WD Green - Data

Deepak

Sponsored links

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB drive lost

#2 Postby remy » 08 Jun 2012, 09:02

Do not select intel as type : your disk is 3TB and intel MBR is limited to 2TB. First partition recoverd shows also that you should have an EFI/GPT partition type.

I don't know if testdisk writes partition when EFI/GPT, but if no you may repair with gdisk (gpt-fdisk)
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

Re: 3TB drive lost

#3 Postby strongdc » 08 Jun 2012, 09:42

what about the error that HCS and LBA dont match??

ran deep search using EFi GPT option also. the results given below -

Code: Select all

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63

The harddisk (3000 GB / 2794 GiB) seems too small! (< 1886035 TB / 1715339 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   MS Data               2964749840 3300811953993578 3300808989243738
   MS Data               3020179548 3683663413931614 3683660393752066 [4h^P~KM-O~KM-6 ~]M-)]
>  MS Data               5860532223 11720800254 5860268032NTFS, 3000 GB / 2794 GiB








[ Continue ]


the 3rd (selected) one is the one that's of my concern (atleast thats what i think...)
the next screen gives loads of partitions -

Code: Select all

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
     Partition               Start        End    Size in sectors
>D MS Data                   264192 5860532223 5860268032
 D Mac HFS                 73178241 1445874014 1372695774 [M-I yM-)~PB*~AM-6M-9^FM-;I ^WJAhݧ&]
 D Mac HFS                115956725  179088887   63132163
 D Mac HFS                118007085  181139247   63132163
 D Mac HFS                165157438  179386434   14228997
 D Mac HFS                167192102  181421098   14228997
 D Mac HFS                172665454  179616340    6950887
 D Mac HFS                173616473  178671453    5054981
 D Mac HFS                174700086  181650972    6950887
 D Mac HFS                177920089  182975069    5054981
 D Mac HFS                178671450  183726430    5054981
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector!, 3000 GB / 2794 GiB

now the selected (1st) partition has the correct size - NTFS found using backup sector!, 3000 GB / 2794 GiB
but when i press enter i get the screen saying - "No partition found or selected for recovery".
Now did i do something wrong here?

strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

Re: 3TB drive lost

#4 Postby strongdc » 08 Jun 2012, 09:52

Also if i try to add the partition myslef using 'A' when i enter the ending sector as 5860532223 and press enter, the value that comes is 1565564927. Any idea whats happening here??

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB drive lost

#5 Postby remy » 08 Jun 2012, 10:34

yes, scan has been made by default using sector size 512. Your disk has 4096 sector size. Please make scan with last version 6.14, Christophe told me some weeks ago he improved that.

After deepersearch, try to list files of your first partition with "P" key. You'll see if it's in good condition or corrupted.
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

Re: 3TB drive lost

#6 Postby strongdc » 09 Jun 2012, 15:07

did a deepscan with Testdisk 6.14 after changing sector size to 4096 in geometry manually. got the following screen -

Code: Select all

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45601 255 63

The harddisk (3000 GB / 2794 GiB) seems too small! (< 1690015 TB / 1537060 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data                370593730 412601494249197 412601123655467










[ Continue ]
JFS 237695068, blocksize=3221194465, 1690014 TB / 1537058 TiB

on pressing enter ->

Code: Select all

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 45601 255 63
     Partition               Start        End    Size in sectors
>P MS Data                    33024  732566528  732533504











Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB

If i try to list files i get the error - Can't open filesystem. Filesystem seems damaged. When i had earlier dont the deepscan with sector size 512 and selected the partition for viewing files, i was able to get the correct files. I also copied a file properly. just that i was unable to add it to the partition table.
What to do?

strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

Re: 3TB drive lost

#7 Postby strongdc » 09 Jun 2012, 15:40

Also, WD site lists -
User Sectors Per Drive 5,860,533,168
acc to which the sector size shld be 512bytes.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB drive lost

#8 Postby remy » 11 Jun 2012, 09:57

Thank you for precision. It's curious because most of 3TB have a 4096 sector size, but you are probably right on that point. I'm not sure testdisk can rewrite a partition on a GPT table. If possible, easiest way would be to extract files from testdisk to another destination, and reformat your disk with a new and clean filesystem.
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

strongdc
Posts: 11
Joined: 07 Jun 2012, 13:03

Re: 3TB drive lost

#9 Postby strongdc » 11 Jun 2012, 12:27

Actually, internally the sector size used by the drive is 4096 but to the OS it appears as 512 only. Atleast thats what i can comprehend from the documentation. I might be wrong. The pro's here might be able to explain better.
How do i list files to copy? i cant fill in the ending sector as 5860532223...
i ll have to deep scan again? FYI, that partition when i listed gave me the correct filelist n i was able to copy.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB drive lost

#10 Postby remy » 11 Jun 2012, 16:43

Yes, easiest is to compleate again your search (quick/deep). Tip : with last 6.14, as soon as a partition is recovered in deepersearch mode, you can go to the end of this partition using "F" key.

When partition is found, list with "P", then select either the files you want, or only some of them, and extract with c or C. Destination must be another disk, but as far as you partition can't be mounted, I bet it will be the case.
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.


Return to “Partition Recovery”

Who is online

Users browsing this forum: No registered users and 0 guests