cgsecurity.org

Hi all,

My first post here and my first time using testdisk.
OS: win7x64
Disk:
Type Fixed Disk
System Name 81h
OS Device \\.\PhysicalDrive1
BIOS Name WDC WD30EZRZ-00WN9B0
Partition Style GPT
Total Size 2.73 TB (3000592982016 bytes)
Cylinders 364801
Tracks per Cylinder 255
Sectors per Track 63
Bytes per Sector 512

The disk was previously on another Win7x64 machine and failed showing up as RAW. My friend brought it to me saying that it had only a single partition on there (although when I checked it with minitool partition wizard it showed 2 partitions could have been previously present which included a tiny system partition. Therefore I am not sure what was on there exactly, except that the guy said he had a huge partition for his backup files. BTW minitool after analysis did not give me any remedies so I went to testdisk. Bear in mind that the disk passed the WD extended test with flying colors!!!).

Testdisk defaulted to [EFI GPT] partition!
QUESTION: Is that normal for a HD on an Intel PC with windows 7x64?????

So I proceeded to do a quick search which should take 2.7 days and I am at 43% currently. As you can see, I am getting loads of 'Bad jump in FAT partition' and 'Bad number of sectors per cluster'. Also the partition names are corrupted and are identified as unknown!!!

You could help me by :
1. Should I have changed the default [EFI GPT] to [Intel] before analysis?
2. If [EFI GPT] is fine, then tell me what you think is going on with my findings so far.

Thank you so much in advance for taking the time to enlighten me on this.
Remember this is my first experience with Testdisk and I do not want to mess it up.

Below is the analysis section... Still waiting for the quick search to complete currently at 74%.


Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - WDC WD30 EZRZ-00WN9B0
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]

74%

The QUick search is done with a weird result:
TestDisk 7.1-WIP, Data Recovery Utility, April 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63

The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
Partition Start End Size in sectors
> MS Data 5763073943 11623341974 5860268032
MS Data 5860532223 11720800254 5860268032

What's going on here?
Any help?

Here is the latest log in the post below as the forum will not allow txt or log attachments.

As I was given 2 options I chose the first one, and went to the next screen to 'P' the files.
Unfortunately it told me that no files could be shown because
'MS Data 264192 5860532223 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.'.
I then tried to go back to the previous screen to select the second partition and try the same. Unfortunately by pressing 'Q', I was not returned to the previous screen. Instead I was taken to a screen without any partitions allowing me to only do a deeper search. SO now this is what I am doing.

Another 3 days wasted ((

Sat Apr 22 13:31:20 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, April 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=600132550656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=32015679488
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=600132550656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=32015679488
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=600130453504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=32015678464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=0
Warning: can't get size for \\.\O:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=0
Warning: can't get size for \\.\P:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=0
Warning: can't get size for \\.\Q:
Hard disk list
Disk /dev/sda - 600 GB / 558 GiB - CHS 72961 255 63, sector size=512 - Intel Raid 0 Volume, S/N:VELOCIRAID, FW:1.0.
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30 EZRZ-00WN9B0, S/N:W -DCW4C6EVV9T54, FW:80.0
Disk /dev/sdg - 32 GB / 29 GiB - CHS 3892 255 63, sector size=512 - SanDisk Cruzer Glide, S/N:20051032001AFB12E9DC, FW:2.01

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - WDC WD30 EZRZ-00WN9B0
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63

LVM magic value at 4951/69/41

SYSV4 Marker at 11240/225/8

recover_sysv4
Unknown 180584782 180584781 0 [Âù§‡Ü]
SysV4, 0 B
Partition not added.

Unknown 414373527 8070199838 7655826312
WBFS, 3919 GB / 3650 GiB
Partition not added.

SYSV4 Marker at 51862/27/25

recover_sysv4
Unknown 833164755 2616581403090 2615748238336 [%ÿFßË:]
SysV4, 1339 TB / 1218 TiB
Partition not added.

SYSV4 Marker at 64179/182/59

recover_sysv4
Unknown 1031047159 1031047158 0 [¬]âŒIï]
SysV4, 0 B
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
Unknown 2014548713 35705267737039592 35705265722490880 [PÔ´ÓTX+îd`“|Ý[ Æ€ºì'<‚WV®eÍ]
BeFS blocksize=32768, 18281096 TB / 16626560 TiB
Partition not added.

LVM magic value at 146550/128/15

Unknown 2819412314 2819412313 0
WBFS, 0 B
Partition not added.

cramfs Marker at 180460/18/57

recover_cramfs
MS Data 2899091090 2900484517 1393427 [tDc§ƒŽSbÐY§_]
cramfs, 713 MB / 680 MiB

cramfs Marker at 196879/208/18

recover_cramfs
MS Data 3162874256 3168501556 5627300 [¬­÷@àŠÇºÒÖ?šR½ ç]
cramfs, 2881 MB / 2747 MiB

SYSV4 Marker at 254396/1/3

recover_sysv4
Unknown 4086871805 1275126671100 1271039799296 [Œ±_ê8c]
SysV4, 650 TB / 591 TiB
Partition not added.
NTFS at 358734/194/12
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=2950693858816, part_size=3000457232384, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 358734/194/12
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 5763073943 11623341974 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5763073943, size=5860268032, end=11623341974, disk end=5860533168)
file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533169(364801/81/2)) lseek err Invalid argument
.
.
.
file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533215(364801/81/48)) lseek err Invalid argument
file_pread(5,1,buffer,5860533236(364801/82/6)) lseek err Invalid argument
file_pread(5,1,buffer,5860533286(364801/82/56)) lseek err Invalid argument
file_pread(5,1,buffer,5860535199(364801/113/16)) lseek err Invalid argument
file_pread(5,1,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,5860533216(364801/81/49)) lseek err Invalid argument
file_pread(5,8,buffer,5860533230(364801/81/63)) lseek err Invalid argument
file_pread(5,11,buffer,5860533277(364801/82/47)) lseek err Invalid argument
file_pread(5,1,buffer,5860535200(364801/113/17)) lseek err Invalid argument
file_pread(5,1,buffer,5860533170(364801/81/3)) lseek err Invalid argument
file_pread(5,1,buffer,5860533217(364801/81/50)) lseek err Invalid argument
file_pread(5,1,buffer,5860533238(364801/82/8)) lseek err Invalid argument
file_pread(5,1,buffer,5860533288(364801/82/58)) lseek err Invalid argument
file_pread(5,1,buffer,5860535201(364801/113/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533171(364801/81/4)) lseek err Invalid argument
file_pread(5,1,buffer,5860533218(364801/81/51)) lseek err Invalid argument
file_pread(5,1,buffer,5860533239(364801/82/9)) lseek err Invalid argument
file_pread(5,1,buffer,5860533289(364801/82/59)) lseek err Invalid argument
file_pread(5,1,buffer,5860535202(364801/113/19)) lseek err Invalid argument
file_pread(5,14,buffer,5860533156(364801/80/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533170(364801/81/3)) lseek err Invalid argument
file_pread(5,3,buffer,5860533217(364801/81/50)) lseek err Invalid argument
file_pread(5,8,buffer,5860533233(364801/82/3)) lseek err Invalid argument
file_pread(5,11,buffer,5860533280(364801/82/50)) lseek err Invalid argument
file_pread(5,2,buffer,5860535202(364801/113/19)) lseek err Invalid argument
file_pread(5,14,buffer,5860533157(364801/80/53)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,2,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533171(364801/81/4)) lseek err Invalid argument
file_pread(5,3,buffer,5860533218(364801/81/51)) lseek err Invalid argument
file_pread(5,8,buffer,5860533234(364801/82/4)) lseek err Invalid argument
file_pread(5,11,buffer,5860533281(364801/82/51)) lseek err Invalid argument
file_pread(5,2,buffer,5860535203(364801/113/20)) lseek err Invalid argument
file_pread(5,14,buffer,5860533158(364801/80/54)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,3,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533172(364801/81/5)) lseek err Invalid argument
file_pread(5,3,buffer,5860533219(364801/81/52)) lseek err Invalid argument
file_pread(5,8,buffer,5860533235(364801/82/5)) lseek err Invalid argument
file_pread(5,11,buffer,5860533282(364801/82/52)) lseek err Invalid argument
file_pread(5,2,buffer,5860535204(364801/113/21)) lseek err Invalid argument
file_pread(5,14,buffer,5860533159(364801/80/55)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,4,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533173(364801/81/6)) lseek err Invalid argument
file_pread(5,3,buffer,5860533220(364801/81/53)) lseek err Invalid argument
file_pread(5,8,buffer,5860533236(364801/82/6)) lseek err Invalid argument
file_pread(5,11,buffer,5860533283(364801/82/53)) lseek err Invalid argument
file_pread(5,2,buffer,5860535205(364801/113/22)) lseek err Invalid argument
file_pread(5,14,buffer,5860533160(364801/80/56)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,5,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533174(364801/81/7)) lseek err Invalid argument
file_pread(5,3,buffer,5860533221(364801/81/54)) lseek err Invalid argument
file_pread(5,8,buffer,5860533237(364801/82/7)) lseek err Invalid argument
file_pread(5,11,buffer,5860533284(364801/82/54)) lseek err Invalid argument
file_pread(5,2,buffer,5860535206(364801/113/23)) lseek err Invalid argument
file_pread(5,1,buffer,5860533177(364801/81/10)) lseek err Invalid argument
file_pread(5,1,buffer,5860533224(364801/81/57)) lseek err Invalid argument
file_pread(5,1,buffer,5860533245(364801/82/15)) lseek err Invalid argument
file_pread(5,1,buffer,5860533295(364801/83/2)) lseek err Invalid argument
file_pread(5,1,buffer,5860535208(364801/113/25)) lseek err Invalid argument
file_pread(5,14,buffer,5860533162(364801/80/58)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,7,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,3,buffer,5860533176(364801/81/9)) lseek err Invalid argument
file_pread(5,3,buffer,5860533223(364801/81/56)) lseek err Invalid argument
file_pread(5,8,buffer,5860533239(364801/82/9)) lseek err Invalid argument
file_pread(5,11,buffer,5860533286(364801/82/56)) lseek err Invalid argument
file_pread(5,1,buffer,5860535209(364801/113/26)) lseek err Invalid argument
file_pread(5,1,buffer,5860533179(364801/81/12)) lseek err Invalid argument
file_pread(5,1,buffer,5860533226(364801/81/59)) lseek err Invalid argument
file_pread(5,1,buffer,5860533247(364801/82/17)) lseek err Invalid argument
file_pread(5,1,buffer,5860533297(364801/83/4)) lseek err Invalid argument
file_pread(5,1,buffer,5860535210(364801/113/27)) lseek err Invalid argument
file_pread(5,14,buffer,5860533164(364801/80/60)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,8,buffer,5860533170(364801/81/3)) lseek err Invalid argument
file_pread(5,3,buffer,5860533178(364801/81/11)) lseek err Invalid argument
file_pread(5,3,buffer,5860533225(364801/81/58)) lseek err Invalid argument
file_pread(5,8,buffer,5860533241(364801/82/11)) lseek err Invalid argument
file_pread(5,11,buffer,5860533288(364801/82/58)) lseek err Invalid argument
file_pread(5,1,buffer,5860535211(364801/113/28)) lseek err Invalid argument
file_pread(5,10,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,5860533181(364801/81/14)) lseek err Invalid argument
file_pread(5,1,buffer,5860533228(364801/81/61)) lseek err Invalid argument
file_pread(5,1,buffer,5860533249(364801/82/19)) lseek err Invalid argument
file_pread(5,1,buffer,5860533299(364801/83/6)) lseek err Invalid argument
file_pread(5,1,buffer,5860535212(364801/113/29)) lseek err Invalid argument
file_pread(5,14,buffer,5860533166(364801/80/62)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,5860533179(364801/81/12)) lseek err Invalid argument
file_pread(5,3,buffer,5860533180(364801/81/13)) lseek err Invalid argument
file_pread(5,3,buffer,5860533227(364801/81/60)) lseek err Invalid argument
file_pread(5,8,buffer,5860533243(364801/82/13)) lseek err Invalid argument
file_pread(5,11,buffer,5860533290(364801/82/60)) lseek err Invalid argument
file_pread(5,1,buffer,5860535213(364801/113/30)) lseek err Invalid argument
file_pread(5,12,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,1,buffer,5860533183(364801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,5860533230(364801/81/63)) lseek err Invalid argument
file_pread(5,1,buffer,5860533251(364801/82/21)) lseek err Invalid argument
file_pread(5,1,buffer,5860533301(364801/83/8)) lseek err Invalid argument
file_pread(5,1,buffer,5860535214(364801/113/31)) lseek err Invalid argument
file_pread(5,1,buffer,5860533184(364801/81/17)) lseek err Invalid argument
file_pread(5,1,buffer,5860533231(364801/82/1)) lseek err Invalid argument
file_pread(5,1,buffer,5860533252(364801/82/22)) lseek err Invalid argument
file_pread(5,1,buffer,5860533302(364801/83/9)) lseek err Invalid argument
file_pread(5,1,buffer,5860535215(364801/113/32)) lseek err Invalid argument
file_pread(5,1,buffer,5860533168(364801/81/1)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,2,buffer,5860533181(364801/81/14)) lseek err Invalid argument
file_pread(5,1,buffer,5860533185(364801/81/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533232(364801/82/2)) lseek err Invalid argument
file_pread(5,8,buffer,5860533246(364801/82/16)) lseek err Invalid argument
file_pread(5,11,buffer,5860533293(364801/82/63)) lseek err Invalid argument
file_pread(5,1,buffer,5860535216(364801/113/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860533169(364801/81/2)) lseek err Invalid argument
file_pread(5,14,buffer,5860533170(364801/81/3)) lseek err Invalid argument
file_pread(5,1,buffer,5860533186(364801/81/19)) lseek err Invalid argument
file_pread(5,1,buffer,5860533233(364801/82/3)) lseek err Invalid argument
file_pread(5,1,buffer,5860533254(364801/82/24)) lseek err Invalid argument
file_pread(5,1,buffer,5860533304(364801/83/11)) lseek err Invalid argument
file_pread(5,1,buffer,5860535217(364801/113/34)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partitions can't be recovered:
MS Data 5763073943 11623341974 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
MS Data 5860532223 11720800254 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
MS Data 264192 5860532223 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
MS Data 2899091090 2900484517 1393428 [tDc§ƒŽSbÐY§_]
cramfs, 713 MB / 680 MiB
MS Data 3162874256 3168501556 5627301 [¬­÷@àŠÇºÒÖ?šR½ ç]
cramfs, 2881 MB / 2747 MiB

MS Data 264192 5860532223 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery

The EFI GPT partition table is ok.
Run TestDisk, Advanced, select the last partition, Boot, BackupBS, confirm, Quit and restart your computer.
Once it's done, use "chkdsk /f d:" (right click run as administrator, replace d: by the correct drive letter). What is the result ?

Hi CG and thanks for replying.

As I was at a loss on how to proceed, I tried some things with 'active partition recovery'.
I tried its 'fix boot sector' option and it copied the boot sector over from a backup. Now all copies look the same. Then I tried to 'recover' the partitions and it gave me the following: I tried to chkdsk but it would say 'Unable to determine volume version and state. CHKDSK aborted.'
So I followed the instructions and deleted the volume in acronis disk director.
Then I came back to 'active partition recovery', loaded my previous saved scan and it recovered the partition.
For the first time I can see the folder structure shown, but the drive is marked 'BAD'. In windows explorer, I get 'The parameter is incorrect.' instead of 'format the drive' which I remember getting (i think).

Disk management still shows this as a single RAW partition.

This is how I recovered the volume after I deleted it.
This is where I stand before receiving your post.

I will now follow your instructions.
I will reboot and try chkdsk again and report back to you.

After a reboot i run it:
C:\Windows\system32>chkdsk d: /f
The type of the file system is NTFS.
Unable to determine volume version and state. CHKDSK aborted.

Bear in mind that even though I could see some folder structure in 'APR', i cannot see it now when I double click D inside that application.
Some thing is still bad.
I wait your instructions and thanks again.