cgsecurity.org

Hello,
hope you can help:
I have 2 x 3 TB hdd in a Raid 0; external (/dev/sda). I had 2 partitions on it: 1: 2 TB NTFS and 2: 4 TB NTFS. The 4 TB is encrypted by VeraCrypt. Few days ago this RAID showd up in Win 7 as a single unallocated disk that wanted to be initialized. I did not touch it but tried to recover the partitions with TestDisk.
TestDisk found the Raid, I made a backup of the current partitions structure and run Quick Search. It found 2 partitions that I meant to be correct and wrote that structure. But the written structure turns out to be not correct. (I did not care about: "The harddisk seems too small")
What can I do ?
Is it possible:
1) get back to the beginning by loading the backup.log?
2) if 1) should work can I "cut" the size of partition 2 in order that it fits to the disk? (Partition 1 seems to be fine... I see my files in it)

Hope you can help.

Best Regards
Mike

The log:

Tue Mar 27 16:39:30 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=6001185947648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=5999999975424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000469553152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=6001185947648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=5999999975424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000469553152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104847611392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=41948927488
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=41940671488
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1887436800000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=693467034624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=314571751424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=5999863529472
Hard disk list
Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63, sector size=512 - JMB352 RAID-0, S/N:2020202057202d4443573443364e564b46353845
Disk /dev/sdb - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 850 PRO 512G, S/N:S2BENWAJ610401R, FW:EXM0
Disk /dev/sdc - 5999 GB / 5587 GiB - CHS 729458 255 63, sector size=512 - AMD 2+0 Stripe/RAID0, S/N:2503bc080000000000000000000000000000000000000000, FW:1.10
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 182393 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 182393 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Drive G: - 1887 GB / 1757 GiB - CHS 114733 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Drive H: - 693 GB / 645 GiB - CHS 42154 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Drive U: - 104 GB / 97 GiB - CHS 6374 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Drive V: - 314 GB / 292 GiB - CHS 19122 255 63, sector size=1024 - AMD 2+0 Stripe/RAID0, S/N:d4ea1e5ac3ac000000000000000000000000000000000000, FW:1.10
Drive Z: - 5999 GB / 5587 GiB - CHS 3128548864 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 6001 GB / 5589 GiB - JMB352 RAID-0
Partition table type: Intel

Analyse Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Backup partition structure
partition_save

search_part()
Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 370200064
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
NTFS, blocksize=4096, 758 GB / 706 GiB
file_pread(4,2,buffer,3131131903(729602/164/34)) lseek err Invalid argument
file_pread(4,1,buffer,3131131903(729602/164/34)) lseek err Invalid argument
Search for partition aborted

Results
* HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
NTFS, blocksize=4096, 758 GB / 706 GiB

interface_write()
1 * HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 370200064
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
NTFS, blocksize=4096, 758 GB / 706 GiB
BAD_RS LBA=2533452001 12578014
check_part_i386 failed for partition type 01
FAT12 157700 23 53 370827 116 37 3423891099
BAD_RS LBA=3152906992 10655592
file_pread(4,1,buffer,3152906992(730958/20/55)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 730958 20 55 997169 85 20 4276683776
This partition ends after the disk limits. (start=11742841584, size=4276683776, end=16019525359, disk end=11721066304)
file_pread(4,2,buffer,3131131903(729602/164/34)) lseek err Invalid argument
file_pread(4,1,buffer,3131131903(729602/164/34)) lseek err Invalid argument
file_pread(4,2,buffer,3131131904(729602/164/35)) lseek err Invalid argument
file_pread(4,14,buffer,3131131906(729602/164/37)) lseek err Invalid argument
file_pread(4,3,buffer,3131131920(729602/164/51)) lseek err Invalid argument
file_pread(4,3,buffer,3131131967(729602/165/35)) lseek err Invalid argument
file_pread(4,8,buffer,3131131983(729602/165/51)) lseek err Invalid argument
file_pread(4,11,buffer,3131132030(729602/166/35)) lseek err Invalid argument
file_pread(4,2,buffer,3131133952(729602/197/4)) lseek err Invalid argument
Disk /dev/sda - 6001 GB / 5589 GiB - CHS 729602 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 8201 GB / 7638 GiB)
The following partition can't be recovered:
HPFS - NTFS 730958 20 55 997169 85 20 4276683776

Results
* HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
NTFS, blocksize=4096, 758 GB / 706 GiB
P FAT12 157700 23 53 370827 116 37 3423891099

interface_write()
1 * HPFS - NTFS 16 113 34 92191 254 31 1480800256 [Backup]
2 P FAT12 157700 23 53 370827 116 37 3423891099
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

As you had 2 partitions and you have created the backup.log file where a single raw partition was listed, this file is useless.
Try EFI GPT partition table instead of PC Intel.
After Quick Search, manually add an NTFS partition starting after the first NTFS, with some luck, it will be the correct location of your VeraCrypt partition.
Set the partition as P(rimary). On next screen, choose Write, confirm, Quit and restart your computer.
If it doesn't work, try http://sourceforge.net/projects/testcrypt/
Good luck

Thank you for your answer.
I am just giving it a try. This Quick Search seems to take a VERY long time: about 1 second per cylinder, and approx. 630000 cylinders to be read...
Best Regards
Mike

Quick search did finish, finally.
When I try to add a ntfs partition I have to enter a number for the size (in sectors) of the new partition. But I do not have no idea which number to enter here. Could you please help once more?
Regards
Mike