cgsecurity.org

Posted: **22 Feb 2019, 01:12**

well... this one has me drawing a blank. the last time i unplugged the hdd it was fine. did safe removal (even though i dont need to). but now i put it into my new computer build and all of a sudden the drive is split into 2 partitions. 1 is 2048gb raw. and the other is 1678.02gb unallocated this is a 4tb drive. of windows is saying the disk has to be formatted 1st. and i cant do anything to the unallocated space. i have about 1.5ish tb of data i believe.

ive read the testdisk manual and im confused. bc the options it has dont match what i see. i do have the quick search scan and then the deeper scan (running now) and its coming back with fat16 invalid boot fat12 invalid boot...ect pretty sure i had the hdd formatted as ntfs.

it also said something about mismatched size and to check the jumpers and bois setting... i have checked the bois. and it sees the drive as a 4tb and all the info like manf. serial number ect. the drive itself i do not see any jumpers on?

can someone please help me.

Posted: **22 Feb 2019, 07:03**

When you scan the disk, choose EFI GPT instead of PC Intel.
Can you copy/paste the testdisk.log file content ?

Posted: **22 Feb 2019, 13:02**

update: didnt want to waste a post with the update but i didnt realize the efi scan was so slllooooowwwwww. itll probably be an overnight scan

ill do the new scan after work. heres the testdisk.log. i believe it only shows the quick scan. bc at the end of the log i posted what i see in the tool after the deep scan.

Thu Feb 21 18:34:05 2019
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249481396224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199022206976
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30331 255 63, sector size=512
Drive D: - 2199 GB / 2047 GiB - CHS 267349 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 4000 GB / 3726 GiB
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248

fat1x_boot_sector
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
No partition is bootable

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
file_pread(5,1,buffer,3519070207(486401/86/21)) lseek err Invalid argument
file_pread(5,1,buffer,3519070208(486401/86/22)) lseek err Invalid argument
file_pread(5,14,buffer,3519070209(486401/86/23)) lseek err Invalid argument
file_pread(5,3,buffer,3519070223(486401/86/37)) lseek err Invalid argument
file_pread(5,3,buffer,3519070270(486401/87/21)) lseek err Invalid argument
file_pread(5,8,buffer,3519070286(486401/87/37)) lseek err Invalid argument
file_pread(5,11,buffer,3519070333(486401/88/21)) lseek err Invalid argument
file_pread(5,2,buffer,3519072255(486401/118/53)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248

fat1x_boot_sector
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
No partition is bootable

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
file_pread(5,1,buffer,3519070207(486401/86/21)) lseek err Invalid argument
file_pread(5,1,buffer,3519070208(486401/86/22)) lseek err Invalid argument
file_pread(5,14,buffer,3519070209(486401/86/23)) lseek err Invalid argument
file_pread(5,3,buffer,3519070223(486401/86/37)) lseek err Invalid argument
file_pread(5,3,buffer,3519070270(486401/87/21)) lseek err Invalid argument
file_pread(5,8,buffer,3519070286(486401/87/37)) lseek err Invalid argument
file_pread(5,11,buffer,3519070333(486401/88/21)) lseek err Invalid argument
file_pread(5,2,buffer,3519072255(486401/118/53)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63

test_FAT()
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
1 P FAT16 >32M 0 32 33 267349 89 4 4294965248
No partition is bootable

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
BAD_RS LBA=843518476 7716552
check_part_i386 failed for partition type 04
FAT16 <32M 52506 152 11 115174 132 42 1006760192
BAD_RS LBA=2693512726 13101410
check_part_i386 failed for partition type 0B
FAT32 435012 194 21 581280 53 11 2349786528
This partition ends after the disk limits. (start=6988480022, size=2349786528, end=9338266549, disk end=7814037168)
BAD_RS LBA=40349630 783733
check_part_i386 failed for partition type 01
FAT12 269860 254 25 342571 88 5 1168091738
file_pread(5,2,buffer,3519070208(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,3519070208(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,3519070207(486401/86/21)) lseek err Invalid argument
file_pread(5,14,buffer,3519070209(486401/86/23)) lseek err Invalid argument
file_pread(5,3,buffer,3519070223(486401/86/37)) lseek err Invalid argument
file_pread(5,3,buffer,3519070270(486401/87/21)) lseek err Invalid argument
file_pread(5,8,buffer,3519070286(486401/87/37)) lseek err Invalid argument
file_pread(5,11,buffer,3519070333(486401/88/21)) lseek err Invalid argument
file_pread(5,2,buffer,3519072255(486401/118/53)) lseek err Invalid argument
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 4781 GB / 4452 GiB)
The following partition can't be recovered:
FAT32 435012 194 21 581280 53 11 2349786528

Results
L FAT16 <32M 52506 152 11 115174 132 42 1006760192
L FAT12 269860 254 25 342571 88 5 1168091738
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * FAT16 <32M 52506 152 11 115174 132 42 1006760192
2 E extended LBA 269860 0 1 342571 254 63 1168118280
5 L FAT12 269860 254 25 342571 88 5 1168091738

deep scan results that were on the tool window:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
The harddisk (4000 GB / 3726 GiB) seems too small! (< 4781 GB / 4452 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
FAT32 435012 194 21 581280 53 11 2349786528
HPFS - NTFS 448335 112 30 515107 143 49 1072694153
> FAT12 474843 120 61 567795 106 52 1493272990
[ Continue ]
764 GB / 712 GiB

Posted: **23 Feb 2019, 18:13**

ok so the scan has been going for 16 hours and is only 14% done... do i need to let it run the whole scan?? heres what on the screen right now...nvm idk what i did but appearemtly the scan stopped and the info is gone. the testdisk. log says this.... which was on the scan but on the scan also was this

Fri Feb 22 19:44:46 2019
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249481396224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199022206976
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30331 255 63, sector size=512
Drive D: - 2199 GB / 2047 GiB - CHS 267349 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 4000 GB / 3726 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

ms data 250323635 252859836 2536201 [^D*4^Y~K~A/m\^G

Posted: **23 Feb 2019, 23:18**

restarted the scan just to get this info. the computer is off till someone replys.

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Analyse cylinder 17333/486400: 03%
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster
MS Data 250323635 252859836 2536201 [^D*4^Y~K~A/m\^G M-$ 34]

cgsecurity.org

4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.

4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.

Re: 4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.

Re: 4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.

Re: 4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.

Re: 4tb hdd, split into 2 pats., 1 raw, 1 unaloc. i didnt do.