Seagate 3TB Partition Recovery

[silentdth]

Hi There,

I am trying to recover a partition on my Seagate 3TB.
There is one partition spanning the entire disk.
It was formatted in windows, with EFI using default options.

Selecting The drive, choosing 'EFI' and then Analyzing, testdisk discovers a partition table of type MS Data. There is an error message showing 'number of bytes per sector mismatches 1024 (NTFS) != 512 (HD)'.
The files do list without a problem.

Writing the partition table to the disc and rebooting, shows the filesystem as RAW in windows and inaccessible. testdisk can still list the files.

test version 6.14 WIP, windows, 32 bit.

Mon Jul 30 20:34:20 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, July 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-07-28T12:34:33
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500103643136
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:2020202020202020202020203153304654323441, FW:CC4C
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:2020202057202d4443575741315a363939333033, FW:80.00A80
Disk /dev/sdc - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSC2CT120A3, S/N:5643504d3232343136305747323142304e472020, FW:300i
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320NS, S/N:2020202020202020202020205139324d36394841, FW:SN04

Partition table type (auto): EFI GPT
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM001-9YN166
Partition table type: EFI GPT

Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 1024 (NTFS) != 512 (HD)
1 P MS Data 264192 5860532223 5860268032 [SEAGATE_3TB]

search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 1024 (NTFS) != 512 (HD)
filesystem size 2930134016
sectors_per_cluster 4
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 5860532223 5860268032 [SEAGATE_3TB]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(4,2,buffer,1565566976(364801/98/34))

After this there are a whole lot of errors(3 shown here, about 200 of these):

lseek err Invalid argument
file_pread(4,1,buffer,1565567341(364801/104/21)) lseek err Invalid argument
file_pread(4,1,buffer,1565567342(364801/104/22))

Thanks for any help in advance

[Fiona]

Has your disk been an external disk and you use it internally?
Some large disks have 4 KB sectors.
To use it externally almost doesn't cause any problem, but internally, advanced formatted disks make the BIOS believe that the sector size only has 512 Bytes, so that the disk can be used as a bootable using Intel MBR.
That's why it's possible that your message is wrong.
But something important is to check your windows disk management console, like your disk ist listed.
Basic disk means Intel MBR, GPT disks is dedicated to support disks larger than 2.2TB.
But often windows doesn't actualize it correctly.
That's why it's also very important in disk management console to right click your little quadrat at the left from your disk.
Your context menu will pop up.
If there is a description to convert your disk to MBR means it's already GPT.
If there is a description that your disk can be converted to GPT, you'll have the wrong disk type (for disks larger than 2.2 TB).
This can cause exactly your behavior.
Recovering is different, because you can only convert a disk, if there is no volume on it.
As long as a disk contains a volume you can't highlight it and convert it to GPT.

Please provide the required info from your disk management console.
Until then, don't change anything to your disk where you're not absolutely sure..
Infos will follow.

Fiona

[silentdth]

Hi Fiona,

Thanks for your reply.

To answer your questions:

1. Has your disk been an external disk and you use it internally?
A: No, it's only ever been used internally.

2. If there is a description that your disk can be converted to GPT, you'll have the wrong disk type (for disks larger than 2.2 TB).
A: There is no option to convert to GPT. Only a greyed out option to Convert to MBR. If I look at the properties of the disk (by right click the quadrant on the left) and choose volumes, it shows GPT. Capacity shown is 2,861,588MB.

[silentdth]

Hi Fiona,

Would love some further help with this - would screenshots help?

Thanks

[Fiona]

Start TestDisk.
Confirm at "Create a Log" with enter.
Select your affected disk and press enter.
If partition table Type EFI GPT is not predefined, please choose it and press enter.
Don't confirm at Analyse but Advanced.
If the menu "Boot" is not available please check the menu Type and hit enter.
In some cases the partition was still listed as MS Data.
In case just check it and change it to NTFS.
Afterwards you'd be able to use the menu "Boot" to diagnose your boot sector.
Then, confirm at Boot with enter also.
Please upload a screen!
If your backup of your boot sector is ok, you can check "Type" and have a try to list your data.
Highlight Rebuild BS and hit Enter.
Rebuild your BS will be in progress.
Normally, it takes some minutes.
Large disks might take a bit longer.
If it's finished, please post the infos or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, did you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

Fiona

[Laurent44]

Hi, I have the same problem : i have a Seagate 3Tb HDD and i cannot access to it anymore although it was not victim of any shock. My mistake was probably to have unplugged it once from its USB 3.0 plug (I use the disk as an external unit) with my laptop running on win 7 x64 family premium).
For the moment, i have tried many softwares and none of them manages to recover my partition (the whole disk actually because i did not split it into several partitions, which is not very clever i confess !).
So, testdisk is performing a quick search on the disk which may take around 20 hours. And then, i am not sure i will be able to recover my data. Anyone can help me ? Thanks. Last precision : the disk is detected twice in windows manage disks, and in testdisk too (3000 GB / 2794 GiB).