FILESYSTEM REPAIR - REBUILDING BOOT SECTOR STUCK

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
medinacha
Posts: 1
Joined: 04 Dec 2019, 16:34

FILESYSTEM REPAIR - REBUILDING BOOT SECTOR STUCK

#1 Post by medinacha »

Im trying to recover all data stored on my 1tb WD external hdd. Windows file explorer wont allow me to get to my drive folders, returning an error msg "Incorrect parameter", Ive tried using chkdsk but it doesnt work in which prompted me to use testdisk. Luckily, testdisk was able to view all the drive's folder (advanced tab->list files) and was able to copy some of my jpeg files but the problem was it was very slow so I canceled it. I was worried that there are stored malware on the device and it causes my hard disk to be slow.

Due to my inexperience,impatience and incompetence, I decided to format my external hard disk drive using cmd code I found online using windows diskpart tool. I clean the drive and created a primary partition and formatted it into NTFS but an error appeared that the format was unsuccessful. I was hoping that after formatting the external hdd I would be able to recover the folders I formatted, I went to the advanced tab and clicked on the list files/folders and it returned a msg that my filesystem was damaged.

My activities with test disk so far:
  • I went to advanced tab->boot->rebuild bs *problem was it was stuck and the pointer is not moving so I have cancelled it. went to the log file and found file_pread(5,16,buffer,18410759(1146/4/18)) ReadFile Data error (cyclic redundancy check).
  • I decided to use ddrescue-gui for windows but it wont let me use a different device to store the image file of my damage external hard drive.
    Went back on using testdisk to create an image *problem was the pointer is not moving at some point.
    log file error: $MFT has invalid magic.ntfs_mft_load(): Failed.Failed to load $MFT: Input/output error.Failed to startup volume: Input/output error.

Will rebuilding the boot sector and using photorec after on the image recover my files?

Image creation on testdisk is ongoing but theres no progress at all :cry: , Any tips to avoid being stuck ?


Image

Image


log files:

TestDisk 7.2-WIP, Data Recovery Utility, November 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999022075392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000199946240
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ04ABF100, S/N:19CGSTU9S, FW:JU0C0J
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - WD Elements 1042, S/N:WXC1E33FVJX3, FW:1022

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WD Elements 1042
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 215 23 1953515520
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63
NTFS at 0/32/33
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 215 23 1953515520
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953519616(121600/247/56)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953519616(121600/247/56)) ReadFile The drive cannot find the sector requested.

file_pread(5,2,buffer,1953519656(121600/248/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953519656(121600/248/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953519679(121600/248/56)) lseek err Invalid argument
file_pread(5,1,buffer,1953519679(121600/248/56)) lseek err Invalid argument
file_pread(5,2,buffer,1953519719(121600/249/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953519719(121600/249/33)) lseek err Invalid argument
file_pread(5,8,buffer,1953519616(121600/247/56)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953519616(121600/247/56)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953519617(121600/247/57)) lseek err Invalid argument
file_pread(5,14,buffer,1953519618(121600/247/58)) lseek err Invalid argument
file_pread(5,3,buffer,1953519632(121600/248/9)) lseek err Invalid argument
file_pread(5,3,buffer,1953519679(121600/248/56)) lseek err Invalid argument
file_pread(5,8,buffer,1953519695(121600/249/9)) lseek err Invalid argument
file_pread(5,11,buffer,1953519742(121600/249/56)) lseek err Invalid argument
file_pread(5,2,buffer,1953521664(121601/25/25)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 121600 215 23 1953515520
NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
1 P HPFS - NTFS 0 32 33 121600 215 23 1953515520

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121600 255 63
NTFS at 0/32/33
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 215 23 1953515520
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,16,buffer,968704(60/76/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,968704(60/76/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,968703(60/76/16)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,968705(60/76/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,968705(60/76/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,968706(60/76/19)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,1003583(62/119/57)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,1003583(62/119/57)) ReadFile Data error (cyclic redundancy check).

and so on


TestDisk 7.2-WIP, Data Recovery Utility, November 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Top
User avatar
cgrenier
Site Admin
Posts: 5441
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: FILESYSTEM REPAIR - REBUILDING BOOT SECTOR STUCK

#2 Post by cgrenier »

There are bad sectors. You should clone your disk to a new empty disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk from your computer and try TestDisk, Advanced, RebuildBS, List on the clone.
If it doesn't work, use PhotoRec to recover your data. It will not recover the original filenames but it's better than nothing.
Top
Locked

Return to “Filesystem repair”