cgsecurity.org

Hi,

I'm not having much success getting any clarification on "check_part_gpt failed for partition". This showed up on my log. I've looked on both the forum here and elsewhere. For as many posts as there are, there seem to be just as many opinions and, none of them very conclusive.

My situation is this, I have a 3 TB external drive that got "zapped". This may have been a power outage, some issue with the USB HDD caddie that I'm using or, it could be a software based issue. I don't think a virus. I was running some trial image prep software and, at around the end of the trial period this drive, hosting all my RAW files got hosed as well as all the images in my laptop drive - just those images form the trail version image prep app.

The issue became apparent after trying to hook up the HDD. On WIN 10, I got the usual error message - something about not recognising the drive and about reformatting drive, etc.

I didn't do that obviously. Now, using TestDisk, I'm trying to figure out what is going on. Compared to other posts on this BB, it doesn't look as though I have very going on? I'm not sure? The thing that has me "confused" is this "check_part_gpt failed for partition".

Here is my log:
<-- BEGINS -->

Sat Dec 28 17:00:59 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=237979566080
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000068874240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000457232384
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM035-1RK172, S/N:WDEJGEDP, FW:SDM3
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - PM961 NVMe SAMSUNG 256GB, S/N:0025_38B6_71B1_63D8., FW:CXB73D1Q
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - USB3.0 , S/N:2017030601EB, FW:0101

Partition table type (auto): EFI GPT
Disk /dev/sdc - 3000 GB / 2794 GiB - USB3.0
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
<-- ENDS -->

At the moment I'm "stuck" in the Analysis cycle - at 78%. Been on this for the past few hours. Not sure whether to stop this or, let it run it's course? As above, there doesn't seem to be much to show. This is what shows up in the CLI console:
<-- BEGIN -->
TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
Analyse cylinder 287690/364800: 78%

MS Data 2048 4294965247 4294963200
Unknown 4392683473 427907147040720 427902754357248 [M3&iTM-7]
Linux filesys. data 4513429586 4515461855 2032269 [?%b^W^QR##^Qg^VM-'&^V]
<-- ENDS-->

Maybe more will show up, who knows? This is my first run.

On the above, have no idea about "Unknown". I'm guessing the numbers thereafter refer to HHD sectors? Not too sure. As for the Linux filesys.data, have no idea from where this comes? Have always used this HDD set up on MS Windows - WIN 10 now and WIN 7 before that. As a BTW, [IMAGE_ARCHIVE_01] is the name of this HDD - so, that's still as it should be.

Any enlightenment on the above and where we go from here would be much appreciated.

Thanks in advance,

Ting

Hi,

I have an external 3 TB HDD whose contents I cannot access. The HDD is attached via USB 3.0 to my laptop running WIN 10.

In the WIN 10 Event Viewer I get this:

A corruption was discovered in the file system structure on volume E:.

The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x1000000000018. The name of the file is "<unable to determine file name>".

It seems that there's a suggestion here that there's something wrong with the MFT file.

Yesterday I installed TestDisk on my WIN 10 machine and ran a Search on that drive. 24 hours later I land up with quite a huge log full of stuff. This is what's at the head of this log:

Sat Dec 28 17:00:59 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=237979566080
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000068874240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000457232384
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM035-1RK172, S/N:WDEJGEDP, FW:SDM3
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - PM961 NVMe SAMSUNG 256GB, S/N:0025_38B6_71B1_63D8., FW:CXB73D1Q
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - USB3.0 , S/N:2017030601EB, FW:0101

Partition table type (auto): EFI GPT
Disk /dev/sdc - 3000 GB / 2794 GiB - USB3.0
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]

search_part()
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 0/32/33
filesystem size 4294963200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=2199021158400, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 4294963200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 4294965247 4294963200
NTFS, blocksize=4096, 2199 GB / 2047 GiB

SYSV4 Marker at 273431/229/32

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 4392683473 427907147040720 427902754357248 [M3&iT·]
SysV4, 219086 TB / 199257 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

cramfs Marker at 280947/254/30

recover_cramfs
Linux filesys. data 4513429586 4515461855 2032269 [?%bÌR##g§&ð]
cramfs, 1040 MB / 992 MiB

SYSV4 Marker at 300979/90/9

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 4835233313 4835233312 0 [šÐÈÿÔ]
SysV4, 0 B
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

SYSV4 Marker at 329999/49/10

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 5301437031 107827335365222 107822033928192 [~ÀU ]
SysV4, 55204 TB / 50208 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
NTFS at 355769/111/55
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=2926303248384, part_size=3000457232384, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 355769/111/55
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 5715436032 11575704063 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5715436032, size=5860268032, end=11575704063, disk end=5860533168)
file_pread(6,1,buffer,1565565872(364801/81/1)) ReadFile The drive cannot find the sector requested.

file_pread(6,1,buffer,1565565873(364801/81/2)) lseek err Invalid argument
[this "file ..... lseek err invalid argument" is repeated for 100s of lines]

This is what is in the tail section of this log:

Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partitions can't be recovered:
MS Data 5715436032 11575704063 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
MS Data 5860532223 11720800254 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
MS Data 2048 4294965247 4294963200
NTFS, blocksize=4096, 2199 GB / 2047 GiB
MS Data 264192 5860532223 5860268032 [IMAGE_ARCHIVE_01]
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Linux filesys. data 4513429586 4515461855 2032270 [?%bÌR##g§&ð]
cramfs, 1040 MB / 992 MiB

interface_write()
1 P MS Data 264192 5860532223 5860268032 [IMAGE_ARCHIVE_01]
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

ntfs_boot_sector
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 16/113/34
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.

ntfs_boot_sector
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 16/113/34
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.

ntfs_boot_sector
2 P MS Data 264192 5860532223 5860268032 [Basic data partition] [IMAGE_ARCHIVE_01]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

As can be observed, there seems to be nothing wrong with this HDD's boot sectors. There seems to be nothing wrong with the MFT. The file structure seems to be intact. In this lot I see something about partitions cannot being recovered. Not too sure what to make of that.

I have "played" with some of the various options in TestDisk but there seems to be little here that relates to anything - this within my limited understanding of these things. Any insights will be most appreciated.

TIA

Ting

IMAGE_ARCHIVE_01 is listed in your partition table, so not need to search for a lost partition.
You need to repair the filesystem. Run "cmd" (right click run as administrator) and use "chkdsk /f d:" (replace d: by the correct drive letter).
If it doesn't work, use PhotoRec.

Hi Christophe,

Thank you so much for your suggestions. I am now sitting here somewhat red faced and embarrassed. Didn't realise the that solution was so simple. No kidding. Not only did you make my day, you made my year.

That said, I could have sworn that I've tried out the solution provided here before but, recall getting the error messages that seemed to suggest all I was doing was going to making a bad situation worse. Hence, the hunt for other third party solutions.

To help others, let me recant my situation. In late 2017 I bought a new laptop. The laptop had a Type C connector to connect up devices using USB 3.0/3.1. In the process, bought a USB 3.x enabled hard drive caddie.

Regarding my own situation, I manage my own 200,000+ digital images archive. To facilitate this, I have all my work on external hard drives. Unless one is streaming video content, USB 3.x might be something of an extravagance. But, if it's there, why not. And, herein lies the rub.

While my laptop and hard drive caddie were USB 3.x enabled and ready, seems like MS was not. I have WIN 10 on this laptop.

Right from the onset I had "issues" with the hard drive caddie - or, so I thought. Initially, there were time out issues - where the unit would just shut down taking the hard drive offline - this after 20 or so minutes of supposed inactivity. I would be editing or prepping an image and, poof, it was gone. The drive was offline. At the time, I recall finding some online solutions. Nothing from MS. The solutions invariably involved going into Device Manager, properties and the registry to do some tweaks there. These would work until the next MS update. With these updates, sometimes things were fixed. At other times, made worse.

In the process, I first lost my 4 TB unit. All the messages were there: while the drive was there, no one was at home, so to speak. Files couldn't be accessed. The drive couldn't be accessed. I'm almost sure I tried CHKDSK and it's options and got the "drive is inaccessible" message, etc. Thereafter I did the run around looking at data recovery options. Events overtook me and, I let things be.

Last year I went to my primary hard drive, a 3 TB unit, to access and edit some of my images. The 4 TB unit was the backup to this 3 TB hard drive. After a short while, the 3 TB unit went much the same way - as in RAW. Time to revisit my research on data recovery applications. I looked at this and looked at that. US$90 - the average price - was a sizeable chunk of money to pony up for something that might or might not work AND, if it was indeed needed as all?

I have to say this, MS has a lot to answer for in this regard. MS has had issues with their USB 3.x drivers on the WIN 10 platform for a long while. I would like to say "significant issues" but, that is me being me. Aside from the "time out" issues - which got "cured" there was another issue. When it came time to "disconnect" the hard drive, this involved having to go into Device Manager. Then, selecting the USB device. Then, right clicking it to uninstall the device. A message then popped up asking you to restart the computer. In the restart process, you could then switch off the caddie.

It has only been in the last couple of mouths where MS seems to have "stabilised" the situation and got all this right at last - where, on the Task Bar, you go to the hidden icons box, right click the USB icon, select the device to remove and that would be that. This is the way it should have been right from the start. But, it wasn't. I also have to add here, that I never had these issues with USB 2.0 connected devices - only ever USB 3.x.

All that said, after the fix posted here, I now have both hard drives up and running and working as they should. If anyone else has had similar issues, I hope this helps?

Thank you again.