cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Written into WD My Passport using dd command

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=9973

Page 1 of 1

Written into WD My Passport using dd command

Posted: 06 Apr 2020, 09:46
by prager
Hi,
I'm not that familiar with all the terms, so I hope I can explain properly what happend.

I'm using WD My Passport, and several days ago I ran the command:
""dd if=/dev/sdb of=/dev/sda..."
After about 29GB have been copied, I stopped the process using CTRL + C, as I realised it wasn't just copying the data from one place to another, but over-writting in the process.
I was using a dual-booted computer, having windows 10 & Ubuntu 19.04.

In the last few days I tried recovering files from the external hard disk using PhotoRec.
However, because I over-written the partition info, only some of the disk's storage space partitions were displayed (as EFI partitions).
In the last 20hours testdisk is running (I chose the EFI option), and I wonder what I should do next and did I make the right choice?
I currently planned of following the Documentation's section 8.1 TestDisk: undelete file for FAT, exFAT, ext2.

Re: Written into WD My Passport using dd command

Posted: 06 Apr 2020, 12:42
by cgrenier
Using TestDisk, you should be able to recover the partitions starting after the first 29GB.
If the first partition was an NTFS, TestDisk may be able to find it using the NTFS boot sector (After Analyse, Quick Search and Deeper Search).
If it's the case, choose BackupBS when asked.

Re: Written into WD My Passport using dd command

Posted: 07 Apr 2020, 09:05
by prager
I will try it as soon as the deeper search ends.
Is it normal that it analyses 1 cylinder/second?

When the Quick Search ended it found two partitions starting at 2048, one was the EFI system and the other was the desired My Passport partition (that was missing before).
Perhaps I can post some of the details in the log file for more details, where can I find it?

Re: Written into WD My Passport using dd command

Posted: 07 Apr 2020, 12:13
by recuperation
in the folder with the Testdisk executable file

Re: Written into WD My Passport using dd command

Posted: 07 Apr 2020, 16:02
by prager
The beginning of the log file:

Code: Select all


Sun Apr  5 12:28:07 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=263257587712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26843545600
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-24VHAT0, S/N:WD-WXF1A188YJFZ, FW:02.01A02
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 25E2, S/N:WX71A87798Z4, FW:4004

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Passport 25E2
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Reserved               534528     567295      32768 [Microsoft reserved partition]
check_part_gpt failed for partition
 4 P MS Data                922296320  974725119   52428800 [Basic data partition]
 1 P EFI System                  2048     534527     532480 [EFI system partition]
 2 P MS Reserved               534528     567295      32768 [Microsoft reserved partition]
 3 P MS Data                   567296  514742271  514174976 [Basic data partition]
     NTFS, blocksize=4096, 263 GB / 245 GiB
 6 P Linux filesys. data    678582272  922296319  243714048
 4 P MS Data                922296320  974725119   52428800 [Basic data partition]
 5 P Windows Recovery Env   974725120  976773119    2048000 [Basic data partition]

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Reserved               534528     567295      32768 [Microsoft reserved partition]
check_part_gpt failed for partition
 4 P MS Data                922296320  974725119   52428800 [Basic data partition]
Current partition structure:
 1 P EFI System                  2048     534527     532480 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Reserved               534528     567295      32768 [Microsoft reserved partition]
 2 P MS Reserved               534528     567295      32768 [Microsoft reserved partition]
 3 P MS Data                   567296  514742271  514174976 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 4 P MS Data                922296320  974725119   52428800 [Basic data partition]
 4 P MS Data                922296320  974725119   52428800 [Basic data partition]
 5 P Windows Recovery Env   974725120  976773119    2048000 [Basic data partition]
 6 P Linux filesys. data    678582272  922296319  243714048

search_part()
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048     534527     532480 [EFI System Partition] [SYSTEM_DRV]
     FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 35/79/45
filesystem size           514174976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=290455552, part_size=263257587712, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 35/79/45
filesystem size           514174976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   567296  514742271  514174976
     NTFS, blocksize=4096, 263 GB / 245 GiB

LVM magic value at 32861/156/22
FAT12 at 56345/163/35
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-4
FAT2 : 5-8
start_rootdir : 9
Data : 41-4860
sectors : 4864
cluster_size : 4
no_of_cluster : 1205 (2 - 1206)
fat_length 4 calculated 4
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 56345/163/35
     EFI System             905192728  905197591       4864 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 2490 KB / 2432 KiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/2799, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 91749888
recover_EXT2: part_size 733999104
Filesystem created: Sat Jul 21 10:10:22 2018
     Linux filesys. data   1023724454 1757723557  733999104
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/2799, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 91749888
recover_EXT2: part_size 733999104
Filesystem created: Sat Jul 21 10:10:22 2018
     Linux filesys. data   1143371974 1877371077  733999104
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
NTFS at 243197/25/28
filesystem size           3906959360
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 3906961407 3906959360 [My Passport]
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
NTFS at 243197/25/28
filesystem size           3906959360
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,2,buffer,3913252869(243588/184/58)) lseek err Invalid argument
file_pread(5,1,buffer,3913252869(243588/184/58)) lseek err Invalid argument
NTFS: Can't read MFT
     MS Data               3906961407 7813920766 3906959360
     NTFS, blocksize=4096, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=3906961407, size=3906959360, end=7813920766, disk end=3906963456)
file_pread(5,1,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.
Afterwards I received about 2000 rows along the lines of:

Code: Select all

file_pread(5,1,buffer,3906965505(243197/90/31)) lseek err Invalid argument
and

Code: Select all

file_pread(5,1,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.
Finally, the quick search results:

Code: Select all


The harddisk (2000 GB / 1862 GiB) seems too small! (< 4000 GB / 3725 GiB)
The following partition can't be recovered:
     MS Data               3906961407 7813920766 3906959360
     NTFS, blocksize=4096, 2000 GB / 1862 GiB

Results
     EFI System                  2048     534527     532480 [EFI System Partition] [SYSTEM_DRV]
     FAT32, blocksize=4096, 272 MB / 260 MiB
     MS Data                     2048 3906961407 3906959360 [My Passport]
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
     MS Data                   567296  514742271  514174976
     NTFS, blocksize=4096, 263 GB / 245 GiB
     EFI System             905192728  905197591       4864 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 2490 KB / 2432 KiB
     Linux filesys. data   1023724454 1757723557  733999104
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
     Linux filesys. data   1143371974 1877371077  733999104
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB

interface_write()
 
No partition found or selected for recovery
NTFS filesystem needs to be repaired.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited