Primarily I'm looking for:
Details of what TestDisk means by "Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)"
Analysis or suggestions regarding what probably went wrong and how to best undo/recover from it.
Suggestions on good (preferably free) software tools for partition / disk editing and recovery
But any ideas, information or suggestions on how to best deal with this would be appreciated.
Responses that boil down to giving up (hire a data recovery company, restore from backups, you can't recover from this, etc) are not going to be productive. I just started this process and have recovered data under much worse conditions in the past so I'm not going to give up on this after only a couple hours. The circumstances are different and I'm very unfamiliar with current tools though which is why I'm seeking advice.
I have a 6 TB drive using GUID partition structure that contained 1 small reserved and 1 large NTFS partition. Windows stopped recognizing these and was displaying the entire disk as RAW in Disk Management. TestDisk could see the partitions (it displayed the reserved one twice) and could even list the files on the NTFS partition.
After having TestDisk write the partition data the NTFS partition is now displayed as Unallocated in Disk Management and even TestDisk can not display the file contents! I think it wrote the wrong partition data for the NTFS partition (see the before & after backup logs below).
Decided its best to stop making changes and seek advice before proceeding.
I've got a 6 TB RAID 5 disk in my home server that's using HighPoint RocketRAID card. The power supply on the system died and it was off-line for awhile. Just replaced the power supply and everything seems fine except the 6TB drive now appears as RAW in Windows Disk Management instead of containing my NTFS data volume. The OS (Windows Server 2012 Standard) was on a different drive and boots fine.
Tried several recovery software tools to get the partition and/or data back. Both TestDisk (open source) and Active Partition Recovery (commercial) could see the partitions (1 small reserved, 1 large data) and could list my files. I paid for Active Partition Recovery and tried it since it seemed the most straight forward to use. Unfortunately it stopped during the restore partition process one prompt after where it requires a commercial license saying it can't recover the partition because its already active or live or something. Completely bogus, I'll be seeking a refund or a charge back (FYI).
TestDisk after running Analyze over night displayed a list of my files then allowed me to perform data recovery. I've discovered that you can "stop" the Analyze once it displays the partitions (which is almost immediate) instead of leaving it to run multiple hours which doesn't seem to change its results. I'm guessing / hoping that's fine to do because I updated to version 7 of TestDisk (was running 6.12), ran analyze again and stopped it to proceed.
TestDisk could have copied the data to a different location. Unfortunately I don't have 6 TB of disk space available to copy the data off so I tried writing the partitions and fixing it in-place. When I got to the repair partition options I had it "Write" the partition data to disk. It completed and said I needed to reboot to see the changes.
After rebooting Windows Disk Management now displays 2 small partitions and 1 big chunk of unallocated space. This is obviously wrong and the NTFS data is not accessible at all. Even TestDisk can't display the file contents and now shows "Can't open filesystem. Filesystem seems damaged." after performing Analyze.
Below is all of the relevant information I can think of which might help resolve this issue. I'm very experienced with system administration and such but have no experience with TestDisk and haven't had to manipulate / recover partitions in 10+ years so I'm stale and my memory is fuzzy on the topic.
Any advice or help would be greatly appreciated. If there are other tools that would help me recover the data I'm open to that (as long as they aren't expensive, though free would be preferred).
1406052104 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
1 : start= 34, size= 262144, Id=00, P
2 : start= 264192, size=3130388480, Id=00, P
1406053772 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
1 : start= 2048, size= 204800, Id=00, P
2 : start= 206848, size=125829120, Id=00, P
I didn't write it down but the entire drive showed as a single RAW entry
Disk 3, Basic, 5588.81 GB, Online
100 MB RAW, Healthy (Primary Partition)
60 GB RAW, Healthy (Primary Partition)
5528.71 GB, Unallocated
I didn't save this. I believe it displayed the 1st reserved partition twice (with identical start and stop positions) and then the NTFS partition once. It also displayed number of bytes per sector mismatches warnings and I believe the numbers were the same before and after.
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER
http://www.cgsecurity.org
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
Current partition structure:
Partition Start End Size in sectors
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
This is a RAID 5 disk implemented in hardware using a HighPoint RocketRAID card. RAID is configured using the card, not in Windows Disk Management. So Windows just sees this as a single large 6 TB drive and the fact that its a hardware RAID should be irrelevant.
Note that this is the complete log containing multiple runs. The run that performed the write begins with Tue Jul 22 11:27:07 2014 or just search for "write!"
Tue Jul 22 11:26:54 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
SIGINT detected! TestDisk has been killed.
Tue Jul 22 11:27:07 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
Partition table type (auto): EFI GPT
Disk /dev/sdd - 6000 GB / 5588 GiB - HPT DISK 0_0
Partition table type: EFI GPT
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Backup partition structure
partition_save
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
gpt_change_part_type
Change partition type:
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
P NTFS 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_load
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63 Tue Jul 22 11:29:32 2014
1 P Unknown 2048 206847 204800
2 P Unknown 206848 126035967 125829120
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
write!
No extended partition
You will have to reboot for the change to take effect.
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
gpt_change_part_type
Change partition type:
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
P NTFS 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63 sector_size=2048
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
file_pread(7,4,buffer,3130703844(729575/254/60)) lseek err Invalid argument
Bad GPT partition, invalid signature.
Trying alternate GPT
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
NTFS at 0/8/9
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 512 51711 51200
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 3/55/53
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 512 51711 51200
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Data 512 51711 51200
2 P MS Data 51712 31508991 31457280
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63 sector_size=512
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
simulate write!
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
No comments:
Post a Comment