1

I have two external USB3 HDD drives (2.5", both from Toshiba) that have a bad sector. One drive is sized 500GB, the other is 1TB. Interestingly, both show exactly the same problem:

The partition table is okay, but the drives are not able to read the very first 4kb of the single NTFS partition.

I was able to recover the rest of the drive using ddrescue, but - as said - the PBR is not recoverable.

the ddrescue map file looks like this for both drives:

# Rescue Logfile. Created by GNU ddrescue version 1.16
# Command line: ddrescue -s 1G /dev/sdg TEMP.img TEMP.img.map
# current_pos  current_status
0x00100C00     +
#      pos        size  status
0x00000000  0x00100000  +
0x00100000  0x00001000  -
0x00101000  ...         +

For reference, the partition table of the smaller drive:

# fdisk -l /dev/sdc

Disk /dev/sdc: 500.1 GB, 500107859968 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773164 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x460692ac

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1            2048   976769023   488383488    7  HPFS/NTFS/exFAT

AFAIK any NTFS partition should have a copy of the PBR somewhere, but I'm not able to read (mount) the partition neither with Linux, nor with Windows 7. They claim that the partition is not formatted.

Also tried with "Testdisk", but it is not able to restore the PBR as it can't find the root directory.

I'm experienced with parititioning (MSDOS, GPT) and linux file systems, but not that much with NTFS. Any way to recover that data?

The disks contain mainly photo files (Canon RAW, .CR2 format) and Adobe Lightroom catalogs.

Update

Apparently the 500GB disk is actually formatted in FAT32, even if the partition table claims something else. I guess Windows doesn't really care the partition type and rather looks at the partition contents. When configuring Testdisk to expect a FAT32 LBA partition, then it is able to find the root directory and some subdirs (I think that proves that it's a FAT32 partition). However, Testdisk fails to find the vast majority of the files - no clue why.

As for the 1TB disk: Testdisk does not find any files neither in FAT32 nor in NTFS mode. I'm currently running RecuperaBit in hope that it is able to succeed.

Udo G
  • 125
  • 1
  • 5
  • My answer here will help you: https://superuser.com/a/1165578/278831 (especially the last part with a link to another answer as well) BTW, if the root directory cannot be found, then the damage is more severe than just missing a PBR. – Andrea Lazzarotto Sep 21 '17 at 22:53
  • 1
    Possible duplicate of MBR recovery - Corrupted MBR after it changed to dynamic & testdisk gives up . No backup sector found – Andrea Lazzarotto Sep 21 '17 at 22:53
  • IMHO the MBR is intact (partition table is okay), but rather the PBR is gone, so it may not be related to the MBR recovery question. – Udo G Sep 22 '17 at 08:04
  • Please see my Update. I'm currently running RecuperaBit on the 1 TB partition. – Udo G Sep 22 '17 at 08:04
  • @AndreaLazzarotto: RecuparaBit could not find any partition on the 1TB drive (see https://pastebin.com/PAV9gcdp) - is there a way (in my situation) to detect which filesystem there is (really) on that drive? – Udo G Sep 25 '17 at 13:23
  • have you checked that the image file is truly 1TB? How long did it take to scan it? Could it be that it wasn't NTFS but exFAT? – Andrea Lazzarotto Sep 25 '17 at 17:33
  • the image is 1000204883968 bytes in size. Since the partition table is intact and the Kernel gives direct access to the partition (1000202657792 bytes) I also tried to scan that - same result. It took quite some time (1-2 hours?), but can't tell exactly, since wasn't there all the time. I wish I could tell exactly which filesystem it was. It was either formatted using Windows 10 or used as prepared by the manufacturer. As said, it should contain lots of image files with a common filename pattern (IMG_nnnn.CR2), does this help? Should I be able to find them in plain text within the bin. image? – Udo G Sep 25 '17 at 21:14
  • It appears that the disk is actually formatted in some sort of ext4 filesystem used by Samsung TVs (PVR), which could actually be true. The Kernel won't mount it anyway, but testdisk has no problems listing the files that match the file structure of recorded TV programs. Sorry for wasting your time, I apparently had the wrong assumptions.. – Udo G Sep 25 '17 at 21:35
  • It's OK. Now that we have triaged the problem, please update the question and remove unnecessary references to NTFS. Does testdisk solve your problem? – Andrea Lazzarotto Sep 26 '17 at 11:37

0 Answers0