0

I am attempting to recover an external hard drive. It is western digital (like always).

Force mounting does not work:

user@linux:/home/user# mount -t vfat /dev/sdb1 /media/test1 -o force,umask=000
mount: /media/test1: wrong fs type, bad option, bad superblock on /dev/sdb1, missing codepage or helper program, or other error.

I get IO Errors when I attempt to run gparted. If I try to boot with the drive attached to the system, linux freezes. Gparted crashes also:

enter image description here

fdisk -l output:

Disk /dev/sdb: 1.84 TiB, 2000365289472 bytes, 3906963456 sectors
Disk model: My Passport 2626
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 8AD8DA33-56D1-4E2D-A00D-AB61AC3863C0

Device     Start        End    Sectors  Size Type
/dev/sdb1   2048 3906961407 3906959360  1.8T Microsoft basic data

lsblk output:

NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
loop0    7:0    0  50.7M  1 loop /snap/snap-store/481
loop1    7:1    0 217.9M  1 loop /snap/gnome-3-34-1804/60
loop2    7:2    0   2.2M  1 loop /snap/gnome-system-monitor/148
loop3    7:3    0 140.7M  1 loop /snap/gnome-3-26-1604/100
loop4    7:4    0  55.4M  1 loop /snap/core18/1932
loop5    7:5    0  97.8M  1 loop /snap/core/10185
loop6    7:6    0  62.1M  1 loop /snap/gtk-common-themes/1506
sda      8:0    0 232.9G  0 disk 
├─sda1   8:1    0   512M  0 part /boot/efi
└─sda2   8:2    0 232.4G  0 part /
sdb      8:16   0   1.8T  0 disk 
└─sdb1   8:17   0   1.8T  0 part

Testdisk output:

enter image description here

enter image description here

enter image description here

enter image description here enter image description here

Log:

Tue Jun  8 22:18:42 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.9.0-050900-lowlatency (#202010112230 SMP PREEMPT Sun Oct 11 22:37:09 UTC 2020) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, LBA48 support
/dev/sda: size       488397168 sectors
/dev/sda: user_max   488397168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - GB0250EAFYK, S/N:WCAT1H963933, FW:HPG2
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 2626, FW:1028
Disk /dev/loop0 - 53 MB / 50 MiB - 103776 sectors (RO), sector size=512
Disk /dev/loop1 - 228 MB / 217 MiB - 446248 sectors (RO), sector size=512
Disk /dev/loop2 - 2273 KB / 2220 KiB - 4440 sectors (RO), sector size=512
Disk /dev/loop3 - 147 MB / 140 MiB - 288064 sectors (RO), sector size=512
Disk /dev/loop4 - 58 MB / 55 MiB - 113384 sectors (RO), sector size=512
Disk /dev/loop5 - 102 MB / 97 MiB - 200168 sectors (RO), sector size=512
Disk /dev/loop6 - 65 MB / 62 MiB - 127160 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Passport 2626
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                     2048 3906961407 3906959360 [My Passport]
Current partition structure:
check_FAT: can't read FAT boot sector
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                     2048 3906961407 3906959360 [My Passport]
 1 P MS Data                     2048 3906961407 3906959360 [My Passport]

Testdisk then hangs when attempting to "Quick Search" for the partition.

chkdsk does not see the filesystem: enter image description here

What I did next is I copied the data onto a second external hard drive using gddrescue. This is an amazing piece of software that was able to deal with the I/O Errors:

enter image description here

After I left gddrescue running on the drive for several days, it was able to recover most of the data, and copied what was on the broken disk (sdb) to the new one (sdc). Thank you to the developers for this amazing piece of software.

I then ran photorec (thank you to Christophe Grenier, the developer) on the new disk, and it recovered most of the files: enter image description here

However, the directory (folder) structure is obviously not-recovered by photorec. As a result, there is a hundred folders with lots of photos and other files spread around.

I would still like to recover the folder structure if possible in addition to the files. I then ran testdisk on the new disk. A quick partition search only reveals the original partition that was on the disk before I copied the data off of the broken disk using gddrescue to it. After a deep partition search, I see a number of various partitions. I have no idea why there are HFS+ partitions on the disk besides the fact that the disk was used with a mac computer recently:

enter image description here

Tesdisk presents me with the following partitions after the deep search is concluded. The second partition was the one that was originally on the new drive to which the data was copied: enter image description here

What should I try next to recover the partitions? I believe the drive was FAT32, as it was used on both windows and Mac. I do not believe it was formatted to be HFS+ unless my friend, whose data this is, did so accidentally.

Please advise!

Cross-posted: https://serverfault.com/questions/1068013/hard-drive-recovery-i-o-error-bad-partition-table-and-filesystem

Improve this question
6
  • 3
    The disk seems to be in very bad shape, perhaps unrecoverable. Try this strange advice: Package the disk well against humidity (add some anti-humidity material even rice) and put it in the deep-freeze for an hour. Then take out and try. If it works, you will only have a short time for saving your data.
    – harrymc
    Jun 9, 2021 at 8:55
  • 1
    To add to the comment above from harrymc, this has saved me a few times, but if you do get it to read, make sure you copy off everything that you can. It sounds like this hard drive is very much at the end of its life
    – Randomhero
    Jun 9, 2021 at 10:34
  • thanks @harrymc and Randomhero. I will see to doing the freezer thing, but I never have attempted it in the past and I am worried about damaging it further. The drive belongs to a friend who asked me to try and get the data off, so I am reluctant to try anything out of the ordinary. Worst case it goes to the lab. I want to try running GNU ddrescue next.
    – stackOverFlew
    Jun 9, 2021 at 15:35
  • Just remember that any minute that it's turned on can be its last one. Don't leave it turned on unnecessarily. On the other hand, turning it off/on too many times is also damaging.
    – harrymc
    Jun 9, 2021 at 16:53
  • RAW is like unformatted. Often from a damaged PBR or BS, partition boot sector or Boot Sector.NTFS has to have its info in the PBR. If you installed grub to PBR, then also valid, but wrong for NTFS. If corrupted or damaged it is seen as RAW and then even Windows chkdsk will not work. Testdisk can restore a BS/PBR if backup valid or create a new BS which may be Windows XP type and you have to run chkdsk & fixboot from newer Windows to update. You have to run chkdsk from Windows anyway. help.ubuntu.com/community/BootSectorFix Try recover of backup & then chkdsk from Windows or rebuild.
    – oldfred
    Jun 9, 2021 at 19:38

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.