3

Primarily I'm looking for:

  • Details of what TestDisk means by "Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)"

  • Analysis or suggestions regarding what probably went wrong and how to best undo/recover from it.

  • Suggestions on good (preferably free) software tools for partition / disk editing and recovery

But any ideas, information or suggestions on how to best deal with this would be appreciated.

Responses that boil down to giving up (hire a data recovery company, restore from backups, you can't recover from this, etc) are not going to be productive. I just started this process and have recovered data under much worse conditions in the past so I'm not going to give up on this after only a couple hours. The circumstances are different and I'm very unfamiliar with current tools though which is why I'm seeking advice.

Quick Summary

I have a 6 TB drive using GUID partition structure that contained 1 small reserved and 1 large NTFS partition. Windows stopped recognizing these and was displaying the entire disk as RAW in Disk Management. TestDisk could see the partitions (it displayed the reserved one twice) and could even list the files on the NTFS partition.

After having TestDisk write the partition data the NTFS partition is now displayed as Unallocated in Disk Management and even TestDisk can not display the file contents! I think it wrote the wrong partition data for the NTFS partition (see the before & after backup logs below).

Decided its best to stop making changes and seek advice before proceeding.

Complete Details

I've got a 6 TB RAID 5 disk in my home server that's using HighPoint RocketRAID card. The power supply on the system died and it was off-line for awhile. Just replaced the power supply and everything seems fine except the 6TB drive now appears as RAW in Windows Disk Management instead of containing my NTFS data volume. The OS (Windows Server 2012 Standard) was on a different drive and boots fine.

Tried several recovery software tools to get the partition and/or data back. Both TestDisk (open source) and Active Partition Recovery (commercial) could see the partitions (1 small reserved, 1 large data) and could list my files. I paid for Active Partition Recovery and tried it since it seemed the most straight forward to use. Unfortunately it stopped during the restore partition process one prompt after where it requires a commercial license saying it can't recover the partition because its already active or live or something. Completely bogus, I'll be seeking a refund or a charge back (FYI).

TestDisk after running Analyze over night displayed a list of my files then allowed me to perform data recovery. I've discovered that you can "stop" the Analyze once it displays the partitions (which is almost immediate) instead of leaving it to run multiple hours which doesn't seem to change its results. I'm guessing / hoping that's fine to do because I updated to version 7 of TestDisk (was running 6.12), ran analyze again and stopped it to proceed.

TestDisk could have copied the data to a different location. Unfortunately I don't have 6 TB of disk space available to copy the data off so I tried writing the partitions and fixing it in-place. When I got to the repair partition options I had it "Write" the partition data to disk. It completed and said I needed to reboot to see the changes.

After rebooting Windows Disk Management now displays 2 small partitions and 1 big chunk of unallocated space. This is obviously wrong and the NTFS data is not accessible at all. Even TestDisk can't display the file contents and now shows "Can't open filesystem. Filesystem seems damaged." after performing Analyze.

Below is all of the relevant information I can think of which might help resolve this issue. I'm very experienced with system administration and such but have no experience with TestDisk and haven't had to manipulate / recover partitions in 10+ years so I'm stale and my memory is fuzzy on the topic.

Any advice or help would be greatly appreciated. If there are other tools that would help me recover the data I'm open to that (as long as they aren't expensive, though free would be preferred).

TestDisk Backup.log (before)

1406052104 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
 1 : start=       34, size=   262144, Id=00, P
 2 : start=   264192, size=3130388480, Id=00, P

TestDisk Backup.log (after)

1406053772 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
 1 : start=     2048, size=   204800, Id=00, P
 2 : start=   206848, size=125829120, Id=00, P

Windows Disk Management (before)

I didn't write it down but the entire drive showed as a single RAW entry

Windows Disk Management (after)

Disk 3, Basic, 5588.81 GB, Online
100 MB RAW, Healthy (Primary Partition)
60 GB RAW, Healthy (Primary Partition)
5528.71 GB, Unallocated

TestDisk Analyze display output (before) *

I didn't save this. I believe it displayed the 1st reserved partition twice (with identical start and stop positions) and then the NTFS partition once. It also displayed number of bytes per sector mismatches warnings and I believe the numbers were the same before and after.

TestDisk Analyze display output (after) *

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 1 P MS Data                     2048     206847     204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 2 P MS Data                   206848  126035967  125829120

Hardware RAID

This is a RAID 5 disk implemented in hardware using a HighPoint RocketRAID card. RAID is configured using the card, not in Windows Disk Management. So Windows just sees this as a single large 6 TB drive and the fact that its a hardware RAID should be irrelevant.

TestDisk log file

Note that this is the complete log containing multiple runs. The run that performed the write begins with Tue Jul 22 11:27:07 2014 or just search for "write!"

Tue Jul 22 11:26:54 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00

SIGINT detected! TestDisk has been killed.



Tue Jul 22 11:27:07 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00

Partition table type (auto): EFI GPT
Disk /dev/sdd - 6000 GB / 5588 GiB - HPT DISK 0_0
Partition table type: EFI GPT
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
 2 P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB

Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 1 P MS Data                     2048     206847     204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 2 P MS Data                   206848  126035967  125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Backup partition structure
partition_save

search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted

Results
   P MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
gpt_change_part_type
Change partition type:
   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
   P NTFS                      206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB

   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_load
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63 Tue Jul 22 11:29:32 2014
 1 P Unknown                     2048     206847     204800
 2 P Unknown                   206848  126035967  125829120

interface_write()
 1 P MS Data                     2048     206847     204800
 2 P MS Data                   206848  126035967  125829120
write!
No extended partition
You will have to reboot for the change to take effect.



Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 1 P MS Data                     2048     206847     204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 2 P MS Data                   206848  126035967  125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted

Results
   P MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB

   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
gpt_change_part_type
Change partition type:
   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
   P NTFS                      206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB

interface_write()
 1 P MS Data                     2048     206847     204800
 2 P MS Data                   206848  126035967  125829120
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63 sector_size=2048

Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
file_pread(7,4,buffer,3130703844(729575/254/60)) lseek err Invalid argument
Bad GPT partition, invalid signature.
Trying alternate GPT
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
NTFS at 0/8/9
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                      512      51711      51200
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 3/55/53
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                    51712   31508991   31457280
     NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted

Results
   P MS Data                      512      51711      51200
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P MS Data                    51712   31508991   31457280
     NTFS, blocksize=4096, 64 GB / 60 GiB

   P MS Data                    51712   31508991   31457280
     NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P MS Data                      512      51711      51200
 2 P MS Data                    51712   31508991   31457280
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63 sector_size=512

Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 1 P MS Data                     2048     206847     204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 2 P MS Data                   206848  126035967  125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           51200
sectors_per_cluster       2
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size           31457280
sectors_per_cluster       2
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -11
clusters_per_index_record 1
     MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted

Results
   P MS Data                     2048     206847     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB

   P MS Data                   206848  126035967  125829120
     NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P MS Data                     2048     206847     204800
 2 P MS Data                   206848  126035967  125829120
simulate write!

Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 1 P MS Data                     2048     206847     204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
 2 P MS Data                   206848  126035967  125829120
  • 1
    Yeah, I'd bet you've wrecked any change you had of recovering by writing back to the same disk... NEVER do that, as it very likely will overwrite the very thing you're trying to restore. But maybe someone else will have a magic idea, but really, restore from backups (you have backups, riiight?) Alternatively, pack up the drives and send them off to a professional data recovery service to see if they can reconstruct and pull anything from the RAID volume. – Ƭᴇcʜιᴇ007 Jul 22 '14 at 20:19
  • I believe the only thing written would have been the partition tables and maybe boot sector. The data itself, including file system structures, should still be intact. So it should be possible to correct the partition tables and such and get the data back. I'm not sure of the best way to do that however. Professional data recovery is prohibitively expensive. Most of the data does have backups or could be re-obtained but that would take quite a lot of effort and I'd much prefer to recover the data (which is probably newer and may have a bit more than is in the backups). – James Higgins Jul 22 '14 at 20:39
  • You are assuming it wrote the new partition tables to the EXACT same physical spot on the disk surface(s), this is highly unlikely, especially when you introduce RAID into the equation. – Ƭᴇcʜιᴇ007 Jul 22 '14 at 20:42
  • Unless things have greatly changed in the past few years partition data is always written at the exact same position near the beginning of the disk. It has to be in a known location because the partition table is what defines where everything else is. The fact that the underlying storage is RAID should be irrelevant (as mentioned in my post). The data should still be recoverable and, honestly, is probably fairly easy to do if using the right tool & method to do so. Which is why I'm asking. – James Higgins Jul 22 '14 at 20:56
  • RAID is highly relevant when it comes to how/where the data is written, due to the abstraction it adds. I think perhaps you're confusing logical addressing, with physical storage. Address "1A" (made up example address ;) ) isn't guaranteed by any means to end up in the same place on the physical disk surface. once you recover your data, are you going to check each file to ensure they recovered properly, without corruption? If not, then you're better to take them from a known-good backup. Anyhow, I've said my piece, good luck! :) – Ƭᴇcʜιᴇ007 Jul 22 '14 at 21:09
1

Partial answer regarding the warning.

I received the following from the developer of TestDisk: "The boot sector of each NTFS partition contains the information that the disk sector size is 2048 bytes. The Operating System returns a sector size of 512 bytes for this disk."

Which explains part of my problem. I'll have to experiment with the sector size to see if that helps recovering data.

Still looking for advice on tools and best methods to recover data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.