Recover a GPT Partition that became RAW in 3T Internal HDD

RFG · 30 Mar 2019

hello jumanji, good afternoon/eve :)

jumanji said:

The devil returns.
...

Check sector 0 of your 3TB drive with bootice. If it is not the same edit the fields as in the above screenshot and save it to disk. Save the sector before editing so that you can restore it if need be.

Using bootice: My post #7 here: Lost partitions!

( I would think that your disk's protective MBR is not corrupted. To my knowledge if the protective MBR is corrupted the whole disk will become RAW.)

Exercise caution to perform this on the correct disk.

To be continued after a break.

OK, i've never used bootice or any other software to edit sectors from HDDs so this is gonna take a while. Let me read your topic about it. I'll return here everytime i have a doubt before i make a new move.

Thanks again for all the explanation, things are more clear to me now. Even so, what do you think that could have caused this corruption?

If this dont work i'll make an approach with a linux distro.

Brb...

OK so the sector 0 of my drive is the same as yours

RFG · 30 Mar 2019

I forgot to mention that bootice only detects my HDD with ~800G... not the full size of 3T

Initial screenshot of Bootice Sector Editor (it's the last pic. of the following uploaded screenshot series)

Next i'm posting screenshots of my 1st and last sectors respectively.

Also the screenshots of my 2nd sector where i can only see MSR Partition table plus 2 data partitions (i cant recognize the 3rd...) and its backup n-33

Then yet the screenshot of sector 264192 that should be the VBR of 1st data partition... but mine looks very different from yours. maybe the size of the disk detected by bootice has some influence in the shown results...

At this stage i am a bit lost...

jumanji · 30 Mar 2019

"Even so, what do you think that could have caused this corruption? " If only I know that I would have resolved the problem in a jiffy

In most cases we do not know what caused the problem.

I have searched the whole web and haven't come across anyone having the same problem. So no precedent also.

Referring to your post #31 sector 0, the circled field in screenshot is 01.

If you look at my screenshot in post #28 (Initialised with Windows Disk Management) and post #29 ( as initialised in the factory) that field is 02. I don't know how significant it is but let us change it. Make sure you are doing it on the right disk - always, always.

Recover a GPT Partition that became RAW in 3T Internal HDD-30-03-2019-21-36-52.jpg

So you will change 01 to 02, editing and writing it with bootice Click on that field. If 0 flashes move it to 1 with right arrow key. Now 1 should flash. Type 2 to overwrite 1. Then click on Save changes icon in the top menu bar. Done. Close bootice and then run it again. View sector 0. Do you see 02 now? Close bootice.

Shut down your PC and then restart to stop all disk processes that may be running. ( if it is an external drive we safely remove it and plug it in again)

Now has that made any difference in your situation?

This is my last post for the day. Rest I shall look tom morning. That will also give time for you read my writeup on using bootice.Good day

RFG · 30 Mar 2019

jumanji said:

...

So you will change 01 to 02, editing and writing it with bootice Click on that field. If 0 flashes move it to 1 with right arrow key. Now 1 should flash. Type 2 to overwrite 1. Then click on Save changes icon in the top menu bar. Done. Close bootice and then run it again. View sector 0. Do you see 02 now? Close bootice.

Shut down your PC and then restart to stop all disk processes that may be running. ( if it is an external drive we safely remove it and plug it in again)

Now has that made any difference in your situation?

This is my last post for the day. Rest I shall look tom morning. That will also give time for you read my writeup on using bootice.Good day

OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?

I already have an Ubuntu Live USB distro, i'm going to boot through there and see whats the output from that approach. i'll keep you informed about my results.

Thanks again jumanji for being patient and for all the help

RFG · 30 Mar 2019

I've comeback with a few more infos...

Finally i've ran Ubuntu Live USB that i already had in a pendrive and it came up with a few errors when running GParted. Meanwhile i'll get the Lucy distro yer suggesting and make the same moves as you suggest. I'll post some shots of that when i've done it.

I had some issues with saving the printscreens so i've took a few shots with my phone, not best quality but i think its enough for the purpose.

After logon with Ubuntu the 1st thing i noticed was that the partition also wasn't listed under the Devices menu.

Next thing i did was to start GParted to analyse my discs. immediatly after open it a first error message poped up claiming "The backup GPT table is not at the end of the disk as it should be. This might mean that another OS believes the disk is smaller. Fix by moving backup to the end and removing the older?" - At this stage i've selected the Ignore option

After this, another pop up window show with the message "Not all of the space available to /dev/sda appears to be used, you can fix the GPT to use all the space or continue with the current setting?" - At this stage i've selected the Ignore option again

Gparted finally opened and detected all my 3T disk as unallocated space. The partition info makes reference to the previous warning messages.

At this time i feel that i should give a try with the fixes proposed by GParted, but before i make a move i'll wait for a few opinions more about this...

jumanji · 30 Mar 2019

"OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?"

No need to restore Sector 0, where we changed 01 t0 02 for that is the way Sector 0, the protective MBR should be.

Yesterday night, I only examined the Sector 0 screenshot and put off examining the the other screenshots for this morning since it was already time to retire.

This morning I examined the the other Bootice screen shots you had put on your screenshots in post#32

My God! Sector 1565565871 - the last sector in the truncated RAW partition shows the presence of a backup of a new GPT header. How come!!!!

Sector n-32, 15655565839 sector shows the presence of a new backup of the partition tables at sector 2. How come!!!!

I am of the opinion that this couldn't have happened on its own accord. To me it would appear that when your first partition turned RAW, an attempt was made to reinitialise it as a GPT drive.

Yes, when you try to access a RAW partition and it is because sector o is corrupted, it would ask you initialise it as an MBR/GPT drive.And it was initialised as a GPT drive.

If you hadn't done it, then forget my accusation

I shall continue after a short break. I am still responding to post #32. I shall now look into your other posts after the break.

jumanji · 30 Mar 2019

I will still take some more time. Do not use Gparted to shift the wrong partition tables backup and wrong Header backup to the end of the drive.That will kill the original correct backups and if that happens or has happened it will be the end of the story.

jumanji · 31 Mar 2019

I have gone through your post#35 now.

As stated earlier Bootice showed bakups of the partition tables and the header. As I said it is an anamoly which needs an explanation.

Gparted also saw that anamoly and since the backups are always at the end of the disk, offered to shift them to the end. It also specified that doing so will remove the old backups. Actually the old backups at the end of the drive are the right ones. Since those are the valid ones you were seeing the second and third partitions.

I only hope that you haven't accepted the fix offered by gparted. If you had done that fix my comment in the previous post holds.

If you confirm that you haven't done the fix, only then we can proceed further.

Linux is used only check whether we could see and access a disk/partition when Windows is not able to see, not to make any fix.

RFG · 31 Mar 2019

jumanji said:

"OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?"

No need to restore Sector 0, where we changed 01 t0 02 for that is the way Sector 0, the protective MBR should be.

Yesterday night, I only examined the Sector 0 screenshot and put off examining the the other screenshots for this morning since it was already time to retire.

This morning I examined the the other Bootice screen shots you had put on your screenshots in post#32

My God! Sector 1565565871 - the last sector in the truncated RAW partition shows the presence of a backup of a new GPT header. How come!!!!

Sector n-32, 15655565839 sector shows the presence of a new backup of the partition tables at sector 2. How come!!!!

I am of the opinion that this couldn't have happened on its own accord. To me it would appear that when your first partition turned RAW, an attempt was made to reinitialise it as a GPT drive.

Yes, when you try to access a RAW partition and it is because sector o is corrupted, it would ask you initialise it as an MBR/GPT drive.And it was initialised as a GPT drive.

If you hadn't done it, then forget my accusation

I shall continue after a short break. I am still responding to post #32. I shall now look into your other posts after the break.

Good afternoon jumanji!

OK, as i said, i have ignored the fix options presented by Ubuntu (at least i do think so :) ).

Although when i first noticed this problem, a couple of weeks ago or so, an auto chkdsk was launched by default after a reboot of windows and i haven't stopped it because the pc restarted and i moved away for a bit and when i looked again, chkdsk was already running. The only thing that happened at that ttime was that chkdsk couldnt finnish its task claiming that the disk was full and couldnt write/recover all the data because of lack of space on the drive, which was strange because the partition wasnt even half full... At that point i needed to do a reboot again. Do you think that in the middle of that procedure the PBR got even more corrupted?

I won't do anything else with linux for now. I've just ran it to check for errors which has only confirmed that something bad messed with my disk.

So, with the actual picture, what should i do next ? Can at least my data be recovered? At this point i'm almost preparing myself to resign...

jumanji · 31 Mar 2019

OK, we don't know what has happened actually that resulted in the new backups at the end of the current RAW partition. It was indeed a jolt for me. Anyway let us see. Worst comes to worst, we can format the entire Disk or only the the RAW partition and attempt data recovery. In such a case the original Master File Table is lost but still Photorec in TestDisk can rebuild the files abinitio. Since MFT is lost you will get only a bunch of files without the original filenames and folder structure if Photorec succeeds in rebuilding the files.that will be the last option.

1. Post a fresh screenshot of Windows Disk Management. ( Just to confirm that we are still in the same condition with which we started.)

2. I am now going back to Partition Wizard - your Post #21 with the screenshot of found partitions after a quick scan.Quick scan did find a valid VBR at sector 264192. ( This VBR could be a new VBR overwriting the original VBR)

Run a quickscan again. When it finds the partitions, please select the second partition by clicking on the square, double click on the second partition (starting LBA 264192 ending LBA 1565565871) that should open the explorer Window showing the files it could see. ( Please refer to image 5 and image 6 in dsperber's
post # 17)

If it shows the folders/files well and good. Post a screenshot. Close the explorer Window. Cancel and close Partiion Wizard.

Do it slowly at your leisure.Absolutely no need to do anything in a hurry. Absolutely no need to keep awake at night.