Switch to full style
Anything related to computer forensics (new section!)
Post a reply

Repair hdd,partition table & filesys after bitlocker failure

July 21st, 2018, 15:08

Hi guys, I'm new to this forum. I hope you can help me out. :D

My Problem is:

I want to regain a filesystem/ partition table/ my data. Please help me. The data is very important to me!
What happened?

I tried to encrypt a 8TB external hard disk with Bitlocker on Windows 10 (stupid I know!). For unknown reasons the encryption failed. At first I still had access to the data. The next time I connected the external drive it showed only 1404 GB as hard disk size and no data is listed.
Drive info:

The following command (smartmontools):
Code:
smartctl -a /dev/sdb


gives me these details about the hard disk (8 TB Seagate):

Code:
smartctl 6.6 2016-05-31 r4324 [x86_64-linux-4.15.0-23-generic] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Archive HDD
Device Model:     ST8000AS0002-1NA17Z
Serial Number:    Z8414DRB
LU WWN Device Id: 5 000c50 0a46101d3
Firmware Version: AR17
User Capacity:    8.001.563.222.016 bytes [8,00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5980 rpm
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ACS-2, ACS-3 T13/2161-D revision 3b
SATA Version is:  SATA 3.1, 6.0 Gb/s (current: 1.5 Gb/s)
Local Time is:    Sat Jun 23 14:59:41 2018 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Incomplete response, ATA output registers missing
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.

General SMART Values:
Offline data collection status:  (0x82) Offline data collection activity
                    was completed without error.
                    Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0) The previous self-test routine completed
                    without error or no self-test has ever
                    been run.
Total time to complete Offline
data collection:        (    0) seconds.
Offline data collection
capabilities:            (0x7b) SMART execute Offline immediate.
                    Auto Offline data collection on/off support.
                    Suspend Offline collection upon new
                    command.
                    Offline surface scan supported.
                    Self-test supported.
                    Conveyance Self-test supported.
                    Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                    power-saving mode.
                    Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                    General Purpose Logging supported.
Short self-test routine
recommended polling time:    (   1) minutes.
Extended self-test routine
recommended polling time:    ( 960) minutes.
Conveyance self-test routine
recommended polling time:    (   2) minutes.
SCT capabilities:          (0x30b5) SCT Status supported.
                    SCT Feature Control supported.
                    SCT Data Table supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   114   099   006    Pre-fail  Always       -       64318728
  3 Spin_Up_Time            0x0003   090   090   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   098   098   020    Old_age   Always       -       2395
  5 Reallocated_Sector_Ct   0x0033   100   100   010    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   072   060   030    Pre-fail  Always       -       8625048147
  9 Power_On_Hours          0x0032   098   098   000    Old_age   Always       -       2436
10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       22
183 Runtime_Bad_Block       0x0032   100   100   000    Old_age   Always       -       0
184 End-to-End_Error        0x0032   100   100   099    Old_age   Always       -       0
187 Reported_Uncorrect      0x0032   100   100   000    Old_age   Always       -       0
188 Command_Timeout         0x0032   100   099   000    Old_age   Always       -       4295032833
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   068   048   045    Old_age   Always       -       32 (Min/Max 18/35)
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   099   099   000    Old_age   Always       -       2870
193 Load_Cycle_Count        0x0032   098   098   000    Old_age   Always       -       4719
194 Temperature_Celsius     0x0022   032   052   000    Old_age   Always       -       32 (0 16 0 0 0)
195 Hardware_ECC_Recovered  0x001a   114   099   000    Old_age   Always       -       64318728
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       458 (145 49 0)
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       15024331910
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       245421272660617

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.


But if I use
Code:
parted /dev/sdb print

to check the drive, for some strange reason, only 1404 GB are shown:

Code:
Model: ST8000AS 0002-1NA17Z (scsi)
Disk /dev/sdb: 1404GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number  Start   End     Size    Type     File system  Flags
1      1049kB  1404GB  1404GB  primary  ntfs


How can I repair the hard drive/ filesystem/ partition talbe to regain the data?

I have already tried testdisk. But it doesn't recognize more than parted.

Every help is appreciated! Thanks guys!

Re: Repair hdd,partition table & filesys after bitlocker fai

July 21st, 2018, 17:27

Your external enclosure appears to be affected by a 32-bit LBA limitation.

    8 TB - 6 TiB = 1.403 TB

http://www.google.com/search?q=8TB+-+6TiB+in+TB

Did you originally partition and format the drive as an internal HDD? Did you swap enclosures? What did you change, if anything?
Post a reply