ST3000DM001 GPT Partition problem

[zyx]

Hello,

i am trying to recover a Seagate ST3000DM001, after the 2.7TB GPT partition got crashed. I am not sure what really happened. I had the hdd running on a WindowsXP 64bit System for a while, did some copy jobs when suddenly the Hdd didnt respond. After a reboot, the hdd showed up healthy in the Hdd management, but with no gpt partition and asked for a reformat of the disk.

So i am forced to start my own personal career as recovery specialist

This is what i did so far:

Googled for some recovery and test programs. I discovered soon that there aren't too many gpt recovery tools out there. The most posts pointed me to the testdisk solutions, so i gave it a shot.

First i started photorec and it soon discovered zip files. So i bought another ST3000DM001 for a bit to bit copy per dd. DD gave me no error message so it seems, that i have an exact copy of the broken one.


Testdisk gave me the following error message:


Crashed Disk:

Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM001-9YN166, FW:CC4C

Partition table type (auto): Intel
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM001-9YN166
Partition table type: Intel

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable


New Drive:

Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM001-9YN166, FW:CC4B

Partition table type (auto): Intel
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM001-9YN166
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1565565871 (expected 1565565871)
hdr_lba_start=34
hdr_lba_end=1565565838
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Bad GPT partition entries, invalid checksum.


Then i let testdisk do a deeper search on the new drive with the result that there were directories found, but i only can browse them to the 2nd subdir and there are no files displayed.

This is the point where i stuck and where i need help. What would you advise me to do? If you need any further information, please don't bother asking me.

Any help would be appreciated and thanks in advance!

[lcoughey]

Clone the drive first....then play with the clone.

[zyx]

I did that already:

So i bought another ST3000DM001 for a bit to bit copy per dd.

[labtech]

"DD gave me no error message so it seems, that i have an exact copy of the broken one. "

Confirm this in some hex editor by comparing data content between the original and clone first, otherwise you could be wasting your time.

[zyx]

would you be so kind to point me to a program or procedure for that, thanks!

[mr_spokk]

Winhex is good program, open both drives and compare.

[zyx]

thx for the fast answer i installed winhex, opened both disk and now i should choose tools/compute hash, and then checksum 64bit ?

[labtech]

thx for the fast answer i installed winhex, opened both disk and now i should choose tools/compute hash, and then checksum 64bit ?

Well, that's more complicated.

Use the sync and compare function in viewing drives side by side.

[zyx]

ok, opened both drives and then under view synchronize and compare. And then?

Sorry for the inconvenience, but i never worked with winhex

[labtech]

Look and scroll up and down side by side at the content.

If there is shading, then the contents are different, thus the clone is not a complete image of the source.

If no shading, then they are the same, which would mean the clone is a complete copy, thus dd function completed the process successfully.

[zyx]

thanks, now i got it

After a quick sample search it seems that there are "only" two differences:

At the beginning of the Disk:

Code:

0000001FE   55 AA 45 46 49 20 50 41  52 54 00 00 01 00 5C   UªEFI PART    \
00000020D   00 00 00 6E E8 1D 81 00  00 00 00 01 00 00 00      nè        
00000021C   00 00 00 00 AF A3 50 5D  00 00 00 00 22 00 00       ¯£P]    " 
00000022B   00 00 00 00 00 8E A3 50  5D 00 00 00 00 D6 6F        Ž£P]    Öo
00000023A   9A 69 53 CC E1 11 B5 9B  80 6E 6F 6E 69 63 02   šiSÌá µ›€nonic
000000249   00 00 00 00 00 00 00 80  00 00 00 80 00 00 00          €   €   
000000258   D6 C4 2C 28 00 00 00 00  00 00 00 00 00 00 00   ÖÄ,(           


Code:

00000040B   2D F0 02 15 AE 0C A2 27  B5 3D 8D 2A 45 B1 24   -ð  ® ¢'µ=*E±$
00000041A   46 83 D9 23 3E 0B 22 00  00 00 00 00 00 00 21   FƒÙ#> "       !
000000429   00 04 00 00 00 00 00 00  00 00 00 00 00 00 00                 
000000438   4D 00 69 00 63 00 72 00  6F 00 73 00 6F 00 66   M i c r o s o f
000000447   00 74 00 20 00 72 00 65  00 73 00 65 00 72 00    t   r e s e r
000000456   76 00 65 00 64 00 20 00  70 00 61 00 72 00 74   v e d   p a r t
000000465   00 69 00 74 00 69 00 6F  00 6E 00 00 00 00 00    i t i o n     
000000474   00 00 00 00 00 00 00 00  00 00 00 00 A2 A0 D0               ¢ Ð
000000483   EB E5 B9 33 44 87 C0 68  B6 B7 26 99 C7 A2 32   ëå¹3D‡Àh¶·&™Ç¢2
000000492   C0 A4 CD 8E 26 47 AF 0E  9F 81 80 A8 E2 53 00   À¤ÍŽ&G¯ Ÿ€¨âS
0000004A1   08 04 00 00 00 00 00 FF  9F 50 5D 01 00 00 00          ÿŸP]   


and than no differences until the very end of the Disk:

Code:

BAA1475DFE   00 00 45 46 49 20 50 41  52 54 00 00 01 00 5C     EFI PART    \
BAA1475E0D   00 00 00 25 58 C1 8A 00  00 00 00 AF A3 50 5D      %XÁŠ    ¯£P]
BAA1475E1C   00 00 00 00 01 00 00 00  00 00 00 00 22 00 00               " 
BAA1475E2B   00 00 00 00 00 8E A3 50  5D 00 00 00 00 D6 6F        Ž£P]    Öo
BAA1475E3A   9A 69 53 CC E1 11 B5 9B  80 6E 6F 6E 69 63 8F   šiSÌá µ›€nonic
BAA1475E49   A3 50 5D 00 00 00 00 80  00 00 00 80 00 00 00   £P]    €   €   
BAA1475E58   D6 C4 2C 28 00 00 00 00  00 00 00 00 00 00 00   ÖÄ,(           


@ the moment i do a "deeper scan" (forward seach button in winhex) but i am
pretty sure that there will be no further differences. If there are any other ones
found i will report here.

The Pattern "µ›€nonic" catches my attention here. Perhabs the crashed Disk fades
away and gets worse...

[labtech]

You are doing well so far, on the right path.

Seems like you should be able to recover the data.

[zyx]

thanks alot, that's good to hear..

Winhex did found only one difference at the end of the disk, just a few offsets before my last entry in my last post.

It looks like this is linked to the Partition Table at the beginning and the end of the disk, right? I know there is a
backup partition option in testdisk, and i am not sure if i have done this already before i made the bit copy.
I did this a while ago, dont remember for sure

So, what's the next step?

[labtech]

Need some good software to scan with.

You can try for example the demo version of R-Studio. If it finds your files as you please, then you can purchase it the full version and extract the files.

Other examples are DMDE, GDB, etc.

Winhex may work as well, but not sure what kind of license you have for it.

[zyx]

thanks, @ the moment i'm scanning my drive with the demo of R-Studio. I am curious if R-Studio will find more then testdisk and photorec