I have a challenge restoring the partition on 1 8TB disk:
I have 2 disks with personal docs and working files. Single 8TB partitions are encrypted/formatted with DriveCrypt. A solution originating from the pre-bitlocker time.
Both are 8TB WD Red drives. With matching 8TB backup drives that I sync periodically and store at a different location.
Problem:
After connecting these 2 (source) disks and mounting them I was presented with corruption errors (disk structure corrupted and unreadable).
And, while I'm normally strict on backups, I had not recently backed-up 1 disk. Meaning I now face loosing recent additions and I'm very keen on restoring that work/files given the invested time. Of course that always happens in such cases....
-After connecting and mounting disk1, it gave "structure corrupted". Left it untouched. Dismounted disk1, connected and mounted disk2. Same issue. WTF!!!. Very, very weird. (and scary). Connecting the disks via an external usb3 bay or the internal SATA presents the same errors bytheway.
-I first contacted drivecrypt and they assume hardware/power issues. But both drives are faily new, (still) report no bad sectors and show perfect health in tools. And I don't recall any improper disconnects or power problems while last mounting these disks. Sure, for 1 disk that might have happened without me noticing the last time I had that disk connected. But 2 disks at the same time??!!? So no idea what happened (which I find also tricky not knowing a cause)
What I did/tried allready:
-I was still able to mount both disks properly in DriveCrypt
-Disk1 I was able to correct with checkdisk. It still had missing permissions after that, and somehow a hidden folder. I fixed that and after that all files were restored with original filenames. (and I have a up-to-date backup for Disk1 so that is covered)
-I hopefully expected the same approach with Disk2. So such luck. Checkdisk refused to run and reported NTFS, but "undetermined state". And Disk2 is not back-ed up up-to-date so Disk2 is the problem now.
-Using HDD Raw Copy Tool, I made a sector-by-sector clone of Disk2 disk to a new 8TB drive, and then another clone of the first clone to another new 8TB disk. This to minimize strain on the initial issue/source disk and to test/play with recovery.
After cloning, the clones could be properly mounted with Drivecrypt and showed the same behaviour.
I also tested the cloning on a different (250GB) working disk and the cloning provides properly mountable in DriveCrypt and proper accessible disk contents. So I'm confident this cloning gives me a clone that matches the initial problem disk.
-Both disks were set up with 1 single partition spanning the whole 8TB disk. Partition creation and formatting was done from within DriveCrypt at the time I recall.
So I did not first initialize the disk in Windows Disk Manager with GPT when initially starting to use disks (but setup was quite some time ago)
-Both disks, when working normally/properly, are shown in Windows Disk manager as 1 disk with a 2TB unallocated partition and 5TB unallocated partition. (Suggesting being split up by the MBT 2TB disk limit. Which I always found odd as the disks had 8TB/7.3TB useable capacity in 1 large partition in Windows Explorer)
-Both Disk1, as well as the remaining issue Disk2 now are still listed with this config in WDM (2TB/5TB, unallocated). So nothing different then normally
-I ran several partition/file recovery tools (EaseUS, Drill Disk, DMDE, Active Partition Recovery, Disk Genius, Mini Tool Power Data Recovery, Magic Partition Recovery).
With quickscans, none of those did directly provide a "quick fix/recovery" on partition level such a finding an undeleted partition that I could recover.
-Spread over those tools, they did find multiple filetypes that were offered for recovery (.pst, .ppt, .NEF, .mp3, .mp4, .jpg, .mpg). At first glance, some I could recognize some as being correct in size. For instance, in the past I compressed created holiday movies to 4.3GB .mpg files in order to fit on a DVD back then for storage. One of the recovery tools listed 6 of those files. But not as .mpg but as swf files. Also some .pst, .ppt, .NEF and .mp3 files were found by other tools. All of which with randomized filenames.
-As disk2 contains a large amount of folders and different files, ending up with a recovered container with randomized files will be a big mess to sort out. So not an ideal solution. Also, I feel very few files were found. But I don't know what to be expect in duration. Perhaps 6 files in 20min of scanning for the tools that did find files for recovery.
I did not let these tools finish yet as that seemed to take days for a full scan and I was looking for an idea that recovery would be possible. Gut feeling says only partially and with incorrect filenames .... In other words, a mess...
-I have no problem paying for any of these tools if that enables proper recovery. But I'm not seeing that yet at this moment.
-I have another 8TB WD RED drive which had the exact same partition config. I made a backup of that partition table with Gdisk and restored that one to the issue disk. That resulted in 1 unallocated partioning that asked for formatting. Making the issue worse I think. Re-cloned that one to start over.
-I had testdisk analyse the disk. Tried with None, Intel/PC and with GPT. Testdisk also reported a mismatch between CRC and LBA (?) when choosing Intel/PC.
After 10hours testdisk tool only had 3% analyzed when selecting EFI/GPT and starting Quick Search. I stopped that step to first see if other ways are more efficient.
-In Gdisk I choose to load the backup partition table and save that to the primary table (recovery menu, then c and b).
Loading worked, but then when writing the primary table, it reported that partition entries 125-128 are all too big for the disk, and that 126-128 are all overlapping entry 125. I should delete those entries -> but how???
After the above from the last 2 weeks I'm thinking in the following direction:
-I've never really looked into partition types prior to the last weeks, or dove into the technical background and differences in mbt/gpt.
So I feel I'm now jumping into all directions based on posts and tips on various forums/blogs (eg this one:
https://forum.hddguru.com/viewtopic.php?f=1&t=41040). But none exactly matches my case so I'm just trying to find relations/matching characteristics and solutions that matches my case. In fairness: Normally I consider myself tech savvy, but to be honest in this case I don't know what I'm doing;-) But good to be learning again...
-I'm not shy of doing the technical stuff like working with a hex editor if that would work. However, meddling with partition tables and certainly via a Hex editor is unknown territory for me.
And each time that I screw up a disk with trial and error, it will take another 2 days to re-clone the disk that I can work on for recovery. So I'd like as few screw ups as possible;-)
-Restoring the backup GPT to primary GPT feels promising. But I have no idea how I can delete individual partition entries or adjust it's size. I've saved the partition tables to files (.ptf. .dat .txt) and I think these should be editable, but without knowing what to edit that's doomed to fail.
-In the expectation that the drive contents is still there (as various tools do show files with proper filesizes), would it indeed be possible to copy/clone the partiton table from another (same sized) disk? I did do that as a test and I was presented a success message. But after that, Windows showed just 1 unallocated partion in WDM (with the SRC disk also previously showing 2tB/5TB config in WDM). And DriveCrypt no longer accepted mounting the drive (password was not accepted).
So either I'm doing something wrong with the table restore, or this approach is not possible.
-I am Windows guy, no experience with Linux. I'm willing to setup a Linux VM if that would be really the only way to run certain tools/actions. But preferably not.
-I've attached 3 screens from DMDE: 2 from the info after selecting the physical disk. The 3rd is from the info when choosing logical disk. This shows a weird/corrupt volume name for the issue Disk2.
Hope someone can make sense of the above and help me in the right direction. And please let me know if screens/logs are need to gain more insights in my problem. Thanks in advance!