Hello,

i am trying to recover a Seagate ST3000DM001, after the 2.7TB GPT partition got crashed. I am not sure what really happened. I had the hdd running on a WindowsXP 64bit System for a while, did some copy jobs when suddenly the Hdd didnt respond. After a reboot, the hdd showed up healthy in the Hdd management, but with no gpt partition and asked for a reformat of the disk.

So i am forced to start my own personal career as recovery specialist

This is what i did so far:

Googled for some recovery and test programs. I discovered soon that there aren't too many gpt recovery tools out there. The most posts pointed me to the testdisk solutions, so i gave it a shot.

First i started photorec and it soon discovered zip files. So i bought another ST3000DM001 for a bit to bit copy per dd. DD gave me no error message so it seems, that i have an exact copy of the broken one.


Testdisk gave me the following error message:


Crashed Disk:

Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM001-9YN166, FW:CC4C

Partition table type (auto): Intel
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM001-9YN166
Partition table type: Intel

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable


New Drive:

Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000DM001-9YN166, FW:CC4B

Partition table type (auto): Intel
Disk /dev/sdb - 801 GB / 746 GiB - ST3000DM001-9YN166
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1565565871 (expected 1565565871)
hdr_lba_start=34
hdr_lba_end=1565565838
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Bad GPT partition entries, invalid checksum.


Then i let testdisk do a deeper search on the new drive with the result that there were directories found, but i only can browse them to the 2nd subdir and there are no files displayed.

This is the point where i stuck and where i need help. What would you advise me to do? If you need any further information, please don't bother asking me.

Any help would be appreciated and thanks in advance!

Clone the drive first....then play with the clone.

_________________
Luke
Recovery Force Data Recovery

I did that already:

"DD gave me no error message so it seems, that i have an exact copy of the broken one. "

Confirm this in some hex editor by comparing data content between the original and clone first, otherwise you could be wasting your time.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

would you be so kind to point me to a program or procedure for that, thanks!

Winhex is good program, open both drives and compare.

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se

thx for the fast answer i installed winhex, opened both disk and now i should choose tools/compute hash, and then checksum 64bit ?

Well, that's more complicated.

Use the sync and compare function in viewing drives side by side.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

ok, opened both drives and then under view synchronize and compare. And then?

Sorry for the inconvenience, but i never worked with winhex

Look and scroll up and down side by side at the content.

If there is shading, then the contents are different, thus the clone is not a complete image of the source.

If no shading, then they are the same, which would mean the clone is a complete copy, thus dd function completed the process successfully.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

thanks, now i got it

After a quick sample search it seems that there are "only" two differences:

At the beginning of the Disk:





and than no differences until the very end of the Disk:



@ the moment i do a "deeper scan" (forward seach button in winhex) but i am
pretty sure that there will be no further differences. If there are any other ones
found i will report here.

The Pattern "µ›€nonic" catches my attention here. Perhabs the crashed Disk fades
away and gets worse...

You are doing well so far, on the right path.

Seems like you should be able to recover the data.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

thanks alot, that's good to hear..

Winhex did found only one difference at the end of the disk, just a few offsets before my last entry in my last post.

It looks like this is linked to the Partition Table at the beginning and the end of the disk, right? I know there is a
backup partition option in testdisk, and i am not sure if i have done this already before i made the bit copy.
I did this a while ago, dont remember for sure

So, what's the next step?

Need some good software to scan with.

You can try for example the demo version of R-Studio. If it finds your files as you please, then you can purchase it the full version and extract the files.

Other examples are DMDE, GDB, etc.

Winhex may work as well, but not sure what kind of license you have for it.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

thanks, @ the moment i'm scanning my drive with the demo of R-Studio. I am curious if R-Studio will find more then testdisk and photorec