2

I have a 5TB WD Elements external USB disk, which was formatted as a single 5TB NTFS partition without about 4TB of files. It's not a bootable disk. It stopped mounting, so I pulled it apart and docked it on my HD dock to see if the drive is alive - it is, and I have since determined that the internal sata-to-usb mount inside the WD case is dead.

I only have mac m1 (running 14.4.1) to recover on, as my win10 pc motherboard recently died in a separate incident, so I haven't got a way to run chkdsk or see if Windows knows what to do with it.

I have determined that the disk is alive but the partition map seems to be corrupt. I grabbed a demo copy of "Disk Drill" and it thought the drive had a 256GB NTFS partition, and the rest was "Unpartition space". I did a quick scan on both partitions anyway and it found hundreds of thousands of files in the unpartitioned space. Cool. Disk Drill won't recover the partition though, only allow me to copy files by type - ugh!

I got the latest TestDisk (7.2) and got that going. I could explore into the partitions and see the expected file structure. It also thinks there are two partitions on the disk. I'd like to modify the partitions so that there is only the one 5TB NTFS partition and see if that can mount. I said 'save backup' at this point.

I'm at the Partition screen showing the sectors with start, end and size. Here's what that looks like:

screen grab of testdisk terminal

I have tried to follow https://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair but it's assuming I know what I'm doing, and I kinda have some vague ideas but I'm certainly no expert and don't want to lose the drive data if I can help it.

I selected a partition (the big one) and Analysed it, and it tells me there is a 'Bad starting sector'.

screen grab of testdisk terminal - analyse

After analysis it mentions that the heads per cylinder is 1 but it might be 128 and to use the geometry menu to edit it. I don't know how I would get to this 'menu', so I hit enter to continue and now it shows the partition map is OK, the partition is Primary, and the start is 2048 and end is 9767475199.

partition map after analysis

If I write this to the partition map, what happens to any data between 256 and 1220934399 (from the first screen grab)? - is there data there? are those numbers just a glitch and ultimately meaningless?

Should I press Write and see what happens? Is there a way to then restore the backup I saved earlier when the disk was broken, and do something different?

Just for funsies I did an advanced search, and it thinks there's more partitions. But i've never use fat on this disk: NTFS was the default partition format when I bought the drive, so I left it alone.

advanced search

I don't have the space to write a full image of the drive.

Improve this question
5
  • 2
    First things first, write nothing... "I have determined that the disk is alive but the partition map seems to be corrupt" - are you confident? Some USB to SATA adapters will present 4k sectors for 512B disks, making them "look corrupt" when accessed natively as 512B disks - connecting via a similar adapter can make things "look fine". (Conversely, it could be the dock being non-standard, not the original adapter)
    – Attie
    Commented May 23 at 11:31
  • 1
    I’m voting to close this question because you're asking for crash-course partition recovery. You're all over the place.
    – Joep van Steen
    Commented Jun 22 at 11:24
  • The partitions in 2nd image can not co-exist, one of them is wrong. You analyze the one starting at LBA and it does not have valid BS, so probably this one is wrong. You're clueless, you shouldn't be doing this.
    – Joep van Steen
    Commented Jun 22 at 11:25
  • 1
    Thanks Joel for considering that incompetent people aren't allowed the possibility of developing skills, much appreciated.
    – frumbert
    Commented Jun 23 at 22:00
  • The risks involved to your data are significant when you are trying to learn on a non-standard custom/weird setup like this. Given that you could come back here with "I followed your instructions but now all my data is irretrievably gone", this isn't really the sort of situation where you want to learn at the level you appear to be at currently. Writing a full image of the drive is THE key to minimizing potential issues enough to mitigate this risk.
    – music2myear
    Commented Jun 25 at 18:52

1 Answer 1

Reset to default
0

The vast majority of recovery isn't designed to repair the damage, but to copy the data to another drive because of the dangers of overwriting something important. Advanced software that cost money like RStudio and GetDataBack and hundreds of other packages exist that will display the files in a nice GUI. Though I have used these packages I have not done enough of recovery to say these software packages are better than other products.

Should I press Write and see what happens? Is there a way to then restore the backup I saved earlier when the disk was broken, and do something different?

I advise against this because if you mess up, it will definitely make things worse.

This will only backup the first 1000 sectors, but typically the partition tables are stored in less than 10 sectors.

dd if=/dev/sdb of=/foldername/backup.img bs=512 count=1000

Where /dev/sdb has to be replaced with the alternative drive designation.

If you accidently put the wrong thing after of= you could definitely make things worst. If you did of=/dev/sda you would probably wipe out your macOS.

If you needed to restore the backup

dd if=/foldername/backimg  of=/dev/sdb bs=512

Here the count is auto-detected based on file size.

Warning!!! Caution If you specify the macos drive accidently you will lose your macos.

The only truly safe option is to used test disk or similar to scrape the files off onto your MacOS storage drive or a different external drive.

If I write this to the partition map, what happens to any data between 256 and 1220934399 (from the first screen grab)? - is there data there?

The computer will interpret it as a single partition, be we have no way of know if this is correct or not. If there were actually 2 partitions there it will likely display gibberish when listing the files. There maybe seems to be some legit files present but they maybe be corrupt or partially corrupt.

As a person with 30 years of IT experience the cost of a new 5tb drive doesn't justify the risk to your data, especially given the presence of bad sectors.

The most sane way is to use ddrescue to clone the data to another drive and then you can test whatever you need on the copy of the drive with no additional risk to your data.

Improve this answer
1
  • I've marked this as the answer, since it contains the phrasing in bold, and this is what I've learned from this experience. I was able to (quite slowly), scrape the various sets of data that I'd wanted to keep (after writing my new guess of the bytes per sector, against recommendations). After reformatting/verifying drive, it had no bad sectors. The fault originated with the sata-to-usb mount pcb inside the enclosure.
    – frumbert
    Commented Jun 23 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .