themaddoctor
commented
1 year ago No. And it appears that you have not found the filesystem.
Open digitalbaron opened 2 years ago
themaddoctor
commented
1 year ago No. And it appears that you have not found the filesystem.
digitalbaron
commented
1 year ago Okay, thanks for clarifying. The TestDisk advanced analysis option completed and provided the following info:
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 2861588 64 32
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6326 GB / 5891 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
> Linux 2826214 0 1 5683371 59 32 5851459456
Linux 2826223 0 1 5683380 59 32 5851459456
Linux 2826232 0 1 5683389 59 32 5851459456
Linux 2826240 0 1 5683397 59 32 5851459456
Linux 2826249 0 1 5683406 59 32 5851459456
Linux 2826258 0 1 5683415 59 32 5851459456
Linux 2826285 0 1 5683442 59 32 5851459456
Linux 2826299 0 1 5683456 59 32 5851459456
Linux 2826303 0 1 5683460 59 32 5851459456
Linux 2826320 0 1 5683477 59 32 5851459456
Linux 2826329 0 1 5683486 59 32 5851459456
Linux 2826338 0 1 5683495 59 32 5851459456
Linux 2826347 0 1 5683504 59 32 5851459456
Linux 2826356 0 1 5683513 59 32 5851459456
Linux 2826365 0 1 5683522 59 32 5851459456
Linux 2826374 0 1 5683531 59 32 5851459456
Linux 2826383 0 1 5683540 59 32 5851459456
Linux 2826392 0 1 5683549 59 32 5851459456
Linux 2826401 0 1 5683558 59 32 5851459456
Linux 2826406 0 1 5683563 59 32 5851459456
Linux 2826416 0 1 5683573 59 32 5851459456
Linux 2826425 0 1 5683582 59 32 5851459456
Linux 2826434 0 1 5683591 59 32 5851459456
Linux 2826443 0 1 5683600 59 32 5851459456
Linux 2826452 0 1 5683609 59 32 5851459456
Linux 2826461 0 1 5683618 59 32 5851459456
Linux 2826470 0 1 5683627 59 32 5851459456
Linux 2826479 0 1 5683636 59 32 5851459456
Linux 2826488 0 1 5683645 59 32 5851459456
Linux 2826497 0 1 5683654 59 32 5851459456
Linux 2826506 0 1 5683663 59 32 5851459456
Linux 2826515 0 1 5683672 59 32 5851459456
Linux 2826524 0 1 5683681 59 32 5851459456
Linux 2826533 0 1 5683690 59 32 5851459456
Linux 2826542 0 1 5683699 59 32 5851459456
Linux 2826551 0 1 5683708 59 32 5851459456
Linux 2826560 0 1 5683717 59 32 5851459456
Linux 2826569 0 1 5683726 59 32 5851459456
Linux 2826578 0 1 5683735 59 32 5851459456
Linux 2826588 0 1 5683745 59 32 5851459456
Linux 2826597 0 1 5683754 59 32 5851459456
Linux 2826606 0 1 5683763 59 32 5851459456
Linux 2826615 0 1 5683772 59 32 5851459456
Linux 2826624 0 1 5683781 59 32 5851459456
Linux 2826633 0 1 5683790 59 32 5851459456
Linux 2826642 0 1 5683799 59 32 5851459456
Linux 2826651 0 1 5683808 59 32 5851459456
Linux 2826660 0 1 5683817 59 32 5851459456
Linux 2826669 0 1 5683826 59 32 5851459456
Linux 2826678 0 1 5683835 59 32 5851459456
Linux 2826687 0 1 5683844 59 32 5851459456
Linux 2826696 0 1 5683853 59 32 5851459456
Linux 2826705 0 1 5683862 59 32 5851459456
Linux 2826714 0 1 5683871 59 32 5851459456
Linux 2826723 0 1 5683880 59 32 5851459456
Linux 2826732 0 1 5683889 59 32 5851459456
Linux 2826741 0 1 5683898 59 32 5851459456
Linux 2826750 0 1 5683907 59 32 5851459456
Linux 2826759 0 1 5683916 59 32 5851459456
Linux 2826769 0 1 5683926 59 32 5851459456
Linux 2826778 0 1 5683935 59 32 5851459456
Linux 2826787 0 1 5683944 59 32 5851459456
Linux 2826796 0 1 5683953 59 32 5851459456
Linux 2826805 0 1 5683962 59 32 5851459456
Linux 2826814 0 1 5683971 59 32 5851459456
Linux 2826823 0 1 5683980 59 32 5851459456
Linux 2826832 0 1 5683989 59 32 5851459456
Linux 2826841 0 1 5683998 59 32 5851459456
Linux 2826850 0 1 5684007 59 32 5851459456
Linux 2826859 0 1 5684016 59 32 5851459456
Linux 2826868 0 1 5684025 59 32 5851459456
Linux 2826877 0 1 5684034 59 32 5851459456
Linux 2826886 0 1 5684043 59 32 5851459456
Linux 2826895 0 1 5684052 59 32 5851459456
Linux 2826904 0 1 5684061 59 32 5851459456
Linux 2826913 0 1 5684070 59 32 5851459456
Linux 2826922 0 1 5684079 59 32 5851459456
Linux 2826931 0 1 5684088 59 32 5851459456
Linux 2826947 0 1 5684104 59 32 5851459456
Linux 2826958 0 1 5684115 59 32 5851459456
Linux 2826972 0 1 5684129 59 32 5851459456
Linux 2826995 0 1 5684152 59 32 5851459456
Linux 2827005 0 1 5684162 59 32 5851459456
Linux 2827025 0 1 5684182 59 32 5851459456
Linux 2827038 0 1 5684195 59 32 5851459456
Linux 2827055 0 1 5684212 59 32 5851459456
Linux 2827059 0 1 5684216 59 32 5851459456
Linux 2827078 0 1 5684235 59 32 5851459456
Linux 2827109 0 1 5684266 59 32 5851459456
Linux 2827113 0 1 5684270 59 32 5851459456
Linux 2827115 0 1 5684272 59 32 5851459456
Linux 2827125 0 1 5684282 59 32 5851459456
Linux 2827145 0 1 5684302 59 32 5851459456
Linux 2827161 0 1 5684318 59 32 5851459456
Linux 2827189 0 1 5684346 59 32 5851459456
Linux 2827197 0 1 5684354 59 32 5851459456
Linux 2827205 0 1 5684362 59 32 5851459456
Linux 2827229 0 1 5684386 59 32 5851459456
Linux 2827236 0 1 5684393 59 32 5851459456
Linux 2827244 0 1 5684401 59 32 5851459456
Linux 2827245 0 1 5684402 59 32 5851459456
Linux 2827251 0 1 5684408 59 32 5851459456
Linux 2827255 0 1 5684412 59 32 5851459456
Linux 2827264 0 1 5684421 59 32 5851459456
Linux 2827267 0 1 5684424 59 32 5851459456
Linux 2827287 0 1 5684444 59 32 5851459456
Linux 2827294 0 1 5684451 59 32 5851459456
Linux 2827319 0 1 5684476 59 32 5851459456
Linux 2827336 0 1 5684493 59 32 5851459456
Linux 2827345 0 1 5684502 59 32 5851459456
Linux 2827346 0 1 5684503 59 32 5851459456
Linux 2827385 0 1 5684542 59 32 5851459456
Linux 2827389 0 1 5684546 59 32 5851459456
Linux 2827390 0 1 5684547 59 32 5851459456
Linux 2827396 0 1 5684553 59 32 5851459456
Linux 2827401 0 1 5684558 59 32 5851459456
Linux 2827403 0 1 5684560 59 32 5851459456
Linux 2827406 0 1 5684563 59 32 5851459456
Linux 2827412 0 1 5684569 59 32 5851459456
Linux 2827443 0 1 5684600 59 32 5851459456
Linux 2827450 0 1 5684607 59 32 5851459456
Linux 2827468 0 1 5684625 59 32 5851459456
Linux 2827472 0 1 5684629 59 32 5851459456
Linux 2827484 0 1 5684641 59 32 5851459456
Linux 2827489 0 1 5684646 59 32 5851459456
Linux 2827493 0 1 5684650 59 32 5851459456
Linux 2827502 0 1 5684659 59 32 5851459456
Linux 2827508 0 1 5684665 59 32 5851459456
Linux 2827518 0 1 5684675 59 32 5851459456
Linux 2827523 0 1 5684680 59 32 5851459456
Linux 2827542 0 1 5684699 59 32 5851459456
Linux 2827562 0 1 5684719 59 32 5851459456
Linux 2827568 0 1 5684725 59 32 5851459456
Linux 2827585 0 1 5684742 59 32 5851459456
Linux 2827605 0 1 5684762 59 32 5851459456
Linux 2827622 0 1 5684779 59 32 5851459456
Linux 2827623 0 1 5684780 59 32 5851459456
Linux 2827688 0 1 5684845 59 32 5851459456
Linux 2827690 0 1 5684847 59 32 5851459456
Linux 2827692 0 1 5684849 59 32 5851459456
Linux 2827694 0 1 5684851 59 32 5851459456
Linux 2827704 0 1 5684861 59 32 5851459456
Linux 2827705 0 1 5684862 59 32 5851459456
Linux 2827707 0 1 5684864 59 32 5851459456
Linux 2827720 0 1 5684877 59 32 5851459456
Linux 2827753 0 1 5684910 59 32 5851459456
Linux 2827756 0 1 5684913 59 32 5851459456
Linux 2827816 0 1 5684973 59 32 5851459456
Linux 2827834 0 1 5684991 59 32 5851459456
Linux 2827850 0 1 5685007 59 32 5851459456
Linux 2827853 0 1 5685010 59 32 5851459456
Linux 2827888 0 1 5685045 59 32 5851459456
Linux 2827906 0 1 5685063 59 32 5851459456
Linux 2827933 0 1 5685090 59 32 5851459456
Linux 2827985 0 1 5685142 59 32 5851459456
Linux 2827997 0 1 5685154 59 32 5851459456
Linux 2828034 0 1 5685191 59 32 5851459456
Linux 2828045 0 1 5685202 59 32 5851459456
Linux 2828047 0 1 5685204 59 32 5851459456
Linux 2828050 0 1 5685207 59 32 5851459456
Linux 2828068 0 1 5685225 59 32 5851459456
Linux 2828109 0 1 5685266 59 32 5851459456
Linux 2828132 0 1 5685289 59 32 5851459456
Linux 2828138 0 1 5685295 59 32 5851459456
Linux 2828144 0 1 5685301 59 32 5851459456
Linux 2828145 0 1 5685302 59 32 5851459456
Linux 2828165 0 1 5685322 59 32 5851459456
Linux 2828179 0 1 5685336 59 32 5851459456
Linux 2828189 0 1 5685346 59 32 5851459456
Linux 2828191 0 1 5685348 59 32 5851459456
Linux 2828223 0 1 5685380 59 32 5851459456
Linux 2828232 0 1 5685389 59 32 5851459456
Linux 2828249 0 1 5685406 59 32 5851459456
FAT16 >32M 3481933 44 9 4940692 34 14 2987538118
FAT12 3549460 40 29 4601795 11 9 2155181133
FAT16 >32M 4308331 6 18 6033066 45 3 3532258514For all of the Linux items, output on selection: ext4 blocksize=65536 Large_file Sparse_SB Recover, 2995 GB / 2790 GiB For the first FAT16 >32M: 1529 GB / 1424 GiB For the FAT12: 1103 GB / 1027 GiB For the last FAT16 >32M: 1808 GB / 1684 GiB
When I continue, TestDisk provides the following info (assuming for partitions that can be recovered):
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 2861588 64 32
Partition Start End Size in sectors
D Linux 504 0 1 2456 63 32 3999744
D Linux RAID 504 0 1 2456 63 32 3999744 [md1]
D Linux 1278 1 1 3230 63 32 3999712
D Linux 1282 0 1 3234 63 32 3999744
D Linux 1286 2 1 3238 61 32 3999616
D Linux 1288 0 1 3240 63 32 3999744
D Linux 1288 2 1 3240 61 32 3999616
D Linux 1289 2 1 3241 61 32 3999616
D Linux 1301 1 1 3253 63 32 3999712
D Linux 1302 0 1 3254 63 32 3999744
D Linux 2457 0 1 4409 63 32 3999744
D Linux RAID 2457 0 1 4409 63 32 3999744 [md1]
D Linux 3231 1 1 5183 63 32 3999712
D Linux 3235 0 1 5187 63 32 3999744
D Linux 3239 2 1 5191 61 32 3999616
D Linux 3241 0 1 5193 63 32 3999744
D Linux 3241 2 1 5193 61 32 3999616
D Linux 3242 2 1 5194 61 32 3999616
D Linux 3254 1 1 5206 63 32 3999712
D Linux 3254 61 1 5207 56 32 3999616
D Linux 3255 0 1 5207 63 32 3999744
>D Linux 4410 0 1 2861567 63 32 5851459584
D FAT12 74003 2 1 74004 27 32 2880 [EFI System Partition] [EFISECT
D HFS 536847 0 1 536851 63 32 10240 [iFlavaX-FruitFloat]
D HFS 605523 0 1 605527 63 32 10240 [iFlavaX-FruitFloat]
Structure: Ok. Use Up/Down Arrow keys to select partition.I don't know what your blocksize is. Try the command I sent previously, but with bs=512 or bs=1024 or bs=2048 or bs=4096 or bs=8192
and see if one of them finds the partition. But it looks like, from doing division, that 2048 should be the right one.
Then try this: for x in seq 4400 6000; do sudo dd if=/dev/sdb skip=$x bs=2048 count=100 | file -s - ; done | more (instead of _ use single left quote, which is the key to the left of "1") See if it finds the partition somewhere else. Use the spacebar to get each new page of output.
digitalbaron
commented
1 year ago Thanks for this suggestion @themaddoctor . I tried this, but not sure if I followed correctly. The first step would be to try various bs numbers? If so, this is what the system found:
sudo dd if=/dev/sdb skip=4410 bs=512 count=100 | file -s -
100+0 records in
100+0 records out
51200 bytes (51 kB, 50 KiB) copied, 0.645823 s, 79.3 kB/s
/dev/stdin: data
sudo dd if=/dev/sdb skip=4410 bs=1024 count=100 | file -s -
100+0 records in
100+0 records out
102400 bytes (102 kB, 100 KiB) copied, 0.00144661 s, 70.8 MB/s
/dev/stdin: data
sudo dd if=/dev/sdb skip=4410 bs=2048 count=100 | file -s -
100+0 records in
100+0 records out
204800 bytes (205 kB, 200 KiB) copied, 0.000440466 s, 465 MB/s
/dev/stdin: data
sudo dd if=/dev/sdb skip=4410 bs=4096 count=100 | file -s -
100+0 records in
100+0 records out
409600 bytes (410 kB, 400 KiB) copied, 0.661037 s, 620 kB/s
/dev/stdin: data
sudo dd if=/dev/sdb skip=4410 bs=8192 count=100 | file -s -
100+0 records in
100+0 records out
819200 bytes (819 kB, 800 KiB) copied, 0.773179 s, 1.1 MB/s
/dev/stdin: dataIt looks like you wanted me to try the other command 'as is'? If so, I have shared the output below. Similar output is presented for the other bs values as well (albeit with different bytes, etc.)
for x in seq 4400 6000; do sudo dd if=/dev/sdb skip=$x bs=2048 count=100 | file -s - ; done | more
dd: invalid number: ‘seq’
/dev/stdin: empty
100+0 records in
100+0 records out
204800 bytes (205 kB, 200 KiB) copied, 0.00046756 s, 438 MB/s
/dev/stdin: data
100+0 records in
100+0 records out
204800 bytes (205 kB, 200 KiB) copied, 0.000422114 s, 485 MB/s
/dev/stdin: data
@themaddoctor I meant to add that TestDisk is reporting blocksize if I hover over the partition:
Partition Start End Size in sectors
>D Linux 4410 0 1 2861567 63 32 5851459584Which reports:
ext4 blocksize=65536 Large_file Sparse_SB Recover, 2995 GB / 2790 GiB@themaddoctor / @u2n Not sure if the blocksize info might help point to another command to mount the partition, or if there may otherwise be some other command ideas that you may have, but I wanted to share that I learned TestDisk appears to be copying data okay now. The trick is to first print the list of directories/files (via the "P" key), and before copying, hide deleted files (otherwise, as u2n pointed out earlier, TestDisk does not differentiate between non deleted and deleted files by default). If you do not hide deleted files, TestDisk will attempt to copy significantly more files that will likely exceed the storage space of your target drive, and I noticed that there appears to be a bug where a symlink is created, which copies files from other areas of the partition -- a bit odd. It will take some time, but I am now copying each share one by one and hope to see 0 failures for everything. It would still be nice to mount the partition if I can, so that I can compare directory file counts, but that would be a nice to have (for me at least, since I am now having promising results using TestDisk). I will share an update after I finish my new copy attempt, which will take some time. Thank you again for all of your help.
u2n
commented
1 year ago Helping out a little here, to get the semi-automated search for the filesystem working, execute the seq phrase: '$(seq 4400 6000)', so
for x in $(seq 4400 6000); do sudo dd if=/dev/sdb skip=$x bs=2048 count=100 | file -s - ; done | more
On reviewing the 1600 returns, a found FS report will stick out.
Or to keep from checking by eye, one could first run a modified version to see if any FS even exists in the range:
for x in seq $(4400 6000); do sudo dd if=/dev/sdb skip=$x bs=2048 count=100 | file -s - | grep stdin | grep filesystem; done
(This is based on the file utility's output of both keywords 'data' and 'filesystem' on lines where a FS is being described.)
The 64k block size reported by testdisk appears to be an anomaly, but who knows, maybe try some commands with it if nothing else works.
Background: I have a WD My Book Live Duo 6TB device which I configured for RAID 1. For some reason, my access gradually reduced to no access -- I was able to login to the dashboard with the device connected to the router (via the IP)... then, something happened and I could not get past the "initializing" stage. I connected the device to my laptop via an ethernet adapter and I was able to see the dashboard -- drive 2 was noted as "bad". I lost dashboard access later that day. I am normally a Windows 11 user and attempted to view the contents of drive 1 via a SATA wire (without a power cable), but was only able to see two empty folders... and then a subsequent access attempt did not recognize the drive. I am assuming that the latter issues may have been attributed somewhat to not powering the drive (I put the drive in a non WD adapter with power later, which you will see below).
Upon reading information online further, I realized that I needed to see the files using a Linux file system reader and tried using DiskInternals Linux Reader, but the drive was not recognized. The drive shows up as a physical drive "WDC WD30 EZRX-00DC0B0", but when I try to open it, I get an error: "Can't open disk. Check the disk and try again." I also saw a message in the Linux Reader program window footer: "File system is not supported."
I then booted the latest version of Ubuntu from a flash drive. This time, I used a Unitek drive adapter with power. Under Disks, I saw "3.0 TB Hard Disk" and "WDC WD30 EZRX-00DC0B0". Size: 3.0 TB (3,000,592,982,016 bytes). Partitioning: GUID Partition Table. Contents: Unallocated Space. Device: /dev/sdb
I was not able to access the drive via Ubuntu. My understanding is that My Book Live Duo drives may or may not be encrypted. Can you please help me identify whether the drive is encrypted or not? If the drive was encrypted, I feel that this would show up as encrypted in Disks. I have not read anything that would suggest automatic drive wipes.
Thank you!