I am attempting to recover an external hard drive. It is western digital (like always).
Force mounting does not work:
user@linux:/home/user# mount -t vfat /dev/sdb1 /media/test1 -o force,umask=000
mount: /media/test1: wrong fs type, bad option, bad superblock on /dev/sdb1, missing codepage or helper program, or other error.
I get IO Errors when I attempt to run gparted. If I try to boot with the drive attached to the system, linux freezes. Gparted crashes also:
fdisk -l output:
Disk /dev/sdb: 1.84 TiB, 2000365289472 bytes, 3906963456 sectors
Disk model: My Passport 2626
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 8AD8DA33-56D1-4E2D-A00D-AB61AC3863C0
Device Start End Sectors Size Type
/dev/sdb1 2048 3906961407 3906959360 1.8T Microsoft basic data
lsblk output:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 50.7M 1 loop /snap/snap-store/481
loop1 7:1 0 217.9M 1 loop /snap/gnome-3-34-1804/60
loop2 7:2 0 2.2M 1 loop /snap/gnome-system-monitor/148
loop3 7:3 0 140.7M 1 loop /snap/gnome-3-26-1604/100
loop4 7:4 0 55.4M 1 loop /snap/core18/1932
loop5 7:5 0 97.8M 1 loop /snap/core/10185
loop6 7:6 0 62.1M 1 loop /snap/gtk-common-themes/1506
sda 8:0 0 232.9G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
└─sda2 8:2 0 232.4G 0 part /
sdb 8:16 0 1.8T 0 disk
└─sdb1 8:17 0 1.8T 0 part
Testdisk output:
Log:
Tue Jun 8 22:18:42 2021
Command line: TestDisk
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <[email protected]>
https://www.cgsecurity.org
OS: Linux, kernel 5.9.0-050900-lowlatency (#202010112230 SMP PREEMPT Sun Oct 11 22:37:09 UTC 2020) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, LBA48 support
/dev/sda: size 488397168 sectors
/dev/sda: user_max 488397168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - GB0250EAFYK, S/N:WCAT1H963933, FW:HPG2
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 2626, FW:1028
Disk /dev/loop0 - 53 MB / 50 MiB - 103776 sectors (RO), sector size=512
Disk /dev/loop1 - 228 MB / 217 MiB - 446248 sectors (RO), sector size=512
Disk /dev/loop2 - 2273 KB / 2220 KiB - 4440 sectors (RO), sector size=512
Disk /dev/loop3 - 147 MB / 140 MiB - 288064 sectors (RO), sector size=512
Disk /dev/loop4 - 58 MB / 55 MiB - 113384 sectors (RO), sector size=512
Disk /dev/loop5 - 102 MB / 97 MiB - 200168 sectors (RO), sector size=512
Disk /dev/loop6 - 65 MB / 62 MiB - 127160 sectors (RO), sector size=512
Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Passport 2626
Partition table type: EFI GPT
Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 2048 3906961407 3906959360 [My Passport]
Current partition structure:
check_FAT: can't read FAT boot sector
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 2048 3906961407 3906959360 [My Passport]
1 P MS Data 2048 3906961407 3906959360 [My Passport]
Testdisk then hangs when attempting to "Quick Search" for the partition.
chkdsk does not see the filesystem:
What I did next is I copied the data onto a second external hard drive using gddrescue. This is an amazing piece of software that was able to deal with the I/O Errors:
After I left gddrescue running on the drive for several days, it was able to recover most of the data, and copied what was on the broken disk (sdb) to the new one (sdc). Thank you to the developers for this amazing piece of software.
I then ran photorec (thank you to Christophe Grenier, the developer) on the new disk, and it recovered most of the files:
However, the directory (folder) structure is obviously not-recovered by photorec. As a result, there is a hundred folders with lots of photos and other files spread around.
I would still like to recover the folder structure if possible in addition to the files. I then ran testdisk on the new disk. A quick partition search only reveals the original partition that was on the disk before I copied the data off of the broken disk using gddrescue to it. After a deep partition search, I see a number of various partitions. I have no idea why there are HFS+ partitions on the disk besides the fact that the disk was used with a mac computer recently:
Tesdisk presents me with the following partitions after the deep search is concluded. The second partition was the one that was originally on the new drive to which the data was copied:
What should I try next to recover the partition? I believe the drive was FAT32, as it was used on both windows and Mac. I do not believe it was formatted to be HFS+ unless my friend, whose data this is, did so accidentally.
Please advise!
