Data recovery from 3TB HDD connected via external device supporting up to 2 TB

Toggle sidebar Toggle sidebar
Status
Not open for further replies.
F

Fandomas

Honorable
May 25, 2013
7
0
10,510
Hi.
Help me, please, with data recovery. The new 3TB HDD was crypted by TrueCrypt and formated. I connected it externally via USB device, which can handle up to 2 TB only. I started filling it with AVI and MKV files, but after amount of data reach about 2 TB, I noticed data loss. The disk has completely diappeared until I realised what is happening. The partition was lost.

I succesfully loaded backup TrueCrypt "header", so I was able to connect it, but the partition is not viewable still, main and backup "header" is lost (I tried TestDisk and R-Studio).

R-Studio allowed me to save some data, but mostly rubbish. For example MKV file, which had about 4 GB, has now about 10-14 GB, but sometimes plays...

I am only reading the corrupted disk now, no writes. It has GPT instead of MBR, because of 3TB size.

Is it possible to repair the GPT header? I work in Windows, but if Linux will have tools for this, I will try some live distribution.

Thank you in advance for any suggestion.
 
Sort by date Sort by votes
F

Fandomas

Honorable
May 25, 2013
7
0
10,510


I can mount the disk easily with TrueCrypt, there is no problem. How should I continue, please?
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
Sorry, I didn't see your reply.

Anyway, I would examine sectors 0 to 34 with a disc editor in readonly mode.

DMDE is a freeware disc editor:
http://dmde.com/

To save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 35

In the Destination pane, select File.

You will be offered a filename of lba_0_35.bin

Click Save, OK, etc.
 
Upvote 0 Downvote
F

Fandomas

Honorable
May 25, 2013
7
0
10,510

Oh, you replied just before I decided to format the drive and forget I had those data ;o)

I did what you write, but what now with the lba_0_35.bin file, please?
 
Upvote 0 Downvote
F

Fandomas

Honorable
May 25, 2013
7
0
10,510


Here it is: www.grafikon.cz/zakaznici/lba_0_35.bin

I just realised that TrueCrypt cannot work with GPT disks! Strange is that it seems it worked. I have to test on other 3TB drive if the problem came from TrueCrypt, or external connection solution...

It seems that TrueCrypt has no problems with drives over 2TB, if they are non-system. I have non-system 3TB drive, so it is OK, I think.
 
Upvote 0 Downvote
F

Fandomas

Honorable
May 25, 2013
7
0
10,510


Sorry, I accidentaly overwritten the drive and his bit2bit copy too :eek:(

So, thank you for your time a lot!
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
I was expecting that sector 264192 may have been overwritten. It should be an NTFS boot sector. Some enclosures have a 32-bit LBA limitation which means that when data is written beyond the 2TiB point, its wraps around to the beginning of the drive, wiping out critical system sectors. If that's what has happened, then it will happen again in future, but you won't see it until you have written more than 2TiB of data.
 
Upvote 0 Downvote
F

Fandomas

Honorable
May 25, 2013
7
0
10,510


What do you mean by "some enclosures"? I am afraid it will happen again...
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
DMDE will show you a sector range at the top of the screen. An enclosure with a 32-bit LBA limitation will report a max LBA that corresponds to a capacity of around 800GB for a 3TB drive. AIUI, Windows consults the partitioning data in sectors 0 through 34 to determine the partition sizes, so it will be unaware of this 32-bit limitation.
 
Upvote 0 Downvote
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom