Closed

Data recovery from 3TB HDD connected via external device supporting up to 2 TB

Hi.
Help me, please, with data recovery. The new 3TB HDD was crypted by TrueCrypt and formated. I connected it externally via USB device, which can handle up to 2 TB only. I started filling it with AVI and MKV files, but after amount of data reach about 2 TB, I noticed data loss. The disk has completely diappeared until I realised what is happening. The partition was lost.

I succesfully loaded backup TrueCrypt "header", so I was able to connect it, but the partition is not viewable still, main and backup "header" is lost (I tried TestDisk and R-Studio).

R-Studio allowed me to save some data, but mostly rubbish. For example MKV file, which had about 4 GB, has now about 10-14 GB, but sometimes plays...

I am only reading the corrupted disk now, no writes. It has GPT instead of MBR, because of 3TB size.

Is it possible to repair the GPT header? I work in Windows, but if Linux will have tools for this, I will try some live distribution.

Thank you in advance for any suggestion.
12 answers Last reply
More about data recovery 3tb hdd connected external device supporting
  1. I could probably repair the GPT data manually, but I'm not sure how to do this on an encrypted drive.

    Basically you need to examine sectors 0 to 34, and the last 34 sectors at the end of the drive.
  2. fzabkar said:
    I could probably repair the GPT data manually, but I'm not sure how to do this on an encrypted drive.

    Basically you need to examine sectors 0 to 34, and the last 34 sectors at the end of the drive.


    I can mount the disk easily with TrueCrypt, there is no problem. How should I continue, please?
  3. Sorry, I didn't see your reply.

    Anyway, I would examine sectors 0 to 34 with a disc editor in readonly mode.

    DMDE is a freeware disc editor:
    http://dmde.com/

    To save the requested sectors, launch DMDE.

    In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

    You should now see LBA 0 (sector 0) of your drive.

    Now select Tools -> Copy Sectors

    Start Sector -> 0
    Number of Sectors -> 35

    In the Destination pane, select File.

    You will be offered a filename of lba_0_35.bin

    Click Save, OK, etc.
  4. fzabkar said:
    Sorry, I didn't see your reply.

    Anyway, I would examine sectors 0 to 34 with a disc editor in readonly mode.

    DMDE is a freeware disc editor:
    http://dmde.com/

    To save the requested sectors, launch DMDE.

    In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

    You should now see LBA 0 (sector 0) of your drive.

    Now select Tools -> Copy Sectors

    Start Sector -> 0
    Number of Sectors -> 35

    In the Destination pane, select File.

    You will be offered a filename of lba_0_35.bin

    Click Save, OK, etc.

    Oh, you replied just before I decided to format the drive and forget I had those data ;o)

    I did what you write, but what now with the lba_0_35.bin file, please?
  5. Upload the BIN file to a file sharing service, eg RapidShare.
  6. fzabkar said:
    Upload the BIN file to a file sharing service, eg RapidShare.


    Here it is: www.grafikon.cz/zakaznici/lba_0_35.bin

    I just realised that TrueCrypt cannot work with GPT disks! Strange is that it seems it worked. I have to test on other 3TB drive if the problem came from TrueCrypt, or external connection solution...

    It seems that TrueCrypt has no problems with drives over 2TB, if they are non-system. I have non-system 3TB drive, so it is OK, I think.
  7. According to the information in sector 2, the boot sector for your data partition is 0x40800. That's sector 264192 in decimal. Could you upload this sector?
  8. fzabkar said:
    According to the information in sector 2, the boot sector for your data partition is 0x40800. That's sector 264192 in decimal. Could you upload this sector?


    Sorry, I accidentaly overwritten the drive and his bit2bit copy too :o(

    So, thank you for your time a lot!
  9. I was expecting that sector 264192 may have been overwritten. It should be an NTFS boot sector. Some enclosures have a 32-bit LBA limitation which means that when data is written beyond the 2TiB point, its wraps around to the beginning of the drive, wiping out critical system sectors. If that's what has happened, then it will happen again in future, but you won't see it until you have written more than 2TiB of data.
  10. fzabkar said:
    I was expecting that sector 264192 may have been overwritten. It should be an NTFS boot sector. Some enclosures have a 32-bit LBA limitation which means that when data is written beyond the 2TiB point, its wraps around to the beginning of the drive, wiping out critical system sectors. If that's what has happened, then it will happen again in future, but you won't see it until you have written more than 2TiB of data.


    What do you mean by "some enclosures"? I am afraid it will happen again...
  11. DMDE will show you a sector range at the top of the screen. An enclosure with a 32-bit LBA limitation will report a max LBA that corresponds to a capacity of around 800GB for a 3TB drive. AIUI, Windows consults the partitioning data in sectors 0 through 34 to determine the partition sizes, so it will be unaware of this 32-bit limitation.
  12. Locking - attracting nothing but spam posts.
Ask a new question

Read More

Data Recovery Storage Hard Drives Devices