Sign in with
Sign up | Sign in
Your question
Closed

Data recovery from 3TB HDD connected via external device supporting up to 2 TB

Last response: in Storage
Share
May 24, 2013 10:35:44 PM

Hi.
Help me, please, with data recovery. The new 3TB HDD was crypted by TrueCrypt and formated. I connected it externally via USB device, which can handle up to 2 TB only. I started filling it with AVI and MKV files, but after amount of data reach about 2 TB, I noticed data loss. The disk has completely diappeared until I realised what is happening. The partition was lost.

I succesfully loaded backup TrueCrypt "header", so I was able to connect it, but the partition is not viewable still, main and backup "header" is lost (I tried TestDisk and R-Studio).

R-Studio allowed me to save some data, but mostly rubbish. For example MKV file, which had about 4 GB, has now about 10-14 GB, but sometimes plays...

I am only reading the corrupted disk now, no writes. It has GPT instead of MBR, because of 3TB size.

Is it possible to repair the GPT header? I work in Windows, but if Linux will have tools for this, I will try some live distribution.

Thank you in advance for any suggestion.
a c 288 G Storage
May 28, 2013 3:23:45 PM

I could probably repair the GPT data manually, but I'm not sure how to do this on an encrypted drive.

Basically you need to examine sectors 0 to 34, and the last 34 sectors at the end of the drive.
Score
0
May 30, 2013 8:35:53 AM

fzabkar said:
I could probably repair the GPT data manually, but I'm not sure how to do this on an encrypted drive.

Basically you need to examine sectors 0 to 34, and the last 34 sectors at the end of the drive.


I can mount the disk easily with TrueCrypt, there is no problem. How should I continue, please?
Score
0
Related resources
a c 288 G Storage
May 31, 2013 3:29:34 PM

Sorry, I didn't see your reply.

Anyway, I would examine sectors 0 to 34 with a disc editor in readonly mode.

DMDE is a freeware disc editor:
http://dmde.com/

To save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 35

In the Destination pane, select File.

You will be offered a filename of lba_0_35.bin

Click Save, OK, etc.
Score
0
May 31, 2013 4:18:59 PM

fzabkar said:
Sorry, I didn't see your reply.

Anyway, I would examine sectors 0 to 34 with a disc editor in readonly mode.

DMDE is a freeware disc editor:
http://dmde.com/

To save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 35

In the Destination pane, select File.

You will be offered a filename of lba_0_35.bin

Click Save, OK, etc.

Oh, you replied just before I decided to format the drive and forget I had those data ;o)

I did what you write, but what now with the lba_0_35.bin file, please?
Score
0
a c 288 G Storage
May 31, 2013 4:33:17 PM

Upload the BIN file to a file sharing service, eg RapidShare.
Score
0
May 31, 2013 4:53:53 PM

fzabkar said:
Upload the BIN file to a file sharing service, eg RapidShare.


Here it is: www.grafikon.cz/zakaznici/lba_0_35.bin

I just realised that TrueCrypt cannot work with GPT disks! Strange is that it seems it worked. I have to test on other 3TB drive if the problem came from TrueCrypt, or external connection solution...

It seems that TrueCrypt has no problems with drives over 2TB, if they are non-system. I have non-system 3TB drive, so it is OK, I think.
Score
0
a c 288 G Storage
June 2, 2013 1:15:07 AM

According to the information in sector 2, the boot sector for your data partition is 0x40800. That's sector 264192 in decimal. Could you upload this sector?
Score
0
June 2, 2013 5:38:53 AM

fzabkar said:
According to the information in sector 2, the boot sector for your data partition is 0x40800. That's sector 264192 in decimal. Could you upload this sector?


Sorry, I accidentaly overwritten the drive and his bit2bit copy too :o (

So, thank you for your time a lot!
Score
0
a c 288 G Storage
June 2, 2013 11:43:52 AM

I was expecting that sector 264192 may have been overwritten. It should be an NTFS boot sector. Some enclosures have a 32-bit LBA limitation which means that when data is written beyond the 2TiB point, its wraps around to the beginning of the drive, wiping out critical system sectors. If that's what has happened, then it will happen again in future, but you won't see it until you have written more than 2TiB of data.
Score
0
June 2, 2013 3:39:27 PM

fzabkar said:
I was expecting that sector 264192 may have been overwritten. It should be an NTFS boot sector. Some enclosures have a 32-bit LBA limitation which means that when data is written beyond the 2TiB point, its wraps around to the beginning of the drive, wiping out critical system sectors. If that's what has happened, then it will happen again in future, but you won't see it until you have written more than 2TiB of data.


What do you mean by "some enclosures"? I am afraid it will happen again...
Score
0
a c 288 G Storage
March 12, 2014 4:40:28 PM

DMDE will show you a sector range at the top of the screen. An enclosure with a 32-bit LBA limitation will report a max LBA that corresponds to a capacity of around 800GB for a 3TB drive. AIUI, Windows consults the partitioning data in sectors 0 through 34 to determine the partition sizes, so it will be unaware of this 32-bit limitation.
Score
0
a b G Storage
April 1, 2014 9:33:09 AM

Locking - attracting nothing but spam posts.
Score
0
!