Recovery Force® Data Recovery Forum

Data Recovery Discussion and Support Forum
https://recoveryforce.com/forums/

Repair harddrive, partition table and filesystem after bitlocker failure

https://recoveryforce.com/forums/viewtopic.php?t=421

Page 1 of 1

Repair harddrive, partition table and filesystem after bitlocker failure

Posted: Sat Jul 21, 2018 7:35 pm
by lumanet
I'm new to this forum. Please be nice to me. :P

Problem:

I want to regain a filesystem/ partition table/ my data. Please help me. The data is very important to me!

What happened?

I tried to encrypt a 8TB external hard disk with Bitlocker on Windows 10 (stupid I know!). For unknown reasons the encryption failed. At first I still had access to the data. The next time I connected the external drive it showed only 1404 GB as hard disk size and no data is listed.
Drive info:

The following command (smartmontools):

Code: Select all

smartctl -a /dev/sdb
gives me these details about the hard disk (8 TB Seagate):

Code: Select all

smartctl 6.6 2016-05-31 r4324 [x86_64-linux-4.15.0-23-generic] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Archive HDD
Device Model:     ST8000AS0002-1NA17Z
Serial Number:    Z8414DRB
LU WWN Device Id: 5 000c50 0a46101d3
Firmware Version: AR17
User Capacity:    8.001.563.222.016 bytes [8,00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5980 rpm
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ACS-2, ACS-3 T13/2161-D revision 3b
SATA Version is:  SATA 3.1, 6.0 Gb/s (current: 1.5 Gb/s)
Local Time is:    Sat Jun 23 14:59:41 2018 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Incomplete response, ATA output registers missing
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.

General SMART Values:
Offline data collection status:  (0x82) Offline data collection activity
                    was completed without error.
                    Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0) The previous self-test routine completed
                    without error or no self-test has ever 
                    been run.
Total time to complete Offline 
data collection:        (    0) seconds.
Offline data collection
capabilities:            (0x7b) SMART execute Offline immediate.
                    Auto Offline data collection on/off support.
                    Suspend Offline collection upon new
                    command.
                    Offline surface scan supported.
                    Self-test supported.
                    Conveyance Self-test supported.
                    Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                    power-saving mode.
                    Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                    General Purpose Logging supported.
Short self-test routine 
recommended polling time:    (   1) minutes.
Extended self-test routine
recommended polling time:    ( 960) minutes.
Conveyance self-test routine
recommended polling time:    (   2) minutes.
SCT capabilities:          (0x30b5) SCT Status supported.
                    SCT Feature Control supported.
                    SCT Data Table supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   114   099   006    Pre-fail  Always       -       64318728
  3 Spin_Up_Time            0x0003   090   090   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   098   098   020    Old_age   Always       -       2395
  5 Reallocated_Sector_Ct   0x0033   100   100   010    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   072   060   030    Pre-fail  Always       -       8625048147
  9 Power_On_Hours          0x0032   098   098   000    Old_age   Always       -       2436
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       22
183 Runtime_Bad_Block       0x0032   100   100   000    Old_age   Always       -       0
184 End-to-End_Error        0x0032   100   100   099    Old_age   Always       -       0
187 Reported_Uncorrect      0x0032   100   100   000    Old_age   Always       -       0
188 Command_Timeout         0x0032   100   099   000    Old_age   Always       -       4295032833
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   068   048   045    Old_age   Always       -       32 (Min/Max 18/35)
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   099   099   000    Old_age   Always       -       2870
193 Load_Cycle_Count        0x0032   098   098   000    Old_age   Always       -       4719
194 Temperature_Celsius     0x0022   032   052   000    Old_age   Always       -       32 (0 16 0 0 0)
195 Hardware_ECC_Recovered  0x001a   114   099   000    Old_age   Always       -       64318728
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       458 (145 49 0)
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       15024331910
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       245421272660617

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
But if I use

Code: Select all

parted /dev/sdb print
to check the drive, for some strange reason, only 1404 GB are shown:

Code: Select all

Model: ST8000AS 0002-1NA17Z (scsi)
Disk /dev/sdb: 1404GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start   End     Size    Type     File system  Flags
 1      1049kB  1404GB  1404GB  primary  ntfs
How can I repair the hard drive/ filesystem/ partition talbe to regain the data?

I have already tried testdisk. But it doesn't recognize more than parted.

Every help is appreciated! Thanks guys!

Re: Repair harddrive, partition table and filesystem after bitlocker failure

Posted: Tue Jul 24, 2018 12:58 pm
by lcoughey
Sorry for the delayed response.

It seems that your system isn't seeing the drive with the advanced 4K sectors and reading each sector as 512B. As a result, everything is being shrunk by 8. If you had the drive connected to your system with or without a USB bridge, you might want to try connecting exactly as it was when it last worked.

Also, if you value your data, you might want to consider getting a full sector-by-sector clone so that if you accidentally make a change to the drive in its current condition, you will not have completely lost any chance of recovery.

Assuming that it went through the entire process of encrypting the drive, you may need to run a data recovery program designed to work with Bitlocker. The only one that I know of is put out by M3 and can be found here - https://www.m3datarecovery.com/bitlocke ... -recovery/

If the drive failed to encrypt at all, you may want to run a scan with the demo of R-Studio and see what it finds.

Be prepared to have another drive on hand on which you can save any files you recover.
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited