5

I’m trying to fix an issue with a Seagate 6TB HDD (formatted as exFAT with 3.5TB of data) using testdisk, but I think I made things worse:

  • I left files to copy overnight and in the morning my Mac showed a notification the HDD wasn’t ejected properly, and since then, I haven't been able to mount it

Before I used testdisk, I was able to see the HDD greyed out in Disk Utility, displaying errors when trying to mount it, but after the below, I no longer can:

  1. When running testdisk for the first time, it displayed the following 
    No partition from this disk must be mounted:
  Open the Disk Utility and press Unmount button for each volume from this disk
    I chose Continue, with the partition table type automatically detected as EFT GPT
  2. Deep Search showed a number of errors with the EFI partition, stating something is != 1, with it only completing 0.3% after leaving overnight
  3. Quick Search showed two partitions, EFI and MS Data
  4. Analysis > Quickly Search showed the HDD had P in front of it
    • P conirmed all files were there > Write > Y went very quickly, but still unable to see the drive on my Mac
  5. I wondered if this was due to the message displayed in #1, so I reissued sudo testdisk after unmounting via sudo diskutil unmountDisk /dev/disk2
    1. Quick Search > EFI and MS Data detected, but MS Data showed as D(eleted)
    2. P conirmed all files were there > P to replace D(eleted) > Write (took ~10-15s)

The HDD no longer displays in Disk Utility and diskutil list doesn't show the EFI partition:

  • testdisk no longer automatically detects partition type
    • Depending on the partition type I chose, it shows either:
      Intel: Partition: Read error.
      EFI GPT: Trying alternate GPT
  • Quick Search takes ages to run, whereas before it took ~15-20min, it's now been >3hrs
  • Data on the HDD is no longer viewable via testdisk

What is my best course of action in the situation?

JW0914
  • 7,052
  • 7
  • 27
  • 48
user912830823
  • 151
  • 1
  • 3

2 Answers2

5

STOP ANY ACTION ON THE DRIVE RIGHT NOW. Good. Now you are no longer compounding the problem, let's try to dig ourselves out of the hole.

Realize your disk is likely failing - anything you do to it can only make it worse.

The first step I would take is to get another equal or larger drive and use ddrescue to try copy off the raw data. Once this is done, you can then pick at it as you like.

  • ddrescue is a godsend, as it gives you multiple bites at the cherry by allowing ongoing attempts to pull data off a failing drive.
  • I start with a forward pass, when it fails, cancel and start a backwards pass, then just keep it running till I run out of time. (If you get into this problem in the future, check logs and S.M A.R.T to bolster a diagnosis of a failing drive)

Once you have copied as much data as you are going to get, you may want to copy your copy and run testdisk on that; alternatively, if its to far gone, try photorec to recover partial files.

JW0914
  • 7,052
  • 7
  • 27
  • 48
davidgo
  • 68,623
  • 13
  • 106
  • 163
  • thanks @davidgo. I was running diskdrill for a couple of days now and it says its gonna take around 300 000 hours (around 35 years) tom complerte. I switched it off.. I wonder if for 6TB its gonna be similar with ddrescue? Also i wonder if i sholud try and find a company that repairs disk. Do they have better chances recovering it? – user912830823 Jun 09 '20 at 09:10
  • 1
    all ddrescue does is try and get as much raw data off the disk as possible. Unfortunately you have likely compounded the issues by continuing to stress the failing disk. A specialist company does have a better chance of recovery. For a start they can use a cleanroom to do physical disk operations you are unable to do. – davidgo Jun 09 '20 at 09:21
  • 1
    @user912830823 You're getting astronomically high finish times due to physical damage to the platters or heads, as it's essentially stalling while trying to read bad/damaged sectors. Install `smartmontools`, then issue `sudo smartctl -a /dev/disk2` > Review the S.M.A.R.T output for damage _(will be below the S.M.A.R.T values)_ > Run S.M.A.R.T short and long tests via `sctl="sudo smartctl"; disk="/dev/disk2"; $sctl -t short $disk && $sctl -a $disk; $sctl -t long $disk && $sctl -a $disk` _(Short test takes 1min, check Long progress via `$sctl -a $disk | grep progress`)_ – JW0914 Jun 16 '20 at 13:58
0

Partition read error means that your partition table is not readable. That means the partition is not physically damaged is often soft bads. At least crystaldiskinfo reported that your disk is GOOD.

Have you tried another paid data recovery software? I have experience with many data recovery software. I've used free tools like Recuva, Photorec, TestDisk as well as paid ones: EaseUS, Minitool, Disk Drill, iBoysoft Data Recovery. The best one should be iBoysoft. Although it's not as famous as others. But it has found 70% of my data (none of the data recovery software can guarantee to recover 100% of your lost data.). You can try its deep scan mode. Look at this guide: https://iboysoft.com/data-recovery/raw-drive-recovery/recover-data-from-raw-partition.html

If they still failed to find your lost data, please send the drive to a local data recovery service. But it would be costly.

laurayuan
  • 145
  • 4