Question Bizarre partitions larger than drive capacity on my HD. Why?

[Matuzak]

Can anyone explain what's happened to my hard drive and what I should do with it? MiniTool Partition Wizard shows Disk 3 looks like this:

I can still read and probably write to the real partition of 2791.49 GB. Acronis True Image Home 2014 says it successfully wrote a backup to the drive last week. I didn't create the other partitions.

I discovered the mystery when I installed a larger SSD to replace my C drive on disk 1. Acronis' clone drive feature was checking the state of all drives and it threw up a few dozen "retry ignore cancel" boxes saying "Failed to read from sector __ of hard disk 3." Check Disk says nothing is wrong. Partition Wizard's surface scan found nothing wrong.

After telling Acronis to ignore those sectors it allowed me to start cloning but then the program stopped doing anything. I disconnected Disk 3, tried the clone again, and it seemed to work. I disconnected the old disk 1 and booted from its replacement. About a minute after reaching the desktop, the mouse cursor still moved but everything else was "not responding". I disconnected disk 3, Windows booted fine, I used the computer for hours, turned it off, re-connected disk 3, it booted fine and Windows has been working for two days with the files on disk 3 read-able. Although it's working now, I'm not comfortable with the situation and just leaving it alone. Please help and advise.

 

[fzabkar]

Can you show us the Partitions window in DMDE?

https://dmde.com/

What is the history of this drive? Did it come from an external USB enclosure or NAS?

 

[Matuzak]

I bought it new from Newegg or Amazon and it went directly into my desktop PC. It's about two years
old. DMDE threw up this box over 50 times and each time I clicked Ignore. In Parameters I checked "Ignore now, and always" but the boxes kept coming.

Then I clicked Abort and got this screen

 

[fzabkar]

On a GPT drive the partition information is stored in sectors 2 through 33, plus a backup at the end of the drive. I would first examine that area. There should only be stuff in sector 2. The rest should be empty.

 

[Matuzak]

What numbers do you suggest I should enter here or somewhere else to examine sectors 2 through 33?

If sectors 3-33 aren't empty, what should I do about it? Or will that really depend on what's in those sectors?

 

[fzabkar]

Go to main menu.

Select Editor -> Goto offset -> sector 2

Then hit the Page Down button on your keyboard.

 

[Matuzak]

Go to main menu.

Select Editor -> Goto offset -> sector 2

Then hit the Page Down button on your keyboard.

In the sector box I type "2", which caused the Offset number to change from 440 to 1464.

Pressing Page Down does nothing until I click OK. Then it shows

The zeros continue until the end of block 6

that continues through block 17. Then the zeros resume for some time. Then the zeros disappear for almost all of the remaining 5.8 billion blocks.
Thank you for sticking with me so far.

 

[fzabkar]

"Sector offset" should preferably be 0, but it doesn't matter. It appears that LBAs 6 through 17 are filled with garbage. The OS would see each 128-byte block as a separate partition. This is very strange corruption.

I would write zeros to LBAs 6 - 17, but before doing so I would examine the contents in hex mode. To do this, select Mode -> Hexadecimal/Text. Do the contents give you any clue as to the source of the corruption?

 

[Matuzak]

Not a single clue.

To write the zeros, should I go to Edit -> Edit Mode (check mark on) and start pressing "0"?
When I'm done, do I uncheck Edit Mode and need to do anything else to save the changes?
Then restart the computer and see what happens?

 

[fzabkar]

That's one, tedious way. Just be VERY careful.

There is a much easier way.

• 
  Select Tools -> Fill Sectors
  
  
  • Hex = 00
    
    Start sector = 6
    
    End Sector = 17
    
    OK
  
  
  Drive -> Apply Changes

 

[Matuzak]

Unfortunately it's not fixed yet. After clicking yes to this box

Apply Changes was greyed out

I exited and shut the computer down. On post an error gave some reason for resetting my overclock (which has been stable for a year). It restarted, Windows checked my C drive (not the disk with corruption) and then I got to my desktop. I checked and all the corruption had returned. I wrote the zeros again, exited, and restarted the computer. No scan disk this time or other problem, but the corruption was back. I wrote the zeros a third time, exited, and shut down the computer instead of restarting. It posted and booted normally, but the corruption is back and that's where I'm at now.

Do you happen to have any other suggestions, or is it formatting time now? I'd rather not if I don't have to. I can read and write files to the drive, but it's strange and I don't trust it anymore.

 

[fzabkar]

Are you trying to modify your boot drive? If so, can you connect it as a data drive and boot from a different drive?

 

[Matuzak]

Are you trying to modify your boot drive? If so, can you connect it as a data drive and boot from a different drive?

No. My boot drive is disk 0. The problem drive is disk 2.

 

[fzabkar]

Sorry, I have no idea what is happening.

Perhaps you could try Drive -> Lock Volumes before making your changes, then restart.

Alternatively, you could prevent Windows from mounting the drive by toggling the MBR On/Off button in the Partitions window. Then restart and make your changes to sectors 6 - 17. If these changes stick, then Toggle MBR On again.

Edit:

Is it possible that your antivirus software is preventing DMDE from updating this critical area of your drive?

 

[Matuzak]

I really appreciate all your suggestions and time. I tried both methods. I see why they should have worked, but for some reason they didn't. I'm just using Windows Defender.

If I'm headed towards formatting the drive, what do you think about me seeing what happens if I try to remove the partitions whose "First sectors" are higher than the 5.8 billion of the genuine partition?

 

[fzabkar]

You could r-click each of the bogus partitions and select "Remove the Partition".

These bogus partitions start from the third entry and include all those with sector 0 as the start sector. The second group of bogus entries begins at sector 64841843810 and includes all the remaining entries.

https://dmde.com/manual/partitions.html

BTW, I hope you are selecting Edit -> Edit Mode as you stated earlier.

 

[fzabkar]

I notice that there is a GPT(EE) entry at sector 4294967296. That's the first sector past the 2TiB boundary (= 0x100000000).

This could be a relic from an earlier setup which was subject to a 32-bit LBA limitation. Perhaps you switched to RAID mode from AHCI mode in the BIOS, or maybe you inadvertently switched to an earlier SATA driver, or maybe you switched from your SATA driver to an early RAID driver. The result is that everything appears to function normally until such time as you write beyond the 2TiB point on the drive. When this happens, the data wraps around to sector 0. For example, instead of writing to sector 0x100000006, your OS would write to sector 0x000000006.