GPT 3TB hard drive "magically" changed to MBR

[biospot]

After my motherboard died, I setup a new motherboard, and I setup my 4 - 3TB hard drives on the built in SATA 3 Controller. I then tried to replace the AHCI drivers in windows with new drivers for that motherboard. The 3TB drives showed up for some time (a few hours -12 hours)
Now all 4 of my TB drives have been converted (HOW?) to MBR drives and a new 2TB partition created on the drives.
I did NOT write anything to those drives. I knew better. I did not initialize, format, quick format.. anything.they had worked a few times....
as a test, I initialized one of the 4 drives on a different machine and I can now see it has (now) an MBR boot block and a 2TB partition (overwriting my almost full 2.7GB GPID partitions)
this happened to all 4 of the drives
I understand there were wrong drivers installed (from using it on the Foxconn), but I never in my wildest nightmares could envision all 4 of my hard drives getting a MBR 2TB partition written to it.
Does anyone have the slightest idea how this could have happened?

 

[fzabkar]

Are you wanting to recover your data? Perhaps a forensic examination could both repair the MBR and uncover a reason for the mess. I suspect that editing at most 16 bytes in the partition table would be all that would be required to restore your file systems, assuming that the new 2TiB partitions have not been formatted.

BTW, is the drive's capacity still seen as 3TB in the BIOS?

If you wish to edit your partition table, could we see the contents of sectors 0, 1, and 2?

Here are three freeware disc editors:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector%20Editor

 

[biospot]

yes, I want to recover it. I had about 2 months of updates, though I have the base data on another set of 3TB drives.

it is seen as 3TB in the bios and windows sees the drive as 3TB in the disk management app. It shows it as needing to be "initialized" and waiting for me to choose either GPT or MPR to set the drive up.

I took a chance on the disk that had the least changes from my backup and told windows to write the GPT header to it.
Now it shows as unformated 2.7TB drive.. but when I run Partition Guru on it, it still finds a 2TB partitoin left.

Thanks for your willingness to help. I am still learning about GPT at this point. Thanks also for the links.

I have not touched the other three drives. I will get the requested sectors from one of them and post here.


Thanks

 

[biospot]

Sorry I did not get back to you earlier.

I have been researching my own problem (always a good idea) and using what you said about sectors 1, 2 and 3, I started examining them using DMDE 2.4.4

I found only a few places (actually 5) where there were any differences between them.

I then did a search for NTFS partitions.

after a short time, it found my partition (at about sector 265,000), and I ordered a replacment 3TB drive to copy it to.

I found DMDE would bring up most of the drive, but a few folders were marked with pink + and additionally, I saw a bunch of folders with numbers for names below. Inside of those folders, were other folders that belonged (I think) inside some of the folders above that were marked with pink +.. so I infered that some of the directory items that were needed to complete the directory error free were still missing.

I decided to let DMDE run for 24 or more hours to look for any missing directory fragments on the rest of the drive.

Unfortunately, when DMDE is stopped after a long amount of searching, it appears to freeze up and (as I write this), it keeps saysing "completing current operation", but nothing is happening (for 12-14 hours now)

If you have any insites or advice at this point I would be happy.

Note, I did a test recovery and got 100GB of files off, and verifed they worked (readable).

Thanks for your simple method of making me find this out for myself.

I am going to try to let the search go all the way thorough. I expect it to take 1.5 days or so at this point. Any thoughts would be most welcome

Biospot

 

[fzabkar]

IMO, allowing Windows to write on your damaged file system was a bad idea. However, I suspect that Windows may have only touched the first three sectors, plus the backups at the end of the drive, so you might be lucky. I could help you analyse these sectors and possibly reconstruct them, but it will be a learning process for both of us. That said, I would never suggest that you write anything to your drive without having a foolproof undo strategy, and we would always be referring to authoritative references. In any case, I propose that our initial examination should be in readonly mode (DMDE's power-up default).

If you could show us sectors 0, 1, 2 and 264192 for your "damaged" and "good" drives, then that will allow us to compare the critical areas.

Sector 0 will be a protective MBR. It will have a partition type of EE and a size of 2TiB (= 0xFFFFFFFF) sectors. A legacy OS such as Windows XP would see it as an unrecognisable 2TiB MBR partition and would leave it alone. That's why it is referred to as "protective". If the partition type is changed from EE to 07, for example, then it reverts to being recognised as a 2TiB NTFS partition. Of course the NTFS boot sector would then be in the wrong place, so the partition would show up as unformatted.

Sector 1 contains the EFI Partition header. It defines the limits of the physical disc and the location of the partition array, usually from sector 2 to sector 33.

Sector 2 is the first sector of the partition array. Each partition entry has a size of 128 bytes, and the array can have up to 128 partitions. If you have a single 3TB partition, then you will see an entry for a 128MB "reserved Microsoft" partition plus a 3TB "basic data" partition.

Sector 1 is mirrored at the last sector of the physical drive, and sectors 2 to 33 are also mirrored immediately before the last sector.

Depending on the actual capacity of your drive, sector 264192 will probably be an NTFS boot sector, ie it will be the first sector of your 3TB NTFS partition.

To save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 3

In the Destination pane, select File.

You will be offered a filename of lba_0_3.bin

Click Save, OK, etc.

You could repeat the above procedure for sector 264192.

 

[biospot]

Hello and thanks

I didn't let windows write to it. That was the (bad) magic of what happened. I have no idea how windows wrote to those hard drives in the first place. I believe it was done by the windows 7 installer while I was re-installing the OS.

I have recovered the frist 3 TB disk to a spare disk, by useing DMDE to search for NTFS partitions. at about 265,000 sectors, it found the original partition and I have "recovered" it to another drive. No writing has occured at any point except the origina damage, and the 1 (of 4) drives that had less important data. That one I allowed windows to write the boot sector so it could be readable in diskmanager. If this one never recovers I won't mind much.

Thanks. Once I get the three sectors (I have them since your first reply).. Is there a better, easier way to get the info into this forum for you? I am not exactly super knowledgeable about websites, but I know computers well.

Thanks. I will study what you have. Oh, when I found the NTFS sector, it was almost exctly where you said it would be. Thanks again for the help...

IMO, allowing Windows to write on your damaged file system was a bad idea. However, I suspect that Windows may have only touched the first three sectors, plus the backups at the end of the drive, so you might be lucky. I could help you analyse these sectors and possibly reconstruct them, but it will be a learning process for both of us. That said, I would never suggest that you write anything to your drive without having a foolproof undo strategy, and we would always be referring to authoritative references. In any case, I propose that our initial examination should be in readonly mode (DMDE's power-up default).

If you could show us sectors 0, 1, 2 and 264192 for your "damaged" and "good" drives, then that will allow us to compare the critical areas.

Sector 0 will be a protective MBR. It will have a partition type of EE and a size of 2TiB (= 0xFFFFFFFF) sectors. A legacy OS such as Windows XP would see it as an unrecognisable 2TiB MBR partition and would leave it alone. That's why it is referred to as "protective". If the partition type is changed from EE to 07, for example, then it reverts to being recognised as a 2TiB NTFS partition. Of course the NTFS boot sector would then be in the wrong place, so the partition would show up as unformatted.

Sector 1 contains the EFI Partition header. It defines the limits of the physical disc and the location of the partition array, usually from sector 2 to sector 33.

Sector 2 is the first sector of the partition array. Each partition entry has a size of 128 bytes, and the array can have up to 128 partitions. If you have a single 3TB partition, then you will see an entry for a 128MB "reserved Microsoft" partition plus a 3TB "basic data" partition.

Sector 1 is mirrored at the last sector of the physical drive, and sectors 2 to 33 are also mirrored immediately before the last sector.

Depending on the actual capacity of your drive, sector 264192 will probably be an NTFS boot sector, ie it will be the first sector of your 3TB NTFS partition.

To save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 3

In the Destination pane, select File.

You will be offered a filename of lba_0_3.bin

Click Save, OK, etc.

You could repeat the above procedure for sector 264192.

 

[biospot]

I think I can provide you some related articles:
http://msdn.microsoft.com/en-us/library/windows/hardware/gg463525.aspx
http://www.anchor.com.au/blog/2012/10/the-difference-between-booting-mbr-and-gpt-with-grub/
http://www.pcworld.com/article/235088/everything_you_need_to_know_about_3TB_hard_drives.html

Interesting read. I appreciated it.

Thanks

I have had 3TB drives in my file server for a year or so, but I recently bought a "modern" MB with UEFI and I just purchased a 4TB coolspin drive. I have decided to install onto the 4TB and then use it as a destnation of the recovered partitions. I will have to play "musical hard drives" to get all the data off and onto reformated disks, but I expect it to work OK, though it will take me a week or so at least to recover and transfer the (4 X 3TB) 12 TB of data...

Fzabkar, I am interested in your obvious knowledge of GUID hard drives. You should work for a data recovery company as I think your ideas and explanations are highly professional. I would not mind to hear any more "synopsis" of the GPT disks that you wanted to toss out to the reast of us....
Thank You!
Biospot

 

[fzabkar]

@biospot, I don't have any significant knowledge of GPT partitions. In fact there doesn't appear to be much to know. The first 3 sectors basically just tell us the number and types of partitions, and their starting sector and capacity in sectors. That's why I suggested that the easiest approach would be to examine these sectors.

I have been through similar data recovery procedures for MBR drives, and I don't believe your problem will be much different. In any case I would suggest that you should try to determine the cause and nature of the problem, otherwise it may happen again.

At the moment you appear to be suggesting that you intend to rebuild all your drives, and that this would entail copying around 12TB ... twice. ISTM that the potential solution may only involve editing a few bytes.

You could upload the sector dumps to a file sharing service ...