Question GPT > MBR Conversion FAIL: 8TB HDD showing as 1.3TB, almost completely unrecoverable data loss. Please HELP!

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
I'm not exactly new to data recovery, I've dabbled in the past but especially now after weeks of researching and attempting to fix the issue myself. All I've managed to do though, is change the problem and not find an actual solution.


TL;DR,
I had an 8TB HDD as NTFS GPT, was not playing nice with other devices at all, so I converted it from GPT to MBR "non-destructively"... and lost all data. Now it shows as 1.3TB and most files I find are corrupt/bad.

Pls pls pls, send help. I don't mind losing most of it, it'll be a pain to install and download everything on there again, but I'm more upset that 10 years of personal photos are now gone in the wind.

OS: Windows 10 (2004)
Secondary HDD: 8TB Seagate Barracuda ST8000DM004
File System: NTFS
Partition Map: Originally GPT (then to MBR and back to GPT again)


The Long Story:
My mistake began with taking my 8TB Internal Hard Drive out of my PC and placing it in an external enclosure to take with me on holiday.
When I got there, I had an issue that's come up a bunch of times now (and is why I will NEVER use GPT again), my NVidia Shield and my MacBook would not recognise my hard drive. I already did everything so they could read and write NTFS. Eventually I found that GPT does not play nice, either at all or when you remove the drive from the original PC.

In my haste to actually be able to access my files, rather than cutting my holiday short, I did the deed. I attempted to convert my hard drive to MBR from GPT, without data loss... from a Mac. Yeah, I couldn't have made a more stupid decision, could I? Alas, I can't turn back time.
Now I'm left with a hard drive that registers as 1.3TB on all my devices and any amount of recovery results in a few measly text files, pictures or videos. I should mention that I had filled 6TB's worth of space before "The Event". I've even tried converting back to GPT, in the hopes it would gather its marbles. It didn't.

Now I'm unsure what to do. Recovery software works to varying degrees, some not at all. MiniTool, Stellar, Easeus, Paragon, more than I can recall off-hand, all the big names have utterly failed. I then discovered DMDE which is fantastic (I will absolutely be buying a lifetime license) but still, I'm recovering mostly corrupt/bad files. I haven't got down to a granular level and tried fixing the bad files themselves yet, but I don't want to do much more if there's some way I can recover the original partition still, from the GPT partition table/map, if that's even possible. Technically the drive hasn't been formatted. Unless the conversion did that, but it stated it was the only way without data loss. I did research heavily before doing it. But the worst happened and now I don't know if I should give up, format and then try recovery, or just hold out for a professional at a later date.
It means I'm out a large hard drive currently, as well as all my files, media and games that are still there. I can see most of the files in DMDE (the singular copies of 10 year's worth of personal photos are strangely the only thing missing entirely) and I can try to recover them. The issue is more are corrupt than not and I don't have another drive big enough to recover everything now and worry later.

Please, someone save me.


If there's anything else, any other information I can give to assist people in helping me I'm very willing.
Thank you in advance to anyone able to give some input.
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
"so I converted it from GPT to MBR "

WHY????
MBR only works on a 2.2TB volume, max.
BECAUSE I'M AN IDIOT
:tearsofjoy:😭

You know when you read so much about something, and when all logical reasoning should leave you to say "Nah" but instead you press the buttons and realise you just did it anyway? No? Just me...

I will never take partitioning so lightly again, this is my second error this year. The first whereby I had a spare nvme ssd plugged in without realising and whilst reinstalling Windows I did a diskpart clean command on the incorrect disk. Boom goes all the files I was painfully ironically charged with recovering from said Apple nvme ssd... from my partners MacBook :hot:

I've always been the one to help (and school others) in these situations. Only to find out I'm the biggest idiot of all.
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
"now I don't know if I should give up, format and then try recovery, "

Formatting at this stage simply adds another layer of "You'll never get your stuff back"
Oh lord. Well, that's a start. I certainly won't do that. I only suggest because most of the recovery software out there either recovers lost partitions or lost data, not both at the same time. Which is what DMDE does. Recuva doesn't even know what say it is, and the rest are bloated and still no more useful.

I feared the answer would be something along the lines of "buy another 8TB and glhf". As I said, I'm reluctant but not unwilling to forgo everything non-vital, which barring a few documents etc is mostly the Photo folder that just does not appear on any recovery software. It's bizarre. I only need as much as they take up, which was well under 1TB if I recall.

I just do not know how to proceed. Should I seek professional help? Get both drives done at once? And what prices do they realistically charge? I have no clue at all.

Beyond that, backing up a few terabytes of disorganised, well, living is a life's work. You're absolutely right, but I've been trying to get it in a manageable state for about 5+ years now. There just wasn't the software I needed at the time and the cost of backing it all up would've been an issue too.

I just feel like putting it in a corner and leaving it for next year me. 2020 is done. I've already done that with my partners drive and a dead hard drive from donkeys years ago.
 

USAFRet

Titan
Moderator
Mar 16, 2013
129,176
5,170
165,040
20,013
The more you mess with your current drive and the only (potential) copy of your data...the less likely it is to recover anything.

Ideally what you'd do is buy a matching size drive, and do a forensic clone to this new one.
ddrescue (Linux), for instance.

Then, work on any "data recovery" on this clone. Of course, you'd also need another drive to recover to.
 

USAFRet

Titan
Moderator
Mar 16, 2013
129,176
5,170
165,040
20,013
For the future, backups:

My procedure may seem a bit excessive, but could easily be reduced to an external drive or two.
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
The more you mess with your current drive and the only (potential) copy of your data...the less likely it is to recover anything.

Ideally what you'd do is buy a matching size drive, and do a forensic clone to this new one.
ddrescue (Linux), for instance.

Then, work on any "data recovery" on this clone. Of course, you'd also need another drive to recover to.
That makes it sound less expensive to pay a professional to do it for me! 😅

As far as I'm concerned I have two viable options, give it all up and carry on, or go the professional route. Anything else seems like overkill. I mean, I could spend all that time and money and be dead tomorrow. The photos don't matter so much then 🤪

I guess I have 3 main questions though.
First, is the original 8TB functioning partition gone gone? Or is there a chance that we can find the partition table/map or whichever it is for the original GPT partition and get it back?

Second, is there any way to avoid this in future? I read up on Hybrid MBR and all sorts when I went down into the rabbit hole. Can I not backup my MBR/GPT in future to avoid this?

Lastly, how worthwhile is attempting to fix the corrupted files? I have photos and videos that just don't show up or play and it informed me they were bad. Should I try? Or is it just as unlikely?


Thanks so much for getting back to me though, makes me feel less alone, even if I am a lone idiot 😭
 

USAFRet

Titan
Moderator
Mar 16, 2013
129,176
5,170
165,040
20,013
Again, working on this single drive reduces any chance of "recovery".

Think of the data like a book.
If you take one of the pages, and with a Sharpie, overwrite the whole thing...or even just parts of it. Those words are gone.
But...the table of contents still exists, and may mislead you into thinking something is recoverable.
 
Reactions: jamiewhite

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
For the future, backups:

My procedure may seem a bit excessive, but could easily be reduced to an external drive or two.
Oh and as to backups, firstly I'll be giving your threads a read at some point this weekend, but also in future I will only ever be storing critical things in the cloud. I had luckily just gotten through with uploading all of my work documents to Google Drive.
These personal photos however have been a decade long battle. I already wiped most of the metadata and file structure about 6 years ago (accidentally of course) whilst trying to organise them.

I swear, I AM careful and I am very aware. Just sometimes I still make silly mistakes.
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
Don't despair. There is probably an easy DIY fix involving just a few clicks with the free version of DMDE.

https://dmde.com/

Can you show us DMDE's Partitions window? This should take less than 1 minute. Don't do a full scan.
It took some effort to find DMDE initially. I found some old Reddit thread where someone who obviously knows their stuff had said all the other crap is borderline useless (with lots of paid reviews etc) and that DMDE is the real deal.
It certainly found what the others couldn't.

Here's a shot of the partition screen (I enabled the "tables" section just for extra measure).



A full scan actually yields the original partition, but I have had very little luck with the files I've recovered. I'd say well over half came back corrupt, leading me to be reluctant to do a large scale recovery just yet.
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
Again, working on this single drive reduces any chance of "recovery".

Think of the data like a book.
If you take one of the pages, and with a Sharpie, overwrite the whole thing...or even just parts of it. Those words are gone.
But...the table of contents still exists, and may mislead you into thinking something is recoverable.
That is way too deep of a metaphor for a stressful Friday night! :tonguewink: Lovely though.

I see what you're saying. I had hoped that all we needed to do was tell everyone where they should be and we could get back to class. There's been no wiping or writing. But I guess if the conversion DID wipe it, then what you said will be true. I followed all the instructions to do it without data loss, is that real or was it just made up?

Yeah, for my work cloud is perfect. But for personal stuff, I would be looking more to the custom cloud solutions, SpiderOak (I think one is called?) and its ilk. It was a while ago I did the research on that. I just didn't have the money back then to do it. It would do me for photos that aren't on Google Photos and need work before they can be organised (the lack of metadata issue).
 

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
Your USB enclosure has a 32-bit LBA limit. That's why you are not seeing the full 8TB capacity. You need to install the drive inside your computer, or a suitable enclosure.

8TB - 6TiB = 1.40 TB
Wow, I had no idea. Sounds so obvious now that you say it. I don't know why I didn't think that the interfacing would effect it in some way, even if it's just the speed of recovery. Another doh moment to add to the growing list :tired:

So, now I'm back on my original desktop with the drive back where it began and this is the readout I get from the basic first scan of DMDE.


I will save the logs and have a look see what DMDE shows, but if this means something to you and you have some next steps, please go ahead. I'm all ears.

Most importantly, thank you!!!
 
D-click the Barracuda 8TB partition and expand the Root. Do you see your file/folder structure?

If so, then this looks like the original partition. The Indicators column is showing "ExCF", whereas it should be EBCF. This means that the boot sector is missing. You can restore it by r-clicking the Barracuda 8TB partition and selecting "Restore boot sector from copy". Then Apply Changes and reboot. Hopefully the other partition at LBA 34 will not be a problem. We can always delete it if necessary.

BTW, none of these changes touch your data.
 
Reactions: jamiewhite

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
D-click the Barracuda 8TB partition and expand the Root. Do you see your file/folder structure?

If so, then this looks like the original partition. The Indicators column is showing "ExCF", whereas it should be EBCF. This means that the boot sector is missing. You can restore it by r-clicking the Barracuda 8TB partition and selecting "Restore boot sector from copy". Then Apply Changes and reboot. Hopefully the other partition at LBA 34 will not be a problem. We can always delete it if necessary.

BTW, none of these changes touch your data.
I was just getting so excited and hopeful. Unfortunately upon following your instructions and entering that drive the root is unexpandable with no files/folders. I'm hoping it doesn't mean what I think it does...



Should I still go ahead and recover the boot sector as you instructed, or do a deep scan instead?
 
The "F" in the Indicators is telling us that DMDE has found the $MFT which is where the NTFS file/folder structure lives. This would suggest that you've done more "damage" than usual. You may need to do a full scan, or at least try All found / Virtual FS.
 
Reactions: jamiewhite

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
The "F" in the Indicators is telling us that DMDE has found the $MFT which is where the NTFS file/folder structure lives. This would suggest that you've done more "damage" than usual. You may need to do a full scan, or at least try All found / Virtual FS.
Well, I think most of the damage was the fact that I did this on a MacBook running High Sierra, which is a barren wasteland of abandonware when it comes to anything useful, outside of writing or web browsing anyway. I was on holiday in the middle of nowhere with spotty and limited data. I made a serious error in judgement. Beyond that, the only thing I did was try to do the same in reverse, turn it back to GPT. Either of those things or both are what lead us here.

The "All found / Virtual FS" option nets some results, I got a lot of corrupt data and small random lost files (listed as $F0-and then some more numbers), as well as the original folder structure minus some bits and bobs. Strange again is that the whole section that included backups is nowhere to be seen? It just isn't in any of the results.

I'm running a deep scan now but it'll take a fair amount of time. I can either abort and try the boot sector recovery you suggested or leave it running overnight. I'm at your disposal:ouimaitre:
 
I expect that your Mac was confused when it saw an 8TB partition on a drive whose capacity was being reported as 1.4TB.

I wouldn't do anything to the boot sector, or write anything to the drive. Hopefully the full scan will find your data. In fact the original MFT would normally be at the 4GB mark or thereabouts, unless the Mac has done something to it.

It would be best to clone your drive in its present state, as others have said, and then work on the clone.
 
Last edited:
Reactions: jamiewhite

jamiewhite

Distinguished
Dec 12, 2011
69
0
18,530
0
I wouldn't do anything to the boot sector, or write anything to the drive. Hopefully the full scan will find your data. In fact the original MFT would normally be at the 4GB mark or thereabouts,
I expect that your Mac was confused when it saw an 8TB partition on a drive whose capacity was being reported as 1.4TB.

I wouldn't do anything to the boot sector, or write anything to the drive. Hopefully the full scan will find your data. In fact the original MFT would normally be at the 4GB mark or thereabouts, unless the Mac has done something to it.
Originally the software I was using on the Mac could see the partition, it just couldn't interact with it. Now that's either because it was GPT or because of the external enclosure issue. After researching the fact that nothing except the original PC would recognise and access the drive, that's what lead me to go MBR. Either the research was flawed because it was the enclosure at fault or I'm never going to touch GPT again.

As it is the scan is very slow and might be done tomorrow if I'm lucky (I'm not). The one thing of mention is that it does throw up worrying errors every now and then. This is the error:



I bought this drive in early 2019. It's not old at all and whilst I've used up a ton of space, it rarely gets changed. It just stays there or gets added to. So it shouldn't be failing at this point. I'm guessing it's just picking up bad sectors where data has been well and truly wiped? I've clicked "Ignore All" for now, as no matter how many times I retry it won't solve itself.

Also, is there a way in future I can copy the MFT or MBR/GPT info and back it up off site, whereby it would fix this situation had it been a simple loss of that data?
 

ASK THE COMMUNITY