[solved] GPT accidentaly overwritten by MBR in non-native USB SATA dock

[Marsjanin]

Sorry if I miss some solution, but I can't find issue like my one, especially looking into gpart status in answers.

What I have got:

■ Seagate 4000GB 3,5" drive ST4000DM000
■ Probably shipped as mounted in USB 3.0 SATA dock, Seagate (unknown model, the case is incomplete and USB port is damaged)
■ Trekstor USB 2.0 SATA dock DSMMU-S-SU-a
■ Unitek USB 2.0 SATA dock Y-1031

1-3 is my friend's stuff, 4th is mine.

Well. What probably happened. My friend bought 4TB HDD in USB dock case, it can be used even under Windows XP as he says. The case is broken now and I can't confirm that yet.

When he broke the socket, he simply pulled the disk from the native case and put that in Trekstor case. And probably Trekstor controller wrote an MBR to the disk somehow.

When I try to run HDD with my Unitek dock, it shows in gnome-disks as 4 TB drive. When I try my friend's Trekstor case it shows only 2 TB storage device!

So I assumpt my Unitek dock is compatible with GPT and I want to use it for recovery.

Now, what I can see on the disk (plugged via Unitek).

On Linux, there is classic MBR, 500 GB unknown partition and 3,5 TB free space.

On Windows 7, MBR, 500 unknown GB partition AND TWO unpartitioned spaces (WTF?).

And what is most important, on Linux gpart can't see even broken GPT file, only MBR:

# gdisk 
GPT fdisk (gdisk) version 0.8.10

Type device filename, or press <Enter> to exit: /dev/sdb
Partition table scan:
  MBR: MBR only
  BSD: not present
  APM: not present
  GPT: not present

Probably the disk was shipped formatted as one 4 TB big NTFS partition, under GPT partition table.

Maybe I can copy GPT table (the disk beginning and the copy at disk ending) from someone that has identical drive, using dd command? If not, how to fix it, and how to see is there a copy od GPT at disk ending? Can i back up the GPT table over that MBR, taking data from disk ending?

 

[Someone Somewhere]

Do you want to get the data off, or simply use it as a drive?

Your best bet for the former is probably some form of data recovery software.

Writing a new partition table and partition table is pretty easy, both on Windows and Linux.

 

[Marsjanin]

I'm sorry, this is so important so I didn't wrote that.

I want to recover the partition with all data structures on it, that's my target. At least I can try to recover data file by file, but that I can probably simply make with testdisk or similar.

I hope recovery is possible, probably the drive has overwritten only first sector (for MBR) or two.

 

[Someone Somewhere]

If that was the case, I'd expect it to find the backup table at the end of the disk - it looks like this should show up as 'damaged' rather than 'not present'.

I believe many of the brand-name disks like Seagate do tricky things with the partitions so that they can have what appears as a CD full of utilities - but is actually stored hidden at the start or end of the disk. Or there's the in-controller encryption, though I think that's more of a WD thing.

It's possible that the normal disk table at the start of the drive has been overwritten by the Trekstor enclosure, and the backup at the end isn't actually at the end of the disk.

I'm having a bit more of a read on how GPT works, but in the meantime can you install GPartEd and hit Device>Attempt Data Rescue? Don't know if it'll work though...

 

[Marsjanin]

Well, I can try do that by night, because I'm pretty sure it will took hours.

 

[Someone Somewhere]

Yeah.

 

[Marsjanin]

So, for now, gparted found no partitions. I think I can try testdisk, maybe it would be helpful…

 

[Marsjanin]

Yup – testdisk has found valid NTFS and also listed directories structure! Maybe I'll recover all the data, now I got to do chkdsk from Windows, that I can do on Monday, 'cause I'm now on TeamView. I'll set the flag [solved] when I make myself sure the partition is truly recovered.

 

[Someone Somewhere]

Cool!

 

[Marsjanin]

OK – now I got weird situation.
Two USB cases, on both: any Linux see valid GPT with valid NTFS on it, and I can read and write files. On any Windows 7 or 10, there's a valid GPT with unknown RAW partition on it, that Windows want to format (so cannot do chkdsk or so). What can be wrong yet?

 

[Someone Somewhere]

Weird...

Do you have any desktops? Try connecting the drive internally.

 

[Marsjanin]

Well, fixing the broken USB socket in the original Seagate USB case did the trick.

But when I put the disk into the case, I again saw nothing in disk managers – just empty, unpartitioned disk. Searching for partitions again in testdisk worked once more. The GPT partition table has been found again and saved. The difference is, whole partition could be now seen then under any OS – Linux and Windows XP, 7, 10.

Conclusion: probably the Seagate case has some internal and writable flash/EPROM memory to save its own GPT (it's one kilobyte if I understood that well), and it treats it as HDD sectors, pushing real HDD sectors after own memory.

The data was not touched when I swapped disk because the partition was preceded and followed by two 8-megabyte unpartitioned spaces, so there was much place to wrote GPTs or any other trash.

That's the only explantation I can imagine for now. Still the puzzle is, why the disk can be seen under Windows XP, but it's not a problem.

Thanks for all the help.