Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

SOS - Storage HDD files gone!


  • Please log in to reply
23 replies to this topic

#1 MZAdotcom

MZAdotcom

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 12 February 2012 - 03:44 AM

Hi, all:

Need some serious help here. My question is regarding a very critical, technical matter & has to do with Hiren's BootCD [LINK].

I'm in the process of contacting it's creator. With the issue I'm having, I need all the help I can get.

I'll try to explain this as precisely as I can. The GPU of my older notebook recently died so, as the display would not come on anymore, I needed to save the OS from the still working HDD. I put the notebook HDD in an external enclosure &, from the suggestion of a friend, gave Hiren's BootCD a shot @ cloning the notebook's HDD to the Storage HDD @ my desktop.

Under the "Mini Windows XP" environment from the CD, I ran a program called "CloneDisk". The cloning options I set for it were:

1] Disk to Disk
2] Source: Notebook HDD in external enclosure
3] Destination: Storage HDD in my PC

Let's say the Destination is E Drive & the Source F Drive. After the cloning was successfully done & I restarted my desktop, the entire 500GB Storage HDD @ E Drive is gone! It's been "replaced" by a 35GB one, which is the size of the cloned HDD of the notebook. To make matters worse, I had a roughly 120GB TrueCrypt partition on that HDD so that's completely gone, too. I am beside myself. This HDD & it's 2 partitions housed everything I have of value. Are the changes made by CloneDisk irreversible? I sure hope not. That would be disastrous for me.

This is causing me a lot of stress. As it appears now, I have lost all my critical work/life files from this drive amounting to over 10 years worth of work. Please help. If you can't, please point me to someone who can. I'm hoping there's a simple solution to all this. Perhaps with a HDD/file recovery or system restore function @ Hiren's BootCD or other Linux Recovery Discs/etc.

Any & all assistance in this matter will be greatly appreciated.

MZA

Attached File  MissingHDDPartitions@CloneDisk_HirensBootCD.zip   185.28KB   3 downloads

Edited by MZAdotcom, 12 February 2012 - 05:45 AM.


BC AdBot (Login to Remove)

 


#2 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 16 February 2012 - 08:59 AM

Greetings MZAdotcom and Welcome to the Forums,

I'm considering your issue at the moment and will have some suggestions for you in a short while. In the meantime, please do nothing else with that computer. Make no changes whatsoever except what is directed here and until we get a handle on things.

Also, as a precaution, I like to know beforehand if a user I'm assisting has installation media for their operating system(s) and as well, if you have any removable media that we can use if necessary. Thanks for your patience!

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#3 MZAdotcom

MZAdotcom
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 16 February 2012 - 05:50 PM

Hello & thanks for the welcome, 1972vet.

That's fantastic, I could use all the help I can get.

I'll tell you what I have so far. I contacted the makers of Hiren's BootCD & we've been emailing back & forth. They've been helpful. Tried contacting the people @ CloneDisk, but basically was told there's nothing that can be done. On the suggestion of Hiren's BootCD maker, I was going to try TestDisk today. Read about it last night & seems to be a fantastic recovery tool. If you don't know about that program, please take a moment & check out that link. There are a bunch of recovery tools on Hiren's BootCD, also.

I'm excited about TestDisk because in my research of the issue I'm having the one thing I keep coming to is that the Partition Table has been damaged. In Windows Disk Management it shows that my 500GB Storage HDD is still intact. So maybe a program like TestDisk, or similar, will be able to fix the Partition Table. But, if you think I should hold off, I can, no worries.

In the downtime of finding a solution, the main thing I'm trying to do is research, research, research. I'm an artist/writer/graphic designer & my life's work is @ stake here.

Also, just wanted to mention that, though it would be nice to have back, the TrueCrypt partition data is not as important as the rest. Me & the guy from Hiren's BootCD figured out that without the Rescue Disk for the Backup Volume Header, recovery is virtually impossible. Unfortunately, I had the Rescue Disk .iso image on the other partition of the Storage HDD. Ironic?

Yes to both having my OS install media & having external HDD's/thumb drives.

Thanks again & please keep me posted.

Cheers.

#4 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 16 February 2012 - 06:09 PM

Ok great...and my apologies for the delayed response. I had an emergency of sorts, here at home, and had to jump in to get doctors records straightened out for a new appointment. One doctor moving out of town, the new doctor appointment needs the old records and with no dedicated fax line here, the doctor's office needed my signature in order to fax them to the other doctor...shouldn't be that complicated, but with laws the way they are.

Anyway, on to business. Are you familiar with linux?

edit added:
Ironic indeed but certainly a real hemorrhoid when it happens to "us", huh? Hopefully, even if we can't rescue a thing we will have learned valuable lessons about creating image files for storage on removable media. I know myself, I learned the hard way when my system(s) image files were stored on another partition that also was lost to mishap. Having to reinstall three systems and re-create my storage partition from old data...essentially starting over from scratch, was enough for me. Now my images files are kept on separate DVDs as well as on the storage partition (when I have room for them). Anyway...

Read through This Tutorial and see if you think you can follow those instructions ok to create a bootable Linux distro that we can use to see what's on that disk. Let me know. Thanks!

Edited by 1972vet, 16 February 2012 - 06:54 PM.

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#5 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 16 February 2012 - 07:15 PM

I don't want to put you on data overload, but after you've gone over the previous suggestion, which might be moot, if those files are all visible to Windows, I thought we should try to have a look at the partitions on the disk, from outside of Windows.

Gparted, an open source partition editing tool, will serve that purpose. Although we won't need to use it for partitioning, we can indeed use it to see exactly what partitions are still on the disk, even if Windows can't see them.
  • Download Gparted Live CD ISO from Here and save where you can easily find it.
  • Create a bootable CD by burning that ISO image to a CD, you can d/l and use ImageBurn for that task.
  • Instructions for ImageBurn Here if required.
  • Boot your system from the GParted Live CD. You should see the following:


    Posted Image

  • Press ENTER


    Posted Image

  • By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.


    Posted Image

  • Choose your language and press ENTER. English is default


    Posted Image

  • Once again, at this prompt, press ENTER You will now be taken to the main GUI screen. You seem to me, savvy enough that when you reach this point you should be able to take it from there. That screen should be showing you exactly what partitions are on the drive...whether Windows can seem them or not. This view may very well be the same as what you had already seen from the Windows Disk Management console but there's always the chance that something was changed regarding the missing partitions attributes.

If you are lucky, you might see there what is missing. If so, and if you have access to some digital camera, take a picture and upload it here so I can have a look.

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#6 MZAdotcom

MZAdotcom
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 17 February 2012 - 03:03 AM

Totally understand about the life/work stuff. I'm a bit bogged down @ the moment, too. But, I suppose that's true @ any given moment. I hope things are under control for you now.

It's really nice to know there's someone's out there trying their best to help me out. You're the man, 1972vet!

You're absolutely right about backing things up. I've actually been pretty good @ it over the years with a small, open-source program called FreeFileSync. It's simple, fast, no muss-no fuss. What's happening now is just a case of me not using a software [CloneDisk] correctly. So, I have no one to blame but myself. I have, in the short time going through this trouble, learned my lesson many times over. I'm in the process of backing up my girlfriends & 2 good friends computers as a result. The best route is what you're saying: have backups & then backups of your backups.

Thanks very much for the step-by-step guide to GParted! I've heard a lot of good things about it & have used it once or twice @ a machine running Ubuntu to just have a look around @ the SSD there. To answer your question: yes, I am relatively familiar with Linux. Currently have a netbook running the latest Linux Mint which I installed/configured myself. Have had different versions of Ubuntu running on desktops & virtual machines [VMware Player] in the past.

I totally get why you're suggesting this. There are a lot of Linux tools that are offered pre-boot @ Windows. Just as an FYI, Hiren's BootCD can do that. As can Knoppix & TKR [Trinity Rescue Kit]. Of the last 2, gave Knoppix a go when all of this started. There I can see the newly created "VM@GWLT" partition @ my Storage HDD, which is the result of running CloneDisk to rescue the OS of my notebook. That's the partition, sized about 35GB, which has "replaced" the 2 partitions of the 500GB Storage HDD [one the regular storage space, the other the TrueCrypt volume]. Unfortunately, @ Knoppix, I can't see them, but only VM@GWLT, along with my OS HDD.

Now having said that, do you think I should give the tutorial of creating a bootable Linux USB thumb drive a go? I might be answering my own question with this, but would that offer something new that GParted, Hiren's BootCD, Knoppix and/or TKR wouldn't? If you suggest I go for it, not a problem @ all. I have a spare thumb drive for just such an occasion. I'm willing to try any/all solutions for this <-- answering my own question.

Must admit, GParted & TeskDisk, have me excited as they seem to hold promise. God-willing, one of them'll do the trick. On a side note: there are a few programs that I have used religiously over the years & they've been very good to me. Examples: anything by Piriform, such as CCleaner, Defraggler, Recuva & Speccy; Revo Uninstaller; TeraCopy; File Shredder; FreeFileSync. These & a few others are must haves on all my Windows-based machines & I recommend them to anyone who'll listen. If one of these recovery ones works & I'm able to save my data, guess who's getting a nice donation for future software development :thumbup2:.

Anyways, before I try TestDisk, I'll run GParted first. Will post screenshots/photos here ASAP.

Again, can't thank you enough for your assistance.

#7 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 17 February 2012 - 04:58 AM

If you've already loaded a Linux distro onto that system, then you're right, it would be pointless to create yet another Linux distro even onto a removable drive. One is like the other, in that they are outside of Windows and installed, allows a side by side view of things. Since/if you've already done this without good results, then applying the same principle again is just plain...foolish.

Seems you're pretty hip to all the open source stuff available and it looks like you've run through them already as well without result. Doesn't look very good at this point I might add.

There is one last suggestion...Easeus is a decent piece of work and has a free version. I use it. There is an option available in the "Wizard" menu that allows for a scan/recovery of lost or deleted partitions. If you've not tried it then I would shoot for it before throwing in the towel.

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#8 MZAdotcom

MZAdotcom
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 18 February 2012 - 06:04 PM

Sorry for the late reply. To make a long story short, I had to take my entire PC apart, clean all it's components from A-Z & put them back together. Great learning experience.

I thought that might be the case with the Linux distros, but thanks for clearing it up. Going to still try pretty much every one of the leading ones, just so I can say I tried.

The main thing that nobody seems to have an answer for, so far, is if it's possible to undo a cloning process @ a HDD/partition. I say this because, again, my 500GB Storage HDD has been written over in the cloning. In Windows Disk Management & other HDD management tools, it shows the entire 500GB to still be there/intact. Meaning, the space, & maybe & more importantly, the files, are still there. So I'm thinking the new cloned files are sitting "on top" of the original ones. But If the answer is that once you clone a HDD to another, there's no way to reverse/undo it, then I'm doomed. Not giving up, though. I can't be the only person this has happened to.

A few days ago I run a program called DiskDigger @ Hiren's BootCD. It showed a lot of files [GB's worth] that are recoverable. The problem is it only shows the file types [.pdf, .odt, .tiff, etc.], not their actual names. I tested it with recovering 1 video file about 1.5GB in size & once it was done, it was corrupted pixelation.

So now that my system is back together, I will run GParted, TestDisk & EaseUS Partition Master as soon as I can & post the results here. Maybe it can help someone else who might have the same problem.

As always, thanks for the assistance. Cheers.

#9 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 19 February 2012 - 09:55 AM

...the entire 500GB Storage HDD @ E Drive is gone! It's been "replaced" by a 35GB one, which is the size of the cloned HDD of the notebook

From what few pieces of freeware I have ever used to clone a disk or partition, the software generally will copy the data from the source, and creates the clone without regard to the size of the target disk. In other words, the clone can be created and it will replace the original with the clone without having to go through any further configuration(s).

That said, your data should still be there. Can you read what's on the 35 gig drive? I have had no luck in finding a download for the clone disk freeware mentioned in the hbcd web page. Do you have a link to the download? I'll give it a shot and test it to see if I can undo a clone on my test box.

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#10 MZAdotcom

MZAdotcom
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 20 February 2012 - 05:18 AM

This was my first time cloning. As someone else has pointed out, the biggest mistake I made was cloning Disk to Disk. It was my lack of knowing what that fully meant. As you said, "the software generally will copy the data from the source, and creates the clone without regard to the size of the target disk".

Yes, the newly created partition of 35GB is readable. I can click into the area, open the folders, etc.

Regarding a CloneDisk download, I ran into the same problem of locating a site for it. What I did find was the same program @ 2 different links, both software from the same Russian guy/company: 1st LINK & 2nd LINK. I did email back & forth with a person @ HBCD. Maybe I should ask him where exactly they got theirs from.

Recreating the problem sounds like a fantastic idea. I'm thinking in the interest of expediency, would it be possible for you to burn the latest copy of HBCD & just run the Clonedisk that's packed there. That's the one I used, regardless of whoever makes it & whatever version it is. What do you think?

By the way, I wanted to ask you when you replied with the How To for GParted, how did you get the images in the actual body of your reply? Everytime I've done it here, I have to provide a URL link offsite.

Just a quick update on how the recovery is going: the weekend was hectic for me, but managed to run GParted. It basically said the Storage HDD is corrupt & unmountable. There was even a suggestion that I try another Linux distro environment. As soon as you share how you get images in the body of a reply, I'll post the details/photos. Going to run TestDisk & EaseUS tomorrow, hopefully.

Edited by MZAdotcom, 20 February 2012 - 05:30 AM.


#11 Platypus

Platypus

  • Moderator
  • 14,223 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:01:29 AM

Posted 20 February 2012 - 06:28 AM

As it appears now, I have lost all my critical work/life files from this drive amounting to over 10 years worth of work.

I've missed seeing this previously.

Not wanting to preempt 1972vet's heroic efforts on your behalf, but I would like to offer a couple of comments I feel could be be very important.

Firstly - don't don't don't attempt to run a software "repair" on the drive in its existing condition. As you've observed, it's not faulty or damaged, it's just that the image of the smaller drive has been overlaid on top of the existing data content.

Resign yourself to the loss of whatever was originally on that portion of the drive.

To give yourself the best chance of maybe recovering what is left, I strongly suggest you obtain a second drive of the same capacity or larger, and use cloning/imaging software to make a sector-for-sector copy of the affected drive. Put the original drive safely aside and attempt all recovery on this identical copy.

Ignore recovery software at the moment - the drive now appears to software to be the 35GB drive. Recovery software will find files that could be potentially recovered from that drive.

The biggest thing in your favor is that if the 500GB drive was set up as a single partition, the Master File Table (MFT) should have been located further into the drive than the 35GB image will extend. Can you confirm if there was only a single 500GB (nominal) partition on the drive?

As you've also observed, a major factor is the Partition Table - not that is is damaged, but that it is now the Partition Table for a 35GB drive. That's another reason "repair" software is not going to help, the drive structure is not faulty, it's completely valid - just wrong.

Initially, my suggestion would be to make an exact copy drive, and on that drive use partitioning software like GParted to re-create the state of the original Partition Table. So if the drive was a single partition occupying the entire drive (the best scenario), delete the existing partition information and create that single partition the size of the entire drive. Do nothing more.<< Edit: This doesn't mean stop following instructions - purely that this is the only change you should need to make in order for the recovery procedure to work correctly.

Then the drive will appear to recovery software as a 500GB drive with a damaged file system. With luck, good recovery software should be able to locate the MFT (which hopefully is not fragmented) and rebuild the file system.

The advantage of working with a copy of the drive is that if one recovery software gives up or messes up the drive, you can re-create the copy if necessary and try another.

I've seen forum posters I respect say GetDataBack was the software that saved them - it isn't free and I've fortunately never been in a desperate situation myself to need to try it. My minor recovery scenarios in the past have been handled mostly by PCInspector.

Edited by Platypus, 20 February 2012 - 04:28 PM.

Top 5 things that never get done:

1.


#12 1972vet

1972vet

  • Malware Response Team
  • 1,698 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midwest U.S.A.
  • Local time:09:29 AM

Posted 20 February 2012 - 10:24 AM

@MZAdotcom,
My apologies for the interruption. As complicated as your issue is, following advice from two or more assistants just adds to it. I don't know of any malware removal specialist who will work a thread alongside another assistant unless their has been a request for other eyes (which I didn't make).

So...Please carry on now with Platypus.

Disabled Veteran, U.S.C.G. 1972 - 1978
mvpsigpic.jpg
2009 - 2013

Member: U.N.I.T.E.
Performance and Maintenance for Windows XP, Windows Vista and Windows Seven


#13 Platypus

Platypus

  • Moderator
  • 14,223 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:01:29 AM

Posted 20 February 2012 - 04:23 PM

1972 vet, I've sent an apology to you for seeming like I wanted to take over from you, that wasn't at all the intention of my late-night posting.

Edited by Platypus, 20 February 2012 - 04:29 PM.

Top 5 things that never get done:

1.


#14 MZAdotcom

MZAdotcom
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:29 AM

Posted 21 February 2012 - 01:33 AM

@1972vet:

No apologies necessary. I haven't requested for anyone's assistance @ this site. The only other person to make suggestions was a guy from HBCD before I posted @ bleepingcomputer.com. You've helped me so far & I thank you for it. Hope you can continue to make suggestions. I'm sure Platypus was only trying to help & not intending to swoop in on this thread...

@Platypus:

Thanks very much for your advice. Having a safe way to test/recover the HDD/files in question sounds like a brilliant idea. I actually have another 500GB HD coming in in 7-10 days, so this should work out.

A quick update: ran TestDisk earlier today & after a 2 hour, deep scan, it said, to my dismay, the partition table[s] it discovered is/are not recoverable. So far, I'm 0 for 2 with GParted & TestDisk not working. The good news is that of the 3 programs, only EaseUS Partition Master shows info the other 2 did not display. I can actually see the 2 partitions I had @ my Storage HDD now, 1 the regular where all my critical files are & the 2 the TrueCrypt volume. I've taken pictures & screenshots of everything. As soon as I figure out how to get the images in the actual body of my reply, like 1972vet did a few posts back, I'll put 'em up.

I appreciate the both of you giving a helping hand. Means a lot of me. Impressed with the level of help @ this site.

#15 Platypus

Platypus

  • Moderator
  • 14,223 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:01:29 AM

Posted 21 February 2012 - 03:32 AM

@Platypus:

You are kind, MZAdotcom. My intent is always and only to help. I sincerely hope 1972vet is not really offended at my intervention, which is actually outside of site protocol as I had not noticed it isn't in a hardware forum, but in malware.

My greatest concern was (and is) that operating your own investigations on the original drive might harm the prospect of 1972vet's sterling work on your behalf being successful. Since it was extremely late at night and I couldn't wait and see your responses, I posted my suggestion and went to bed.

I find it most unfortunate that it looks like I'm suggesting you stop following 1972vet's advice, whereas I hoped to dissuade you from running your own forensic investigations on the drive vet was working with.

I hope 1972vet will consent to continue helping you - as I said above, I have offered my apology to him and acknowledged the correct procedure would have been to privately offer my suggestions to him, as he was your helper.

Top 5 things that never get done:

1.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users