Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HDD files recovery, I hope.


  • Please log in to reply
48 replies to this topic

#16 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 06:21 AM

OMFG!! I THINK ITS WORKING!! But I had to use PhotoRec Plus TestDisk.. there's recover folder made, and MP3s, JPGs, and etc.. songs and etc.. going into it!! YES!! :D I hope I get it ALL BACK!!

BC AdBot (Login to Remove)

 


#17 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 06:26 AM

But i'd rather have that drive "compiled" together again tho.. proper...

#18 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 03:51 PM

Is there a way to maybe repair this properly even though the heads/cylinders weren't right? With Paragon manager or whatever? What would be best method of doing this

#19 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:56 PM

Posted 15 June 2012 - 04:06 PM

Sit tight for a little while: I would like to consult with James before I jump in here.

I think it very likely that the drive can be recovered to its former state quite easily .... using TestDisk.

Please be patient ... and do not do anything that might make the situation worse.

Perhaps you might attempt to fill in the gap between the following two posts of yours and tell us exactly what you did and what you saw on-screen.

alright, here's what TestDisk said after running search/scan whatever...

Warning: the current number of heads per cylinder is 135 but the correct value maybe 240. You can use the geometry menu to change this value. It's something to try if:
some partitions aren't found by TestDisk
or the partition table can not be written because partitions overlaps.

Option to Continue... Not sure after that then.. ?


>>>> There's a lot of information needed from you at this stage, if we are to provide any useful guidance.

I THINK ITS WORKING!! But I had to use PhotoRec Plus TestDisk..


AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#20 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 04:17 PM

Okay, sure.. :) And here's testdisk.log...

Fri Jun 15 10:26:15 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-06-14T10:11:31
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=164696555520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=164696555520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500105740288
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 164 GB / 153 GiB - CHS 170197 135 14, sector size=512 - WDC WD1600YS-01SHB1, S/N:2020202057202d44435750413330303037393938, FW:20.06C06
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-65YGA0, S/N:2020202057202d44435753413338303838333837, FW:12.01C02

Partition table type (auto): Intel
Disk /dev/sda - 164 GB / 153 GiB - WDC WD1600YS-01SHB1
Partition table type: Intel
New geometry
Disk /dev/sda - 164 GB / 153 GiB - CHS 90105 255 14 sector_size=512
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=135 sector=14
BAD_RS LBA=2048 1513
NTFS at 0/146/5
heads/cylinder 224 (NTFS) != 255 (HD)
sect/track 19 (NTFS) != 14 (HD)
 1 * HPFS - NTFS              0 146  5    57 239 12     204800 [System Reserved]
     NTFS, blocksize=4096, 104 MB / 100 MiB

Analyse Disk /dev/sda - 164 GB / 153 GiB - CHS 90105 255 14
Geometry from i386 MBR: head=135 sector=14
BAD_RS LBA=2048 1513
NTFS at 0/146/5
heads/cylinder 224 (NTFS) != 255 (HD)
sect/track 19 (NTFS) != 14 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 224 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 19 (NTFS) != 14 (HD)
 1 * HPFS - NTFS              0 146  5    57 239 12     204800 [System Reserved]

Warning: Bad starting sector (CHS and LBA don't match)

Basically after I ran the TestDisk and got that warning/error message... I searched google about it, and stumbled on this thread the person at the end suggested...which linked to TestDesk + PhotoRec... http://forum.cgsecurity.org/phpBB3/filesystem-seems-damaged-t229.html

Which I had already downloaded anyway, PhotoRec came with this TestDisk version I downloaded. So I basically went through all the same steps, as that page you showed me previously... Except I did a WHOLE scan instead of the quicker search... And it started listing/finding files, saving them all into "recup_12" directories in TestDisk program folder...

I believe it restored all my files, but they're all scattered about in various "recup" folders from 1 through 100 something.. I didn't do anything more with this drive, so nothing has been touched...

#21 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:56 PM

Posted 15 June 2012 - 04:23 PM

Thanks: That looks like a very useful start.

Let's wait and see what James has to say.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#22 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 04:26 PM

Thanks: That looks like a very useful start.

Let's wait and see what James has to say.


Sure.. :) But yeah, that message came after the first scanning with TestDesk, from that Tut page you linked me first. THEN, got that message after it was done 100%... I searched google about that message, not much showed up really... except that thread there... hence giving TestDisk + PhotoRec a try.. and actually was able to get files.. lol. Oh, and some trojans.exe files were found by ESET and MSE... and they removed them / quarantined them.. and deleted them. They weren't "ran/run"... Just found and removed. I thought... craaap!! not again!! lol!!

6/15/2012 9:25:54 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.158\f317636328.exe	a variant of Win32/TrojanDownloader.FakeAlert.FL trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 9:25:51 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.158\f317633672.exe	a variant of Win32/TrojanDownloader.FakeAlert.FL trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 9:22:44 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.149\f310852880.exe	a variant of Win32/Kryptik.AT trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 9:20:42 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.147\f306664312.exe	a variant of Win32/Kryptik.ATU trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 9:14:34 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.143\f303406976.exe	a variant of Win32/Kryptik.CBE trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:52:57 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.131\f235972576.exe	probably a variant of Win32/Nuwar worm	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:52:55 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.131\f235958024.exe	a variant of Win32/Kryptik.BXV trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:46:56 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.95\f226349008.dll	Win32/Adware.SpywareCease application	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:39:23 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.93\f217729832.exe	a variant of Win32/Kryptik.AT trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:33:30 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.85\f212405536.exe	Win32/Adware.SpywareCease application	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:21:10 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.77\f197473336.exe	a variant of Win32/Kryptik.AT trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/15/2012 8:19:24 AM	Real-time file system protection	file	C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\recup_dir.75\f194069736.exe	a variant of Win32/TrojanDownloader.FakeAlert.GI trojan	cleaned by deleting - quarantined	spencer-PC\spencer	Event occurred on a new file created by the application: C:\Users\spencer\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP\photorec_win.exe.
6/14/2012 10:41:16 PM	HTTP filter	file	http://software-files-a.cnet.com/s/software/12/53/40/91/media.player.codec.pack.v4.2.0.setup.exe?token=1339763835_d9f901aec6422a147f86f8aeb7288ad1&lop=link&ptype=3000&ontid=13632&siteId=4&edId=3&spi=92b35ed34f07aabf96b6dfc5065d7d6a&pid=12534091&psid=10749065&&fileName=media.player.codec.pack.v4.2.0.setup.exe	probably a variant of Win32/Toolbar.Widgi potentially unwanted application	connection terminated - quarantined	spencer-PC\spencer	Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

Edited by Twisted13, 15 June 2012 - 04:32 PM.


#23 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:11:56 PM

Posted 15 June 2012 - 04:45 PM

Hi

Can you get a stable version of Testdisk and try that?

You used TestDisk 6.14-WIP (WIP is Work In Progress aka beta)

http://www.cgsecurity.org/wiki/TestDisk

Get 6.13

I've had a lot of problems lately that had to do with people using distributions with the WIP instead of the latest stable version. Hopefully, the stable version won't have the size/geometry error.

You can run it from Windows. The right-click the program testdisk_win.exe and RUN AS ADMINISTRATOR.

Let me know if you have any problems and post the new log file.

James

#24 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 04:51 PM

Hi

Can you get a stable version of Testdisk and try that?

You used TestDisk 6.14-WIP (WIP is Work In Progress aka beta)

http://www.cgsecurity.org/wiki/TestDisk

Get 6.13

I've had a lot of problems lately that had to do with people using distributions with the WIP instead of the latest stable version. Hopefully, the stable version won't have the size/geometry error.

You can run it from Windows. The right-click the program testdisk_win.exe and RUN AS ADMINISTRATOR.

Let me know if you have any problems and post the new log file.

James


Oh okay, sure! Will get that now and try it... I'm currently running "Lost Partition Recovery" as well.. and it's finding tons of files. But yeah, I'll install TestDisk 6.1.3 and report back.. :)

#25 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 05:51 PM

Scan about 60% now, but I'm getting ALL my stuff back though regardless... Since I got that MiniTool Power Data Recovery program... All my photos, in proper order in their original folders and layout... I'm assuming the Videos and Music are the same way... But yes!! :D

I was gonna delete all the extra junk, but figured I best not... Until TestDisk is done and you guys can maybe figure out how to restore HDD back to "normal" lol. I think with this tool, I can delete each individual partition/section area... till its ONE complete section?

Edited by Twisted13, 15 June 2012 - 06:15 PM.


#26 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 06:43 PM

Okay.. I ran that other stable version of TestDisk... and still got same message...
Warning: the current number of heads per cylinder is 135 but the correct value maybe 240. You can use the geometry menu to change this value. It's something to try if:
some partitions aren't found by TestDisk
or the partition table can not be written because partitions overlaps.

Option to Continue...

Not sure after that then.. ?



Fri Jun 15 17:54:14 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=164696555520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=164696555520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500105740288
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
file_pread(4,1,buffer,321674219(170197/134/14)) lseek err Invalid argument
file_pread(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 164 GB / 153 GiB - CHS 170197 135 14, sector size=512 - WDC WD1600YS-01SHB1, S/N:2020202057202d44435750413330303037393938, FW:20.06C06
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-65YGA0, S/N:2020202057202d44435753413338303838333837, FW:12.01C02

Partition table type (auto): Intel
Disk /dev/sda - 164 GB / 153 GiB - WDC WD1600YS-01SHB1
Partition table type: Intel

Analyse Disk /dev/sda - 164 GB / 153 GiB - CHS 170197 135 14
Geometry from i386 MBR: head=135 sector=14
BAD_RS LBA=2048 1513
NTFS at 1/11/5
heads/cylinder 224 (NTFS) != 135 (HD)
sect/track 19 (NTFS) != 14 (HD)
Current partition structure:
Warning: Incorrect number of heads/cylinder 224 (NTFS) != 135 (HD)
Warning: Incorrect number of sectors per track 19 (NTFS) != 14 (HD)
 1 * HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]

Warning: Bad starting sector (CHS and LBA don't match)
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Computes LBA from CHS for Disk /dev/sda - 164 GB / 153 GiB - CHS 170198 135 14
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sda - 164 GB / 153 GiB - CHS 170198 135 14
NTFS at 1/11/5
heads/cylinder 224 (NTFS) != 135 (HD)
sect/track 19 (NTFS) != 14 (HD)
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]
     NTFS, 104 MB / 100 MiB
NTFS at 160016/0/1
heads/cylinder 255 (NTFS) != 135 (HD)
sect/track 63 (NTFS) != 14 (HD)
filesystem size           210944
sectors_per_cluster       8
mft_lcn                   8789
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          160016   0  1 160127  82  6     210944
     NTFS, 108 MB / 103 MiB
file_pread(4,2,buffer,321673216(170197/63/5)) lseek err Invalid argument
file_pread(4,1,buffer,321673216(170197/63/5)) lseek err Invalid argument
file_pread(4,2,buffer,321674378(170198/11/5)) lseek err Invalid argument
file_pread(4,1,buffer,321674378(170198/11/5)) lseek err Invalid argument
file_pread(4,2,buffer,321674392(170198/12/5)) lseek err Invalid argument
file_pread(4,1,buffer,321674392(170198/12/5)) lseek err Invalid argument
file_pread(4,7,buffer,321673217(170197/63/6)) lseek err Invalid argument
file_pread(4,8,buffer,321673224(170197/63/13)) lseek err Invalid argument
file_pread(4,3,buffer,321673232(170197/64/7)) lseek err Invalid argument
file_pread(4,3,buffer,321673279(170197/67/12)) lseek err Invalid argument
file_pread(4,8,buffer,321673295(170197/68/14)) lseek err Invalid argument
file_pread(4,11,buffer,321673342(170197/72/5)) lseek err Invalid argument
file_pread(4,2,buffer,321675264(170198/74/9)) lseek err Invalid argument
get_geometry_from_list_part_aux head=135 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
Warning: the current number of heads per cylinder is 135 but the correct value may be 240.

Results
   * HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]
     NTFS, 104 MB / 100 MiB
   P HPFS - NTFS          160016   0  1 160127  82  6     210944
     NTFS, 108 MB / 103 MiB
Not an exFAT boot sector.

   P HPFS - NTFS          160016   0  1 160127  82  6     210944
     NTFS, 108 MB / 103 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
   * HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]
     NTFS, 104 MB / 100 MiB
Directory /
       5 dr-xr-xr-x     0      0         0 14-Jun-2012 18:32 .
       5 dr-xr-xr-x     0      0         0 14-Jun-2012 18:32 ..
      35 dr-xr-xr-x     0      0         0 14-Jun-2012 19:23 Boot
      85 -r--r--r--     0      0    383786 20-Nov-2010 16:29 bootmgr
      96 -r--r--r--     0      0      8192 14-Jun-2012 19:23 BOOTSECT.BAK
      97 dr-xr-xr-x     0      0         0 14-Jun-2012 18:32 System Volume Information

interface_write()
 1 * HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]
 2 P HPFS - NTFS          160016   0  1 160127  82  6     210944
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 164 GB / 153 GiB - CHS 170198 135 14
Geometry from i386 MBR: head=135 sector=14
BAD_RS LBA=2048 1513
NTFS at 1/11/5
heads/cylinder 224 (NTFS) != 135 (HD)
sect/track 19 (NTFS) != 14 (HD)
Current partition structure:
Warning: Incorrect number of heads/cylinder 224 (NTFS) != 135 (HD)
Warning: Incorrect number of sectors per track 19 (NTFS) != 14 (HD)
 1 * HPFS - NTFS              1  11  5   109  59 12     204800 [System Reserved]

Warning: Bad starting sector (CHS and LBA don't match)

dang! now i gotta scan it all over again.. to get back that page again.. where i need be.. :(

Edited by Twisted13, 15 June 2012 - 06:52 PM.


#27 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 07:09 PM

I'm running another new scan again, since I hit ESC too much and started at screen again to "Analyze" and etc.. It's at 38%... but in that other program... MiniTool Power Data Recovery I can select the drive, and hit "Recover" button... ? I got ALL my files off of this HDD so you guys know.. so really now its just matter of totally wiping it and starting fresh.. unless the drive is toast?

#28 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:11:56 PM

Posted 15 June 2012 - 07:12 PM

Hi

I'll put together some instructions for you and post them in a little while.

James

EDIT: Ooops just saw your last post.
Since the drive has infected files on it, I would probably just get the important files off of it and then wipe it and reformat it. Then test it for bad sectors (a full format should do this in Win 7 not the 'quick format').

Let me know if you still want to try to save the drive with the data intact or if you have any difficulty reformatting it.

Edited by NeverSayDie, 15 June 2012 - 07:14 PM.


#29 Twisted13

Twisted13
  • Topic Starter

  • Members
  • 81 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 15 June 2012 - 07:13 PM

Oh okay, thanks James! :)

#30 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:11:56 PM

Posted 15 June 2012 - 07:15 PM

Doh!

See my edit above LOL

EDIT: Ooops just saw your last post.
Since the drive has infected files on it, I would probably just get the important files off of it and then wipe it and reformat it. Then test it for bad sectors (a full format should do this in Win 7 not the 'quick format').

Let me know if you still want to try to save the drive with the data intact or if you have any difficulty reformatting it.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users