Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

NTFS to RAW to FAT16


  • Please log in to reply
31 replies to this topic

#1 Klobered

Klobered

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 03:25 PM

I have a situation with a 1T SimpleSave MD1000h connected to an HP Pavilion dv-7 laptop running W7. The computer works fine, but slows to a crawl when the ext. hdd is connected. Also, I see the SimpleSave icon in the tray, but the backup program no longer runs.

Following the steps here at http://html5.litten.com/how-to-fix-external-disk-drive-suddenly-became-raw/, I am at the point where the deeper search is being conducted when I see:

Screenshot - 01142013 - 11:34:04 AM.png

My issue is that W7 eventually does see this drive, but cannot read it because it thinks it is in RAW format. Testdisk shows it as still being NTFS, but with this FAT16 issue popping up during deeper search.

I believe all the files are still on the drive so the goal is to repair without a full erase and reformat of the SimpleSave drive.

Thanks in advance for your help!

P.S. Running now from live parted magic cd... my image did not post. What can I do to insert my screenshot?

Edited by Klobered, 14 January 2013 - 04:40 PM.


BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 04:33 PM

Hi Klobered

Let's run TestDisk again but this time we'll be sure to create the testdisk.log file.

Boot into PartedMagic with the external drive connected.
Open the Terminal window and type
testdisk
and press enter

This time select CREATE and press enter (this will create the file testdisk.log in the root folder which is a folder stored in the computer's RAM so it is erased when the computer is shutdown).
You should now see a list of drives including your external drive.
If you have any difficulty identifying which one it is, let us know what you see and we'll help you figure it out.
Select the external drive and choose Proceed and hit enter
It should automatically have Intel or EFI GPT selected (if not, select Intel and let me know) hit enter
Select Analyse and hit enter
Select Quick Search and hit enter
Say 'Y' if it asks if the disk was made in Vista/Win7 (even if it was made in XP say 'yes')

If you see what looks like a normal partition, highlight it and press
p
and see if you can see your files and folders there.
If there is more than one partition check each one for files and folders by getting back to the list of partitions found (pressing q), highlighting the next one and pressing p again.

If you can see your files and folders and it all looks normal then stop here and go down to the section below called POST TESTDISK.LOG

If anything does not look correct then continue on to the DEEPER SEARCH. Get to the screen showing the partitions that it found and press ENTER to coninue.
DEEPER SEARCH is an option at the bottom of the screen.
Highlight it and press ENTER

After the DEEPER SEARCH finishes do the same thing with pressing p to see if you can see your files and folders in any of the partitions found and then press
q
a bunch of times to get out of TestDisk.

POST TESTDISK.LOG

On the PartedMagic desktop, double-click the File Manager icon.
In the left pane, you should see a folder called
root
(actually it is usually open when you start File Manager this way)
Locate the testdisk.log file in that folder
Double-click it to open it.
Select all of the text in it and paste that text in your reply for us to look at.
Hopefully, you can open Firefox in PartedMagic and login here and reply. There is a wireless network connection icon in the lower right (by the clock) of the PartedMagic desktop if you need to connect to a wireless network.

If you can not get an internet connection from PartedMagic, you will need to mount the internal drive and copy the testdisk.log file from the root folder to your internal drive. Then you can get it to us via posting from Windows (Let us know if you need directions for doing this).

If anything looks different than I described or you have any questions/problems, stop and ask.

James

#3 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 06:13 PM

James,

Thanks for your direction. This is all new to me, particularly working in Linux from the live Parted Magic CD, and I have no experience with partitions.

How do I insert a screenshot? I want to show you what is happening, but the Insert Image button wants to go to a web address, and I see no option to load a file in memory from the pictures folder at /root. This is where I save them from Screenshot. Here is the path: '/root/Pictures/Screenshot - 01142013 - 02:38:47 PM.png'.

Since that doesn't work, here is a copy and paste of the Testdisk screens"

Starting at the Analyze screen:
TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Current partition structure:
Partition Start End Size in sectors

1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
--------------------------------------------------
Of the Quick Search:
TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 999 GB / 930 GiB
----------------------------------------------------------------------------
Of the files on the partition:

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
Directory /

>dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
-r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll


Use Right to change directory
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
-------------------------------------------------------------------------

I can go into Deeper Search if necessary, but the last one ran over 13 hours and only made it to 66%. Hopefully the information provided will give you a better idea of what I am faced with, and what direction to go.

#4 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 06:37 PM

James,

Here is the testdisk log that I currently have:

Mon Jan 14 14:36:25 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.6.10-pmagic (#1 SMP Mon Dec 17 13:06:57 CST 2012) i686
Compiler: GCC 4.7
Compilation date: 2012-11-18T10:24:11
ext2fs lib: 1.42.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500325AS, S/N:5VE0GRR5, FW:0001SDM1
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63, sector size=512 - HP External HDD, FW:1028
Disk /dev/sr1 - 700 MB / 668 MiB - 342016 sectors (RO), sector size=2048 - HP Virtual CD 4607, FW:1028

Partition table type (auto): Intel
Disk /dev/sdb - 999 GB / 930 GiB - HP External HDD
Partition table type: Intel

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll
Change partition type:
* FAT32 LBA 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Change partition type:
* FAT32 LBA 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
partition_save
Results saved in backup.log.

interface_write()
1 * FAT32 LBA 0 1 1 121515 254 63 1952154477 [HP SimpleSave]

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Change partition type:
P HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 P HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 999 GB / 930 GiB - HP External HDD
Partition table type: Intel

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=208 sector=35
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
No partition is bootable
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800020001) of index buffer is different from expected VCN (0x0) in inode 0x5.

search_part()
Disk /dev/sdb - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/1/1
filesystem size 1952151488
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122009467
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 121515 207 35 1952151488 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
* HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
NTFS, blocksize=4096, 999 GB / 930 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 .
5 dr-xr-xr-x 0 0 0 12-Jan-2013 18:12 ..
30286 -r--r--r-- 0 0 90128 7-Nov-2007 15:44 install.res.1033.dll

interface_write()
1 * HPFS - NTFS 0 1 1 121515 254 63 1952154477 [HP SimpleSave]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

#5 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 07:09 PM

Hi

The testdisk.log file shows me what you see on the screens (and some more stuff) so there is no need for screenshots yet but I do appreciate you trying to get ALL the information to us.

What I see is some filesystem damage instead of just partition or boot sector problems. When this happens, you need to do a data recovery before attempting a repair. A repair may cause the loss of data.

I'd like to see the condition of the drive. You already have everything that you need to show me that.

Boot into PartedMagic

Check SMART status of drive
After PartedMagic loads, double-click the Disk Health icon on the desktop and then double-click the icon for your hard drive.

Click on the PERFORM TESTS tab.
Make sure that the Test Type is set to Short Self-Test and click the EXECUTE button
I will need to know if it passed or not.
Next click the ERROR LOG tab and let me know if there are any entries and if there are let me know what the rows say.
Next select the ATTRIBUTES tab and let me know what the raw values are for the ID's listed there.

If you can connect to the internet from PartedMagic use Firefox (icon on the desktop) to login here. You can get a report from the Disk Health program by clicking the VIEW OUTPUT button. Copy and paste it in your reply here for both drives and that will tell me everything.

If you don't have an internet connection while in PartedMagic,
I need to know...
  • Did it pass the Short Self-Test?
  • Any entries in the Error Log
  • The Attributes list (at least the RAW VALUES for ID's 1, 5 and 197 if you have to type them by hand in your reply)

There are more detailed instructions with pictures here

James

#6 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 07:28 PM

I need to add something here. The SimpleSave drive does some kind of encryption to the drive whether you set it or not. That is probably what is preventing us from seeing it.

What tipped me off was the virtual CD drive listed in the testdisk.log

Disk /dev/sr1 - 700 MB / 668 MiB - 342016 sectors (RO), sector size=2048 - HP Virtual CD 4607, FW:1028

This means that HP does some non-standard things with the drive that these tools probably can't fix.

The virtual CD is actually on a chip inside the enclosure so if there is a problem with the enclosure or a problem with that virtual CD talking to the drive (as in your case) it will show an empty partition like yours is showing in TestDisk.

I found this quote that sums it up...

It will show only unallocated space. There is no way to
remove the CD formatted partition. It can't be deleted because it is a hardware
partition. If the enclosure ever fails all data is unrecoverable and unrecognizable.
HP does it again with their proprietary hardware


Can you tell us if anything unusual happened before you started having problems or did it just stop working one day?

James

#7 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 08:02 PM

Hi James,

When dbl. clicked in GSmart, the External HDD displays the red triangle with the exclamation point in the center. It says "No additional information is available for this drive." When I click the Show Output button, it opens a window reading:
smartctl 6.0 2012-10-10 r3643 [i686-linux-3.6.10-pmagic] (local build)
Copyright © 2002-12, Bruce Allen, Christian Franke, www.smartmontools.org

Vendor: HP
Product: External HDD
Revision: 1028
User Capacity: 999,501,594,624 bytes [999 GB]
Logical block size: 512 bytes
Serial number: WCAV53451017
Device type: disk
Local Time is: Mon Jan 14 16:54:41 2013 UTC
Device does not support SMART

Error Counter logging not supported
No self-tests have been logged

As near as I can tell, this all started around 12/8/12 and there may have been a power outage, but I can't say for certain.

Can't thank you enough...

#8 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 08:28 PM

I'm not surprised. It is probably related to the customization that the enclosure's electroncs perform.

I did a quick look around at some other data recovery places and found a few more examples like yours. SimpleSave drives that had gone bad and showed empty partitions in data recovery tools (yours shows install.res.1033.dll which is used by the SimpleSave user interface but no other files). Almost all of them were related to power adapters going bad or being replaced and afterwards they had the same problem as you. A power outage certainly sounds like a possible cause.

Unfortunately none of the examples I found ended with the data being recovered.

You can try contacting HP support and see if they have a solution for this.

Even if you could find a data recovery software that would see the files on it, I imagine that they are probably not normal files but are in some proprietary format that only the software on the virtual CD can decode them.

I wish I had better news for you.

James

#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 08:37 PM

Is there a specific type of data that you need to recover?
Like photos or videos or documents?

We can try PhotoRec which is included in PartedMagic. Someone just told me that it might work but it will not recover the filenames or directory structure.

James

#10 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 09:03 PM

James,

It is used primarily for a backup drive so perhaps there is nothing that can be done for recovery, but is there a way to test the drive, other than just reformat, reload SimpleSave software, and put it back to work - or would you even recommend doing so? If there is any chance it could wipe out the laptop, I would rather just replace the drive and start over.

#11 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 09:06 PM

I suppose it wouldn't hurt to try PhotoRec. Really nothing to lose at this stage...

#12 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 14 January 2013 - 09:31 PM

If you don't mind the possibility of losing some data on the external drive (you probably won't lose any) then you can try to get chkdsk to run on it.

You can try this two ways.

1. Just start Windows with the drive not connected.
After Windows finishes loading, open Windows Explorer and go to 'Computer' so you can see the list of drives on the computer.
Plug in the external drive
Go make a sandwich
Come back and see if there is a drive listed for the external drive
If there is, right-click it and choose PROPERTIES
Go to the TOOLS tab
Click CHECK NOW
check both checkboxes and click START

If it works great, if not then onto

2. Shutdown the computer
Keep the bad drive connected this time
Turn on the computer and start pressing F8 so you get the Advanced Boot Options menu (has stuff like Safe mode on it)
Choose REPAIR YOUR COMPUTER
Go through the prompts until you get to the SYSTEM RECOVERY OPTIONS window
Choose COMMAND PROMPT
Type
notepad
and press enter
Click FILE then SAVE AS and click COMPUTER to list the drives
This is how you find out what drive letter the external drive has let's say it is E:
so now you cancel out of this and close notepad
At the command prompt type
chkdsk E: /r
(replace E: with whatever letter your external drive is)

If this doesn't work, I'll get together some instructions for trying PhotoRec.

James

#13 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 14 January 2013 - 09:44 PM

I will re-boot and perform #2, James. I know that if I start with the external hdd connected and go into Windows, it would be tomorrow before I could do anything with it (the ext. hdd). Back to you when I see what it does.

Thanks again,
Klobered (by this one!)

#14 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 AM

Posted 15 January 2013 - 12:26 PM

Hi Klobered

I'm trying to get my hands on a SimpleSave drive that is being used for backups so I can see exactly how that virtual CD works and how it stores the backups. So far I'm not finding any amongst clients and friends but I'll let you know if I come up with something else.

Let me know if/when you are ready for some PhotoRec instructions.

James

#15 Klobered

Klobered
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 15 January 2013 - 12:44 PM

Hi James,

Chkdsk has been running since my last post. For the past 5 hours (that I know of) It has been holding at:
Verifying file data <Stage 4 of 5>... 10 percent complete. <16763 of 100592 files processed>

If there continues to be no change, then at some point I will have to cut my losses and maybe give PhotoRec a try. Everything I have read about Chkdsk /r seems to indicate that it will eventually continue, so I am going along with it for now, unless you have other inclinations... it appears to have done a substantial amount of recovery to this point.

Thanks for checking back with me,
Klobered (still)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users