Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recovery Effort


  • Please log in to reply
13 replies to this topic

#1 hyde34

hyde34

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 20 February 2013 - 05:27 PM

Mod Edit:  Split from http://www.bleepingcomputer.com/forums/t/481048/external-drive-showing-raw-data-after-removal-without-ejecting/page-2#entry2983287  - Hamluis.

 

Hi, I am trying to recover an external 250GB hard drive that I placed in external enclosure, originally from a laptop.
It suddently went RAW yesterday, and overnight after 18 hrs I could only copy 2GB of data, which is very slow. So I cancelled recovery and tried to fix the drive. I am running testdisk from Desktop, trying to recover USB drive. At first attempt everything was OK and I thought it fixed it but then It only recovered the hidden partition (which was a hidden recovery partition for laptop) but the storage partition is still missing in Windows.
 
After few tries, now I am getting this:
2c3e89425916d8c314a213ebea8963f8.png
 
before this I tried to change the small partition to L and large one to P, before that I tried to make them both P, neither method made the RAW available to Desktop.
 
a9fc89898c8af7131c5dfae1246fd701.png?136
 
It says Structure is Bad when I cycle L/P/*. But when I check BOOT from Advance, it says it matches..
 
90e9ef9515b765241733f109a7cf50b4.png?136
 
Like I said I am running this straight from Windows, is it really necessary to run parted live OS? Or can this whole thing be done from Win?
Thanks in advnace to all who helped others so far.
 

Should I just delete the 1st partition forcing to keep only 2nd larger partition where all my data is? Any guidance is appreciated.
 


Edited by hamluis, 20 February 2013 - 06:42 PM.
PM sent new OP - Hamluis.


BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 20 February 2013 - 06:53 PM

Hi Hyde34

 

When you select the second partition like in that last picture, you want it to be P

 

Now if you have that partition highlighted and press the letter

P

on your keyboard, does it show you your files and folders that are on that partition?

 

James



#3 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 20 February 2013 - 07:05 PM

Hi Hyde34

 

When you select the second partition like in that last picture, you want it to be P

 

Now if you have that partition highlighted and press the letter

P

on your keyboard, does it show you your files and folders that are on that partition?

 

James

 

Hi James,
Yes, when I hit P I can see all my files & folders.

It is very odd, so I was experimenting with all possible combinations, * + P, D+P, etc.. because no matter what I try, I kept seeing that 1st partition (recovery part) but not the main storage partition in windows explorer.

After I tried one more combination, now I think I totally messed it up, now it does not even show up in the tool anymore and I am getting "not initialized" message from Windows Disk Management

 

45ba5aec27eef2183d6f17e47de50dad.png?136

 

 

Up until now, it used to show up as RAW.

It still shows in Computer with drive letter without access.

 

 

 

 

31ccc3f7bae4362efa4df69cd5fe7811.png?136

 

 

I will removed the drive, restarted and retried with testdisk_win.

After a very long "Please wait..." and lots of blinking on the troubled drive, it reappeared in the software.

 

71de94f0939434d7f1694b25c330f22f.png?136

 

Hitting proceed:

e45f2f8fe264d1399bcca9b28bd51ccb.png?136

I am posting above sector info in case that makes any sense to you or others..

Analyzing results:

 

04d8e04c1fc4d36069038c1ef65c9d4f.png?136

 

 

--

 

ea2d23887a40511859bcc36f611d61f8.png?136

 

Result of Quick Search, one is P, yet still not showing in windows explorer/my computer:

 

4418fec0a828ce7c5df6d661ce66f49d.png?136

 

I can see the files by hitting P:

 

5044a7eff7594507c8655b7735c4755c.png?136


Edited by hyde34, 20 February 2013 - 07:32 PM.


#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 20 February 2013 - 08:31 PM

From the last picture you posted showing files and folders press

Q

to get back to the list of partitions (the second to last picture you posted).

Press ENTER to continue

Choose WRITE

Say Y when asked to confirm writing the partition table.

Then it will ask you to reboot (if there are problems with the boot sector, it will ask to fix that at this point. Let us know if this happens)

 

After rebooting, does Windows see it normally?

 

James



#5 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 20 February 2013 - 08:34 PM

Thanks James,

I went and hit enter

with * for 1st Partition and P for 2nd Partition as above

 

11ab4bd5ee3741548baf475b0de54353.png?136

 

Hit Write


1f1b6e1d4adfe810f2b3d7d8f0983862.png?136

 

 

After confirming, it takes a split second before I get the following. Does it really write anything? I cannot tell..

0fbe2e8582c03e72d65d738c41ed2aa1.png?136

 

c4795b08dde2ee2d8aa70f5e9c9454b8.png?136

 

At this stage I just go to quit, then quit again, and then should I restart with USB plugged in or do I eject then restart, or should I be seeing my drive now? It feels like when I restart something gets overwritten. Even as I speak I see the light on USB drive blinking even though I am not writing on it.



#6 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 20 February 2013 - 08:43 PM

It just writes a very tiny piece of data to the first sector of the disk. Reboot into Windows with it attached and if it worked it should look normal and not ask you to format it.

 

James



#7 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 20 February 2013 - 09:23 PM

I tried, like before only the "recovery partition" comes back, but the other one remains RAW. This is why I wanted to somehow get rid of the recovery partition of 1.5GB, I don't know if I am choosing the wrong combination or else, but after restart I get this:

 

de27e0d6d1664e0ca4943f33b72d8009.png?136

 

It is Disk 2.

 

3ed80ec7569db1ebc0e48466c4add321.png?136

 

 

 

 

I am doing this within windows, I am not using a live CD or any other 3rd party application. I assume it is OK, right? Since this is an external hard drive, I am just running it within Windows.

 

testdisk is now showing me:

 

ea28c74c57d43ee4fccb00be53b24d92.png?136

 

Result of Quick Search:

 

131b6138e51214dfe2e0ce9fac9dbb58.png?136

 

Hitting Continue:

 

355eef3bf6c03a6d7b36afb6c79310fe.png?136



#8 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 20 February 2013 - 09:58 PM

Hi

 

Deleting the first partition should not affect the second partition. Or if it does, it would be because of something like an overlap and would cause even more problems if you delete it. So I would not reccomend doing it.

 

There is probably damage to the disk drive or damage to the meta files of the filesystem on the second partition. You may need to do a data recovery rather than a repair.

 

Can you post the Testdisk.log file? It's in the directory where the testdisk executable is. It may give a clus as to what is happening.

 

James



#9 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 20 February 2013 - 10:31 PM

I did not keep a log, but I quit and ran it again with a log here is what I got:

 



Wed Feb 20 22:09:22 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-02-11T11:20:27
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=7960788992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=7960788992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308326432768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1572864000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7959740416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=248485249024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=10485760000
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - HITACHI HTS723232A7A, S/N:3E385436NJ77NR, FW:EC2Z
Disk /dev/sdb - 7960 MB / 7592 MiB - CHS 967 255 63, sector size=512 - RICOH R5C822, S/N:0001, FW:01
Disk /dev/sdc - 250 GB / 232 GiB - CHS 208716 90 26, sector size=512 - TOSHIBA MK2546GSX

Partition table type (auto): Intel
Disk /dev/sdc - 250 GB / 232 GiB - TOSHIBA MK2546GSX
Partition table type: Intel

Analyse Disk /dev/sdc - 250 GB / 232 GiB - CHS 208716 90 26
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 864
NTFS at 0/78/21
heads/cylinder 255 (NTFS) != 90 (HD)
sect/track 63 (NTFS) != 26 (HD)
file_pread(6,4096,buffer,1026048(438/43/11)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,1026593(438/64/10)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
BAD_RS LBA=3074048 449280
NTFS at 1313/62/17
heads/cylinder 255 (NTFS) != 90 (HD)
sect/track 63 (NTFS) != 26 (HD)
file_pread(6,4096,buffer,9365504(4002/31/19)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,9365586(4002/34/23)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 90 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 26 (HD)
 1 * HPFS - NTFS              0  78 21  1313  62 16    3072000

Warning: Bad starting sector (CHS and LBA don't match)
Warning: number of heads/cylinder mismatches 255 (NTFS) != 90 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 26 (HD)
 2 P HPFS - NTFS           1313  62 17 208716  52  8  485322752

Warning: Bad starting sector (CHS and LBA don't match)

I hope there is something we can do. Trying to recover/copy data off this drive takes forever.



#10 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 21 February 2013 - 12:32 PM

I'm afraid there appears to be damage to the filesystem that is not repaired using a tool like TestDisk. The damage may be physical and could be getting worse with use. The damage may just be logical but TestDisk is not detecting a problem with the boot sector even though it is likely returning incorrect data from the BPB.

 

If the data is very important, you should use a professional data recovery service.

 

Otherwise, if you want to attempt the recovery yourself, you can try using data recovery software. Many offer free trials that will tell you what they can recover. Then you pay them (usually less than $100) and they give you a key to unlock the software and allow you to make the recovery.

 

I often use Restorer Ultimate but there are others that are fine to use. I believe Easus may have a free product that may find the partition (but I don't think it will fix the filesystem problem). There is also Getdataback, ZAR and many more.

 

Wish I had better news.

 

James



#11 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 21 February 2013 - 12:54 PM

I'm afraid there appears to be damage to the filesystem that is not repaired using a tool like TestDisk. The damage may be physical and could be getting worse with use. The damage may just be logical but TestDisk is not detecting a problem with the boot sector even though it is likely returning incorrect data from the BPB.
 
If the data is very important, you should use a professional data recovery service.
 
Otherwise, if you want to attempt the recovery yourself, you can try using data recovery software. Many offer free trials that will tell you what they can recover. Then you pay them (usually less than $100) and they give you a key to unlock the software and allow you to make the recovery.
 
I often use Restorer Ultimate but there are others that are fine to use. I believe Easus may have a free product that may find the partition (but I don't think it will fix the filesystem problem). There is also Getdataback, ZAR and many more.
 
Wish I had better news.
 
James

 
I am beginning to think the Win 7 64bit hates legacy devices like this SATA External Enclosure, or maybe it is my USB port on the laptop.. that's possible as well. I am now in the office using an old XP system with on board USB, and I was shocked to see first set of files, approx 4GB, get copied almost instantly. I am going to have to test the integrity of those files somehow, if there is anything you can suggest to see if those files are intact, please let me know? I wonder if TestDisk can display MD5 so I can compare them.. Anyway, now it is copying the whole drive, which seems to be fast. After this is done I just have to get a new drive and copy them over.
In the meantime, the copy process may stop at one point if it hits that damaged sector, unless TestDisk can skip over them when it hits a problem.
Thanks for your help anyway James, if the drive was not in shape it is, I am pretty sure your suggestion would have solved the issue.

Edited by hyde34, 21 February 2013 - 12:54 PM.


#12 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 21 February 2013 - 01:04 PM

Yeah, TestDisk repaired some issues but not enough for Win 7. That's why the other computer sees it and it is also why I was so confident that a data recovery solution would work. I have seen TestDisk logs like yours many times before :)

 

The only way I can think to verify the file integrity in your situation is to verify that they open properly. Beyond that it is tough because of the type of filesystem error you have. Incorrect integrity could very possibly occur at the source instead of during the copy process so MD5's would probably appear to match even if the file was broken.

 

James



#13 hyde34

hyde34
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New York
  • Local time:05:03 PM

Posted 21 February 2013 - 01:09 PM

Thank you James, I figured the same thing but it was worth a shot asking :) I can open each file but stuff like PDF or Word documents will be tough to determine if they are corrupt. But honestly if I knew it would perform this fast with XP, I wouldn't have bothered trying to restore/fix the drive so much, would just leave it to copy. Now I look back at waiting overnight for just few files..



#14 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:05:03 PM

Posted 21 February 2013 - 01:33 PM

I know what you mean but the way we wrote the partition table yesterday probably helped make it easier for you to do what you are doing with the XP machine. I believe what you did definitely helped some to get you to where you are.

 

You did a great job. It was just a more complex problem than normal, otherwise you definitely would have been successful with the path you chose.

 

James






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users