Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

External drive folders blanked after USB unplug


  • Please log in to reply
22 replies to this topic

#1 Chuaz

Chuaz

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 23 December 2013 - 05:23 PM

Hi guys, hopefully someone can help extricate me from this depressing situation.  I'm running Windows XP, have a 2TB Hitachi external drive that I've had trouble disconnecting via "Safely Remove Hardware" past.  Several days ago I simply unplugged the USB to use the port for something.  When I reconnected it, it came on but did not Autoplay.  When I checked the drive in My Computer, it was not named the usual "Hitachi" but simply "E:".  When I opened it, it was blank!  But when I right-clicked properties, it showed that it still had 268GB of used space.

 

Under Folder Options I made sure "show hidden files" was selected, but nothing.

 

I tried unplugging it and reinserting it.  

 

I tried restarting the computer.

 

I tried plugging it into a different computer.  It shows up, but my files are still absent.

 

In Command Prompt I tried "attrib -h -r -s /s /d e:\*.*" but it said "Unable to change attribute - E:\'Çs".

 

In Command Prompt I tried "dir" but it said the drive "has no label" and "System Volume Information the parameter is incorrect".

 

In Command Prompt I tried "chkdsk" and it said:

"file system is FAT32.
Volume Serial Number is 1AFC-2847
Windows is verifying files and folders...
Windows found errors on the disk, but will not fix them
because disk checking was run without the /F (fix) parameter.
\'Çs first allocation unit is not valid. The entry will be truncated."

 

I plugged a different external drive in, which automatically now occupied the E slot, and plugged the compromised drive in, which now occupied the F slot, but still nothing.

 

I tried running "Find and Mount" software.  The intelligent scan returned a single FAT32 table, and when I mounted it I saw the same thing I could already see, which was a file named 'Çs and a folder named "System Volume Information", but none of my folders or files.  I then tried the deep scan, let it run overnight, and when I checked the next morning it said ""failed to restore the following drive, ran out of memory".  It had found two small additional FAT 16 tables, each with two recoverable jpegs.

 

I tried running Recuva, and it returned about 600 jpegs, all renamed and with no folder or subfolder structure.  It also wanted me to manually put a check mark beside each jpeg I wanted it to recover.  I still had tens of thousands of files that weren't found.

 

I read several posts from people saying they ran Error Check from Windows and it restored their drive to how it was before, so I ran this with "automatically fix file systems" enabled.  After ten minutes it said "disk check complete" but my drive was still blank!

 

In Command Prompt I checked "dir" and "chkdsk" again, and I no longer get error messages.

 

In Command Prompt I tried "attrib -h -r -s /s /d e:\*.*" again, changing "e" to "f" (because it now occupies the F slot).  I looked at my drive, and now there is a folder called "FOUND.000" that is 14.6 GB in size with a bunch of files ending in .CHK in it.  I copied a few to my C drive and renamed them .jpg and they open as jpegs.  But even if I gave up on having original file names and folder structure, that's still only 14.6GB out of 268GB of data that is on that drive.

 

Any ideas on what to try now?  Any help would be appreciated, I'm frazzled!



BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 24 December 2013 - 10:23 AM

Hi

 

Were the jpg files recovered by chkdsk and placed into FOUND.000, pictures that you recognized as being from the partition that you are trying to recover?

 

What about the two jpg files from the FAT 16 partitions? Did you recognize any of those as being from the partition that you are trying to recover?

 

I ask because I would have expected that drive to be formatted with NTFS instead of FAT32 but it certainly could be FAT32.

 

The problem sounds like damage to the file system initially that was maybe made a little more complicated by chkdsk. If you can answer my questions I may be able to tell you some relatively simple steps to take that can help determine the best way to proceed.

 

-=[ James ]=-



#3 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 24 December 2013 - 12:21 PM

Hi, James.  I'm not sure what partitions I had before.  I didn't create any additional ones myself, I simply plugged the drive in when I got it and put files on it, so I'm guessing it only had one?  The pictures I saw were pictures I had put on the drive.



#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 24 December 2013 - 07:58 PM

Hi

 

Good, just wanted to make sure that you weren't seeing a partial old partition that was now preventing you from seeing your current data (it happens sometimes).

 

The first step is to determine if there is any physical damage to the drive.

 

Then you can try to scan for broken file systems and see if they can be repaired enough to do a recovery. This is similar to what you tried with Find and Mount but we can try a different tool.

 

So, lets try to determine the physical health of the drive.

 

Plug in the drive.

Get a copy of GSmartControl for Windows
http://prdownload.berlios.de/gsmartcontrol/gsmartcontrol-0.8.7-win32.zip?download
Unzip it and run gsmartcontrol.exe

Double-click your bad drive and click the VIEW OUTPUT button and copy and paste the resulting report in your reply so we can look at it.
 

Let us know if you have any difficulty doing this.

 

-=[ James ]=-



#5 slgrieb

slgrieb

  • Members
  • 270 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas Panhandle
  • Local time:07:07 AM

Posted 24 December 2013 - 08:54 PM

Hi

 

Good, just wanted to make sure that you weren't seeing a partial old partition that was now preventing you from seeing your current data (it happens sometimes).

 

The first step is to determine if there is any physical damage to the drive.

 

Then you can try to scan for broken file systems and see if they can be repaired enough to do a recovery. This is similar to what you tried with Find and Mount but we can try a different tool.

 

So, lets try to determine the physical health of the drive.

 

Plug in the drive.

Get a copy of GSmartControl for Windows
http://prdownload.berlios.de/gsmartcontrol/gsmartcontrol-0.8.7-win32.zip?download
Unzip it and run gsmartcontrol.exe

Double-click your bad drive and click the VIEW OUTPUT button and copy and paste the resulting report in your reply so we can look at it.
 

Let us know if you have any difficulty doing this.

 

-=[ James ]=-

Well that's a link I'd sure as Hell avoid! Clicking the link sent me to the page listed, and then bounced me over to SourceForge which began an automatic download. Really?! Why would you ever link to a blind download? 

 

How inappropriate is this?: let's count the ways. A blind download really takes the choice out of the hands of the individual following the link unless they are experienced enough to interrupt the download. James Litten, why would you even think about linking to a site where you can't guarantee the integrity of the download without offering some choices and safeguards? Frankly, you aren't in any position to verify the security of the link you posted. Why would you prefer this solution to a more reputable and better documented site like Convar


Edited by slgrieb, 24 December 2013 - 09:11 PM.

Yes, Mr. Death... I'll play you a game! But not CHESS !!! BAH... FOOEY! My game is... 
WIFFLEBALL!

 


#6 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 24 December 2013 - 09:22 PM


 


Well that's a link I'd sure as Hell avoid! Clicking the link sent me to the page listed, and then bounced me over to SourceForge which began an automatic download. Really?! Why would you ever link to a blind download? 

 

 

 

 

If you think that I've made a malicious mistake then click the REPORT link at the bottom of the message and report me.



#7 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 24 December 2013 - 09:32 PM

Ok James, this is what I got:

 

 

 

smartctl 5.43 2012-06-30 r3573 [i686-w64-mingw32-xp-mc-sp3] (sf-5.43-1)
Copyright © 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Model Family: Hitachi Deskstar 7K3000
Device Model: Hitachi HDS723020BLA642
Serial Number: MN1221F303GASD
LU WWN Device Id: 5 000cca 369c192f8
Firmware Version: MN6OA180
User Capacity: 2,000,398,934,016 bytes [2.00 TB]
Sector Size: 512 bytes logical/physical
Device is: In smartctl database [for details use: -P show]
ATA Version is: 8
ATA Standard is: ATA-8-ACS revision 4
Local Time is: Tue Dec 24 20:29:46 2013 CST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status: (0x84) Offline data collection activity
was suspended by an interrupting command from host.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (19092) seconds.
Offline data collection
capabilities: (0x5b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
No Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 319) minutes.
SCT capabilities: (0x003d) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000b 100 100 016 Pre-fail Always - 0
2 Throughput_Performance 0x0005 136 136 054 Pre-fail Offline - 81
3 Spin_Up_Time 0x0007 130 130 024 Pre-fail Always - 444 (Average 439)
4 Start_Stop_Count 0x0012 100 100 000 Old_age Always - 1825
5 Reallocated_Sector_Ct 0x0033 100 100 005 Pre-fail Always - 0
7 Seek_Error_Rate 0x000b 100 100 067 Pre-fail Always - 0
8 Seek_Time_Performance 0x0005 133 133 020 Pre-fail Offline - 27
9 Power_On_Hours 0x0012 099 099 000 Old_age Always - 12573
10 Spin_Retry_Count 0x0013 100 100 060 Pre-fail Always - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 134
192 Power-Off_Retract_Count 0x0032 099 099 000 Old_age Always - 2048
193 Load_Cycle_Count 0x0012 099 099 000 Old_age Always - 2048
194 Temperature_Celsius 0x0002 176 176 000 Old_age Always - 34 (Min/Max 20/54)
196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 0
197 Current_Pending_Sector 0x0022 100 100 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0008 100 100 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x000a 200 200 000 Old_age Always - 1

SMART Error Log Version: 1
ATA Error Count: 1
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 1 occurred at disk power-on lifetime: 12332 hours (513 days + 20 hours)
When the command that caused the error occurred, the device was in standby mode.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 00 00 00 00

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
ec 00 01 00 00 00 00 00 2d+21:19:29.872 IDENTIFY DEVICE
ec 00 01 00 00 00 00 00 2d+21:19:01.165 IDENTIFY DEVICE
e5 00 00 00 00 00 a0 00 2d+21:19:01.165 CHECK POWER MODE
ec 00 01 00 00 00 00 00 2d+21:18:43.020 IDENTIFY DEVICE
e5 00 00 00 00 00 a0 00 2d+21:18:36.508 CHECK POWER MODE

SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Completed without error 00% 12034 -
# 2 Short offline Completed without error 00% 11313 -
# 3 Short offline Completed without error 00% 10574 -
# 4 Short offline Completed without error 00% 9512 -
# 5 Short offline Completed without error 00% 2808 -
# 6 Short offline Completed without error 00% 2070 -
# 7 Short offline Completed without error 00% 1035 -

SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.



#8 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Members
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:08:07 AM

Posted 24 December 2013 - 09:56 PM

Well that's a link I'd sure as Hell avoid! Clicking the link sent me to the page listed, and then bounced me over to SourceForge which began an automatic download. Really?! Why would you ever link to a blind download? 
 
How inappropriate is this?: let's count the ways. A blind download really takes the choice out of the hands of the individual following the link unless they are experienced enough to interrupt the download. James Litten, why would you even think about linking to a site where you can't guarantee the integrity of the download without offering some choices and safeguards? Frankly, you aren't in any position to verify the security of the link you posted. Why would you prefer this solution to a more reputable and better documented site like Convar?

 
The program mentioned by James Litten is here http://gsmartcontrol.berlios.de/home/index.php/en/Downloads
 
Clicking that link goes to the page linked to by James Litten. SourceForge is the mirror for the program. Had you researched it you would have discovered that for yourself. It took me less than one minute to find out what I wanted to know.

Yes, there can be a danger associated with blind downloads. As for beginning an "automatic download" the only thing that happened was asking if I wanted to open, save or save as. One assumes that the user will not want to stop the download after making the choice.
 
James is an trusted member of the Bleeping Computer staff. He would never recommend a malicious program or anything that would cause harm to a system.

Edited by Queen-Evie, 24 December 2013 - 10:07 PM.


#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 24 December 2013 - 10:03 PM

Hi

Excellent, the drive appears to be in good shape physically.

Here is the situation as it appears from what you have posted.

  • There was some kind of corruption that occurred with the file system.
  • One or more of the utilities that you tried to use attempted to repair the file system.
  • The repair was not a success.

This can possibly make it difficult to recover the file system because of changes that chkdsk and MS Error Check made while attempting to repair it but the files themselves are most likely still on the drive (at least the vast majority of them).

The two things that you can try are...
1. Try TestDisk to detect an old copy of the file system (pre-repair) and then list the files and folders allowing you to copy them to another drive. Kind of a long shot but I've seen it work sometimes.

2. Use PhotoRec to recover the files on the drive without using a file system. This is like what you saw before where files do not have filenames but do have proper extensions. For example, a jpeg image would be recovered with a name like 4565466.jpg where 4565466 is the sector that the file began in. The file system is basically a database of the file's names and directory locations as well as where on the disk the files are found. That's why when it is broken badly it makes it impossible to get the filenames.

If you decide to do one of these, make sure that you have enough room on another disk to recover the files to and also realize that it may take a long time to run (possibly 20 hours or more). Let me know when you are ready and what you want to try and I will give you some instructions. (and if you opt to try PhotoRec, let me know what filetypes are most important for you to recover like.jpg or .doc)

James

 



#10 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 24 December 2013 - 10:34 PM

I really wish I had found this site and posted here before I ran Error Check.  I'm paranoid about what's left of my important files on C drive now since my computer is actually a lot older than my back-up drive was, so I'm going to back them up to a borrowed functioning drive immediately.  Since I only have USB2.0 I'm guessing it will go through the night.  When that's finished I would like to try TestDisk, so if there are instructions I need to know about that I'd appreciate it.  If I can get back my folder system with files organized and named as they were I would leap for joy.



#11 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 24 December 2013 - 11:03 PM

We can try to see if using TestDisk will help you. In your case, the Windows version should work fine.

Download TestDisk from
http://www.cgsecurity.org/testdisk-6.14.win.zip
and extract it to your desktop.
Open the folder testdisk-6.14
Double click testdisk_win.exe to run it.

TestDisk is a console application so you have to use your keyboard to interact with it instead of your mouse.

Choose Create and hit enter (this makes the file testdisk.log that is automatically created in the folder testdisk-6.14)
You should now see a list of drives.
If you have any difficulty identifying which one the external drive is, let us know what you see and we'll help you figure it out.
Select the external drive and choose Proceed and hit enter
Select Intel/PC partition and hit enter
Select Analyse and hit enter
Select Quick Search and hit enter
Say 'Y' if it asks if the disk was made in Vista/Win7 (even if it was made in XP say 'yes')

When it is done (if you are at a screen that has only the option CONTINUE at the bottom of it, hit enter to see the screen we need to see).

If you see what looks like a normal partition(s), highlight the one you think has your data and press
p
and see if you can see your files and folders that you are looking for there.

If you see what looks like a normal partition, highlight it and press
p
and see if you can see your files and folders there.
If there is more than one partition check each one for files and folders by getting back to the list of partitions found (pressing q), highlighting the next one and pressing p again.

If you can see your files and folders and it all looks normal then stop here and go down to the section below called POST TESTDISK.LOG

If anything does not look correct then continue on to the DEEPER SEARCH. Get to the screen showing the partitions that it found and press ENTER to continue.
DEEPER SEARCH is an option at the bottom of the screen.
Highlight it and press ENTER

After the DEEPER SEARCH finishes do the same thing with pressing p to see if you can see your files and folders in any of the partitions found and then press
q
a bunch of times to get out of TestDisk.

POST TESTDISK.LOG

If anything looks different than I describe (possible depending on what is causing the problem) or you have any questions, stop and ask

What I need to know...

1. Did you see your files and folders in TestDisk?

2. I'd like to see the contents of the file testdisk.log that is automatically created in the folder testdisk-6.14 it may just be called testdisk instead of testdisk.log if your Windows is set to hide known extensions and it will have a text file icon.

-=[ James ]=-

#12 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 25 December 2013 - 07:07 PM

Just wanted to let you know I finished backing up the important files on my C drive, and I've had DEEPER SEARCH running for a bit.  I'm not sure when it will finish, but I will let you know when it does.

 

Merry Christmas to you and yours, James!



#13 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 25 December 2013 - 11:27 PM


Wed Dec 25 16:56:13 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=154947824640
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396289024
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19452 255 63, sector size=512 - WDC WD1600JS-75NCB2, FW:10.02E03
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Toshiba 3.5"External HDD, FW:MU2O
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Hitachi HDS723020BLA642

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - Hitachi HDS723020BLA642
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
Info: size boot_sector 3907024002, partition 3907024002
FAT1 : 32-476847
FAT2 : 476848-953663
start_rootdir : 953664 root cluster : 2
Data : 953664-3907023999
sectors : 3907024002
cluster_size : 64
no_of_cluster : 61032349 (2 - 61032350)
fat_length 476816 calculated 476816
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
No partition is bootable

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/1/1
FAT1 : 32-476847
FAT2 : 476848-953663
start_rootdir : 953664 root cluster : 2
Data : 953664-3907023999
sectors : 3907024002
cluster_size : 64
no_of_cluster : 61032349 (2 - 61032350)
fat_length 476816 calculated 476816
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(6,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(6,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(6,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(6,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(6,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(6,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(6,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(6,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB


dir_partition inode=0
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
FAT: cluster=2(0x2), pos=953727
Directory /
11 drwxr-xr-x 0 0 0 23-Dec-2013 13:12 FOUND.000
8989371 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 System Volume Information

dir_partition inode=8989371
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
FAT: cluster=8989371(0x892abb), pos=576273343
Directory /System Volume Information
8989371 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 .
0 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 ..
8989372 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 _restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}
FAT: cluster=2(0x2), pos=953727
Directory /
11 drwxr-xr-x 0 0 0 23-Dec-2013 13:12 FOUND.000
8989371 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 System Volume Information


dir_partition inode=0
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
FAT: cluster=2(0x2), pos=953727
Directory /
11 drwxr-xr-x 0 0 0 23-Dec-2013 13:12 FOUND.000
8989371 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 System Volume Information

interface_write()
1 * FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/1/1
FAT1 : 32-476847
FAT2 : 476848-953663
start_rootdir : 953664 root cluster : 2
Data : 953664-3907023999
sectors : 3907024002
cluster_size : 64
no_of_cluster : 61032349 (2 - 61032350)
fat_length 476816 calculated 476816
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
FAT32 at 0/1/7
FAT1 : 32-476847
FAT2 : 476848-953663
start_rootdir : 953664 root cluster : 2
Data : 953664-3907023999
sectors : 3907024002
cluster_size : 64
no_of_cluster : 61032349 (2 - 61032350)
fat_length 476816 calculated 476816
set_FAT_info: name from BS used

FAT32 at 0/1/7
FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(6,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(6,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(6,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(6,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(6,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(6,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(6,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(6,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB


dir_partition inode=0
* FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
FAT32, blocksize=32768, 2000 GB / 1863 GiB
FAT: cluster=2(0x2), pos=953727
Directory /
11 drwxr-xr-x 0 0 0 23-Dec-2013 13:12 FOUND.000
8989371 drwxr-xr-x 0 0 0 21-Dec-2013 00:41 System Volume Information

interface_write()
1 * FAT32 LBA 0 1 1 243200 254 63 3907024002 [NO NAME]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.



#14 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:07 AM

Posted 26 December 2013 - 09:38 AM

UGH! It could not find any FAT tables that have not been repaired. That means the file system is most likely not recoverable since they were overwritten by the repairs made by chkdsk.

 

People in the business of 'file system repairs' have always had mixed feelings about chkdsk.

On one hand, it is an excellent, safe and efficient tool. 

On the other hand it is unpredictable, dangerous and the scourge of data recovery professionals :)

 

What we don't know is how bad the damage was that chkdsk repaired. Chkdsk does not give us detailed logs like TestDisk did. It is quite possible that the file system was destroyed and chkdsk did the best it could but it could also be that chkdsk overreacted and the file system could have been recovered prior to running it.

We just don't know and that is the problem with chkdsk.

 

Well, that is not the only problem with chkdsk. Perhaps a more dangerous problem is that it gives no warning to the user that it may not be able to fix a problem that can be recovered with software like TestDisk and if you run it, it may overwrite things in a way that the data will become inaccessible and no longer recoverable by programs that do temporary file system repairs like TestDisk does.

 

You were never made aware of this.

 

But, like I said before, it is quite possible that the file system was destroyed and chkdsk did the best it could and nothing would have worked.

 

Enough ranting.

 

Would you like to try a raw recovery with PhotoRec?

Feel free to try it yourself, you already have a copy. It is in the same folder as the TestDisk program. You can not hurt anything as long as you DO NOT RECOVER FILES TO THE BAD DISK. Any files you recover need to be recoverd to some place else and by default will be recovered into folders named recup_dir in the TestDisk folder where the program is. Much like the testdisk.log file was created there.

Here are some instructions...

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

If you have questions, let us know.

 

-=[ James ]=-



#15 Chuaz

Chuaz
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:07 AM

Posted 26 December 2013 - 06:02 PM

UGH is right.  chkdsk is hanging over my head like a cloud now.  James, have you heard of the pay program GetDataBack by Runtime?  I read an old thread where a guy with a FAT32 partitioned drive used it after trying several other options that failed, claiming it recovered his files AND folder structure.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users