Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

External HDD problem (after hibernate and a very uncommon set of coicidences)


  • Please log in to reply
12 replies to this topic

#1 blablabla84

blablabla84

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 29 January 2014 - 05:53 PM

Guys, I need help.

I have 2 Samsung M3 portable HDD (HX-M101TCB/G) both same model. Late night, I was backing up (actually only a copy-paste process, I never really tried to use backup softwares) some files from the notebook (old Dell Inspiron of my bride). After some files had been copied to my external HDD (let's calle it "A") and the space has been fulfilled (yeah almost 1tb full, I keep a lot of things) I needed my other external disk (let's call it "B") to end the copy-paste night session... But I was sleepy. I called it a day, and went to sleep. I hibernate the notebook (windows 7, very few updates, I really don't like all those updates...). My bride likes to use this feature, and she had some internet browsers open, so I hibernate the notebook so her session would be saved. (and here begins the coicidences only a user could do) I left the disk "A" in the usb port... the notebook hibernate, all the leds went off, as usual.

The next morning, first thing I did was end my copy-past session! Before turning on the notebook from hiberantion I unplugged the disk "A" and inserted disk "B", on the same port (more coicidences... sorry fate! It is really force of habit, we always use the same port). Then I turned it on. It went back from the hibernate of the night before. I went do copy my files... and then paste them on disk "B"... Just to find out that disk "B" had the same folder structure of disk "A". I found that weird... Both disks are the same model, but I remembered I had unplugged disk "A", and then inserted the other disk. I unpluged (now through safe remove option of tray bar) an inserted the other disk... and... same folder structure... It was like both disks ("A" and "B") had the same things. Although I knew they had VERY-different files: Disk A has some personal files, while disk B has my professional works since the year 2000: works from before, during and after my major! A lot of drawings, cad, text and pdf files...

Weird or not, I wanted to try disk "B" in other device. I hadn't my notebook at the time. So I tried the disk "B" on the TV (LG-32LK450). It has a usb port that we use to view some videos directly from usb keys or the external HD. It is a very nice feature: the tv even remembers the last video we watched (it don't "remember" the time where we stopped the video, but it "remembers" the file -never thought about it, but it may be a simple .db file, don't know for sure, maybe it doesn't even records on the disk, but in a built in memory? I really don't know). We only watch videos from disk A, since disk B has very few (and old) videos. I never tested disk "B" on the tv before, but both are the same model, I don't think the tv would have issues with disk "B". I inserted the disk "B" on the tv, turned it on (in this order). And the same folder-file structure of disk "A" showed up again.

I tried reading disk "B" again, on that notebook. After the third attempt I think, maybe the second, windows flashes me a message: "You need to format the disk in drive H: before you can use it. Do you want to format it?" [yes], [no].

I went nuts.

I still am. I mean, 13years of files? work files, old chat history of msn, pictures and all? It was the only place I had an old movie of my grandma, my very last memory of her.

I clicked no, of course. I may be an architect, but I know how a hard disk works: if I write something, he will simply find a place to write it, and it may be where a "deleted file mark" was. If I format it, mbr (or mft nowadays in these efi disks, right?) goes to hell and I loose the "index table"...

Internet never failed me:
-don't format!
-don't use chkdsk h: /f or /r !
-don't write nothing in it !
-backup, backup, backup - ok sorry, I didn't thought about backing up my backup! COME ON!

two days passed, and I got my other two notebooks (old dell vostro 1520 with win7 utlimate, and a brand-new dell inspiron 15r se, also win 7 ultimate). I tried disk "B" on both of them, just to see that same (and wrong) folder structure again. And the "Do you want to format it? [es] [no]". I went a bit further: I tried opening one folder... and nothing inside. It was like just some part of the folder structure of disk "A" had been copied (or overwritten).

Internet led me to this forum! I read, and re-read some posts. I PMed one of the users (James Litten, thank you man), he said to first: send it to a professional. If I wanted to try my luck: check disk integrity. and if all went all rigth, use the GNU ddrescue.

I got pretty confident... and still I hadn't tried anything with the disk "B" to recover the files! but I used some softwares:

First of all, I tried to check disk physical integrity. It hadn't "click'ed", "beep'ed", "risk'ed", or emitted any kind of odd noise... It is also a very new disk, maybe 3months top. I really really think it has nothing in the platters or header. But even so, I tested. I used HDDScan-3.3 and gsmartcontrol-0.8.7-win32. None of them could read the S.M.A.R.T. data. gSMART sent me this report:
 

smartctl 5.43 2012-06-30 r3573 [i686-w64-mingw32-win7(64)-
sp1] (sf-5.43-1)

Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

 

Vendor:               Samsung

Product:              M3 Portable

Revision:             3

User Capacity:        1.000.194.400.256 bytes [1,00 TB]

Logical block size:   512 bytes

Serial number:        00000000011E4A3A

Device type:          disk

Local Time is:        Mon Jan 20 21:03:52 2014 ESADT

Device does not support SMART

 

Error Counter logging not supported

Device does not support Self Test logging

 


In disbelief, I tried my disk "A" (the one that is intact), it showed me the same messages. I thought it may be an issue of the M3 samsung drive... I want to believe it is a problem of the external drive...

I went with the reading of this forum, and saw that I could make an image... but I had to have another drive, same size or bigger. I went shopping, I bought my disk "C"... same model again, same space. But still I didn't do it.

Since disk "B" is a recent aquisition, I kinda discarded any kind of problem with its integrity. And proceed to another approach: I used "Parted Magic Live CD" (from a CD). It has a Linux OS, already bunched up with great softwares... And linux has some flexible ways to handle the file system (as I read on the forum). I thought maybe he could read correctly my data... I never used linux, but had already used DOS and the command line softwares. Also this Live CD has a user interface, so I gave it a try. I booted the notebook (now in my house, dell inspiron 15r se ) I inserted the usb external drive, I clicked to mount it. I almost went in tears... It had still the same wrong folder structure. I wanted to cry. I was affraid of trying anything with it, and messing with the whole disk B... So I didn't make the image.

But after a week of denial and misery I gather strength and here I'm. Asking guidance. Suggestions. Knowledge. If you could answer these questions, or lead me to someone who could, I would be really glad.

1) If I use the GNU DDrescue of Parted Magic Livec CD is there any chance I (or the software) write something in disk "B"?

2) If using DDrescue is safe to not write anything in the disk, should I proceed with the method of recovering the backup ($MFTmirr) using TestDisk software described by James in his blog? Should I use the deep search option? Or this thing that happend with the hibernate is too complicated for TestDisk to work?

3) If this doesn't work, should I try the full version of GetDataBack? Do you guys know if GetDataBack can read the image created by the GNU DDrescue?

3.1) Are there any other software that is best suited for this task? I mean, this thing that happend with the hibernate?

4) Considering that my MFT got corrupted during the hibernate,does the MFTmirr got corrupted as well? I would like to know (4.1) how often the MFTmirr gets mirroed? please say it is not in every mount! I have already plugged and unplugged (safely and not safely) like 5times!

4.2) If MFT and its backup (as I understand, MFTmirr is the backup that TestDisk uses, rigth?) are both corrupted, will ANY kind of method be able to restore the files? Because if it is "unrecoverable" I will not even send it to the professionals in my town (Rio de Janeiro, Brazil).

5) If there is a way, and some professional can do it, Is there any thing to look for when hiring this kind of professional services ? Two of the enterprises says that they have a cleanroom class 100. Is it a good thing to know in my case? Should I ask if they have any other kind of characteristic? Like, "time in the market", or even require a contact with other clients? or another technical info?

Sorry the wall of text, but I tried to mark in bold the most relevant phrases.



BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:54 AM

Posted 30 January 2014 - 10:33 AM

Hi

 

I am very busy today but will get around to your mystery later this afternoon/evening (I'm on east coast of US). I have some questions and things for you to try.

 

-=[ James ]=-



#3 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:54 AM

Posted 30 January 2014 - 03:19 PM

For this issue, I will first need to establish an accurate situational awareness which can be difficult and somewhat tedious to accomplish in a venue like this where we post back and forth to a forum. I'll endeavor to make it as painless as possible :)

Hibernating for a system such as you have described simply creates a snapshot of the memory and current state of the CPU and then saves it to the hard drive and powers off. Sleep, on the other hand saves the snapshot to memory and maintains a trickle of power to keep the memory alive.
When the hibernating computer is brought out of hibernation, the memory and CPU are restored using the data that was written to the hard drive which sets them to the state that they were in prior to entering hibernation and then processing proceeds on from that point. Since power is restored to the drive during this sequence, Windows should recognize it as being different from the original since it looks at the drives serial number. However, the state of memory could be such that initially you will see the file system from the previous drive but this typically should change upon refreshing.

What I am going to do is describe the problem as I understand it. I need you to read my description of the event and tell me what I have misunderstood, gotten completely wrong and anything that I have omitted. This way, I can get a better grasp of the situation.

Here I go.

There is a laptop running Windows 7 called 'the laptop'
There is an external drive called 'DriveA'
There is an external drive called 'DriveB'

The laptop is on and DriveA is connected to it. A large number of files are copied from the laptop's internal drive to driveA.
After the copy operation is completed, you realized that you needed another drive with free space in order to copy and paste more files. That is to say, the operation of copying was done and it was successful but there were more files that needed to be copied.

At this point the laptop is put into hibernate mode.

Later, just prior to bringing the laptop out of hibernate mode, driveA is disconnected and driveB is connected. Upon coming out of hibernate mode, driveB has the files that were copied to driveA on it and all of the data that was on driveB is inexplicably gone.

Now every time that you attempt to view the contents of driveB, it tells you that it needs to be formatted, to which you respond 'NO'.


Is there anything wrong or missing from my story? Even something seemingly insignificant can be important.

-=[ James ]=-  



#4 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 30 January 2014 - 04:30 PM

Hi James, thanks for the reply. And I'm sorry I write it in a confusing way...

But you got pretty much of every thing. Some corrections follows.

 

There is a laptop running Windows 7 called 'the laptop'
There is an external drive called 'DriveA'
There is an external drive called 'DriveB'

The laptop is on and DriveA is connected to it. A
few number of files are cut-pasted, I think, I had to remove them from the internal hard drive. (ctrl+x ctrl+v of ~20files, that were in 10 folders, total size of ~8gb) from the laptop's internal drive to driveA.
After the copy operation is completed
and succesfull finished, you realized that you needed another drive with free space in order to cut and paste more files. That is to say, the operation of copying was done and it was successful but there were more files that needed to be copied in another day, another time.

At this point the laptop is put into hibernate mode.

Later, just prior to bringing the laptop out of hibernate mode, driveA is disconnected
from the laptop while it was turned off, and driveB is connected to the same usb portUpon coming out of hibernate mode, driveB "shows" ALL the folders and files of driveA (I didn't try to open any of the files*) on it and all of the data that was on driveB is inexplicably gone. Now every time that you attempt to view the contents of driveB, it tells you that it needs to be formatted (except in linux**), to which you respond 'NO'.

*After that, I tried to read driveB in the TV: it showed the files/folders of diskA (but I didn't try opening any file on the tv).
I tried to read driveB in laptop#2, and in laptop#3, both using windows 7: it showed the files/folders of diskA again (and again I didn't try opening any file).
**I tried to read driveB in laptop#3, using linux parted magic cd: it showed the files/folders of diskA again. Here I tried opening a folder, the folder had nothing inside it. (although in driveA it has files). Here I also noted that another folder ("movies folder") was displaying a thumbnail of a jpg file that I have in driveB. Like when you customize its icon. But to me, it is like the OS was looking to a cluster (? or a sector...) that should be the aforementioned "movies folder", but it found the contents of a jpg file (that should correctly be in driveB, it was one of my old photos).

 

 

...Windows should recognize it as being different...

It should =(
 

... this typically should change upon refreshing.

Should I hit F5 ? lol *edit: I'm not doing this until yo usay so.


Edited by blablabla84, 30 January 2014 - 04:30 PM.


#5 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:54 AM

Posted 30 January 2014 - 04:39 PM

Let's see if using TestDisk will help you. In your case, the Windows version should work fine and you can even use the same laptop where the incident first occurred if you wish. What we will do here will not write or change anything on the bad drive.

 

Connect the drive to the laptop if it is not already connected. Do not format if asked :)

Download TestDisk from
http://www.cgsecurity.org/testdisk-6.14.win.zip
and extract it to your desktop.
Open the folder testdisk-6.14
Double click testdisk_win.exe to run it.

TestDisk is a console application so you have to use your keyboard to interact with it instead of your mouse.

Choose Create and hit enter (this makes the file testdisk.log that is automatically created in the folder testdisk-6.14)
You should now see a list of drives.
If you have any difficulty identifying which one the external drive is, let us know what you see and we'll help you figure it out.
Select the external drive and choose Proceed and hit enter
Select Intel/PC partition and hit enter
Select Analyse and hit enter
Select Quick Search and hit enter
Say 'Y' if it asks if the disk was made in Vista/Win7 (even if it was made in XP say 'yes')

When it is done (if you are at a screen that has only the option CONTINUE with no other text at the bottom of it, hit enter to see the screen we need to see).

If you see what looks like a normal partition(s), highlight the one you think has your data and press
p
and see if you can see your files and folders that you are looking for there.

If there is more than one partition check each one for files and folders by getting back to the list of partitions found (pressing q), highlighting the next one and pressing p again.

If you can see your files and folders and it all looks normal then stop here and go down to the section below called POST TESTDISK.LOG

If anything does not look correct then continue on to the DEEPER SEARCH. Get to the screen showing the partitions that it found and press ENTER to continue.
DEEPER SEARCH is an option at the bottom of the screen.
Highlight it and press ENTER

After the DEEPER SEARCH finishes do the same thing with pressing p to see if you can see your files and folders in any of the partitions found and then press
q
a bunch of times to get out of TestDisk.

POST TESTDISK.LOG

If anything looks different than I describe (possible depending on what is causing the problem) or you have any questions, stop and ask

What I need to know...

1. Did you see your files and folders in TestDisk?

2. I'd like to see the contents of the file testdisk.log that is automatically created in the folder testdisk-6.14 it may just be called testdisk instead of testdisk.log if your Windows is set to hide known extensions and it will have a text file icon.

-=[ James ]=-

 

EDIT: Where I ask if it sees your files and folders, I mean the files and folders that it should see and not the mysterious ones identical to the other drive.


Edited by James Litten, 30 January 2014 - 04:40 PM.


#6 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 03 February 2014 - 02:18 PM

I was busy this weekend.

I'll try using testdisk 6.14 as you said.

 

crossing fingers...



#7 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 03 February 2014 - 03:28 PM

Well, I'm doing all those steps... testdisk.log will be uploaded soon...

I did the Analyse option, and the Quick Search option. It showed only one logical partition...

>L  HPFS - NTFS         0  1  2  121599 254 63 1953503936 [samsung]

When I listed files [P option] it just showed 2 files. Or 2 folders. I don't know. I didn't understand its name. It will show in the log, bare with me. Since it wasn't correct, I tried the deeper search.

 

At first I didn't find the Deeper Search option. But I went all the way back to the first menu (analyse, ...) and tried again. There was this menu: "Keys: A: add partition, L: load partition, T: change type, P: list files, Enter:continue". I pressed enter, and found the Deeper Search. hooray \o/ I think the testdisk.log will be somewhat confusing. Sorry for that.

 

Ant here I got something weird. In my first attempt, when I Quick Search'ed, it just showed one logical partition. Now  it was showing two partitions, that logical one

>L ...

and an Extend one

>E ... 

I forgot to take note of its characteristics. I think it will be in the log file, rigth?

 

Well, right now testdisk is Depper Search'ing. I think it is searching the Logical one... It is in "9740/121599 07%". When it is over I'll see what it shows.

In the end I'll post the log.

EDIT: well, it has been more than 12hours, and it is still in 85%. I'll be back only at night (gmt-3).


Edited by blablabla84, 04 February 2014 - 04:37 AM.


#8 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 04 February 2014 - 02:47 PM

Well...

it went through all the deeper search, but in the end it said my HDD was too small !!

 

here it is the tesdisk.log



Mon Feb  3 17:31:14 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000200343040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8608808960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000194400256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000200343040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8608808960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000194400256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107374182400
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=773855379456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000194015232
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - ST1000LM024 HN-, S/N:S2VMJ5CD803107, FW:0040
Disk /dev/sdb - 8608 MB / 8210 MiB - CHS 1046 255 63, sector size=512 - SMART SSD Xceed, S/N:SBR2013083112516, FW:D3Q1
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - Samsung M3 Portable, S/N:00000000011E4A3A, FW:3

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - Samsung M3 Portable
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
 1 * HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
NTFS at 0/1/2
filesystem size           1953503936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122093995
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,8,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,1,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,8,buffer,1953504832(121600/13/14)) lseek err Invalid argument
file_pread(6,8,buffer,1953504960(121600/15/16)) lseek err Invalid argument
file_pread(6,8,buffer,1953505088(121600/17/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953505216(121600/19/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505279(121600/20/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505280(121600/20/21)) lseek err Invalid argument
file_pread(6,14,buffer,1953505281(121600/20/22)) lseek err Invalid argument
file_pread(6,3,buffer,1953505295(121600/20/36)) lseek err Invalid argument
file_pread(6,3,buffer,1953505342(121600/21/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953505358(121600/21/36)) lseek err Invalid argument
file_pread(6,11,buffer,1953505405(121600/22/20)) lseek err Invalid argument
file_pread(6,2,buffer,1953507327(121600/52/52)) lseek err Invalid argument

Results
   L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS Volume is dirty.


dir_partition inode=5
   L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_readdir failed for cluster 5
Directory /
       5 dr-xr-xr-x     0      0         0 16-Jan-2014 23:10 .
       5 dr-xr-xr-x     0      0         0 16-Jan-2014 23:10 ..
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             0   1  1 121599 254 63 1953503937
 5 L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
 1 * HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
NTFS at 0/1/2
filesystem size           1953503936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122093995
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,8,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,1,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,8,buffer,1953504832(121600/13/14)) lseek err Invalid argument
file_pread(6,8,buffer,1953504960(121600/15/16)) lseek err Invalid argument
file_pread(6,8,buffer,1953505088(121600/17/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953505216(121600/19/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505279(121600/20/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505280(121600/20/21)) lseek err Invalid argument
file_pread(6,14,buffer,1953505281(121600/20/22)) lseek err Invalid argument
file_pread(6,3,buffer,1953505295(121600/20/36)) lseek err Invalid argument
file_pread(6,3,buffer,1953505342(121600/21/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953505358(121600/21/36)) lseek err Invalid argument
file_pread(6,11,buffer,1953505405(121600/22/20)) lseek err Invalid argument
file_pread(6,2,buffer,1953507327(121600/52/52)) lseek err Invalid argument

Results
   L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             0   1  1 121599 254 63 1953503937
 5 L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
NTFS at 0/1/2
filesystem size           1953503936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122093995
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953505280(121600/20/21)) lseek err Invalid argument
file_pread(6,1,buffer,1953505280(121600/20/21)) lseek err Invalid argument
NTFS at 121599/254/63
filesystem size           1953503936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122093995
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121599/254/63
filesystem size           1953503936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122093995
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(6,4096,buffer,1959795455(121991/159/24)) lseek err Invalid argument
file_pread(6,1,buffer,1959795455(121991/159/24)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS          121599 254 63 243199 253 61 1953503936
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953503999, size=1953503936, end=3907007934, disk end=1953504688)
file_pread(6,2,buffer,1953506047(121600/32/32)) lseek err Invalid argument
file_pread(6,1,buffer,1953506047(121600/32/32)) lseek err Invalid argument
file_pread(6,2,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506048(121600/32/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953506111(121600/33/33)) lseek err Invalid argument
file_pread(6,8,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,1,buffer,1953504704(121600/11/12)) lseek err Invalid argument
file_pread(6,8,buffer,1953504832(121600/13/14)) lseek err Invalid argument
file_pread(6,2,buffer,1953504959(121600/15/15)) lseek err Invalid argument
file_pread(6,7,buffer,1953504961(121600/15/17)) lseek err Invalid argument
file_pread(6,2,buffer,1953505022(121600/16/15)) lseek err Invalid argument
file_pread(6,2,buffer,1953505085(121600/17/15)) lseek err Invalid argument
file_pread(6,8,buffer,1953505088(121600/17/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953505216(121600/19/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505279(121600/20/20)) lseek err Invalid argument
file_pread(6,1,buffer,1953505280(121600/20/21)) lseek err Invalid argument
file_pread(6,14,buffer,1953505281(121600/20/22)) lseek err Invalid argument
file_pread(6,3,buffer,1953505295(121600/20/36)) lseek err Invalid argument
file_pread(6,3,buffer,1953505342(121600/21/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953505358(121600/21/36)) lseek err Invalid argument
file_pread(6,11,buffer,1953505405(121600/22/20)) lseek err Invalid argument
file_pread(6,2,buffer,1953507327(121600/52/52)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121600 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS          121599 254 63 243199 253 61 1953503936
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             0   1  1 121599 254 63 1953503937
 5 L HPFS - NTFS              0   1  2 121599 254 63 1953503936 [SAMSUNG]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63

TestDisk exited normally.

So, what should I do next ?

I have some questions, if you can shed some light here:

1) what is the meaning of those two partitions:

1 E extended LBA 0 1 1 121599 254 63 1953503937
5 L HPFS - NTFS 0 1 2 121599 254 63 1953503936 [SAMSUNG]

2) Also, in some parts of the program, there was a menu of keys:

A: add partition
L: load partition
T: change type
P: list files
Enter:continue

should I press Enter to see more options?? I didn't press Enter because I didn't understand what the "continue" would do...

3) also:

The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)

could the hibernate append the diskA mft and diskB mft together? so testdisk thinks it has 2000GB ?

 

And also:
4) I don't really need to work with an image of the disk right?



#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:54 AM

Posted 04 February 2014 - 04:15 PM

This is probably the correct partition...

1 E extended LBA 0 1 1 121599 254 63 1953503937

 

Here is how this usually goes for me...
Typically, in a repair like this, that partition would be listed at the end of the deeper search and upon selecting it and pressing 'p' you would see your files and folders.

Then you go back to the list of partitions found and make sure that partition is highlighted and then use the left/right arrow keys to change the E at the beginning of the line to a P for primary.

Then mark any erroneous partitions for delete D and write the new partition table and do any boot sector repairs if prompted.


However, it sounds like you did not see this partition listed after running the deeper search or that you did not see your files/folders when you highlighted it after the deeper search and pressed P. So I don't think I can help you any further since asking you to do things that I am not certain of may cause damage. This is a very complex help topic with many variables which is why I give such exact and seemingly tedious instructions but often even that is not enough to get a good view of the situation. Maybe someone else can jump in here who understands what you are seeing better than me.

To answer your questions...
1.) what is the meaning of those two partitions
The partition table in the drive's MBR has become erroneous or corrupted.

2.)should I press Enter to see more options??
Not sure what you mean

3.)could the hibernate append the diskA mft and diskB mft together? so testdisk thinks it has 2000GB ?
The partition table in the drive's MBR has become erroneous or corrupted.

4) I don't really need to work with an image of the disk right?
If the data is very important you need to send it to a data recovery lab.

If you believe there is physical damage and want to try fixing it yourself then you should make an image and work at recovering files from the image. I have a technique for determining the existence of hardware damage here
http://html5.litten.com/accessing-and-assessing-a-hard-drives-s-m-a-r-t-data/

The work that TestDisk does in this case affects two small parts of the drive. The boot sector (if it is messed up) and the partition table in the MBR. User data is not overwritten.

You can probably recover all the files from the drive with any commercial data recovery tool. I currently use Wonder Share which has a free trial that tells you what can be recovered and then costs about $40 to proceed with the recovery.

-=[ James ]=-



#10 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 04 February 2014 - 06:51 PM

Typically, in a repair like this, that partition would be listed at the end of the deeper search and upon selecting it and pressing 'p' you would see your files and folders.

Here, in the end of the deeper search, it didn't showed me any "P" options to "show files", just the warning of:

Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
HPFS - NTFS 121599 254 63 243199 253 61 1953503936
NTFS, blocksize=4096, 1000 GB / 931 GiB

This is a very complex help topic with many variables which is why I give such exact and seemingly tedious instructions but often even that is not enough to get a good view of the situation.

 

Thanks anyway man. You did what you could. :thumbsup:

 

 

 

I had some doubts here about what you wrote:

 

The work that TestDisk does in this case affects two small parts of the drive.

"in this case" you mean, the deeper search !?!??!?!?! :o  or accessing the S.M.A.R.T. data ?!?!?!?! :o  I mean, I did use the deeper search of test disk! and  I also used the gSMART.
gSMART didn't read my drive... I discarded physical problems because the drive is pretty new!

0) Is there any chance these softwares affected my drive?

 

 

 

Can ask you a few more questions?

1) about the WonderShare. The way it functions is something like a guesssing of the bits and bytes it reads in the disk?

 

I mean, it reads the disk sectors, and "presume" (or "guess", "think", "uses its algorithms") that those bits are from a msoffice word file (or one of the 500file extensions he recognizes). He then copies that file as some "document1.doc" and proceeds.

 

Or it really reads the name of the file? I ask this because it is some 800GB of files... If it finds the original name, ok. If I have to rename the files it will be bad! (not so bad as if I lose the files, though)
 

2) Do you know GetDataBack ? is it some commercial data recovery too as you described ? In another forum a user tried this GetDataBack, and kind of retrieved 90% his files. I don't know if he got the original name/folder or if it (I'll ask him).

3) Can Testdisk 6.1.4 reads the image of GNUddrescue? I would be more confident to try thing in the image and not in the drive itself.

 

4) Can Wondershare reads the image of GNUddrescue?

 

5) What kind of characteristics should I search when hiring a professional lab? Also, they normally asks if I used some software to recover the files. Should I talk about these tools that I used? Or it is best to keep quiet? The labs that I contacted charge extra taxes if the user tried anything... :blink:

Thanks again James.



#11 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:54 AM

Posted 04 February 2014 - 07:18 PM

0) Is there any chance these softwares affected my drive?

 

According to the TestDisk log you did not write anything to the disk so it is still the same as it was prior to running TestDisk. Nothing has been changed. Nothing that I have asked you to do would change it. We were still simply assessing the situation.

 

-=[ James ]=-



#12 blablabla84

blablabla84
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:05:54 AM

Posted 05 February 2014 - 04:56 AM

Whew!

But could gSMART change something in the drive ? the log I posted in the first post.



#13 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:54 AM

Posted 11 February 2014 - 03:29 PM

<<2) Do you know GetDataBack ? is it some commercial data recovery too as you described ? In another forum a user tried this GetDataBack, and kind of retrieved 90% his files. I don't know if he got the original name/folder or if it (I'll ask him).>>

 

GetDataBack is a data-recovery tool, one that I have paid for and used successfully in the past.  There are 2 versions, one for NTFS and one for FAT...if you try it, be sure to use the one matching the file system.  There are plenty of free data-recovery programs out there which users have reported success with, including severa; employing linux.

 

Louis






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users