Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

LINUX Mint hard drive scramble...now RAW & unallocated?


  • Please log in to reply
1 reply to this topic

#1 backinservice

backinservice

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:54 AM

Posted 05 March 2014 - 09:20 AM

I have a WDC 1.5 SATA HD I was using as a secondary drive in a Linux Mint desktop machine (via SATA PCI card) [Pentium III with 1 GB RAM). 

The hard drive in question was initially formatted under the Windows XP system (don't know if FAT or NTFS or huh.gif, but that desktop failed and is history), so I moved the drive to this Linux box as a secondary hard drive.  The primary HD on the Linux Box is IDE and is fine.

A few days ago, as I was transferring photos from the WDC HD across the network, it stopped working.  Not sure if there was a brownout or just a HD issue.

The SATA HD would not show up in Linux mint, although it would show up in the BIOS sequence when starting up.

I got Linux errors, and following up those errors, I was instructed to connect the HD to a Windows machine and run checkdisk to resolve the Linux error and have it recognized by Linux again.

At first Windows showed the HD (via a eSata USB port connected to a universal drive connector on my laptop) as uninitialized, with the SMART as BAD health, then briefly switched to GOOD SMART health and assigned the drive a Letter long enough for me to start CHKDSK /F as instructed.  Checkdisk failed (I cannot remember the exact error), and the drive switched back to an uninitialized designation in windows.  At some point a window popped up and said the drive was in RAW format and asked me to format the drive (which I did not).

The windows Device Manager shows the drive operating normally under Disk Drives.  The Drive Management tool in windows shows the disk as unallocated and asks to initialize the disk in MBR or another format, but I declined.

I tried the open source utility MBRFIX based on a forum fix that was recommended, but it failed with a read error.

I used several utilities like EASUS  (Data Recovery and Partition Master tools), GetDataBack, Seagate Tools, Data Rescue 3, Mini Tool Partition Wizard, AOMEI Partition Assistant, etc.  None recognized the partition, even after hours of analysis, returning errors 23 and 55.  I can't remember which utility, but one indicated the MFT needed to be repaired.  

I tried the Linux boot disks like PartedMagic, TestDisk, gparted, BootMed, etc. but none could recognize the partition, although the disk size, serial number, make, etc.  I tried them with the laptop via USB connection (windows 7) and in the Linux box via the SATA card, with similar results.

I'm unable to clone via conventional tools (Booting into Linux, where this problem started or via Windows clone tools, both open source, freeware, and paid versions) because it appears to the clone tools the partition is not formatted.

I'm confused why it the error happened, and why the disk sometimes shows up and sometimes not (mostly not) and if it is a MFT, MBR, partition error, or other related issue that is "hiding" the data because it does not recognize the partition, so nothing in Linux or Windows is seeing it.

You can hear the drive spinning  up like it is trying to read files, with no clunking sounds normally associated with a drive failure, so my hopeful self wants to believe it is a software fluke and not a total hardware failure.

So I placed the HD back into the Linux box and ran the DiskPatch utility via CD/ROM (It didn't like the USB 1 GB for some reason even after properly formatting it to FAT 32, even though it wrote the logfiles there with the CDROM boot), and the results are below:


.../000:23/LOG> ### LOG START ###
.../000:23/LOG> DISKPATCH 4.0.300
.../000:23/LOG> © 2000-2013 DIY DataRecovery
.../000:23/LOG> Contact info: www.DIYDataRecovery.nl
.../000:23/LOG> MemFree: 64Kb
.../000:23/LOG> CommandLineParms: /sup
.../000:23/LOG> LogDate: 03-05-2014
.../000:23/CFG> FilePath="C:DPFILES\"
.../000:23/CFG> ReadRetries="32"
.../000:23/CFG> WriteRetries="32"
.../000:23/CFG> MaxReadErrors="32"
.../000:23/CFG> MaxWriteErrors="1"
.../000:23/CFG> ReadDelay="0"
.../000:23/CFG> LogEachReadError="1"
.../000:23/CFG> WriteAfterReadError="1"
.../000:23/CFG> VfyFixedBadSect="1"
.../000:23/CFG> CleanAfterDOD="1"
.../000:23/CFG> DiskReset="1"
.../000:23/CFG> SectorSkip="1024"
.../000:23/CFG> AutoSaveState="1"
.../000:23/CFG> DumpFoundSectors="0"
.../000:23/CFG> FixFats="1"
.../000:23/CFG> MaxFatScan="51200"
.../000:23/CFG> MaxDataColEntries="256"
.../000:23/CFG> IgnoreF8FF="0"
.../000:23/CFG> DownSizeExt="1"
.../000:23/CFG> ScanSignature="55AA"
.../000:23/CFG> Rebuild="00"
.../000:23/13H> Ext13H installed test requested
.../000:23/13H> Disk found at 128
.../000:23/13H> Ext13H version: 2.1 / EDD-1.1
.../000:23/13H> Ext13H Support: Extended disk access functions
.../000:23/13H> Ext13H Support: Enhanced disk drive functions
.../000:23/13H> Drive Interface Info: 
.../000:23/13H> Disk 128 X13H data : 16383/16/63 156301488/512
.../000:23/13H> Disk found at 129
.../000:23/13H> Ext13H version: 2.1 / EDD-1.1
.../000:23/13H> Ext13H Support: Extended disk access functions
.../000:23/13H> Ext13H Support: Enhanced disk drive functions
.../000:23/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:23/13H> Drive Interface Info: SATA
.../000:23/13H> Disk 129 X13H data : 16383/16/63 2930277168/512
.../000:23/13H> Disk found at 130
.../000:23/13H> Ext13H version: 2.1 / EDD-1.1
.../000:23/13H> Ext13H Support: Extended disk access functions
.../000:23/13H> Ext13H Support: Enhanced disk drive functions
.../000:23/13H> Ext13H Flags: Write with verify supported
.../000:23/13H> Drive Interface Info: 
.../000:23/13H> Disk 130 X13H data : 520/16/63 1987161/512
.../000:23/13H> Ext13H tested ok
.../000:23/FDL> DiskList requested
.../000:23/FDL> Disk found at 128
.../000:23/FDL> Disk found at 129
.../000:23/FDL> Disk found at 130
### DISKLIST ###
__D_|________LBA_|___H_|__S_|___GB_|__GEO_|___SS_
128 | .156301488 | 255 | 63 | ..74 | BIOS | .512 
129 | 2930277168 | .16 | 63 | 1397 | BIOS | .512 
130 | ...1987161 | .16 | 63 | ...0 | BIOS | .512 
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0 
.../000:23/RDS> ReadError for disk 129 at 0 (0 0 1), C:1, T:01h (Invalid function in AH or invalid parameter)
.../000:26/IAS> AdmiSector on disk 0 (128) not free for DP use, dump follows;
.../000:26/LOG> SectorDump requested at 34 (0 0 35)
###
000   0E 77 BC B2 9F 12 59 6B 1E B8 2B 7D A6 90 EE 39  |  .wŒ²Ÿ.Yk.ž+}Šî9
016   1E 1D 11 8F 7E 93 23 35 E4 83 93 97 86 DD AC 99  |  ...~“#5䃓—†Ý¬™
032   DC AA FC 2A EE BD 3F 50 E9 0E 92 17 8C C2 80 80  |  ܪü*îœ?Pé.’.ŒÂ€€
048   0E 71 E9 0D F8 06 EB 67 D9 46 2F C0 05 79 00 57  |  .qé.ø.ëgÙF/À.y.W
064   FB 6D 7D 3D 72 91 04 FA F2 76 88 94 8E 63 A1 04  |  ûm}=r‘.úòvˆ”Žc¡.
080   FA 04 A3 2C CA 45 36 0A 80 37 B5 F5 D0 25 1B 96  |  ú.£,ÊE6.€7µõÐ%.–
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   3A 26 8F 3C 38 27 82 83 32 6B 36 5F 0E A4 A2 94  |  :&<8'‚ƒ2k6_.€¢”
128   06 D6 B6 9C E4 07 9C 2B CE 2C 6E AF DA 81 36 10  |  .Ö¶œä.œ+Î,n¯Ú6.
144   66 17 51 FE 67 4C CA 39 CA 38 76 BD 15 A7 04 8A  |  f.QþgLÊ9Ê8vœ.§.Š
160   FD D4 78 DE 54 42 CB A1 7F 7B B5 85 2A C5 03 80  |  ýÔxÞTBË¡{µ…*Å.€
176   CF A7 D0 89 09 1A 5D F9 05 47 A5 10 11 76 60 AC  |  ϧЉ..]ù.G¥..v`¬
192   FF E4 0E 60 D8 B5 54 98 4B B8 7F 78 9C 96 ED F9  |  .ä.`صT˜Kžxœ–íù
208   D2 37 6E B1 1B A3 13 6F 8E 56 2B 17 58 85 64 B3  |  Ò7n±.£.oŽV+.X…d³
224   80 9C A3 D0 84 23 81 AB 5E DB B6 1E D2 33 86 58  |  €œ£Ð„#«^Û¶.Ò3†X
240   18 D7 BB 5B 95 DB CB E7 FA DE 73 AB 96 0E 87 E0  |  .×»[•ÛËçúÞs«–.‡à
256   88 1B 2A FE 7E 04 B9 4A 57 A9 51 92 36 54 C8 2C  |  ˆ.*þ~.¹JW©Q’6TÈ,
272   0B 54 A5 1E 1A F8 3F 63 FB 23 E7 0D 17 BA 2B D3  |  .T¥..ø?cû#ç..º+Ó
288   9C 2A 39 95 52 4B 48 9E B7 DF 46 24 E3 25 8C 1F  |  œ*9•RKHž·ßF$ã%Œ.
304   9D 1B C4 11 09 0F 5C FA A8 18 76 9D ED 78 B8 01  |  .Ä...\úš.víxž.
320   2B 15 F9 61 0F F4 D7 49 81 76 ED 44 6D C3 65 3E  |  +.ùa.ô×IvíDmÃe>
336   23 EB 80 00 98 B0 42 CB 41 9B 26 66 27 EE 8B 6C  |  #ë€.˜°BËA›&f'î‹l
352   E6 A9 7E 00 4F FF 08 30 20 D7 90 C9 E9 2E EF 5A  |  æ©~.O..0 ×Éé.ïZ
368   13 DB 16 7E 32 94 6D C3 9A 9C 64 68 F9 66 AA 03  |  .Û.~2”mÚœdhùfª.
384   08 37 93 06 47 C8 24 18 DC 96 A6 4B 66 32 21 54  |  .7“.GÈ$.Ü–ŠKf2!T
400   07 76 00 28 AA EC 7B B8 DA F9 3A 1E 87 A7 55 0F  |  .v.(ªì{žÚù:.‡§U.
416   32 70 F7 F7 E4 B3 7A 51 8D 64 FD 32 AE 52 68 56  |  2p÷÷ä³zQdý2®RhV
432   90 46 B9 EF C2 55 26 29 96 F4 30 72 19 6B 22 0F  |  F¹ïÂU&)–ô0r.k".
448   27 43 17 9F 93 73 07 61 00 C6 73 04 9F 3A BF 5C  |  'C.Ÿ“s.a.Æs.Ÿ:¿\
464   E5 79 0A AC 77 75 3C 2E 13 A4 57 2F C4 D9 F1 EC  |  åy.¬wu<..€W/ÄÙñì
480   59 66 F4 3D 4D 65 E1 71 C4 E8 35 9D CA A2 45 D5  |  Yfô=MeáqÄè5Ê¢EÕ
496   F1 21 88 75 BB 5F 58 72 B1 E2 85 9A 51 A8 3A 00  |  ñ!ˆu»_Xr±â…šQš:.
###
.../000:26/RDS> ReadError for disk 129 at 34 (0 0 35), C:2, T:01h (Invalid function in AH or invalid parameter)
.../000:27/IAS> AdmiSector read error on disk 1 (129), not accessable
.../000:27/IAS> AdmiSector found on disk 2 (130)
.../000:27/KEY> DEMO/1
.../000:27/PFC> PQstuff signature not detected on disk 0 (128)
.../000:27/RDS> ReadError for disk 129 at 10 (0 0 11), C:3, T:01h (Invalid function in AH or invalid parameter)
.../000:28/PFC> PQstuff signature not detected on disk 1 (129)
.../000:28/PFC> PQstuff signature not detected on disk 2 (130)
.../000:28/PFC> Disk health 1-50
.../000:29/RDS> ReadError for disk 129 at 0 (0 0 1), C:4, T:01h (Invalid function in AH or invalid parameter)
.../000:32/PFC> Partition State backup not found on disk 0 (128)
.../000:32/PFC> Partition State backup not found on disk 1 (129)
.../000:32/PFC> Partition State backup not found on disk 2 (130)
.../000:32/PFC> No Repair date found on disk 0 (128)
.../000:32/PFC> No Repair date found on disk 1 (129)
.../000:32/PFC> No Repair date found on disk 2 (130)
.../000:42/VEC> Start Verify EPBR Chain for disk 1 (129)
.../000:42/VEC> Listing current partitions on disk:
.../000:42/RDS> ReadError for disk 129 at 0 (0 0 1), C:5, T:01h (Invalid function in AH or invalid parameter)
.../000:45/VEC> No partitions found
.../000:45/RDS> ReadError for disk 129 at 0 (0 0 1), C:6, T:01h (Invalid function in AH or invalid parameter)
.../000:49/VEC> Could not read MBR on disk 1 (129), VEC aborted
.../000:51/CSD> Start CheckDisk for disk 1 (129)
.../000:51/CSD> 0 (0 0 1)
.../000:51/CSD> 1007 (0 15 63)
.../000:51/CSD> 2930276160 (2907020 0 1)
.../000:51/CSD> 2930277167 (2907020 15 63)
.../000:51/RDS> ReadError for disk 129 at 0 (0 0 1), C:7, T:01h (Invalid function in AH or invalid parameter)
.../000:53/RDS> ReadError for disk 129 at 1007 (0 15 63), C:8, T:01h (Invalid function in AH or invalid parameter)
.../000:54/RDS> ReadError for disk 129 at 2930276160 (2907020 0 1), C:9, T:01h (Invalid function in AH or invalid parameter)
.../000:55/RDS> ReadError for disk 129 at 2930277167 (2907020 15 63), C:10, T:01h (Invalid function in AH or invalid parameter)
.../000:56/CSD> !- Disk 1 (129) can not be accessed
.../001:00/CSD> CheckDisk complete, ReadErrors 4
.../001:00/USD> No source / disk selected
.../001:00/USD> Select disk completed
.../001:00/LOG> RunTime: 001:00
.../001:00/LOG> ### CLOSE LOG ###

 

I have read over and tried the tips at Mr. Litten's fine site and this forum without any real progress.

 

Just a finale desperate thought is whether it would be possible to initialize the disk in windows with the quick format to "restore" the partition and then recover data that way?

 

Also, is it possible to copy the data (about 44 GB) from this 1.5 TB drive to another drive without buying another 1.5 TB drive (short on cash!)?  Any freeware, opensource, or paid software that will do it?  I'm not sure if ddrescue would work since there is no partition per se to recognize or whether it needs to mount a drive that has unallocated data.

Thanks for any assistance or feedback!



BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,449 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:54 PM

Posted 05 March 2014 - 10:14 AM

For a RAW drive you can use PhotoRec but what files are recovered will have generic file names. Just make sure all files are recovered to a drive other than than the one that is being recovered or your files will be lost.

 

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users