Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

External HDD - File System compromised


  • Please log in to reply
9 replies to this topic

#1 Jisec

Jisec

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 21 September 2016 - 07:04 AM

My external 1TB Western Digital - Model: WD10JPCX-24UE4T0 - has been compromised.

 

I had it connected to my laptop, running Windows 10, when I got a desktop notification claiming that an overvoltage issue involved that external drive.

 

From then on, no computer could detect the HDD when connected and the external light that indicates its status never turned on when connected.

 

I've read guides where people could get their drives working by changing the SATA to USB connector of the HDD, which is what I did, and allowed my laptop to detect the drive again.

 

The problem is that I cannot browse the content because I get a "non recognized file system" message when I try to open it, and my laptop tells me that the HDD has to face a format before being able to use it.

 

The data inside that HDD is not crucial to me, but I'd like to recover the content or at least file names - which is the main thing that I need.

 

Can somebody suggest me how to proceed?



BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 23,205 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:29 PM

Posted 21 September 2016 - 07:24 AM

Was this a bare drive in a third party enclosure or was the external drive a WD as WD encrypts the data using a proprietary bridge/interface card.

 

https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/

https://www.youtube.com/watch?v=xpwt13uDDZo

When you connect the drive how is it detected in Disk Management? Does it say the drive is RAW or not initialized? 



#3 Jisec

Jisec
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 21 September 2016 - 07:38 AM

Was this a bare drive in a third party enclosure or was the external drive a WD as WD encrypts the data using a proprietary bridge/interface card.

 

https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/

https://www.youtube.com/watch?v=xpwt13uDDZo

When you connect the drive how is it detected in Disk Management? Does it say the drive is RAW or not initialized? 

 

Originally it was the internal drive of my laptop, then I've purchased a Samsung EVO SSD to replace it and an external case so that I could turn the internal drive in an external one.

 

When attempting to restore it I've changed the external case circuit, not the circuit of the drive itself, so there shouldn't be issues with encryption.

 

About Disk Management, when the drive is connected file system, it is classified as RAW.



#4 JohnC_21

JohnC_21

  • Members
  • 23,205 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:29 PM

Posted 21 September 2016 - 08:32 AM

RAW indicates a corrupt partition table and or file system. Download Testdisk for Windows. Do not download the 64bit version. Unzip to a folder on your desktop and double click the testdisk exe file. 

 

Do a QuickScan. If it detects any partitions highlight each and press the "P" key. Do you see your files? Please post a screenshot.

 

http://www.cgsecurity.org/wiki/TestDisk_Download

 

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step



#5 Jisec

Jisec
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 21 September 2016 - 11:41 AM

RAW indicates a corrupt partition table and or file system. Download Testdisk for Windows. Do not download the 64bit version. Unzip to a folder on your desktop and double click the testdisk exe file. 

 

Do a QuickScan. If it detects any partitions highlight each and press the "P" key. Do you see your files? Please post a screenshot.

 

http://www.cgsecurity.org/wiki/TestDisk_Download

 

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

 

Result of the quick scan:

 

jZjefIu.png



#6 JohnC_21

JohnC_21

  • Members
  • 23,205 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:29 PM

Posted 21 September 2016 - 11:54 AM

If you run TestDisk again but instead of clicking Analyze select Advanced then Boot and the bottom of the window. Does it list the boot sector as okay? Please provide a screenshot.



#7 Jisec

Jisec
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 21 September 2016 - 11:58 AM

If you run TestDisk again but instead of clicking Analyze select Advanced then Boot and the bottom of the window. Does it list the boot sector as okay? Please provide a screenshot.

Negative, this is what I get when selecting Advanced:

 

iYtpO4O.png



#8 JohnC_21

JohnC_21

  • Members
  • 23,205 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:29 PM

Posted 21 September 2016 - 12:22 PM

Under Analyze you can go for a Deeper Search but this will take a long time. If nothing is found then I suggest you do a scan of the drive using Easeus Data Recovery. This will allow you to do 2GB of data for free but it will show you any file names that can be recovered.

 

http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm

 

Edit: you may want to try using Partition Recovery of Partition Wizard. Double click any partition found to show if your files are listed. 


Edited by JohnC_21, 21 September 2016 - 12:25 PM.


#9 Jisec

Jisec
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 12 October 2016 - 11:02 AM

Under Analyze you can go for a Deeper Search but this will take a long time. If nothing is found then I suggest you do a scan of the drive using Easeus Data Recovery. This will allow you to do 2GB of data for free but it will show you any file names that can be recovered.

 

http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm

 

Edit: you may want to try using Partition Recovery of Partition Wizard. Double click any partition found to show if your files are listed. 

 

I've ben unable to use Internet for weeks.

I had ordered another external case from Amazon, which I received during these days.

After placing the HDD in the new case I got it working back, every file is at the right place and doesn't seem like I lost any data.

 

I wanted to thank you for the support received and apologize once again for taking this long to reply.

Thread can be closed.



#10 JohnC_21

JohnC_21

  • Members
  • 23,205 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:29 PM

Posted 12 October 2016 - 11:13 AM

Your Welcome,

 

Thank your for taking the time to post an update and the solution. 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users