Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HDD Boot Sector Virus or failing HDD


  • Please log in to reply
7 replies to this topic

#1 PolarKev

PolarKev

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 19 May 2017 - 04:13 PM

Looking for some insight on my issue with another persons computer.

ASUS GR6 i5-5200U, 8GB, 1TB 7200rpm HGST Hdd.

Original OS-Win 8.1, Latest OS-Win 10 1607 14393.1198

 

The person who owns the system explained it to me this way...These may not be his exact words. He said he didn't notice anything unusual while he was on the internet.

------------------------

I was on the internet and then got off. Went to get something and when I came back, I just barely had time to notice the screen said updating Firefox and then the computer rebooted and would not start windows even after starting and shutting the computer down several times.

------------------------

He brought his computer to me to see if I could help him out. I removed the drive to attached to another computer capable of booting to a USB or CD drive. Used Acronis True Image (ATI) for short, bootable to try and back up the drive. ATI could not see the drive so I rebooted to Acronis Disk Director (ADD). After quit a while the drive showed up with deleted and unallocated partitions. I did a repair on the drive which took 20+ hrs. I shut down and restarted with ATI bootable again. This time I could see the drive and partitions so I plugged in a brand new 3TB MyPassport Ultra, right out of the box. After ATI seen the External MyPassport drive, I proceeded to image the HGST hard drive. ATI popped up with drive 1  read errors so I tried to do a file backup instead of a drive back up. I also got errors when selecting complete folders. If I just selected files I could backup some files but still got read errors on others. As this was a newer system, 2015 or newer, with no media or windows product keys, I tried to back up the original registry hives so I could at least load the hive to extract info.

 

What happened next freaked me out because the first thing I thought of was a Boot Sector Virus. As I was hand picking files to back up within ATI, I starting receiving a Cannot read from Sector "0" Disk 2 which was the MyPassport drive. This happened a couple more times and then I could no longer access the MyPassport drive. At that point I shut down and restarted with (ADD), plugged in the MyPassport drive, (ADD) seen the drive but was viewing it as unallocated. At this point I wasn't going to do anything with the MyPassport drive until I investigated this further. I was able to go back in with ATI and extract 1 file out of the config folder which was the software hive. I did get the info for windows version and converted the binaries into product keys so at least we have something to work with.

 

So guys and or Gals, this is where I am and could use some insight into this before I try and write the drive full of Zero's. Or I guess two drives now.

 

Any help would be appreciated as I have never seen this kind of problem before. I would have taken this as a bad drive except for the brand new MyPassport drive going from read/write capable to unallocated.

 

Thank You in advance

Regards, Kevin


Edited by PolarKev, 19 May 2017 - 04:21 PM.


BC AdBot (Login to Remove)

 


#2 mjd420nova

mjd420nova

  • Members
  • 1,799 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:44 AM

Posted 19 May 2017 - 09:29 PM

Sorry to say that you have a failing drive.  I believe it to be a controller failure rather than a mechanical fault.  It might be possible to recover with a replacement control board.



#3 PolarKev

PolarKev
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 20 May 2017 - 07:30 AM

So the brand new MyPassport drive failing to read/write and showing up unallocated while trying to back up that failing drive is a coincidence? Or would the controller card on that failing drive affect the MyPassport as well?



#4 JohnC_21

JohnC_21

  • Members
  • 23,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:44 AM

Posted 20 May 2017 - 08:06 AM

Is the Passport shown a RAW in Disk Management?

 

https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_devices/windows-10-corrupted-my-external-hard-drive-twice/08342949-e086-4e9b-82d6-b6b491586987?page=2

 

I believe this issue may be related to Windows 10 use of a hibernation file for fast startup. Did you reboot the Windows 10 computer with the Passport drive attached.


Edited by JohnC_21, 20 May 2017 - 08:21 AM.


#5 PolarKev

PolarKev
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 20 May 2017 - 09:30 AM

The New MyPassport has never seen windows 10. It originally showed up in ATI normally but after the backup attempts it showed up as unallocated.

Acronyms used from original post.

ATI (Acronis True Image)

ADD (Acronis Disk Doctor)

HGST (ASUS 1TB HGST Hard Drive)

 

I used a bootable ATI cd in another computer to try backup the HGST HDD. HGST drive not found. Replaced Bootable ATI cd with Bootable ADD cd. After a long time ADD sees HGST HDD but some partitions show up as deleted or and some as Unallocated. Used ADD to repair drive.

 

Rebooted with ATI Bootable, drive shows up as drive-1. Plugged in Brand New out of the Box 3TB MyPassport, it shows up as drive-2. Try to copy HGST to MyPassport as image but has read errors. Retried with folder backup from HGST to MyPassport but has read errors also. Tried file by file from HGST to MyPassport with some success but still read errors on some files.

 

I went after the registry file hives but could only back up Software, system and default. Tried a second time but ATI reported MyPassport (drive-2) could not read sector-0. Rebooted with ADD and MyPassport showed up as Unallocated.

 

Just a note: I've used that ATI cd successfully several times before.



#6 JohnC_21

JohnC_21

  • Members
  • 23,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:44 AM

Posted 20 May 2017 - 09:45 AM

If the drive shows as Unallocated and RAW in Disk Management then it's possible the Partition Table became corrupted and can be recovered with Testdisk for Windows unless there is nothing on the drive you wish to recover then I would partition and reformat. I would use the WD diagnostic to test the drive to make sure it's good.

 

Just a note: If the computer came pre-installed with Windows 8/8.1 or 10 then the key is embedded in firmware and will auto-active once online after a reinstall. On any OEM with Windows 8/8.1/10 you can find the key in the MSDM table. It is also possible to recover the key in firmware using a live linux disk.

 

If Windows 10 was upgraded from Windows 8.1 the license is digital and stored on Microsoft servers. No key is required for a reinstall.

 

https://support.microsoft.com/en-us/help/12440/windows-10-activation



#7 PolarKev

PolarKev
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:44 AM

Posted 20 May 2017 - 10:10 AM

Thanks JohnC_21, I will run the tool and check the drive. Also thanks for the other links, good info and tools.

 

Regards Kevin



#8 JohnC_21

JohnC_21

  • Members
  • 23,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:44 AM

Posted 20 May 2017 - 10:12 AM

Your Welcome, and good luck on the WD diagnostic.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users