EEVblog Electronics Community Forum
General => General Technical Chat => Topic started by: splin on November 23, 2017, 04:04:49 pm
-
Hmm, after reading the 'Are your backups up to date?' thread, I rebooted the PC today into windows 7 to find that it has lost the contents of the D and E drives on the second drive where most of the user account data was stored. Storage manager shows the partions, labelled D and E as healthy primary partions of type RAW and a healthy 450MB primary recovery partition (a windows 7 created partition - this is a home built system). And no my backups aren't all up to date |O
Ok, that could be a corruption of the partion table but there is more to it as Explorer and the control panel won't start - 'Server execution failed'. Computer management runs (start, right click on computer->manage) and command shell run ok. 'CHKDSK C:' and 'SFC /scannow' don't find any problems. The C drive is a Samsung 840 SSD. Ah ha - just found that there is a hotfix for Explorer and Control panel not working when the user account is on an unavailable drive - but that should have been rolled into windows updates long ago surely?
Magiccute formatted recovery is currently looking at the D drive and has found lots of files so I'm hopefull that most, if not all data will be recoverable. I happened to have it installled but the free version won't write those files. There is a free trial of EaseUS Data Recovery Wizard which claims to recover files from a RAW partition which I may try next.
Any suggestions as to why both NTFS partitions changed to RAW at the same time? I might have expected one to get corrupted by a shutdown problem but not both. Any suggestions as to the best way to proceed from here?
-
If you care about the data, make sure you don't use the disk anymore. Any file system operations can worsen the damage. Ideally you want to make a bit for bit copy of the drive, and use the copy for recovery attempts.
-
Good advice generally thanks, but in this particular case, short of formatting those partitions there is very little chance that anything will attempt to write to those raw partitions which Windows doesn't recognise and doesn't even try to mount them into the filesystem. Ransomeware or a virus could but in that case the damage will already have been done - and the C drive is OK.
-
Might be that the partition table was corrupted. Try running testdisk after your current recovery effort. It might be able to repair the damage: http://www.cgsecurity.org/wiki/TestDisk (http://www.cgsecurity.org/wiki/TestDisk)
-
If you care about the data, make sure you don't use the disk anymore. Any file system operations can worsen the damage. Ideally you want to make a bit for bit copy of the drive, and use the copy for recovery attempts.
On reflection, very sensible - copying them now.
Might be that the partition table was corrupted. Try running testdisk after your current recovery effort. It might be able to repair the damage: http://www.cgsecurity.org/wiki/TestDisk (http://www.cgsecurity.org/wiki/TestDisk)
Thanks, I'll give that a go.
FWIW, Magiccute eventually (several hours) finished examining the 1G byte D drive partiton; it found thousands of files but the filenames were random and curiously there were no .exe, .txt,.doc files amongst others. EaseUS Data Recovery Wizard free trial did a much better job finding recognisable file names. I didn't let it run far though as I decided to follow Mr Scram's advice and backup the partitions before going any further.
-
Forensic image copy of the bad drive, do *NOT* let Easeus onto any machine, the free trial versions, at least last year, were installing some rather unpleasant adware that was a PITA to get rid of and their support offering was 'pay for the full version then we will give you advice'.
I can vouch for Testdisk, it's got friends and relatives out of the mire a few times when they've done a stupid.
-
For something simple to use and best still, free, I highly recommend GetDataBack Simple: https://www.runtime.org/data-recovery-software.htm (https://www.runtime.org/data-recovery-software.htm)
It's basic but it does what it says on the box. You should be able to use that to recover your files onto another hard disk, provided there isn't some kind of major fault with the drive itself.
-
https://www.powerdatarecovery.com/hard-drive-recovery/raw-disk-file-recovery.html (https://www.powerdatarecovery.com/hard-drive-recovery/raw-disk-file-recovery.html)
Some interesting stuff here... worth a read.
I would consider the most likely scenario a hardware issue, possible bios corruption or malware.
I would try the following if possible -
Reboot -
Set bios to defaults -
continue boot and check drive
Windoze System restore to an earlier point if possible.
If no, then -
Change the drive sata cable and port.
I would look at EaseUS recovery - however it is expensive - you can experiment with the trial. COntrary to the gent above, I have never had any issues with EaseUS products and indeed use their TODO free backup all the time. All most will ever need. Never had crap installed with it. Usually it is when downloaded from one of the 'popular' download sites that have nasty little checkboxes that trick you into dl'ing crap you don't want. Anyways, good products. !
Some tips, never ever ever run any from of 'registry cleaner' if you have one - delete it and burn any copy you have. Absolutely never ever needed and can be like a small thermonuclear device. ::)
Is your AV current and operating correctly ?
Is your system fully patched ?
Did anything happen before the drive appeared 'raw' ? - did you do anything or run anything = ie - reg cleaner or similar.
Go to - https://www.trendmicro.com/en_gb/forHome.html (https://www.trendmicro.com/en_gb/forHome.html)
Bottom of page, select 'housecall' then run this virus / Malware scan.
The best there is !
Best of luck.
-
ddrescue can make an image of virtually any hard drive, even damaged ones by reading the drive multiple times and filling in missing pieces.
You shouldn't even mount a damaged hard drive, you should make a bit to bit copy and do all of your repair attempts on copies of that image
-
I don't know if this would help, I had something similar happen. Turned out I used the wrong cord on an old Western Digital external harddrive and it put the wrong voltage to the circuit board. It blew out the protection diode on the circuit board, but somehow it got past it and fried some other things. After replacing the blown diode, and it not working, I found an identical damaged drive off fleabay, bought it really cheap, and swapped out the circuit board. It fired right up and all the files were still there.
So, even though it came across as files not on the drive or configurable and noticeable from windows, the platters (mechanically) were just fine. it was the circuit board that was doing it.
-
Good advice generally thanks, but in this particular case, short of formatting those partitions there is very little chance that anything will attempt to write to those raw partitions which Windows doesn't recognise and doesn't even try to mount them into the filesystem. Ransomeware or a virus could but in that case the damage will already have been done - and the C drive is OK.
You're absolutely right, but it's just good practice to minimize any possible further damage done to the disk. If it turns out to be physiscal damage, for example, you want to operate the disk the minimum amount of time possible.
-
If you are up for a challenge, go for a sector copy from the corrupt drive to a similar new one. However, the rescue operation afterwards will usually take up a lot of time and effort and there is a good chance, that you will not be able to recover a whole lot of sane data.
It all depends on how valuable the not accessible data is.
From personal experience, if there is no easy fix it is usually the less painful way to toss such a drive in the dumpster and learn from the event, that having backup of valuable information is a must.
-
Another vote for GetDataBack
-
I'll chime in with a +1 on a sector copy of the damaged drive, to make a 'sandbox' copy to use for recovery attempts. Then if a tool messes something up even worse, you can make a new fresh copy and start again.
I have a nice dual SATA dock that also has a copy function. Pop the source and destination drives in, follow a special sequence to power it up (which avoids accidentally starting a copy), and wait. I recently used it to copy a 240 GB SSD onto a larger one in under 20 minutes, which is ~ 200 MB/s transfer rate.
After I made such a copy of the ailing drive, I'd try booting into a linux based recovery tool, and see what it can do. I don't have recent enough experience to make a specific recommendation on which tools to use.
-
Thanks for all the advice and suggestions. I wasted a lot of time trying to use Windows tools to copy the partitions but it turned out that they failed/took forever/couldn't use the unallocated space on the destination drive (> 2 TB)/produced a proprietary backup format rather than a bit for bit copy. Eventually I did what I should have done in the first place and created a Knoppix Live DVD and used ddrescue as recommended here. It copied really quickly with no read errors at all (so I could have just used DD).
That means the hard drive is probably in good shape mechanically but the data loss could have been due to a glitch in the electronics causing a cache corruption or similar. The prime cause of the corruption was almost certainly due to the fact that the PC locked up on the reboot requiring it to be reset (sorry, should have mentioned that earlier!). At the time I thought that it was due to the previous night's shutdown not having completed properly as it had the symptoms of waking (unsuccessfully) from sleep mode, but it's also possible the corruption could have occurred during the shutdown process. Whatever, I think it is much more likely to be a PC problem than a flakey hard disk (Seagate 2TB ST2000DX001-1CM1).
I used Testdrive, also recommended here, to check the partition tables. The tables seemed to be OK, with the primary and second EFI tables at the start and end of the drive match. Testdrive reported that both the boot sectors and the backup boot sectors on both the RAW NTFS partitions were bad. Tried the option to restore the boot sectors but Testdrive couldn't do it.
Ok, now try to search the RAW partition for files:
First up, Photorec, which comes with Testdrive, It did find a lot of files but unfortunately there was no directory structure and the original filenames and timestamps were lost.
So back to Windows and tried EASUS partition recovery free trial. That is much better, and appears to be finding most of the files, file structure, names and timestamps on one partition and many on the other, though not as good (the indexing must have got crosslinked or something as it found 393GB of files on a 200GB partition). It is supposed to have a 2GB restore limit on the free version, which should be enough as I did have most of the important stuff backed up. But mine wouldn't allow me to restore anything; seems I selected the wrong one as the web page is very confusing. Found and tried the free, 2GB limit, version (same name as the one I already had) and lo - this one allows me to restore up to 500MB - you have to share it with a friend to get another 1.5GBytes. Fair enough I suppose but still irritating - I wish they made it clear up front given that I could end up wasting several hours of my time only to find out their marketing is misleading.
Still, so far I'm very impressed with it - it restored a couple of files with the full directory structure and the original timestamps. Just not sure it's worth $70 to me given that it might not work at all on another occasion (on someone else's computer of course, assuming that the licensing allows that, as mine will always have 100% up to date backups in the future :-DD).
Next up was MiniTool Power Data Recovery V7.5 free edition with 1GB restore limit. This was impressive (but make sure to check the settings as quite a few file types (including .txt) are not selected by default). This also worked very well but unlike EASUS it doesn't show any of the recoverable files until the scan has finished, but the folder and file view looks much nicer than EASUS's in my view. It did restore some files with the fuill directory structure, names and original timestamps.
Again $69 so a gamble that it might not work at all next time if the corruption happens to have some tiny detail that it can't handle such as getting into a circular chain. More seriously, after terminating the scan half way through, it had a long list of partitions it thought it had found with various sizes, none of which matched one of the original partitions. There seemed to be a lot of duplicates as well and a lot of files that it couldn't name or locate in the file system. If I'd let the scan run to completion it may have improved, or got even worse. That's a job for the weekend.
I also tried Getbackdata free trial and despite playing with the options it didn't seem to do any better than the freeware Photorec. I will give it another try. Nor did Magiccute. Recuva, despite offering 'Deep Scan' and 'Scan for non-deleted files (for recovery from damaged or reformatted disk)' options didn't even attempt to handle the corrupted RAW partitions.
There are a few other tools out there - I'd be happy to receive any suggestions, especially for the free kinds. It takes ages (hours) to test them though on the 1GB partition.