Jump to content











Photo
- - - - -

NTFS now showing as RAW

ntfs now showing as raw

  • Please log in to reply
13 replies to this topic

#1 Mr_Cool59

Mr_Cool59

    Newbie

  • Members
  • 22 posts
  •  
    United States

Posted 11 January 2012 - 04:15 PM

my problem is that my computers data drive is showing as raw i did some research last night and all i could come up with is to try and retrieve the data then reformat i was wanting to se f there might be a better solution to fix the issue as to why this happened i could not tell you all i do now is that i noticed the issue after a install of debian on a bother drive that also has windows for a dual boot

#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 11 January 2012 - 04:55 PM

A volume (or partition) seen as RAW may mean several things:
  • the partition or volume is OK, BUT the pointers to it in the MBR or EBPR are "wrong"
  • the partition or volume is OK, BUT the pointers to it's filesytem structure in the PBR/VPR are "wrong"
  • the partitition or volume is actually (partially or totally) corrupted

If #1 or #2 it is generally trivial to recover and there is no need whatsoever to re-format.
If #3 in some cases, once recovered the volume a CHKDSK is enough, but if the partition/volume cannot be recovered, and you get (hopefully) the data back with file-based approach then you need to re-format.

First thing you should check if any of #1 or #2 is true, then attempt recovering the partition and only if this is not possible go ahead with file-based recovery attempts.


Preliminary questions:
  • Which OS are you currenty running (or which Os can you use to access that disk/partition)?
  • Are you familiar with command line?
  • Are you familiar with a disk editor ?
  • Have you available another disk to copy the thingy (possibly the WHOLE disk, but also the partition might do, once verified it is NOT #1 may be enough) to (dd-like copy)?

:cheers:
Wonko

#3 panreyes

panreyes

    Member

  • Members
  • 57 posts
  •  
    Spain

Posted 11 January 2012 - 04:59 PM

Also try to recover the PBR with Testdisk.
It helps in some cases which windows won't be able

#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 11 January 2012 - 05:22 PM

Also try to recover the PBR with Testdisk.
It helps in some cases which windows won't be able

Just for the record the "Also" is EXACTLY #2. :whistling:

Running *any* recovery tool, expecially if you are not familiar with it and until you haven't a "forensic sound" copy of the disk, is IMNSHO "playing with odds".
Example:
http://www.msfn.org/...-after-bsy-fix/

:cheers:
Wonko

#5 Mr_Cool59

Mr_Cool59

    Newbie

  • Members
  • 22 posts
  •  
    United States

Posted 11 January 2012 - 09:14 PM

1 windows 7, Debian neither can access the disk windows just wants to reformat it but it does show up as a disk with both
2 a little i know enough to know when to stop before i get into trouble
3 gparted or acorns are the two i know about off hand
4 no i would need to use more then 1 HDD to back up the disk as i do not have one that is big enough to just copy the whole partition

#6 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 12 January 2012 - 09:41 AM

The lack of capacity for making an integral copy is a problem.
You have to be particularly careful.
Ideally, if you have another system, it would be easier to connect the hard disk to this "other" system, as to have a "full" OS working as opposed to a Live CD.
You can use dd (or a similar program) to backup "chunks" of the hard disk, something similar to what was explained here (though the issue was the unreadability status of the disk, something that you should NOT suffer by):
http://reboot.pro/15040/
that app automatically names the chunks with start address/length, you can do the same with dd or similar, but as said you have to be careful.

The suggested LiveCD is parted magic, as it contains by default testdisk.

Even before doing the imagiing, if you promise you won't write anything you can have a quick look at the partition with testdisk, maybe it is one of those "easy to solve" issues.

Remember that drive was partitioned under Windows 7 (I presume) so you have to go to advanced and set to not respect Cylinder boundaries.
Run testdisk with a log and post the log (or upload it somewhere and post a link to the file).
Follow what has been done in this thread:
http://www.msfn.org/...ith-value-data/

Before anything make sure you have read and got familiar with these:
http://www.cgsecurit...sk_Step_By_Step
http://www.cgsecurit...sector_recovery

If you have any doubt, ask before doing something you may later regret.

:cheers:
Wonko

#7 sambul61

sambul61

    Gold Member

  • Advanced user
  • 1568 posts
  •  
    American Samoa

Posted 12 January 2012 - 01:16 PM

my problem is that my computers data drive is showing as raw

Alternatively, you can try PartitionGuru or Paragon Hard Disk Manager to easily and safely recover a lost partition in 1-2 clicks, if you prefer EasyButton®. :)

#8 Mr_Cool59

Mr_Cool59

    Newbie

  • Members
  • 22 posts
  •  
    United States

Posted 14 January 2012 - 03:23 AM

i belive this is the log you wainted



Fri Jan 13 11:44:51 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, January 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2012-01-10T08:17:59
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1031798784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive1)=640135028736
filewin32_getfilesize(.PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(.PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for .PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive3)=1031798784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.C:)=414102585344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.D:)=640132383744
filewin32_getfilesize(.E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(.E:) SetFilePointer err Incorrect function.

Warning: can't get size for .E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.F:)=0
Warning: can't get size for .F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.G:)=1031766528
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, S/N:091104PCE400VLG29AGC, FW:PC4O
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - TOSHIBA MK6465GSX, S/N:Y0J8S1LHS, FW:GJ00
Disk /dev/sdd - 1031 MB / 984 MiB - CHS 125 255 63, sector size=512 - Memorex TD Classic 003C, FW:5.00

Partition table type (auto): Intel
Disk /dev/sdb - 640 GB / 596 GiB - TOSHIBA MK6465GSX
Partition table type: Intel

Analyse Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
No partition is bootable
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63

recover_EXT2: s_block_group_nr=0/415, s_mnt_count=1/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13605632
recover_EXT2: part_size 108845056
Linux 10981 176 12 17756 250 30 108845056
EXT4 Large file Sparse superblock Recover, 55 GB / 51 GiB

recover_EXT2: s_block_group_nr=0/427, s_mnt_count=1/21, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13998592
recover_EXT2: part_size 111988736
Linux 18436 20 17 25407 14 15 111988736
EXT4 Large file Sparse superblock Recover, 57 GB / 53 GiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35581/5/9
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35581/5/9
FAT12 35581 5 9 35581 50 53 2880 [EFISECTOR]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/125/54
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35592/125/54
FAT12 35592 125 54 35592 171 35 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/171/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35592/171/36
FAT12 35592 171 36 35592 217 17 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/217/18
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35592/217/18
FAT12 35592 217 18 35593 7 62 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/7/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35593/7/63
FAT12 35593 7 63 35593 53 44 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/53/45
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35593/53/45
FAT12 35593 53 45 35593 99 26 2880 [SEAGATE]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/99/27
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35593/99/27
FAT12 35593 99 27 35593 145 8 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/145/9
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35593/145/9
FAT12 35593 145 9 35593 190 53 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/190/54
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 35593/190/54
FAT12 35593 190 54 35593 236 35 2880 [EUROSOFT]
FAT12, 1474 KB / 1440 KiB
file_pread(5,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,7,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(5,8,buffer,1250265096(77825/102/46)) lseek err Invalid argument
file_pread(5,3,buffer,1250265104(77825/102/54)) lseek err Invalid argument
file_pread(5,3,buffer,1250265151(77825/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,1250265167(77825/103/54)) lseek err Invalid argument
file_pread(5,11,buffer,1250265214(77825/104/38)) lseek err Invalid argument
file_pread(5,2,buffer,1250267136(77825/135/7)) lseek err Invalid argument

Results
Linux 10981 176 12 17756 250 30 108845056
EXT4 Large file Sparse superblock Recover, 55 GB / 51 GiB
Linux 18436 20 17 25407 14 15 111988736
EXT4 Large file Sparse superblock Recover, 57 GB / 53 GiB
FAT12 35581 5 9 35581 70 9 4096 [EFISECTOR]
FAT12, 2097 KB / 2048 KiB
FAT12 35592 125 54 35592 190 54 4096 [NO NAME]
FAT12, 2097 KB / 2048 KiB
FAT12 35592 171 36 35592 217 17 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35592 217 18 35593 7 62 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 7 63 35593 53 44 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 53 45 35593 99 26 2880 [SEAGATE]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 99 27 35593 145 8 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 145 9 35593 190 53 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 190 54 35593 236 35 2880 [EUROSOFT]
FAT12, 1474 KB / 1440 KiB

interface_write()

No partition found or selected for recovery

#9 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 14 January 2012 - 11:15 AM

Well, you will need to fill some gaps.
The log shows three disks:

Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, S/N:091104PCE400VLG29AGC, FW:PC4O
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - TOSHIBA MK6465GSX, S/N:Y0J8S1LHS, FW:GJ00
Disk /dev/sdd - 1031 MB / 984 MiB - CHS 125 255 63, sector size=512 - Memorex TD Classic 003C, FW:5.00

The issue should be the TOSHIBA one:

Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63


TESTDISK can find two Linux partitions and a number of floppy disk images, but it has found this:
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
which does look as a primary partition, NTFS, on a disk partitioned with 2k/XP (old cylinder boundary scheme) with size:
1,250,258,562*512=640,132,383,744 bytes
Since the Toshiba disk is 77825*255*63=1,250,258,625*512=640,132,416,000 it should mean that the disk was previously partiioned in a single huge 640 Gb NTFS partition.
Can you confirm this?

If yes, you can try doing what is explained here:
http://www.cgsecurit..._for_partitions
highlight that partition and press p to see if the files are there.

then do like here and ONLY verify that the backup bootsector is OK:
http://www.cgsecurit...sector_recovery

It woud be a very good idea to backup:
  • current MBR/partition table (even if invalid)
  • current PBR/bootsector of that partition (even if invalid)
before attempting writing anything to disk.

From a Linux you could dd the first 100 sectors of the disk to a file (on another disk), or do the same from Windows 7 (though windows 7 has some problems with letting programs access the MBR, so if using the latter you should put the disk offline first):
http://reboot.pro/8200/page__st__39
(it depends on the tool you have handy, some may work allright, as they do the same automatically)

:cheers:
Wonko

#10 Mr_Cool59

Mr_Cool59

    Newbie

  • Members
  • 22 posts
  •  
    United States

Posted 14 January 2012 - 02:12 PM

ok the way i have my computer set up is like this the Hitachi drive is the main drive that has windows and Debian on it in a dual boot setup, the TOSHIBA witch is the drive i have the issue with is what you would cal a data drive witch has all my personal data on it the Memorex was a flash drive that had test disk on and yes the drive was one big partition

#11 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 14 January 2012 - 02:26 PM

... and yes the drive was one big partition

good, then you can proceed with the given steps. :)

Once you have the backup of the mentioned bunch of sectors (just in case), IF when pressing p you can see your files, THEN you can go on and try fixing the bootsector by using the backup one (IF TESTDISK says that the backup one is OK)

:cheers:
Wonko

#12 ianniow

ianniow
  • Members
  • 1 posts
  •  
    United Kingdom

Posted 18 May 2012 - 06:41 PM

I have just read all through this post and was thinking how patient Wonka the sane was and how good the explanations were. Then I get the end and there is no outcome, no thanks very much not even that trashed my disk and lost everything.
I don't normaly comment but that just annoyed me

#13 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 19 May 2012 - 02:06 PM

I don't normaly comment but that just annoyed me

If you like "happy endings", here there is a good example ;):
http://reboot.pro/3833/
(and of course also a few peeps that simply disappeared. that's how life is :rolleyes:)
:cheers:
Wonko

#14 Mr_Cool59

Mr_Cool59

    Newbie

  • Members
  • 22 posts
  •  
    United States

Posted 19 May 2012 - 04:33 PM

sorry i actually forget about the post i used a program to recovery the data then i re formated the drive to fix the issue




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users