DISASTER: partition now not recognised after accident with BOOTICE

I have managed to make a colossal mistake as I idiotically somehow had the wrong drive selected - an external 320Gb NTFS 1 partition Toshiba HD - instead of a Cruzer 4Gb USB stick when I used BOOTICE (part of the WinSetupFromUSB app package) to do a repartition + format to USB-HDD mode.

About 5 seconds after I started the format in BOOTICE, I realised to my horror what I had done and frantically pulled out the USB HD cable while the program was running.

I only have myself to blame to for this error. Most unfortunately, this drive has many many gigabytes of irreplacable non-backed up personal stuff on it.

Now as a result of my cockup, the drive does not have any recognisable partitions - Windows now won't find or recognise any partitions on it, nor will 2 commercial recovery tools I've tried, Acronis RecoveryExpert Deluxe & Active Undelete. If I try to go into it via Explorer, it thinks the drive is not formatted.

Before I go have a nervous breakdown when it fully sinks in just how much data there was on that one drive, I thought I'd ask here in the forlorn hope that someone out there might have some words of advice, even if its confirmation there's definitely nothing I can do now..?

Thanks....

DMTelf

I have managed to make a colossal mistake as I idiotically somehow had the wrong drive selected - an external 320Gb NTFS 1 partition Toshiba HD - instead of a Cruzer 4Gb USB stick when I used BOOTICE (part of the WinSetupFromUSB app package) to do a repartition + format to USB-HDD mode.

About 5 seconds after I started the format in BOOTICE, I realised to my horror what I had done and frantically pulled out the USB HD cable while the program was running.

I only have myself to blame to for this error. Most unfortunately, this drive has many many gigabytes of irreplacable non-backed up personal stuff on it.

Now as a result of my cockup, the drive does not have any recognisable partitions - Windows now won't find or recognise any partitions on it, nor will 2 commercial recovery tools I've tried, Acronis RecoveryExpert Deluxe & Active Undelete. If I try to go into it via Explorer, it thinks the drive is not formatted.

Before I go have a nervous breakdown when it fully sinks in just how much data there was on that one drive, I thought I'd ask here in the forlorn hope that someone out there might have some words of advice, even if its confirmation there's definitely nothing I can do now..?

Thanks....

DMTelf

I would try "Partition Find and Mount" and "Teskdisk" (both included in the VistaPE CAPI project) and see if they can find the partitions. if that fails though I would start thinking about if it was worth spending the $$$$ sending the drive in for professional data recovery.

DON'T PANIC
(assume the above to be written in large, friendly letters)



Most if not all of your data can be recovered, the only thing you need is that you stay calm, don't fret and STOP fiddling with the drive with applications you do not know/understand fully.

It is an external USB drive, right?

If yes you don't need a PE, you can use your main OS, which OS is it? (XP/Vista/7, etc.)?

Describe, to the best you can recall, HOW that drive was partitioned (number and type of partitions, filesystems used, etc).

For the moment you want only TESTDISK:
http://www.cgsecurit...g/wiki/TestDisk

It is strongly advised, though not strictly necessary, that you get ANOTHER (new or however blank) USB hard disk and before starting the recovery you image the old drive at sector level, if you can afford to buy such a new disk, it would be safer to have it.

Anyway you will need an adequate amount of free hard disk space on some device, to store the recovered data temporarily, should the partition recovery "on place" be not possible or not possible entirely.

Here are a few examples of what you will need to be doing, I need also to understand which level of familiarity you have with OS, PC and command line apps:
http://www.msfn.org/...howtopic=141687
http://www.msfn.org/...howtopic=141448
http://www.msfn.org/...howtopic=140675
http://www.msfn.org/...howtopic=133933



Wonko

although it does not sounds nice to interfere while an professional already is in to help you , but i would never post if i did not have same situation in past .

it was a internal hdd of a friend which came across same issue,

all i did was to run the following app (Disk Genius )



i selected search LOST partitions from Tools , and it did the job within 5 minutes..

just remember following 2 points,

MAKE SURE you reserve ONLY those partition what you recognize that you had.
MAKE SURE that you run the wizard with default settings,

http://www.boot-land...?...ded&start=#


by the way this version also has the option to recover files ..

remember it is just an option (disk genius i mean)..

although it does not sounds nice to interfere while an professional already is in to help you , but i would never post if i did not have same situation in past .

You joking right?

If I were a professional I would charge a neat $800÷$2,000 and be done with it. :
http://www.911cd.net...showtopic=23661

I am not familiar with Disk Genius, it is most probably a very good app , but I wouldn't personally bet my DATA on anything that has a WIZARD , I mean, wizards, just like Jedi's, may be allured by the Dark Side , and you know how it goes:

Once you start down the dark path, forever will it dominate your destiny, consume you it will.

When we are talking of DATA recovery, I have my own approach:
http://www.msfn.org/...showtopic=84345
http://www.msfn.org/...opic=84345&st=7

Rules are as follows, as I see it:
1) ALWAYS make a bit by bit copy of the damaged media, if possible, make TWO of them
2) Run against the image EVERY single piece of software you can think of, starting with a program you know and trust, but do NOT overlook "minor" ones or "narrow" ones, i.e. those aimed to recovery just a certain type of file or a certain type of damage
3) Given the low cost of todays hardware, NEVER attempt repair on original media, only do it AFTER recovery was succesful on the copy, what you were not able to do might be possible
4) Do not EVER give up, I was able to recover data that "so-called" professionals had determined to be an impossible recovery, simply by using a different tool or making some minor manual corrections.
5) TELL the customer that recovery has MANY levels of accuracy and corresponding many levels of time involved and cost, explain him that even if a quick scan determined that no recovery was possible, a deeper analisys may give some results, data recovery if not successful with "easy - press one button and go" tools, manual recover is often possible, and in some cases even partial data can be of great help, all in all is a matter of the VALUE the customer attributes to lost data

Programs I can swear by:
TESTDISK (Freeware)

File Scavenger (NTFS only -Commercial)

TiramiSU (FAT16-FAT32-NTFS-ZIP disks - not anymore developed - Shareware - Commercial - acquired by Ontrack)

Wonko

I would try "Partition Find and Mount" and "Teskdisk" (both included in the VistaPE CAPI project) and see if they can find the partitions. if that fails though I would start thinking about if it was worth spending the $$$$ sending the drive in for professional data recovery.

Thank you for your advice!

"Partition Find and Mount" unfortunately didn't find any partitions

I'll post about my TeskDisk results + other findings later on in this thread.

DMTelf

DON'T PANIC
(assume the above to be written in large, friendly letters)

Thank you so much for your help with this! I'll try my best not to panic! It's so nerve wracking for me though...

Most if not all of your data can be recovered, the only thing you need is that you stay calm, don't fret and STOP fiddling with the drive with applications you do not know/understand fully.

I have stopped fiddling with the drive itself & will from now on only fiddle with images made from it.

It is an external USB drive, right?

Yes. The external USB HD is a Toshiba MK3252GSX.
Specs: http://sdd.toshiba.c...XSpecifications
According to the above specs, this drive physically has 4 data heads & 2 disks & this drive logically has 16 heads, 16,383 cylinders & 63 user sectors/track at zone 0.

If yes you don't need a PE, you can use your main OS, which OS is it? (XP/Vista/7, etc.)?

XP SP3 fully patched.

Describe, to the best you can recall, HOW that drive was partitioned (number and type of partitions, filesystems used, etc).

Original Toshiba MK3252GSX partitioning from memory: NTFS format, 1 partition, default sector size. Formatted via XP's Logical Disk Management Service.

I intended to prepare a Cruzer USB stick for installing XP onto the SDHC in my eee 900 PC. I used WinSetupFromUSB 1.0 beta 5 & with this package, you prepare the removable device using BOOTICE and then put the image of the OS to install onto it using RMPrepUSB.

How I screwed it up: I used BOOTICE to format the wrong drive to USB-HDD mode, as shown in the attached screengrab. A few seconds after I started the format, I realised I had chosen the wrong drive so I quickly yanked out the USB cable & the DOS console window which opened after I started the format closed straight away.

NB: the BOOTICE screengrab shows the correct drive has been selected so the disk information shown at the bottom of the "Repartition & Format" window is for the Cruzer 4Gb USB drive & not the Toshiba HD.

It is strongly advised, though not strictly necessary, that you get ANOTHER (new or however blank) USB hard disk and before starting the recovery you image the old drive at sector level, if you can afford to buy such a new disk, it would be safer to have it.

Anyway you will need an adequate amount of free hard disk space on some device, to store the recovered data temporarily, should the partition recovery "on place" be not possible or not possible entirely.

I went out and bought a Seagate Expansion 1Tb external HD for this recovery & have split it to 1 x 500Gb & 1 x 431Gb NTFS partitions. Please let me know if there is another more appropriate partioning I should do.

I've never used dd before so I downloaded dd for Windows from http://www.chrysocome.net/dd & have attached the results of the dd --list command to this post.

As the Toshiba HD does not have a drive letter, I'm unsure how to refer to its NT block device object in the if=\\ part of the the below dd command?

dd --progress if=\\.\..? of=z:\backupimage.dd (drive z is the 500Gb partition where the dd image is to be dumped)

BTW - would I be better off using the dd port in Forensic Aquisition Utilities ?

Here are a few examples of what you will need to be doing, I need also to understand which level of familiarity you have with OS, PC and command line apps:
http://www.msfn.org/...howtopic=141687

TestDisk results (logfile attached to this post):

Create new log file
Choose external HD - Disk /dev/sdb - 320 GB / 298 GiB - TOSHIBA MK3252GSX. It displays the correct disk capacity.
Choose Intel/PC partition
Analyse
"Partition sector doesn't have the endmark 0xAA55" message appears
Choose Quick Search
No drives or partitions are found
Choose Deeper Search
"No partition found or selected for recovery"

I googled the "Partition sector doesn't have the endmark 0xAA55" error message. Apparently this error means that the partition boot sector was not found for the first partition, ie, the boot sector has been overwritten?

The first hit in the search results was the first example titled "The type of the file system is RAW - Recovery of a damaged FAT boot sector" in the TestDisk Data Recovery Examples page:

However, there are partitions listed in the 2 tables given in the above linked description of how to recover data in that situation using TestDisk, and there are no partitions found when I run Testdisk -> Quick or Full Search on my external HD.

As TestDisk was unable to find any partitions, I was not able to follow the advice in the next 2 threads you gave.

http://www.msfn.org/...howtopic=133933

Question: How can I use HDHacker to save the first sector of LogicalDrive if the partition does not have a drive letter?

Using the dd --list output (attached) to identify the correct device, I saved the first sector of Physical Drive (MBR) 2 to MBR.bin.

-->

At this point, I was starting to really panic (sorry, I can't help it!!) so I ran Eisoo DiskGenius v3.0.1206 Beta 2 which says the HD has 298.1GB capacity, 625142447 total sectors, 320072932864 total bytes.

After checking nothing would be written back to the HD, I selected the HD2:MK3252GSX(298Gb) volume, right clicked on it & selected "Search Lost Partitions(Rebuild Partition Table)". A window appeared with the title bar "Searching lost partitions". It took a little while to scan the drive and it found 1 partition, but the file system was shown in DiskGenius as "unknown" & no files were shown when I clicked on the Files tab. I did NOT save the partition table after the scan had finished.

DiskGenius had the following data for the partition it found:
Volume Label: Partition(0)
Seq.(Stat): 0 L
File System: Unknown
ID: 99
Start Cylinder: 0
Head: 1
Sector: 1
End Cylinder: 38913
Head: 80
Sector: 62
Capacity: 298.1GB

-->

HD Tune Pro reports:
Firmware version: LV010A
Capacity 320.1gB (298.1 GB)
Buffer: 8192 KB
Sector size: 512 bytes
Standard: ATA8-ACS - SATA II
Supported: UDMA Mode 5
Active: UDMA Mode 5

-->

Computer Management -> Storage -> Disk Management reports:
Disk: Disk 1
Type: Unknown
Status: Not Initialized
Partition style: Not Applicable
Capacity: 305243Mb
Unallocated space: 305243Mb
Reserved space: 0Mb

-->

I hope the above information will help you & others guide me further...

Thanks again,

DMTelf

although it does not sounds nice to interfere while an professional already is in to help you , but i would never post if i did not have same situation in past .

it was a internal hdd of a friend which came across same issue,

all i did was to run the following app (Disk Genius )

i selected search LOST partitions from Tools , and it did the job within 5 minutes..

just remember following 2 points,

MAKE SURE you reserve ONLY those partition what you recognize that you had.
MAKE SURE that you run the wizard with default settings,

http://www.boot-land...?...ded&start=#

by the way this version also has the option to recover files ..

remember it is just an option (disk genius i mean)..

Many thanks for the recommendation! In desperation, I tried it, followed your advice to the letter & have posted the results in the post above this one - in short, it found a partition whereas DiskTest's Full Scan found nothing, but the partition Disk Genius found apparently did not contain any files.

I am sure there are several good reasons why this happened, but I am not 100% sure if I used it correctly, or and/or if a modification made in DiskTest will make the partition re-appear...?

DMTelf

Many thanks for the recommendation! In desperation, I tried it, followed your advice to the letter & have posted the results in the post above this one - in short, it found a partition whereas DiskTest's Full Scan found nothing, but the partition Disk Genius found apparently did not contain any files.

I am sure there are several good reasons why this happened, but I am not 100% sure if I used it correctly, or and/or if a modification made in DiskTest will make the partition re-appear...?

DMTelf

Well I had this situation before, but with the internal hard disk.
I used Paragon partition manager.
There is an option called Undelete

It searches the unallocated hard disk for partition which has been deleted.
After finishing the check it will list all partition which can bee recovered.


Go to (Advanced partition Tasks

Undelete partition

@dmtelf

You are EXACTLY in the situation ozzyboy was here:
http://www.msfn.org/...howtopic=141687

He was a very, very lucky guy, and only the first sector of his bootsector was zeroed out, it is very possible that your HD has gone through more severe damage, as you were actually using bootice on it.

Now, please (while continuing to avoid panicking ) you should start some serious work.

Time to make a choice , you either trust me or you don't , if yes , simply ignore each and everyone that will come here proposing a "magic" app, you already tried two of them with no benefit, trust me when I tell you that IF that partition can be recovered it can be with TESTDISK and manually, and that most if not all of the "smart" apps around will fail.

Please read again, this time for it's entirety the given thread:
http://www.msfn.org/...howtopic=141687

By the time you will have done so you should have learned to:
1) use dsfo/dsfi instead of the various dd for windows
2) make an image file of the failed hard disk using it
3) post exact size of the hard disk as reported by dsfo during the imaging
4) copy first 200 sectors from the disk image
5) copy last (say) 5000 sectors from the disk image
6) compress the last two files in a .zip or .7z archive and attach it

Again, DON'T PANIC, there is all the time in the world, think twice and thrice before doing anything on that hard disk before having created an image of it.



Wonko

Once you have found the start and end of the partition (Wonko the Sane will probably help you), you could take a look at:
http://www.cgsecurit..._and_MFT_Repair

You can also use Photorec (developer also wrote Testdisk).
Photorec only will recover certain file types (and won't give you the original filename).

@dmtelf

You are EXACTLY in the situation ozzyboy was here:
http://www.msfn.org/...howtopic=141687

He was a very, very lucky guy, and only the first sector of his bootsector was zeroed out, it is very possible that your HD has gone through more severe damage, as you were actually using bootice on it.

Now, please (while continuing to avoid panicking ) you should start some serious work.

Time to make a choice , you either trust me or you don't , if yes , simply ignore each and everyone that will come here proposing a "magic" app, you already tried two of them with no benefit, trust me when I tell you that IF that partition can be recovered it can be with TESTDISK and manually, and that most if not all of the "smart" apps around will fail.

@Wonko, I trust you 100%.

I've not been able to reply until just now because I've had MAJOR problems getting onto this forum from 3 different ISPs in the UK as I normally get a webpage saying IPS Error for hours and hours at a time which is really nerve wracking for me. All I can do then is keep hitting F5 until http://boot-land.net finally opens properly.

Please read again, this time for it's entirety the given thread:
http://www.msfn.org/...howtopic=141687

By the time you will have done so you should have learned to:
1) use dsfo/dsfi instead of the various dd for windows
2) make an image file of the failed hard disk using it
3) post exact size of the hard disk as reported by dsfo during the imaging
4) copy first 200 sectors from the disk image
5) copy last (say) 5000 sectors from the disk image
6) compress the last two files in a .zip or .7z archive and attach it

Again, DON'T PANIC, there is all the time in the world, think twice and thrice before doing anything on that hard disk before having created an image of it.

I read that thread, and have come across a problem - vlm can't find the Toshiba drive but TestDisk can? This means I can't find the physical drive number from vlm which then needs to be passed as a parameter to dsfo so I can then use dsfo to back it up to dump drive 1 (drive letter F) using this command:

dsfo \\.\PHYSICALDRIVEX 0 0 f:\toshibadump.img

vlm (part of dsfok toolkit) found these volumes, comments in brackets are mine:

\\.\Volume{c0e6bdc2-98de-11dc-a8ad-806d6172696f} (Desktop PC HD)
Label: PC-C-Drive, File System: NTFS 76245/6007 MB
Symbolic Link: \Device\HarddiskVolume2

\\.\Volume{0ef3bc56-1c9b-11df-a968-001aa04e173e} (Dump drive 1)
Label: Dump 1, File System: NTFS 512001/511921 MB
Symbolic Link: \Device\HarddiskVolume3

\\.\Volume{16ad517e-260d-11df-a969-001aa04e173e} (Dump drive 2)
Label: Dump 2, File System: NTFS 441865/441787 MB
Symbolic Link: \Device\HarddiskVolume4

TestDisk found these media:

Disk /dev/sda - 80 Gb / 74 GiB - WDC WD800JD-75MSA3 (desktop PC's HD)
Disk /dev/sdb - 1000 Gb / 931 GiB - Seagate Desktop (backup drive, NTFS with 2 primary partitions)
Disk /dev/sdc - 320 Gb / 298 GiB - Toshiba MK3252GSX (drive to be imaged)

Is stress causing me to temporarily be denser than the heads on this knackered hard disc...?

DMTelf

Yep, it's not the good UK ISP problem , it's boot-land that has been a bit hectic lately .

Sure vlm cannot find your drive (as much a windows cannot assign a letter to it): there are no volumes (or they cannot be recognized) this is the problem at hand .

• Your first hard disk (boot disk) is \\.\PHYSICALDRIVE0.
• Your second disk (probably the "Seagate Desktop") is \\.\PHYSICALDRIVE1
• Your third disk (probably the Toshiba) is \\.\PHYSICALDRIVE2
• etc.

Open Disk Management and check that the above is accurate, you should see the same disks as:

• Disk 0
• Disk 1
• Disk 2

IF my assumption is right, the command is:

dsfo \\.\PHYSICALDRIVE2 0 0 <letter of a volume in the Seagate>\toshibadump.img

The amount of confusion between the terms "disk", "hard disk drive", "drive", "volume", partition", "physicaldrive" and "logicaldrive" the good guys at MS (and also the good linux guys, BTW) contributed to create over the years is amazing, you are not dense at all, you are just entering a field where stoopidity and misleading terms have created a situation where very few people know what we are talking about.

Quick dictionary:

• WHOLE Hard Disk Drive = Disk = hard disk drive = physicaldrive
• Partition on hard disk drive = drive (as in "drive letter") = partition = volume = logicaldrive (and this is not really exact, as you can have a logical partition with many "volumes"="drive letters" in it, but is correct as long as we are using Primary Partitions)

Additional translation table:

• /dev/sda in TESTDISK = Disk 0 in Disk Management = \\.\Physicaldrive0 in dsfo/dsfi (or more generally as Windows object)
• /dev/sdb in TESTDISK = Disk 1 in Disk Management = \\.\Physicaldrive1 in dsfo/dsfi (or more generally as Windows object)
• /dev/sdc in TESTDISK = Disk 2 in Disk Management = \\.\Physicaldrive2 in dsfo/dsfi (or more generally as Windows object)

Wonko

Sure vlm cannot find your drive (as much a windows cannot assign a letter to it): there are no volumes (or they cannot be recognized) this is the problem at hand .

Thank you for the very clear tutorial re: drive referencing. It helped me a lot.

The amount of confusion between the terms "disk", "hard disk drive", "drive", "volume", partition", "physicaldrive" and "logicaldrive" the good guys at MS (and also the good linux guys, BTW) contributed to create over the years is amazing, you are not dense at all, you are just entering a field where stoopidity and misleading terms have created a situation where very few people know what we are talking about.

Yes, I have on occasions found this really confusing when doing research on the problem as so much different terminology is used to describe the same things. Your mini dictionary & drive referencing translation table both help me a lot!

Here is the dsfo output, the drive is 160037339136 bytes total size & the 1st 100 sectors & last 5000 sectors have been extracted, compressed & attached to this post.

C:\dsfok>dsfo \\.\PHYSICALDRIVE2 0 0 f:\toshibadump.img
\\.\PHYSICALDRIVE2 - Data error (cyclic redundancy check).
This error can probably be ignored.
OK, 160037339136 bytes, 14460.031s, MD5 = a00c0148804ebb8e992e537cf29bf48f

C:\dsfok>dsfo f:\toshibadump.img 0 102400 f:\1st200sectors.img
OK, 102400 bytes, 0.000s, MD5 = dcea85697436d8e9d1fcf6e42b9f0b63

C:\dsfok>dsfo f:\toshibadump.img -2560000 0 f:\Last5000sectors.img
OK, 2560000 bytes, 0.125s, MD5 = 13f64774e70fddffd494483c883f66bd

DMTelf

C:\dsfok>dsfo \\.\PHYSICALDRIVE2 0 0 f:\toshibadump.img
\\.\PHYSICALDRIVE2 - Data error (cyclic redundancy check).
This error can probably be ignored.
OK, 160037339136 bytes, 14460.031s, MD5 = a00c0148804ebb8e992e537cf29bf48f

Something went wrong here. That's only 50% of the total disk capacity!
According to your testdisk.log file the image size should be 320072933376 bytes.

I don't know what the CRC error means. Maybe dsfo found a bad sector and simply stopped reading.
Or it probably failed to detect the disk size correctly?

Can you try this?

dsfo \\.\PHYSICALDRIVE2 0 320072933376 f:\toshibadump.img

Try another utility INSTEAD of dsfo:
http://www.boot-land...?...ic=7783&hl=

It is possible that dsfo timed out/had an hiccup/whatever.

The good (partially) news are that the fist sector of the "main" bootsector or PBR is almost intact.

Partition is/was ending at 38913*255*63=625,137,345
320,072,933,376/512= 625,142,448
625,142,448-625,137,345=5,103
Let's make it 5,200.

use ddrescue to produce the last 5,200 sectors of the disk and post them.
Then try using it to image again the whole disk.



Wonko

Try another utility INSTEAD of dsfo:
http://www.boot-land...?...ic=7783&hl=

I've downloaded Odin & DataRescue DD from that thread, but (probably incorrectly) assumed you wanted me to try ddrescue first as thats the only program you mentioned by name in your post?

It is possible that dsfo timed out/had an hiccup/whatever.

dsfo copied for about 8 hours, I then went to bed & left it copying, and when I woke up the next day it had finished, but only done half the drive

use ddrescue to produce the last 5,200 sectors of the disk and post them.
Then try using it to image again the whole disk.

I had some problems getting ddrescue up and running, in the end I downloaded & installed a minimum cygwin, downloaded a ddrescue 1.9.1 Windows binary & put it in the c:/cygwin/bin/ directory. ddrescue now runs from within the cygwin Bash shell.

I am a bit stumped by the required ddrescue syntax/command line switches as there are so many of them & I am not sure how to specify the offset from the end of the disk as this isn't given in any of the very few examples I found via Google Could you please advise how it needs to be done? This is what I've got so far (not tested):

ddrescue -g /dev/sdc/ z:\toshdump.img z:\toshdumplog.txt

Is it ok for me to delete the dsfo image before I make the ddrescue image?

Thanks.

DMTelf

Something went wrong here. That's only 50% of the total disk capacity!
According to your testdisk.log file the image size should be 320072933376 bytes.

I don't know what the CRC error means. Maybe dsfo found a bad sector and simply stopped reading.
Or it probably failed to detect the disk size correctly?

Can you try this?

dsfo \\.\PHYSICALDRIVE2 0 320072933376 f:\toshibadump.img

Thanks for the suggestion, @TheK! If @Wonko The Sane also thinks its a good idea, I'm more than happy to try it.

The only reason I'm not trying it straight away is it took well over 8 hours for dsfo to create an image of only half the Toshiba HD last night & I want to "use" the original Toshiba HD as little as possible so I'm going to try Wonko's ddrescue suggestion first, once I've managed to suss out the required syntax / command line switches as I can't find any clear examples to refer to, especially wrt extracting the last n sectors from the end of a disk.

DMTelf

You see how misunderstandings begin?

TYPO, my bad, I meant:
ddrescue Data Rescue DD

Yes, if you get the last sectors with Data Rescue DD it should take a few seconds, then try again with Data Rescue DD to image the whole drive normally and yes, you can delete the partial image made with dsfo.

With Data Rescue DD it should work.

If even that doesn't work, there really may be some (hopefully small) problems with the HD, like a bad sector or something like that.

I don't think that there is a problem with determining the size of the disk, it is more likely that dsfo errored out for some other unknown reasons, however if you want to try with a "determined length" it's allright, at the most you will lose another 8 hours.



Wonko

@dmtelf before you try to create an image of the whole disk again, you should probably try to read only the position where dsfo stopped.
This could save you another 8 hours.

dsfo \\.\PHYSICALDRIVE2 320072923376 320072943376 f:\testdump.img

@dmtelf before you try to create an image of the whole disk again, you should probably try to read only the position where dsfo stopped.
This could save you another 8 hours.

dsfo \\.\PHYSICALDRIVE2 320072923376 320072943376 f:\testdump.img

Thanks for the suggestion! I got this error & it looks a bit worrying to me...

C:\dsfok>dsfo \\.\PHYSICALDRIVE2 320072923376 320072943376 h:\testdump.img
\\.\PHYSICALDRIVE2 - The drive cannot find the sector requested.
This error can probably be ignored.
h:\testdump.img - No more data is available.

DMTelf

Thanks for the suggestion! I got this error & it looks a bit worrying to me...

C:\dsfok>dsfo \\.\PHYSICALDRIVE2 320072923376 320072943376 h:\testdump.img
\\.\PHYSICALDRIVE2 - The drive cannot find the sector requested.
This error can probably be ignored.
h:\testdump.img - No more data is available.

DMTelf

This can't work as it is the end of the disk +/- 10KB
Sorry, my bad

The correct position should be 160037339136 +/- ~10KB

dsfo \\.\PHYSICALDRIVE2 160037329136 160037349136 h:\testdump.img

You see how misunderstandings begin?

I'm deaf - I know all about misunderstandings!

Yes, if you get the last sectors with Data Rescue DD it should take a few seconds, then try again with Data Rescue DD to image the whole drive normally and yes, you can delete the partial image made with dsfo.

I told Data Rescue DD to dump the last 5000 sectors, as shown in the attached screengrab. I'm not sure if I did it right because the last read sector & last read offset as shown in the log below are both 0 & I was expecting it to stop at the 5000th sector hence last read sector in the log would therefore have been 5000 & last read offset -5000?

Source: Drive 3
Source size: 320 GB
Source sectors: 625137345
Source bytes: 320070320640
Destination: C:\Documents and Settings\dmtelf\Desktop\Last 5000 Sectors Toshiba HD.dd
Read direction: <-
Last read sector: 0
Last read offset: 0

The 5000 sector dd file is 2.14Mb zipped & the maximum attachment size here is 1000Kb, so I've had to upload it to Rapidshare (sorry): http://rapidshare.co..._Toshiba_HD.zip

DMTelf

This can't work as it is the end of the disk +/- 10KB
Sorry, my bad

The correct position should be 160037339136 +/- ~10KB

dsfo \\.\PHYSICALDRIVE2 160037329136 160037349136 h:\testdump.img

I did wonder about the original parameters you gave, but I assumed there was a reason for it..

C:\dsfok>dsfo \\.\PHYSICALDRIVE2 160037329136 160037349136 h:\testdump.img
\\.\PHYSICALDRIVE2 - Data error (cyclic redundancy check).
This error can probably be ignored.
h:\testdump.img - No more data is available.

How can I find the range of sectors that have CRC errors in this portion of the drive...?

DMTelf

what is the exact file size of h:\testdump.img ?