37 replies to this topic

[HattersFC]

When I started up my work laptop yesterday morning, I had about 4 BSOD's in a row and then I got the
message "A disk read error occurred, press Ctrl-Alt-Del to restart".

The hardware guys drew a blank when trying to recover the data on there as the boot partition is currently unreadable, so another colleague suggested I try these forums in an effort to recover my data and he's had help from here previously to recover data from a lost partition.

So far I've attempted to create an image of the partition using TestDisk so I can attemopt recovery from there, but the size of the partition doesn't seem right for the size of the drive.. (90 Gb image from a 100Gb drive..)

Does anyone have any suggestions on what I can do next? Any help would be much appreciated!

Thanks...

[skyide]

Hello HattersPC

The hardware guys drew a blank when trying to recover the data on there as the boot partition is currently unreadable

Unreadable does not mean the partition isn't there. I would try running a PE environment and see if you can access the partition from there. If you can see the drive letter but can't access it, try running checkdsk on it or right click the drive, select Tools and select Check Now under Error Checking. Make sure both check boxes are selected. It will take hours....If the partition has been formatted or badlly formatted, you can try Easus Data Recovery Wizard. I successfully recovered files from a formated USB partition. http://www.easeus.co...ry-software.htm.

I did not have any luck with *any* of the mini free tools mentioned on the penadriveapps web site. Absolutely useless. I did not try TestDisks though...But you might have better luck...


You can also try http://www.easeus.co...ition-recovery/.

but the size of the partition doesn't seem right for the size of the drive.. (90 Gb image from a 100Gb drive..)

Again, many of the mini free disk imagers I tried, failed right here. However, Paragon's Hard Disk Manager has an option to automatically resize the partitions to match the new partition size. This means, you can restore an image of a partition with size 100GB on a new 90GB partition if only 50GB are occupied for instance.

Edited by skyide, 17 November 2010 - 03:13 AM.

[skyide]

but the size of the partition doesn't seem right for the size of the drive.. (90 Gb image from a 100Gb drive..)

Ok I misunderstood what you said, 90 Gb image from a 100Gb drive. Are the whole 90GB filled with files? If not and it is just free space then to me it looks like your imaging software has done a terribly bad job at ignoring free space and doing a bad job at compression. Paragon Hard Disk Manager created an 8GB image out of a 30GB flash drive. About 15GB of it is unallocated space and the rest is mixed, allocated/partitioned with files and plenty of free space. Perhaps those 90GB are in fact used, filled with files?

Edited by skyide, 17 November 2010 - 04:59 AM.

[HattersFC]

Ok I misunderstood what you said, 90 Gb image from a 100Gb drive. Are the whole 90GB filled with files? If not and it is just free space then to me it looks like your imaging software has done a terribly bad job at ignoring free space and doing a bad job at compression. Paragon Hard Disk Manager created an 8GB image out of a 30GB flash drive. About 15GB of it is unallocated space and the rest is mixed, allocated/partitioned with files and plenty of free space. Perhaps those 90GB are in fact used, filled with files?

Hi Skyide,

Thanks for the pointers, I'll give them a go and see what I come up with.

[skyide]

Hi Skyide,

Thanks for the pointers, I'll give them a go and see what I come up with.

I gave Easus Partition Wizard a very good review on C|Net. It saved my menu.lst However I am a bit disappointed with their Backup/Restore Imaging software. It produced errors when restoring an image created of a 29.8GB Flash Drive to a 29.X (slightly lower in size). Again, Paragon Hard Disk Manager had no problems with this as it resized the free unallocated space equally. I have been using HDM for years to restore XP on my old system. It never failed. I am tempted to buy the whole suite as it comes with a Win PE version too. The free one comes with Linux Live version which is what I used to restore my XP partition. It always worked. I cannot praise enough this product. I am so very happy with it (so far).

Edited by skyide, 17 November 2010 - 09:58 AM.

[Wonko the Sane]

Use this app (and nothing else) to image the drive:
Datarescue DD
http://www.boot-land...?showtopic=7783
http://www.datarescu...cue/v3/drdd.htm

When recovering data, use data recovery oriented apps and NOT "generic" apps, expecially Commercial ones that "expect" a sound drive/filesystem source AND may behave strangely (and in undocumented ways) when and if errors are found.

Once you have the image, extract from it the MBR (first sector), compress it in a .zip or .7z file, upload it somewhere and post a link to it.

Right now the approach is aimed to "filesystem recovery" (please read as TESTDISK) and NOT (yet ) to "file recovery" (please read as PHOTOREC).

Then, run TESTDISK on the Image, make sure you use a LOG.

DO NOT write any change to the image, but post the LOG also.


Wonko

[HattersFC]

Hi Wonko,

Thanks for the advice

I had already created an image using TestDisk, but will try with the tool suggested.
Could the fact I've already imaged the drive before cause any problems?
(I haven't tried to write to the drive at all since it went bad)

[skyide]

Use this app (and nothing else) to image the drive:
Datarescue DD
http://www.boot-land...?showtopic=7783
http://www.datarescu...cue/v3/drdd.htm

When recovering data, use data recovery oriented apps and NOT "generic" apps, expecially Commercial ones that "expect" a sound drive/filesystem source AND may behave strangely (and in undocumented ways) when and if errors are found.

Once you have the image, extract from it the MBR (first sector), compress it in a .zip or .7z file, upload it somewhere and post a link to it.

Right now the approach is aimed to "filesystem recovery" (please read as TESTDISK) and NOT (yet ) to "file recovery" (please read as PHOTOREC).

Then, run TESTDISK on the Image, make sure you use a LOG.

DO NOT write any change to the image, but post the LOG also.


Wonko

Hmm I haven't heard of this tool before. Looks/sounds interesting.... I am wondering if there is any way to compare the contents of the two USB drives I have in a sector by sector fashion so I can see whether there are any variations in the used areas.....

[Wonko the Sane]

I am wondering if there is any way to compare the contents of the two USB drives I have in a sector by sector fashion so I can see whether there are any variations in the used areas.....

The whole idea of "dd like" or "forensic sound" imaging is to have a sector by sector copy of the original.

To determine whether two images (or the image and the source) are identical, you can hash them (it will be quicker).

Or use a hex/disk editor and compare them.

Results with USB pendrives with wear leveling may be inconsistent.

Please DO not quote WHOLE posts when replying.

Please, this thread was started by HattersFC and is aimed to help him resolve his problem.

If you need help or wish to talk about imaging programs, how to use them, what are correct procedures, etc, or for any problem you have, start a new thread aptly titled.

@HAttersFC
No, unless the drive is dying mechanically, no harm is done.
From what I can gather from the scarce details you posted you only have a partition/filesystem corruption of some kind and the disk drive is fully operational.



Wonko

[HattersFC]

The whole idea of "dd like" or "forensic sound" imaging is to have a sector by sector copy of the original.

@HAttersFC
No, unless the drive is dying mechanically, no harm is done.
From what I can gather from the scarce details you posted you only have a partition/filesystem corruption of some kind and the disk drive is fully operational.



Wonko

Wonko,

What further details do you require - is the below sufficient?

As far as I remember, there was only one (NTFS) partition on the disk, set up through Vista. I'm not sure the exact size of the partition, but as previously stated the advertised disk capacity is 100Gb.

If it helps, it's a Hitachi HTS722010K9SA00, the spec on the drive lists 16383cyl,16 heads,63secs/t...

The previous image created through TestDisk is 91.1Gb in size.. Though there were a LOT of read errors in the log file...

The DrDD is currently underway, and is encountering numerous errors stating:
Read Error at nnnnnnnnn : The semaphore timeout period has expired

Where nnnnnnnnn looks to be a drive location of some kind, e.g. 1b7b40000.
The image job is still running.


I've posted the log from the initial TestDisk image I created here

If there's any other information that might be useful, let me know.

[HattersFC]

OK, so the DrDD image job is still running; looks like it will be running over night too..
When it's finished I'll run the image through TD.

In the mean time, I ran TestDisk on the image I had previously created with TestDisk itself, and have attached the results, if these might help to find out how badly messed up the disk is :-s

TestDisk Image Analysis

[Wonko the Sane]

Be very careful with partition alignment. (drive partitioned under Vista, and probably a non-patched to the old standard one)

Please review this thread:
http://www.msfn.org/...howtopic=145574
particularly:
http://www.msfn.org/...o...45574&st=28


The TESTDISK log is enough to show that some problems do exist, like this:

Drive F: - 93 GB / 86 GiB - CHS 24100 120 63, sector size=512

usual CHS geometry under any 2K and later NT based OS is 255/63 and not 120/63.
The 16/63 is the actual hard disk geometry, that may (or may not) have been used by the Vista (I have never seen it used, but there is always a first time)..

All the rest seems to imply that there is mostly junk in the MBR, but as said, I would like to have a look at it.

The idea of datarescue DD is to check if a given area gives errors, then do a partial image just up to that area where the errors begin, then try to read from past that area backwards.
This maximize the probabilities of recovering more sectors.

Letting it run all night long unattended won't probably give you any better results than any normal dd-like imaging app.


Wonko

[HattersFC]

Be very careful with partition alignment. (drive partitioned under Vista, and probably a non-patched to the old standard one)

Please review this thread:
http://www.msfn.org/...howtopic=145574
particularly:
http://www.msfn.org/...o...45574&st=28

Thanks Wonko, I'm reading through this thread now.

All the rest seems to imply that there is mostly junk in the MBR, but as said, I would like to have a look at it.

Here's a link to what I hope is an extract of the MBR from the first image I created using TestDisk
http://rapidshare.co...mbr-sectors.zip

If you need anything else, please let me know and again, thank you for your help!

[Wonko the Sane]

That is 120000 bytes starting from first sector of the partition. (i.e. starting from first sector of \\Logicaldrive) or in other words the first sector of the file is the PBR or bootsector.

I can already see problems in it.

The $MFTMirr is in a position that is - to say the least - "queer", on 2nd cluster.

And the disk "label" seems like garbage.

Nothing too bad, from the little I have seen, though.

But what I asked is first sector of the \\.\Physicaldrive, i.e. the MBR.

The data in the bootsector at first sight, is that of a partition starting at sector 13169520 (doubtly first partition).
It shows that before it there is a partitionaround 6 Gb in size.
The sectors in the partition are 182195999, i.e. 93,284,351,488.

Most probably you imaged with Testdisk the \\.\LogicalDrive AND NOT the "\\.\PhysicalDrive (or "WHOLE" disk).


If and when dd datarescue ends, just run hdhacker on the actual drive:
http://dimio.altervi.../eng/index.html

I want the first sector of \\.\Physicaldrive and, while you are at it, first 16 sectors of all (if any) \\.\LogicalDrive's


Wonko

[HattersFC]

OK... I've run HDHacker on the original drive as instructed.
The is located here: http://rapidshare.co...R_HardDisk2.dat

I'm working on the logical drives, however the drive keeps disappearing from Windows and then can't be accessed in TestDisk etc..
Once I have them, I'll post them here too.

Going back to the CHS geometry from earlier, and if this helps at all, I opened TestDisk this morning and it reported the drive with CHS of 12162 255 63, but with a warning that the number of heads was incorrect..

[Wonko the Sane]

That hard disk must have some stories to tell.
As expected there is a first, hidden (0x27) partition.
The MBR CODE is an Altiris one.

How did the ddrescue image come out?

From what you say that hard disk has some intermittent problem (heat related?), another reason to image it in "sections" (if the "whole image" you attempted overnight failed).

From the bits I have seen there is no particular "logical" failure in the partitioning or the filesystem (though as said the choice for the $MFTmirr location is "queer".

The problem you experienced is due more to the dying hard disk than anything in the structure.

The more sectors you can get through ddrescue, the more we can get back as data.


Wonko

[HattersFC]

How did the ddrescue image come out?

Annoyingly, the laptop I am using at work for recovery went into Hibernate, so the image failed..
Stupid, I should've checked that.. But, I did get another image today through TestDisk..

From what you say that hard disk has some intermittent problem (heat related?), another reason to image it in "sections" (if the "whole image" you attempted overnight failed).
The more sectors you can get through ddrescue, the more we can get back as data.

It's a weird problem, when I first connect the drive, it appears in Explorer with a drive letter, though "unformatted".. Then after analysing it in TestDisk or attempting an image, in x program, the drive disappears!

From what I've seen I'm assuming DrDD is the best for section-by-section recovery of the drive..
This may seem elementary, but does this mean splitting the drive into sections and recovering section, by section? I just want to make sure I am not barking up the wrong tree. :-s

[Wonko the Sane]

It's a weird problem, when I first connect the drive, it appears in Explorer with a drive letter, though "unformatted".. Then after analysing it in TestDisk or attempting an image, in x program, the drive disappears!

Exactly.

From what I've seen I'm assuming DrDD is the best for section-by-section recovery of the drive..
This may seem elementary, but does this mean splitting the drive into sections and recovering section, by section? I just want to make sure I am not barking up the wrong tree. :-s

Ow, come on, it's not brain surgery, after all.
Say you have a very small disk, containing 100 sectors.
An image of it is an EXACT copy of it.
This means that the image MUST contain ALL sectors from LBA 0 to 99.
Now imagine that a mad hatter has made so that the disk will disconnect after you have imaged a random number of sectors n where 30<n<100
Now what would be your approach.
Insist on using an imaging app that ALWAYS starts from 0 and hope to be lucky and get, before or later n=100 or you are more towards attempting imaging:

• sectors 0-29
• sectors 30-59
• sectors 60-99

and then join these segments together?


If one or more sectors simply cannot be read, you replace it/them with a blank one.

See here for a possibly easier but more exhaustive explanation:
http://www.boot-land...showtopic=11434


Wonko

[HattersFC]

I see now, sorry for the slow uptake...
Thanks for your patience.

I am running a full "back-to-front" image of the drive at the moment..
It has, as expected slowed down to a crawl, around 97% complete.

When the image is finished, what are the next steps I need to perform?

[Wonko the Sane]

I am running a full "back-to-front" image of the drive at the moment..

Perfect, EXACTLY what I tried every which way I could to explain that it was NOT advised.

Sometimes I think that my English has become sub-standard when it comes to make myself clear on these kind of things.

The original message sent was (in case of failing/defective hard disks):

• DO NOT make A FULL image unattended "forward"
• DO NOT make a FULL image unattended "backwards"
• DO NOT make a FULL image unattended
• DO NOT make a FULL image
• BUT INSTEAD
  
• do an ATTENDED attempt "forward" and, as soon as you hit a "bad area" STOP the imaging, check where the imaging stopped, if needed re-do a partial image until the first bad sector found (if not a single one), "skip" a "reasonable amount of sectors and do another partial image until you hit next "bad area".
• Once you have finished the above and reached the end of the disk, try "filling the gaps" going backwards.
• Finally re-assemble the full image by joining the partial images you made adding if needed blank sectors to replace the unreadable/missing parts.

It has, as expected slowed down to a crawl, around 97% complete.

When the image is finished, what are the next steps I need to perform?

Let's wait 100%.
From what I have seen most probably a simple chkdsk may be able to fix the filesystem, but there is NO way to know the result of an experiment until we have something to experiment with...


Wonko

[HattersFC]

Perfect, EXACTLY what I tried every which way I could to explain that it was NOT advised.

Oops... Not much I can say about that, I should've being paying more attention to what I was reading.

The original message sent was (in case of failing/defective hard disks):

• DO NOT make A FULL image unattended "forward"
• DO NOT make a FULL image unattended "backwards"
• DO NOT make a FULL image unattended
• DO NOT make a FULL image
• BUT INSTEAD
  
• do an ATTENDED attempt "forward" and, as soon as you hit a "bad area" STOP the imaging, check where the imaging stopped, if needed re-do a partial image until the first bad sector found (if not a single one), "skip" a "reasonable amount of sectors and do another partial image until you hit next "bad area".
• Once you have finished the above and reached the end of the disk, try "filling the gaps" going backwards.
• Finally re-assemble the full image by joining the partial images you made adding if needed blank sectors to replace the unreadable/missing parts.

I am currently following the above steps and will report back once complete, or if I have any questions.

Once again, thank you for your help.

[Wonko the Sane]

I am currently following the above steps and will report back once complete, or if I have any questions.

That should mean that the "full backwards" image failed also?


Wonko

[HattersFC]

That should mean that the "full backwards" image failed also?

Ah, the backwards image, (I should've mentioned that in my previous post), it
actually completed, with a lot of read errors, the resulting image is 97Gb in size.

[Wonko the Sane]

Ah, the backwards image, (I should've mentioned that in my previous post), it
actually completed, with a lot of read errors, the resulting image is 97Gb in size.

97 Gb is not a "number" (I mean not an accurate enough one ).
"a lot" is also not a number. (knowing how many read errors you have and in which areas - LBA addresses - would help)

A suitable image to work on needs to be AT LEAST:

• 2,048 (hidden sectors, including the MBR)
• 13,167,472 (sectors in the first, hidden 0x27 type partition)
• 182,196,000 (sectors in the second, 0x07 type partition)

i.e. 2,048+13,167,472+182,196,000= 195,365,520 sectors
195,365,520 x 512= 100,027,146,240 bytes

Now, if the image is the above size (or bigger) we can try working on it, if it is smaller than that it cannot be possibly of use.


Wonko

[HattersFC]

97 Gb is not a "number" (I mean not an accurate enough one ).

Good point, so to be more accurate...

When the image is viewed in Explorer (which is less than accurate ) the size is reported as 97,683,233Kb.

When viewing the file properties:

Size: 93.1 GB (100,027,630,080 bytes)
Size on Disk: 93.1 GB (100,027,633,664 bytes)

Now, assuming that the number of sectors reported for the physical drive in DrDD is correct, 195,366,465, then following your calculation of :

sectors*512 bytes

195,366,465 * 512 = 100,027,630,080 bytes.

Which I'm hoping... means we're a little closer to being able to recovery.

"a lot" is also not a number. (knowing how many read errors you have and in which areas - LBA addresses - would help)

I will work on this today.