Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

Lost partition with value data

- - - - -

  • Please log in to reply
30 replies to this topic

#1
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

Hi guys, my first post here...unfortunately with a big problem.:(
My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...
I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ... :(
I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing :(
Also I've tried with Partition Table Doctor 3.5 ...also nothing...
What do you recommand me?!!! ..Is there any chance to recover my files?!
Please need help !!! :worthy:
In Disk Management it look like that (after scan with active).
Posted Image
Posted Image


How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
Try TESTDISK, first thing.

See here for a quick reference:
http://www.msfn.org/...howtopic=133933
http://www.msfn.org/...howtopic=141448

Post some details on how the drive was partitioned/formatted before (size of partitions, filesystem used, etc.)

jaclaz

#3
kang roy

kang roy

    Newbie

  • Member
  • 15 posts
  • Joined 01-February 10

Hi guys, my first post here...unfortunately with a big problem.:(
My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...
I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ... :(
I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing :(
Also I've tried with Partition Table Doctor 3.5 ...also nothing...
What do you recommand me?!!! ..Is there any chance to recover my files?!
Please need help !!! :worthy:
In Disk Management it look like that (after scan with active).
Posted Image




there are some troubled hdd like this, it is likely that problems with its own hdd, such as bad sectors, and also fit in time to copy the files may copy files bad sector, the way this work should be cloned into an empty hdd,, , has completed a new clone in its use of data recovery software that tough if you can use forensic software,,,

#4
nitroshift

nitroshift

    Beware of programmers with screwdrivers!

  • Super Moderator
  • 2,909 posts
  • Joined 29-November 05
  • OS:Windows 8.1 x64
  • Country: Country Flag
I have used Active Partition Recovery in the past with quite high rate of success. Does it find any partitions when scanning?

Please read the rules, folks!


#5
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

Thank's all, for your interest. Right now I'm trying with with TestDisk...
@nitropuppy, nice flag :)...OK, It's not the first time when I have problem like this..I always used Active partition recovery, but this time unsuccesfully. Like I said after 3 hour scanning 81h(with ctr+enter), it found me one unlocated partition(111GiB), then I scanned for another 3-4 hours, this unlocated partition, but found nothing... :(
@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...


l.e. It seems testdisk also found nothing: what's next? :unsure:

Posted Image

Edited by ozzyboy, 06 February 2010 - 02:12 AM.

Posted Image

#6
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...


l.e. It seems testdisk also found nothing: what's next? :unsure:


The general idea is not "I am skipping what you suggested because it's a little hard...." :whistle:

Post some details on how the drive was partitioned/formatted before (size of partitions, filesystem used, etc.)


http://www.msfn.org/...howtopic=133933

Also you should read this:
http://www.cgsecurit...sk_Step_By_Step

Try the deeper search, and next time, instead of the screenshots, post testdisk.log (of course you should ALWAYS create a Log at the beginning of each seesion with Testdisk)


jaclaz

#7
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...
The HDD is sata 2 on external rack, conectivity with pc is through usb...
The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....
Posted Image

#8
DigeratiPrime

DigeratiPrime

    MSFN Junkie

  • Patrons
  • 3,550 posts
  • Joined 18-August 04
  • OS:Windows 7 x64
  • Country: Country Flag

jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...
The HDD is sata 2 on external rack, conectivity with pc is through usb...
The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....


Well if it was just one partition then it was either a single primary partition or a logical inside an extended partition.

What I would do is if possible is clone the drive as is right now, before attempting any further recovery. Then I would if possible remove the drive from the enclosure and connect it directly via IDE/SATA. Also open the disk with a disk editor like HxD to browse the sectors in hex and make sure they're not all zeros.

Can you tell us the model of the drive?
Recommended Software: KeePass | Microsoft ICE | VisualWget | Vitamin D Video |

#9
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
I need to know:
  • under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.
  • which specific app was used to create the partition.
  • the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one

That drive should have (IF formatted under XP with Disk management):
  • a MBR at offset 0 sectors
  • IF Primary a bootsector starting at offset 63
    OR
  • IF Logical inside Extended a EPBR at offset 63 and a PBR at offset 126

Additionally, being NTFS, a copy of the bootsector should be as last sector of the partition.

extract first 200 sectors (200x512=102,400 bytes) with dsfo (read the given thread where a howto is given), compress the output file in a zip and attach the archive to your next post.

jaclaz

#10
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

HI jaclaz, I just have read it, your 1st reference link, and for now I want to colne entire hdd. I'll put him into another pc on sata cable, and will be the 2nd hdd on that pc...so it will be Physical drive 1...right?
The tool I'll need to use it for backup is dsfok toolkit, right?!
Then, I follow your command:

dsfo \\.\PHYSICALDRIVE1 0 0 C:\dsfok\hddfull.img

After that I'll wait for a while...until I've got a message like:

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

=========================================================

I need to know:

* under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.
* which specific app was used to create the partition.
* the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one]

I partitioned about 6 months ago, and I dont remember details. I think it was on windows or maybe, I used some tool from Hiren Boot Cd, I don't remember, how I created the partition... Sorry :unsure:
Also, I dont know how to get the exact size, in bytes. Below is a picture with hdd, maybe it will hepl somehow..
Posted Image



I'll be back with extracted sector!!
Thx a lot for your help!!

Edited by ozzyboy, 10 February 2010 - 05:58 AM.

Posted Image

#11
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
ozzyboy be careful. :ph34r:

YES, if there is just one hard disk on the second PC (and no card readers, attached USB Mass Storage devices, or virtual drives loaded) it will be PhysicalDrive1.

Please take into account that the resulting C:\dsfok\hddfull.img will be around 120 Gb in size!

You'd better make sure that you C:\ drive on the second machine:
  • has enough space
  • is formatted as NTFS

About size, you will have it as output of the dsfo command, when you do the dd-like image:

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

(jolt down these data)

The CHS geometry results from the picture you posted: 16383/16/63, which gives us a:
16383x16x63=16,514,064 sectors x 512 bytes=8,455,200,768 bytes but it isn't useful, as it is the "fake" geometry for the "last CHS limit", which is:
8,455,716,864
http://www.pcguide.c.../sizeGB8-c.html

From here:
http://www.pubbs.net...d/200904/43615/

> wd0 at pciide0 channel 0 drive 0: <HITACHI HTS541612J9SA00 3H>
> wd0: 16-sector PIO, LBA48, 114473MB, 234441648 sectors

234,441,648x512=120,034,123,776

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.
Geometry should be:
14593x255x63=234,436,545 sectors
234,441,648-234,436,545=5,103 unallocated sectors
234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

jaclaz

#12
nitroshift

nitroshift

    Beware of programmers with screwdrivers!

  • Super Moderator
  • 2,909 posts
  • Joined 29-November 05
  • OS:Windows 8.1 x64
  • Country: Country Flag
For future reference, please take some time to read our rules.. Hiren's boot CD is considered warez and will get you banned if further mentioned...

Please read the rules, folks!


#13
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

@ nitropuppy, Sorry, I didn't know that it is warez... :blink: Accept my apology!
@ jaclaz, Thx again, I have 52in1 internal card reader, in floppy place, but I'll disconnect from usb and yes, I have just one HDD....About freespace, I have to delete something...For now I have only 110GB free.

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.
Geometry should be:
14593x255x63=234,436,545 sectors
234,441,648-234,436,545=5,103 unallocated sectors
234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?
Posted Image

#14
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?

Yep :), it is an indirect confirmation we are dealing with the "right" numbers.

So partition data should be:
80-07-0-1-1-1023-254-63-63-234436482

Let's see if Testdisk finds anything, first.

Post the 200 sectors, it is very possible that we can get some confirmation from them.

jaclaz

#15
bauxite

bauxite

    Newbie

  • Member
  • 22 posts
  • Joined 02-July 09
so, was there any luck? are you files recovered?

this might be obvious but what about trying a program like recuva?

is it posible that could recover the lost files?

#16
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

Hi, I'm back again...with some good news!!
OK, I've done the image of HDD. For results see the picture below:
Posted Image

After that I have decided to try something and I mounted the full image with ImDisk Virtual with this settings:

Posted Image

Then I tried "File Scavenger" with "a long scan" on new mounted partition "H"

Posted Image

After 1 hour of scanning...File Scavenger found me all files, you can see that in the picture:
Posted Image



But I dont have so much free space, to copy founded files on other partition.
Now I'm asking you, if it's posible to recostruct, somehow, the original partition, to no longer need copying those files on another hdd.



@jaclaz, I scaned the partition twice, with Testdisk, but with no results!! maybe I'm doing something wrong... :blink:
Thank's guys, especialy to jaclaz!!!!! :rolleyes:

Edited by ozzyboy, 14 February 2010 - 10:31 AM.

Posted Image

#17
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
Let's make a deal. ;)

If you give me a reason why you used a 2048 blocks offset when mounting with IMDISK (I won't ask you how it came to you to use IMDISK with an image that you cannot fix with TESTDISK),
AND you run:
dsfo e:\dsfok\hddfull.img 0 1049088 e:\dsfok\first2049.bin
AND you compress the file in a zip file and post it or give a link from where I can download it,
I will help you further.


Translation:
We were originally trying to have partition based recovery, as opposed to file based recovery, which is what you actually performed, and now you want to go back to partition based one.


jaclaz

#18
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

2048 blocks was default sets from ImDisk Virtual, also I tested with 4096(default NTFS) and I recived the same results. How many blocks must put in there?

And yes, I want a partition recovery instead of file recovery ...You understand me very well.
Thx jaclaz!

Here the file who you request!
Posted Image

#19
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
The data is very, very strange. :w00t:
06 00 0 32 33 1023 254 63   2048 234436608
The partition type is FAT16.
The CHS offset is that of a small device with 32 sectors.

(32+1)*63=2079 and NOT 2048.

The file you sent is all 00's apart the MBR.

Try posting a bigger chunk of the image:
dsfo e:\dsfok\hddfull.img 0 2560000 e:\dsfok\first5000.bin

jaclaz

#20
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

Maybe all data in the begining of hdd is altered because of all recovery apps what I've used. :unsure:
Here, first5000.bin. :ph34r:

Edited by ozzyboy, 14 February 2010 - 03:36 PM.

Posted Image

#21
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
I did a couple of tests, and that geometry seems allright after all, it means that you partitioned that thingy under an unpatched Vista with Alignment ON, aligned on 1 Mb.

So the partition table geometry is "right". the only problem is the partition ID, (which is not a problem it's just a matter of 06 07).

You seeem like a lucky guy, as all that is missing appears to be the first sector of the NTFS bootsector. :)

I need another bit of that thingy:
dsfo e:\dsfok\hddfull.img  -2560000 0 e:\dsfok\last5000.bin

Translation: there is a copy of the bootsector as last sector of the partition on NTFS filesystem.

TESTDISK should be able to find it, however.
http://www.cgsecurit...sk_Step_By_Step
http://www.cgsecurit...sector_recovery

Before fiddling with it, however, do post the last sectors, I will assemble a file for you to merge with the image.

jaclaz

#22
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

Hi!!
Here I am with last requested sectors:
last5000.bin

Thx again! :hello:

Edited by ozzyboy, 17 February 2010 - 06:55 AM.

Posted Image

#23
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,869 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
OK.
Try the attached file.
It is a copy of first2049.bin with the last sector being the NTFS bootsector copy from last5000.bin.

Unzip and apply as follows:

dsfi e:\dsfok\hddfull.img 0 0 e:\dsfok\first2049mod.bin

(please note how you are now using dsfi and NOT dsfo)

After you have applied the file to the image, try running again TESTDISK on the image, you should be able to find the partition AND to see the files. (you shouldn't need to do any repair)

If the above is OK, then try mounting the image with IMDISK.

jaclaz

Attached Files



#24
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

How can I run testdisk on img without mounting? I've opened testdisk and it shows me only real hdd(from my desktop).

l.e. OK, I realized ... I used drag and drop

Edited by ozzyboy, 17 February 2010 - 07:33 AM.

Posted Image

#25
ozzyboy

ozzyboy

    Newbie

  • Member
  • 16 posts
  • Joined 05-February 10
  • OS:Windows 7 x86

Donator

WOW!!I don't belive it. This is Greath!! :w00t:
Mission Acomplishied!! Thank's a lot jaclaz!!!

I want to know how did you repair my sectors :D. Can you explain me all procedures, tools...here on pm...I want to learn to do this by my self, off course if is not a secret :angel !!!
Again thank you very very much, for all your time lost with me.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users