[ozzyboy]

Hi guys, my first post here...unfortunately with a big problem.
My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...
I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ...
I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing
Also I've tried with Partition Table Doctor 3.5 ...also nothing...
What do you recommand me?!!! ..Is there any chance to recover my files?!
Please need help !!! :worthy:
In Disk Management it look like that (after scan with active).

[jaclaz]

Try TESTDISK, first thing.

See here for a quick reference:
http://www.msfn.org/...howtopic=133933
http://www.msfn.org/...howtopic=141448

Post some details on how the drive was partitioned/formatted before (size of partitions, filesystem used, etc.)

jaclaz

[kang roy]

ozzyboy, on Feb 6 2010, 03:51 AM, said:

Hi guys, my first post here...unfortunately with a big problem.
My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...
I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ...
I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing
Also I've tried with Partition Table Doctor 3.5 ...also nothing...
What do you recommand me?!!! ..Is there any chance to recover my files?!
Please need help !!! :worthy:
In Disk Management it look like that (after scan with active).

there are some troubled hdd like this, it is likely that problems with its own hdd, such as bad sectors, and also fit in time to copy the files may copy files bad sector, the way this work should be cloned into an empty hdd,, , has completed a new clone in its use of data recovery software that tough if you can use forensic software,,,

[nitroshift]

I have used Active Partition Recovery in the past with quite high rate of success. Does it find any partitions when scanning?

[ozzyboy]

Thank's all, for your interest. Right now I'm trying with with TestDisk...
@nitropuppy, nice flag ...OK, It's not the first time when I have problem like this..I always used Active partition recovery, but this time unsuccesfully. Like I said after 3 hour scanning 81h(with ctr+enter), it found me one unlocated partition(111GiB), then I scanned for another 3-4 hours, this unlocated partition, but found nothing...
@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...


l.e. It seems testdisk also found nothing: what's next?

This post has been edited by ozzyboy: 06 February 2010 - 02:12 AM

[jaclaz]

ozzyboy, on Feb 6 2010, 08:51 AM, said:

@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...


l.e. It seems testdisk also found nothing: what's next?

The general idea is not "I am skipping what you suggested because it's a little hard...."

jaclaz, on Feb 6 2010, 12:33 AM, said:

Post some details on how the drive was partitioned/formatted before (size of partitions, filesystem used, etc.)

http://www.msfn.org/...howtopic=133933

jaclaz, on May 20 2009, 08:25 PM, said:

Also you should read this:
http://www.cgsecurit...sk_Step_By_Step

Try the deeper search, and next time, instead of the screenshots, post testdisk.log (of course you should ALWAYS create a Log at the beginning of each seesion with Testdisk)

jaclaz

[ozzyboy]

jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...
The HDD is sata 2 on external rack, conectivity with pc is through usb...
The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....

[DigeratiPrime]

ozzyboy, on Feb 6 2010, 09:24 AM, said:

jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...
The HDD is sata 2 on external rack, conectivity with pc is through usb...
The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....

Well if it was just one partition then it was either a single primary partition or a logical inside an extended partition.

What I would do is if possible is clone the drive as is right now, before attempting any further recovery. Then I would if possible remove the drive from the enclosure and connect it directly via IDE/SATA. Also open the disk with a disk editor like HxD to browse the sectors in hex and make sure they're not all zeros.

Can you tell us the model of the drive?

[jaclaz]

I need to know:

• under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.
  
• which specific app was used to create the partition.
  
• the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one

That drive should have (IF formatted under XP with Disk management):

• a MBR at offset 0 sectors
  
• IF Primary a bootsector starting at offset 63
  OR
  
• IF Logical inside Extended a EPBR at offset 63 and a PBR at offset 126

Additionally, being NTFS, a copy of the bootsector should be as last sector of the partition.

extract first 200 sectors (200x512=102,400 bytes) with dsfo (read the given thread where a howto is given), compress the output file in a zip and attach the archive to your next post.

jaclaz

[ozzyboy]

HI jaclaz, I just have read it, your 1st reference link, and for now I want to colne entire hdd. I'll put him into another pc on sata cable, and will be the 2nd hdd on that pc...so it will be Physical drive 1...right?
The tool I'll need to use it for backup is dsfok toolkit, right?!
Then, I follow your command:

Quote

dsfo \\.\PHYSICALDRIVE1 0 0 C:\dsfok\hddfull.img

After that I'll wait for a while...until I've got a message like:

Quote

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

=========================================================

jaclaz said:

I need to know:

* under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.
* which specific app was used to create the partition.
* the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one]

I partitioned about 6 months ago, and I dont remember details. I think it was on windows or maybe, I used some tool from Hiren Boot Cd, I don't remember, how I created the partition... Sorry
Also, I dont know how to get the exact size, in bytes. Below is a picture with hdd, maybe it will hepl somehow..




I'll be back with extracted sector!!
Thx a lot for your help!!

This post has been edited by ozzyboy: 10 February 2010 - 05:58 AM

[jaclaz]

ozzyboy be careful.

YES, if there is just one hard disk on the second PC (and no card readers, attached USB Mass Storage devices, or virtual drives loaded) it will be PhysicalDrive1.

Please take into account that the resulting C:\dsfok\hddfull.img will be around 120 Gb in size!

You'd better make sure that you C:\ drive on the second machine:

• has enough space
  
• is formatted as NTFS

About size, you will have it as output of the dsfo command, when you do the dd-like image:

Quote

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

(jolt down these data)

The CHS geometry results from the picture you posted: 16383/16/63, which gives us a:
16383x16x63=16,514,064 sectors x 512 bytes=8,455,200,768 bytes but it isn't useful, as it is the "fake" geometry for the "last CHS limit", which is:
8,455,716,864
http://www.pcguide.c.../sizeGB8-c.html

From here:
http://www.pubbs.net...d/200904/43615/

Quote

> wd0 at pciide0 channel 0 drive 0: <HITACHI HTS541612J9SA00 3H>
> wd0: 16-sector PIO, LBA48, 114473MB, 234441648 sectors

234,441,648x512=120,034,123,776

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.
Geometry should be:
14593x255x63=234,436,545 sectors
234,441,648-234,436,545=5,103 unallocated sectors
234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

jaclaz

[nitroshift]

For future reference, please take some time to read our rules.. Hiren's boot CD is considered warez and will get you banned if further mentioned...

[ozzyboy]

@ nitropuppy, Sorry, I didn't know that it is warez... Accept my apology!
@ jaclaz, Thx again, I have 52in1 internal card reader, in floppy place, but I'll disconnect from usb and yes, I have just one HDD....About freespace, I have to delete something...For now I have only 110GB free.

Quote

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.
Geometry should be:
14593x255x63=234,436,545 sectors
234,441,648-234,436,545=5,103 unallocated sectors
234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?

[jaclaz]

ozzyboy, on Feb 10 2010, 04:14 PM, said:

Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?

Yep , it is an indirect confirmation we are dealing with the "right" numbers.

So partition data should be:

80-07-0-1-1-1023-254-63-63-234436482

Let's see if Testdisk finds anything, first.

Post the 200 sectors, it is very possible that we can get some confirmation from them.

jaclaz

[bauxite]

so, was there any luck? are you files recovered?

this might be obvious but what about trying a program like recuva?

is it posible that could recover the lost files?

[ozzyboy]

Hi, I'm back again...with some good news!!
OK, I've done the image of HDD. For results see the picture below:


After that I have decided to try something and I mounted the full image with ImDisk Virtual with this settings:


Then I tried "File Scavenger" with "a long scan" on new mounted partition "H"


After 1 hour of scanning...File Scavenger found me all files, you can see that in the picture:




But I dont have so much free space, to copy founded files on other partition.
Now I'm asking you, if it's posible to recostruct, somehow, the original partition, to no longer need copying those files on another hdd.



@jaclaz, I scaned the partition twice, with Testdisk, but with no results!! maybe I'm doing something wrong...
Thank's guys, especialy to jaclaz!!!!!

This post has been edited by ozzyboy: 14 February 2010 - 10:31 AM

[jaclaz]

Let's make a deal.

If you give me a reason why you used a 2048 blocks offset when mounting with IMDISK (I won't ask you how it came to you to use IMDISK with an image that you cannot fix with TESTDISK),
AND you run:

dsfo e:\dsfok\hddfull.img 0 1049088 e:\dsfok\first2049.bin

AND you compress the file in a zip file and post it or give a link from where I can download it,
I will help you further.


Translation:
We were originally trying to have partition based recovery, as opposed to file based recovery, which is what you actually performed, and now you want to go back to partition based one.


jaclaz

[ozzyboy]

2048 blocks was default sets from ImDisk Virtual, also I tested with 4096(default NTFS) and I recived the same results. How many blocks must put in there?

And yes, I want a partition recovery instead of file recovery ...You understand me very well.
Thx jaclaz!

Here the file who you request!

[jaclaz]

The data is very, very strange.

06 00 0 32 33 1023 254 63   2048 234436608

The partition type is FAT16.
The CHS offset is that of a small device with 32 sectors.

(32+1)*63=2079 and NOT 2048.

The file you sent is all 00's apart the MBR.

Try posting a bigger chunk of the image:

dsfo e:\dsfok\hddfull.img 0 2560000 e:\dsfok\first5000.bin

jaclaz

[ozzyboy]

Maybe all data in the begining of hdd is altered because of all recovery apps what I've used.
Here, first5000.bin.

This post has been edited by ozzyboy: 14 February 2010 - 03:36 PM