Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

need to recover mbr on ST950032 5AS seagate from HP HDX w/ Vista 32-bi

- - - - -

  • Please log in to reply
46 replies to this topic

#1
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
Hi, I'm trying to fix my cousins gf laptop. She needs to get at the data and back it up.
I don't know how it originally occurred, but the laptop can get pretty hot, maybe an abrupt shutdown from overheating caused the original error.

Boots directly to the error:
"A Disk Read Error Occurred Press Ctrl-Alt-Del to Reboot"

I tried the Vista DVD, repair, Bootrec.exe to no avail.
Also numerous partition recovery sw w/o success.
I figured I tried the rest and now I'll try the best, you folks at msfn.

The file system is currently in the RAW state.
As far as I know I did not completely delete or format the partition w/ the Vista OS from using any tools. (diskpart, trial versions of recovery sw, acronis, etc.) The OS should still exist on the drive.
This is what I would like to find out and potentially overwrite/rewrite the MBR (to get Vista to function normally again).

I saw a post w/ jaclaz using tools like TESTDISK to help solve the issue but I do not want to further complicate the matter if I happen to make an unreversible change. Can you help diagnose and recover the Vista OS Boot Record? Please let me know of any information I can provide to help w/ this problem/resolution.

Thank you kindly in advance. :)

Edited by d8apzl, 17 July 2012 - 11:19 PM.



How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

I saw a post w/ jaclaz using tools like TESTDISK to help solve the issue but I do not want to further complicate the matter if I happen to make an unreversible change. Can you help diagnose and recover the Vista OS Boot Record? Please let me know of any information I can provide to help w/ this problem/resolution.


Before test disk, it would be interesting to understand what actually is on the disk.
What are you running (I mean which os on which machine) to access that disk?

Best would be a "plainer" OS, like XP, and use Hdhacker:
http://dimio.altervi.../eng/index.html
and use it to save as files:
  • First sector of Physicaldrive
  • First sector of LogicalDrive

You are saying that you see a drive as RAW, this should mean that at least the Magic Bytes in the MBR are there and that *something* is mapped as a partition (otherwise you would have a prompt asking to "initialize the disk" and you would see NO volumes in Explorer).

Once you get the two sectors above, compress them to a .zip file and attach them to your next post.

jaclaz

#3
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
First off, I would just like to say you are THE Man jaclaz and thank you because I saw some other posts in which you helped folks recover their data/drives.
Attached is the zip containing the .dat results from hdhacker.

I used XP 32-bit w/ hdhacker

Edited by d8apzl, 18 July 2012 - 06:21 AM.


#4
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
hmm, thought I attached the zip to the previous post.. here it is.

#5
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

Attached is the zip containing the .dat results from hdhacker.

I used XP 32-bit w/ hdhacker

Good. :)
There are THREE (separate) issues
  • the (only one, NTFS ID) partition in the MBR partition table is NOT active <-trivial to solve :)
  • the partition has data #0 07 00 0 32 33 1023 254 63 2048 3907024896 (which means that it is an almost 2 Tb partition) :w00t:
  • the bootsector (VBR) is strange: the WHOLE BPB has been wiped out with a a B7 02 + a number of 00's (82 of them) <. I wonder what could have caused this, any possibility of a Virus? :unsure: )
Let's leave #1 alone for the moment (as it is a non-problem).

Important question:
How big is the actual hard disk?

Explanation:
the data in the MBR is seemingly senseless, the data in the VBR is non-existing, if we know what is the total size of the hard disk we should be able to find "quickly" the second (or backup) copy of the VBR.
In this case TESTDISK is of little use as it has only "wrong" or "missing" information to work with, I prefere to chack for that sector manually.

Additionally:
How familiar are you with a hex/disk editor?
Get TinyHexer (and possibly my scripts for it, so that you will be able to "view" the same things I do)
http://reboot.pro/8734/

Can you find another disk bigger than this one so that you can make a DD-like copy of the disk (better be safe than sorry) before starting fiddling with the failed disk?

jaclaz

#6
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
The failing drive is 500GB, there possibly could've been a virus, but I cannot say for sure.

not very familiar with hex but I can hack it.

Luckily I have a 750GB :D I never opened. It better not be DOA. :unsure:

What can I use to duplicate the drive?
Technically, I have 908GB free on my XP drive, can I make an image of the 500GB drive using some tool(s)? Ghost?

DL'd:
  • tinyhex 1.8.1.6 (installed on the XP)
  • BSview.zip
  • MBRview.zip
  • PTview.zip

Edited by d8apzl, 18 July 2012 - 08:45 AM.


#7
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag
Sure :), as long as the disk is around 500 Gb, a dd-like image will take 500 Gb.
Since I presume that the disk is fully functional, you can do a single image, in any case I recommend using this app:
http://reboot.pro/7783/
so that in case of *need* :ph34r: you can use it to do a set of "separate images", as in here:
http://reboot.pro/15040/#entry133567
Try with imaging the whole disk drive, and if you have issues, you can adopt "plan B" ;).

Open the files you posted in tinyhexer (after having added to it's installation the structure viewer scripts).
Try looking at the MBR (first sector of Physicaldrive) with both MBRview and PTview.
Try looking at the VBR (first sector of LogicalDrive) with BSview (you will see something a lot like "a suffusion of yellow" :w00t:) and with the built-in "NTFS boot structure" (you will see a number of 0 values)

jaclaz

#8
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
Not sure if this information helps but, on the failing disk I have a drive letter that shows up "System Reserved" 70MB free of 99.9MB, it could be windows PE when I tried bootrec before.

Looks like ddrd found errors but it's slowly still in progress and continues to find errors of the same type.

Running this with admin rights. Should I be running this on the XP? I'm using W7.

see attached png.

Edited by d8apzl, 23 July 2012 - 05:58 PM.


#9
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

Not sure if this information helps but, on the failing disk I have a drive letter that shows up "System Reserved" 70MB free of 99.9MB, it could be windows PE when I tried bootrec.

NO. (meaning not that it doesn't help, meaning that I do not believe you :w00t:)
There is no corresponding entry in the partition table of the MBR, so that thingy must be a "leftover" of some kind, or it belongs to ANOTHER disk, that looks a lot like the Windows 7 "default install on new media" partition, nothing to do with the XP you are running and the Vista :ph34r: that should have been on the failed disk.


Looks like ddrd found errors but it's slowly still in progress and continues to find errors of the same type.
see attached png.

Let's see how it evolves :unsure:

jaclaz

#10
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
I swear, I'm not kidding you.
Please see the pngs.
I will let ddrd continue.

#11
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

I swear, I'm not kidding you.
Please see the pngs.

Yep :), but that is diskpart on disk 4.
You are seemingly using ddrescue on disk 5
The difference between 4 and 5 is ALMOST as important as the one between 5 and 6

Spoiler


unless diskpart and ddrescue use a different numbering scheme which - from memory - I doubt, but in any case you should always test two different items with the SAME tool, to see differences, or the SAME item with two different tools, as is, it seems to me like you are comparing diferent items with different tools....

EDIT:
Are you positive that the MBR you posted was from the actual disk in question?
and is it disk 4 or disk 5 (or what)?

jaclaz

Edited by jaclaz, 18 July 2012 - 10:12 AM.


#12
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

unless diskpart and ddrescue use a different numbering scheme which - from memory - I doubt, but in any case you should always test two different items with the SAME tool, to see differences, or the SAME item with two different tools, as is, it seems to me like you are comparing diferent items with different tools....


It must be a different schema because I only have one 500GB drive connected. Maybe diskpart starts from disk 0

ddrd was still reading errors and stopped erroring about 10 minutes ago, but the 750GB has more than 17GB written so far.

Edited by d8apzl, 18 July 2012 - 10:17 AM.


#13
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

EDIT:
Are you positive that the MBR you posted was from the actual disk in question?
and is it disk 4 or disk 5 (or what)?


Yes, the MBR was posted from the disk in question. 500GB using hdhacker on WinXP.
I started the ddrd w/ the 500GB & 750GB on a W7 system because I thought it would be faster using USB 3.0
It looks like ddrd picked it up as Drive 5, but diskpart picked it up as Disk 4.



p.s. nice spoiler :yes:

Edited by d8apzl, 18 July 2012 - 11:11 AM.


#14
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

It looks like ddrd picked it up as Drive 5, but diskpart picked it up as Disk 4.

Again, NO.
The MBR you posted DOES NOT contain info about two partitions, one around 100 Mb and one around 465 Mb, the one you posted, that I have NO WAY to verify it belongs to the "problematic" disk, has a SINGLE partition, evidently with a wrong size (around 2 Tb) OR it is the MBR of ANOTHER DISK!

I cannot say if the disk that ddrescue is imaging is the SAME disk that you accessed first with diskpart and then with disk management, what I can tell you is that these latter tools BOTH show a VALID partition table WHILST the MBR you posted did not.

You have right now:
  • too many OS's (XP and 7)
  • too many disks (seemingly 8 of them)
  • and you are using too many different tools (possibly under the two different OS's)

this is likely to create confusion :ph34r: .

Let's do it like this :unsure::
  • STOP whatever you are doing. (of course let datarescuedd finish the image)
  • use ONLY the XP (and NOT the Windows 7)
  • run again Hdhacker to save the MBR (first sector of PhysicalDrive) of the disk that you think is the failed one, save it like MBR_disk_n.hdh
  • run ddrescue on the disk that you think is the failed one, saving only 1 sector (lower fields Start=0, Size=1, End=1) to file image[0-512].dd
  • run tiny hexer, use the file->disk->open drive to open the disk that you think is the failed one (it will auto-set to load one sector at the time and will open on the first sector) choose File-> Save as and save it like MBR_disk_n.thx
  • compress the three resulting files into a zip and post it as attachment. (if the three files are not IDENTICAL there is an issue of some kind)




jaclaz

Edited by jaclaz, 18 July 2012 - 11:20 AM.


#15
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

The MBR you posted DOES NOT contain info about two partitions, one around 100 Mb and one around 465 Mb, the one you posted, that I have NO WAY to verify it belongs to the "problematic" disk, has a SINGLE partition, evidently with a wrong size (around 2 Tb) OR it is the MBR of ANOTHER DISK!


Ok, you are right on this. I do have a 2TB on the XP. hdhacker may have saved the results from the 2TB not the failing 500GB. I was sure I selected the 500GB but I may have made a mistake.


Let's do it like this :unsure::

  • STOP whatever you are doing. (of course let datarescuedd finish the image)
  • use ONLY the XP (and NOT the Windows 7)
  • run again Hdhacker to save the MBR (first sector of PhysicalDrive) of the disk that you think is the failed one, save it like MBR_disk_n.hdh
  • run ddrescue on the disk that you think is the failed one, saving only 1 sector (lower fields Start=0, Size=1, End=1) to file image[0-512].dd
  • run tiny hexer, use the file->disk->open drive to open the disk that you think is the failed one (it will auto-set to load one sector at the time and will open on the first sector) choose File-> Save as and save it like MBR_disk_n.thx
  • compress the three resulting files into a zip and post it as attachment. (if the three files are not IDENTICAL there is an issue of some kind)


Again you're right and sorry for the confusion. Thank you for being patient, as soon as the drdd finishes I will follow the steps you outlined and post back.

#16
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

Ok, you are right on this. I do have a 2TB on the XP. hdhacker may have saved the results from the 2TB not the failing 500GB. I was sure I selected the 500GB but I may have made a mistake.

These could actually be "good" news, in the sense that if the MBR (as seen in diskpart and in disk management) contains "valid" data, it should be easier to find the backup bootsector...
BUT, there are some strings attached :whistle:
IF (as it seems now) the disk has two valid partition entries, the "single" VBR you posted is only one half (which one? :unsure:) of the story:
1 disk drive=1 MBR
2 partitions/volumes/drives on it = 2 VBR's

Again you're right and sorry for the confusion. Thank you for being patient, as soon as the drdd finishes I will follow the steps you outlined and post back.

Actually I was wrong :w00t: (but not on the main issue ;) ) I checked and while:
  • Hdhacker
  • Tiny Hexer
  • Diskpart
  • Disk Management
number disks starting from 0
Datarescue does number them starting from 1
so the 4 that becomes 5 is OK :thumbup .

STILL, one MUST be careful with the math ;):
Spoiler


jaclaz

Edited by jaclaz, 18 July 2012 - 12:19 PM.


#17
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

Let's do it like this :unsure::

  • STOP whatever you are doing. (of course let datarescuedd finish the image)
  • use ONLY the XP (and NOT the Windows 7)
  • run again Hdhacker to save the MBR (first sector of PhysicalDrive) of the disk that you think is the failed one, save it like MBR_disk_n.hdh
  • run ddrescue on the disk that you think is the failed one, saving only 1 sector (lower fields Start=0, Size=1, End=1) to file image[0-512].dd
  • run tiny hexer, use the file->disk->open drive to open the disk that you think is the failed one (it will auto-set to load one sector at the time and will open on the first sector) choose File-> Save as and save it like MBR_disk_n.thx
  • compress the three resulting files into a zip and post it as attachment. (if the three files are not IDENTICAL there is an issue of some kind)


I followed the steps, here are the results:

#18
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag
The good news :) are that now that it s the "right" MBR, we have some data to check :thumbup
#0 07 00 0 32 33 12 223 19   2048 204800
#1 07 80 12 223 20 1023 254 63   206848 976564224
The bad news are that you are not (yet) doing EXACTLY what you are told to :w00t:.
What I said:

4. run ddrescue on the disk that you think is the failed one, saving only 1 sector (lower fields Start=0, Size=1, End=1) to file image[0-512].dd

what you did:

4. run ddrescue on the disk that you think is the failed one, saving only 1 sector Mb (lower upper fields Start=0, Size=1, End=1) to file image[0-512].dd

Of course there is no consequence in this instance, you just got more data than what were needed :whistle: , but when you will get to direct disk access through Tiny Hexer or Testdisk, doing thing EXACTly or "almost exactly" may make a difference :ph34r: .

Now you need to access the disk with Tiny Hexer.
File ->Disk->Open drive -> (select the RIGHT PhysicalDrive) -> OK
File ->Disk-> Goto sector/position-> (enter 206848) ->OK
File ->Save as->Sector206848.bin
File ->Disk-> Goto sector/position-> (enter 976771071) ->OK
File ->Save as->Sector976771071.bin
Tools->Compare->Compare (You should find a number of bytes highlighted as different at the beginning of the sector)

In case you are wondering, 976771071 comes from 976564224+206848-1=976771071
the NTFS filesystem stores normally a backup of the first sector as last sector of the Partition/Volume allocated space or - if you prefer - as first sector after the end of the filesystem, which is always one sector less than the Partition/Volume allocated space.

Compress Sector206848.bin and Sector976771071.bin and post the .zip

jaclaz

#19
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

The bad news are that you are not (yet) doing EXACTLY what you are told to :w00t:.
What I said:
4. run ddrescue on the disk that you think is the failed one, saving only 1 sector (lower fields Start=0, Size=1, End=1) to file image[0-512].dd
what you did:
]4. run ddrescue on the disk that you think is the failed one, saving only 1 sector Mb (lower upper fields Start=0, Size=1, End=1) to file image[0-512].dd


sorry about that, I was wondering why the filename was different from what you said it would be. I don't know why I thought the Sectors fields were above the MBs fields.

Ok

I saved the sectors, here they are below. it doesn't look good.
It looks like the backup sectors are gone??

#20
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

I saved the sectors, here they are below. it doesn't look good.
It looks like the backup sectors are gone??

Yep :} .
The backup sector is completely wiped and a "queer" B702 is written to it at the beginning.
Also the "main" bootsector has this strange B702 "incipit".
I wonder what the heck may have caused it.

DId the image complete successfully?
This is "vital" since we will start actually writing to the disk, and if the image is not good we will have "no way back" :ph34r: .

At this point easier would be to try writing a BPB, but before it I would try two things:
  • check if the $MFT main record is "where it should be"
  • check if it is valid (or if it has been overwritten)

The main $MFT should start at:
206848+786432*8=6498304
And it's Mirror at:
206848+61035263*8=488488952


So, open the disk in Tiny Hexer, open the Physicaldrive, goto sector 6498304, it should begin with "FILE0".
Goto sector 488488952, it should also begin with "FILE0".

IF (and ONLY if)the above is correct, then goto sector 206848 and overwrite it with the sector in the attachment (with the physical drive open, goto sector 20848, open file 206848mod.bin, "select all", copy, select the physicaldrive sector, select all, paste, then close the physical drive, and say yes to the prompt to save the change).

Now if you try opening the drive in Explorer, you should be able to browse it's contents (if there are not any further damages).

Report.

If you have ANY doubt, ask for clarifications BEFORE doing anything!

jaclaz

Attached Files



#21
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag
:blink:
The image completed. Successfully? I cannot be positive it is an exact image because there were several errors that occurred before DRDD finished. However, DRDD did complete w/ errors.
25GB +/- 1GB was written to the image with DRDD.

The main $MFT should start at:
206848+786432*8=6498304
And it's Mirror at:
206848+61035263*8=488488952

The sectors do not match, see attachment.

Edited by d8apzl, 20 July 2012 - 07:52 AM.


#22
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

The sectors do not match, see attachment.

Hmmm.
One of the sectors is all 00's that may mean almost anything including the effect of the same thing that wrote B702 that could have wiped it, but the other one does contain some binary data (though not a $MFT mirror) it is unprobable that the whatever happened wiped one sector and wrote garbage to it's mirror.
It is much more likely that we are going to a wrong address.

Could it be that the first "100 Mb" partition is an artifact (of some kind) created by any of your previous attempts? :blink:

If this is the case, than logically there was before a "single" partition and then it would have started at the "default" (for Vista :ph34r:) 2048.
Try again with sectors:
$MFT:
2048+786432*8=6293504
And it's Mirror at:
2048+61035263*8=488284152

Otherwise, a good idea could be to open with Tiny Hexer the disk, goto sector 6280000 then Edit->Find/Replace->input "FILE0" (please note that tis is CaSeSeNsItIvE), make sure that you have Text mode checked and "Dos 8 bits", then click on the "Find" button, at the prompt click on "Yes to all".

This might be a very looong step before you get a "hit".
Compare with this thread:
http://www.msfn.org/...-after-bsy-fix/

jaclaz

Edited by jaclaz, 20 July 2012 - 08:08 AM.


#23
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag


The sectors do not match, see attachment.

Could it be that the first "100 Mb" partition is an artifact (of some kind) created by any of your previous attempts? :blink:

Yes, the 100MB looks like a Win7 PE partition when I tried BOOTREC w/o success w/ Win7.


Otherwise, a good idea could be to open with Tiny Hexer the disk, goto sector 6280000 then Edit->Find/Replace->input "FILE0" (please note that tis is CaSeSeNsItIvE), make sure that you have Text mode checked and "Dos 8 bits", then click on the "Find" button, at the prompt click on "Yes to all".

I followed the instructions you specified. It doesn't look good. No 'FILE0' found and I received an I/O error.

Also, I noticed when I plugged the HDD back in to the XP to do all the work, the HDD light on my HD enclosure is constantly lit up. Could this be causing the I/O errors?

I would really hate to tell my cousins gf her drive is toast, but it looks like it's completely corrupt. What do you think?
see attached .bin files and screenshot.


EDIT: At this point, if I can read the files and transfer to a different drive it would be ok. If she set a pw the files may be inaccessible because of permission issues, yes?
When I ran a recovery program after trying the BOOTREC, it saved all the RAW files (11.9GB) by type,: FILE001.bmp; FILE002.bmp, etc.. but they are not accessible whatsoever, meaning you can open them and some have different file sizes but nothing shows up.

Edited by d8apzl, 23 July 2012 - 06:01 PM.


#24
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,266 posts
  • OS:none specified
  • Country: Country Flag

I followed the instructions you specified. It doesn't look good. No 'FILE0' found and I received an I/O error.

Also, I noticed when I plugged the HDD back in to the XP to do all the work, the HDD light on my HD enclosure is constantly lit up. Could this be causing the I/O errors?

I would really hate to tell my cousins gf her drive is toast, but it looks like it's completely corrupt. What do you think?
see attached .bin files and screenshot.


EDIT: At this point, if I can read the files and transfer to a different drive it would be ok. If she set a pw the files may be inaccessible because of permission issues, yes?
When I ran a recovery program after trying the BOOTREC, it saved all the RAW files (11.9GB) by type,: FILE001.bmp; FILE002.bmp, etc.. but they are not accessible whatsoever, meaning you can open them and some have different file sizes but nothing shows up.

I would be less pessimistic than you are, in the sense that from the few sectors you posted I don't have the feeling of a "toasted" disk, sure it may have had a few bad sectors but since the datarescuedd thing got to the end of the disk, it should be substantially "sound".
It seems to me like more probable that most of the "damages" have been made (for *any* reason) by the failed attempts at recovery, this is actually the reason why one should always - unless he/she is 100% sure that it is a trivial thing and he/she is positive that it can be solved with little effort - image the disk first thing, as in case of issues there is always a "way back".

I am not (yet) convinced that "everything" is lost.

You are now mentioning "password", I sincerely hope that you don't mean - by any chance - that the volume was encrypted :unsure:.

I think I am missing something :w00t: , a $MFT is a "not so little" amount of sectors, it would be queer it has been completely wiped.
The "786432*8" is the "default" address for it, if the disk was partitioned/formatted with the "standard" tools. If it is possible that some "non-standard" tool has been used, it may be at another address.

If I get right, you have now scanned starting from sector 6293504 all the way to the end of the disk.
The settings you have in Tiny Hexer seem correct .
Try this before giving up.
Do the scan from sector 20848 up to 6293504.
Try this time for the hex characters "46494C45" (they are the same as "FILE" in text).

Also, it may help me if you could gather (from your cousin) as many details on the "story" of this disk as you can get (like which OS was there, how many parittions, if he changed something, etc, etc.) and if you would provide a (synthetic) list of the actions you attempted on the disk (again with as much detail as you can remember) before making the image with datarescuedd, including the actual name of the apps you have used, and anything that you can remember about what they did or how they behaved.

Also, you should check the USB enclosure, it is possible that the "always lit" is the symptom of a problem :unsure: .

But you can do the scan on the image, now that you have it :yes: .
Instead of File->Disk->Open Drive use File->Disk->Open disk image or large file as drive....

jaclaz

Edited by jaclaz, 21 July 2012 - 02:44 AM.


#25
d8apzl

d8apzl

    Newbie

  • Member
  • 25 posts
  • OS:none specified
  • Country: Country Flag

I am not (yet) convinced that "everything" is lost.

You are certainly optimistic. When I did the search for "46494C45" from 20848 I do notice that there is a lot of data there so the backup (& drive) still holds data.

Also, you should check the USB enclosure, it is possible that the "always lit" is the symptom of a problem .

I rebooted the XP and when it came back, the lit hdd light had stopped. After I opened the drive in drdd, the lit light was constant again. I rebooted again, it's fine now.

Also, it may help me if you could gather (from your cousin) as many details on the "story" of this disk as you can get (like which OS was there, how many parittions, if he changed something, etc, etc.)

She cannot recall all that much, and at this point she said, all she cares about is the photos on the drive.
I can tell you the OS was always the Vista that came w/ the laptop. Microsoft Windows Vista Home Premium 64-bit Edition. Very sorry, I didn't think it was 64-bit, I thought it was 32-bit.
She also said that one day it just stopped working probably due to the laptop overheating, she cannot be sure if there was a virus or not, the drive was probably not encrypted unless it was a default setting. It should've been a standard Vista OS as a single partition, unless HP had a hidden recovery partition.

and if you would provide a (synthetic) list of the actions you attempted on the disk (again with as much detail as you can remember) before making the image with datarescuedd, including the actual name of the apps you have used, and anything that you can remember about what they did or how they behaved.

Again, I'm very sorry. I did try a few things w/o success before I posted here.

Tried Bootrec commands from Win7 w/ failing disk as enclosure..
- /fixmbr /fixboot, but this must have been run on the PE partition because I could not access the single partition w/ Vista OS on it.

Next, I tried the Vista PE w/ the failing drive in the laptop
- /fixmbr /fixboot, also on the PE partition because I couldn't access the OS partition.

Next I tried a few apps w/o success like MbrFix, EasyBCD, Stellar Phoenix Windows Data Recovery - Home, EASEUS Data Recovery Wizard Professional 4.0.1, Kernel for Windows Data Recovery.

MbrFix
MbrFix /drive <num> fixmbr /vista

EasyBCD
I tried the BCD Backup/Repair w/o success

I even tried am ubuntu LiveCD to access and restore the boot record but I couldn't download the MS-SYS program to do anything so I scraped the idea.
http://www.ehow.com/...mbr-ubuntu.html

Please do not be upset, I know I s*ck because I didn't know how to make a backup of the drive before using these tools. This is when I saw your posts on msfn.org and decided to post here. Thank you for all your help w/ this and for not giving up.

The backup is still scanning at 203000

EDIT: found boot sectors?!?

Edited by d8apzl, 27 July 2012 - 05:03 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN