Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

Need help with data recovery on HDD

- - - - -

  • Please log in to reply
51 replies to this topic

#1
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Your time is valuable and appreciated. I'll be brief.

System drive (Seagate 7200.11) with XPx64 stopped being recognized in BIOS. Found this place, went through steps to get it back. Now I'm not seeing any partitions on the drive from the current OS (win7x64).

Drive is 500GB 7200.11. It contains both the OS and documents of value. Most urgent (priority) is getting a few docs back. Would be wonderful if I could make it bootable again of course, but that's a bonus.

- I have another external 500GB drive that is clean.
- I have another 7200.11 internal that I believe is clean.
- I don't remember which file system was used on the problem drive. Did run testdisk but had to go to work. Believe it said FAT16 (why?). Would have thought I'd have chosen NTFS or FAT32...

Questions:

1) What steps should I take first?
2) Which softwares would be recommended for these steps?

Thanks in advance for any and all help you can give me,

Mattias


How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

1) What steps should I take first?

To be on the safe side you should first thing image the disk.
Normally one would image the disk, i.e. save it's entire contents to a file on another (larger) disk.
Since you only have other disks of the same size this is not possible, so, as a poorman's solution you could clone (i.e. directly copy sector by sector) the contents of the unbricked disk to the other disk.
This is intended as a preventive measure, by having an image or a clone, in case of any possible "mistake" during the recovery procedure you have a "way back".

2) Which softwares would be recommended for these steps?

Under windows NT (and possibly a 2K or XP would be "better" than a Vista :ph34r: or 7 because of some added complications with direct disk access in these two latter OS's) recommended tools are:
For imaging DatarescueDD:
http://www.datarescu...cue/v3/drdd.htm
For cloning :
http://alter.org.ua/...win/bb_recover/

The app of reference is TESTDISK (for partition oriented recovery) or the "companion" PHOTOREC (for file based recovery):
http://www.cgsecurit...g/wiki/TestDisk

It is very possible that some manual intervention by means of a hex editor will be needed anyway, in any case, if you have ANY doubt in the usage of any of the tools, ask BEFORE doing something that you may later regret :ph34r: .

Here is an example of a similar recovery, performed succesfully :thumbup after the OP used TESTDISK improperly :w00t: (that should give you a fair idea also of the steps necessary to use it properly) and - if you are in the same situation - give you some hope in the success of a partition based recovery:
http://www.msfn.org/...-after-bsy-fix/

jaclaz

#3
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Thank you jaclaz, :)

I will clone the drive and then read through the link you mentioned. I'm assuming that the suggested clone software will work in Win8x64 (?). Unfortunately that's all I have available at the moment. I also hope you don't mind if I pose further questions after having read that thread. I'm fairly decent with technology but I'm sure I'll have questions....

/m

Edited by mattiasnyc, 16 August 2012 - 04:38 PM.


#4
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

Thank you jaclaz, :)

I will clone the drive and then read through the link you mentioned. I'm assuming that the suggested clone software will work in Win8x64 (?). Unfortunately that's all I have available at the moment. I also hope you don't mind if I pose further questions after having read that thread. I'm fairly decent with technology but I'm sure I'll have questions....

/m

You are very welcome to ask questions :yes: , but you will need to be more flexible with your "available tools".
I have NO idea IF any of the mentioned software will work:
  • under 64 bit
  • under windows 8
  • under the two above combined
or if they will work "correctly".

If I should bet on the worst possible combination one could find for data recovery, I would bet on Windows 8 64 bit :ph34r: .

Now, get real :) .
You are going to risk supposedly very valuable data by using "legacy" tools, designed for 32 bit on a 64 bit OS (and this in itself is not "smart" as you rely on the 32 bit subsystem that could have some incompatibilities with "real 32 bit OS) and to this you add the use of newly released OS (and traditionally NO MS OS was EVER found to be stable before "SP1").
While the first would be IMHO a limited risk (but that I would anyway choose NOT on valuable data), the second seems to me like "pure folly" :w00t: .
If you had several YEARS of experience with the tools, then it would be logical for you to test the new OS and environment (on EXPENDABLE data ONLY of course) but without any experience with the tools introducing a brand new OS?
Come on....

If you have not available a "good" WIndows NT based system, i.e. a 2K or XP (and possibly NOT Vista or 7 AND definitely NOT 8) then you'd better get a free Linux based live disk, that is known to work.
You want either ddrescue or dd_rescue (most distro's will have one of them) and TESTDISK/PHOTOREC are also available in the Linux version on many distro's, Parted Magic is the first one that comes to mind:
http://partedmagic.c...ku.php?id=start


jaclaz

Edited by jaclaz, 16 August 2012 - 04:59 PM.


#5
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
I'm sorry jaclaz, I had a brain fart.

As I mentioned in my first post my current OS is Windows 7 x64, not 8.

I'm not sure I'll get access to other OS'. How about I just find a different cloner, like EaseUS Todo Backup Free Edition, clone the drive, and then I'll just give it a whirl and continue working on the clone instead of the original. I guess we'd see soon enough if the other software will operate properly under Win 7 x64 or not, with the target in question. Perhaps it'll be enlightening to others in the same situation.

Or do you think it's a waste of time?

#6
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

I'm sorry jaclaz, I had a brain fart.

As I mentioned in my first post my current OS is Windows 7 x64, not 8.

I'm not sure I'll get access to other OS'. How about I just find a different cloner, like EaseUS Todo Backup Free Edition, clone the drive, and then I'll just give it a whirl and continue working on the clone instead of the original. I guess we'd see soon enough if the other software will operate properly under Win 7 x64 or not, with the target in question. Perhaps it'll be enlightening to others in the same situation.

Or do you think it's a waste of time?

No, it's OK, as said it is very likely (though not "granted") that the 32 bit programs will work in the 64 OS without a glitch, but I have a few doubts on the cloning app that you mentioned :unsure:.

According to this:
http://www.todo-back...-hard-drive.htm

6. Large hard drive can be cloned to small hard drive so long as the capacity of destination hard drive is equal or larger than the used space of original hard drive.


It sounds like even in the "sector by sector" mode the actual partition table OR "indexed in the filesystem sectors" (used space in the above snippet) is involved in the "clone" process.

This (forensic version of dd):
http://gmgsystemsinc.com/fau/
or rawcopy:
http://www.ltr-data.se/opencode.html/
might do (as they have a 64 bit version).

If I were you I would try the latter.
Something "plain" like:

rawcopy \\.\PhysicalDrivem \\.\Physicaldriven

should do, the above uses NOT any "fine-tuning", it will probably take some time (a few hours) to perform the copy.

Be VERY, VERY careful in choosing m and n ....they are the disk numbers (as you can see them in Disk Management and/or diskpart, first disk (boot disk) is 0, if you have three disks they will be 0, 1 and 2 be sure to identify correctly which one is the source and which is the target.

When cloning a disk drive it is a good idea to make sure that BOTH the "source" and the "target" drives are kept "cool", depending on your setup/hardware, it could be advisable to add a fan to have some additional airflow aroud the disks.

The "general" issue with 7 might be that the disk (actually some sectors on it) are "locked", from what I understand this should not apply to a disk that is seen as "RAW", most possibly later in the recovery it might be needed to put the disk "offline", see references here:
http://www.msfn.org/...os-with-imagex/
http://www.msfn.org/...ost__p__1006402

jaclaz

#7
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag

This (forensic version of dd):
http://gmgsystemsinc.com/fau/
or rawcopy:
http://www.ltr-data.se/opencode.html/
might do (as they have a 64 bit version).

If I were you I would try the latter.
Something "plain" like:

rawcopy \\.\PhysicalDrivem \\.\Physicaldriven

should do, the above uses NOT any "fine-tuning", it will probably take some time (a few hours) to perform the copy.

Be VERY, VERY careful in choosing m and n ....they are the disk numbers (as you can see them in Disk Management and/or diskpart, first disk (boot disk) is 0, if you have three disks they will be 0, 1 and 2 be sure to identify correctly which one is the source and which is the target.

When cloning a disk drive it is a good idea to make sure that BOTH the "source" and the "target" drives are kept "cool", depending on your setup/hardware, it could be advisable to add a fan to have some additional airflow aroud the disks.


I will use rawcopy as you suggested. I have a question about the highlighted section above:

In my device manager I see the following:

Drive 0 Unallocated (this is the problem drive) 465.76 GB
Drive 1 Sys Reserve / C: / D: (this is the system drive)
Drive 2 Crucial F: (mem stick)
Drive 3 L: (mem stick)

In other words on my system the "boot drive" isn't "Drive 0", but it appears to be "Drive 1". Does this seem correct?

#8
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

In my device manager I see the following:

Drive 0 Unallocated (this is the problem drive) 465.76 GB
Drive 1 Sys Reserve / C: / D: (this is the system drive)
Drive 2 Crucial F: (mem stick)
Drive 3 L: (mem stick)

In other words on my system the "boot drive" isn't "Drive 0", but it appears to be "Drive 1". Does this seem correct?

It is "unusual" in the sense that what you report should be related to BIOS drive order (and the way disks are connected to the actual physical interfaces on the motherboard) and normally first disk in BIOS is the "boot disk" and BOTH the "source" (drive to recover/copy from) and "target" (drive used for cloning/copy to) are attached to it "later".

The above is the "normal" setup, when you have a fully working machine and you add to it the source and the target disks.

On the other hand, if the "bricked" disk "was" a boot disk on that machine and you added a second disk installing to it a "temporary OS" and after the unbricking you placed the "unbricked" disk where it was before, what you report may be "normal".

jaclaz

#9
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag

It is "unusual" in the sense that what you report should be related to BIOS drive order (and the way disks are connected to the actual physical interfaces on the motherboard) and normally first disk in BIOS is the "boot disk" and BOTH the "source" (drive to recover/copy from) and "target" (drive used for cloning/copy to) are attached to it "later".

The above is the "normal" setup, when you have a fully working machine and you add to it the source and the target disks.

On the other hand, if the "bricked" disk "was" a boot disk on that machine and you added a second disk installing to it a "temporary OS" and after the unbricking you placed the "unbricked" disk where it was before, what you report may be "normal".

jaclaz


Actually my functional (win7) OS drive lives on SATA 3 or 4, and my damaged drive on 5 or 6.

But as long as I can trust what's reported it shouldn't make a difference, so the question is: can I trust it?

#10
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

But as long as I can trust what's reported it shouldn't make a difference, so the question is: can I trust it?

Well NEVER trust anything or anyone! :ph34r:

Do a simple experiment.
Check the first sector of both the \\.\PhysicalDrive0 and 1
rawcopy 512 \\.\PhysicalDrive0 C:\drive0.bin
rawcopy 512 \\.\PhysicalDrive1 C:\drive1.bin

Then physically disconnect the "unbricked disk" and redo:
rawcopy 512 \\.\PhysicalDrive0 C:\drive0_2.bin
rawcopy 512 \\.\PhysicalDrive1 C:\drive1_2.bin

If the setup is what you see in disk management you should get two identical files C:\drive1.bin and C:\drive1_2.bin, a file C:\drive0.bin and an error as at the second attempt there should be no drive0 avaialble.

As well, to make sure of the n check in disk management before connecting the "target" drive and after connecting it ;).

jaclaz

Edit: ERRATA CORRIGE
the rawcopy thingy uses bytes and not sectors as "copylength" corrected in the above from "1" to "512"

Edited by jaclaz, 17 August 2012 - 12:05 PM.


#11
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Where can I learn the syntax of the commands you're showing me?

I'm just a bit uncomfortable on a command line without having any frame of reference if you know what I mean... Do you know of any other cloning software that will do the same job but with an intuitive UI? (other people are welcome to jump in here)

Also, I'm guessing here that the problem with some of the cloning softwares that exist is that they actually "analyze" the sectors and decide whether or not to clone them based on whether or not they appear to be used as opposed to "empty" or "corrupted", is this correct? Or in other words they're not really cloning drives as much as they are cloning some/most data on them, which in turn means that some of the data I wish to recover might not make it to the "clone" in the first place...

Again: I greatly appreciate your help and patience with this. I'm pretty well versed in computer technology compared to the average person but this is all completely new to me as you can probably tell.

So, again, thanks!

Edited by mattiasnyc, 17 August 2012 - 03:15 PM.


#12
Kelsenellenelvian

Kelsenellenelvian

    WPI Guru

  • Developers
  • 8,693 posts
  • OS:Windows 7 x64
  • Country: Country Flag
http://hddguru.com/s...-Raw-Copy-Tool/

#13
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

Where can I learn the syntax of the commands you're showing me?

I'm just a bit uncomfortable on a command line without having any frame of reference if you know what I mean... Do you know of any other cloning software that will do the same job but with an intuitive UI? (other people are welcome to jump in here)

Opening a command prompt and typing in it:

rawcopy /?

will give you all the information available (which you should anyway test yourself).
The syntax is similar (though not identical) to many other programs that do the same thing, the "archeotype" of them is "dd" see (only to learn some history and possibly to get a quick laugh ;)):
http://reboot.pro/15207/
Basically dd takes a source and copies it to a target based on offset/position/address without caring about the contents.
The other programs I suggested you before are either "more suited to data recovery" (they use some specific "strategy" to attempt reading the data in case of difficulty and/or "give up" after a number of failed tries and write to the target a 00ed sector instead of throwing an error) or "

Also, I'm guessing here that the problem with some of the cloning softwares that exist is that they actually "analyze" the sectors and decide whether or not to clone them based on whether or not they appear to be used as opposed to "empty" or "corrupted", is this correct? Or in other words they're not really cloning drives as much as they are cloning some/most data on them, which in turn means that some of the data I wish to recover might not make it to the "clone" in the first place...

Exactly. :thumbup
For "normal" use, i.e. NOT for "forensics" or "data recovery", ignoring some data (which are unneeded for these other than foresics or data recovery scopes) will allow a number of advantages, like faster operation, smaller images, etc. a quick sum up is here:
http://www.msfn.org/...inside-windows/

Again: I greatly appreciate your help and patience with this. I'm pretty well versed in computer technology compared to the average person but this is all completely new to me as you can probably tell.

So, again, thanks!

You are welcome, actually the fact that you are "new to the field" is a good thing: it means that you never faced a serious case of data loss in these years :).

The app Kelsenellenelvian :thumbup posted a link to seems like solving the issue in a better way as it is reported to be working (for sure) on 7 both 32 and 64 bit.

jaclaz

#14
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
On HDDguru's page about the software it says:

Bad sectors are skipped by the tool.


I would think this is a potential problem then, is it?



Too bad because I like the fact that the UI gives information about the disk which means that one can easier recognize which disk is which...

#15
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

On HDDguru's page about the software it says:

Bad sectors are skipped by the tool.


I would think this is a potential problem then, is it?



Too bad because I like the fact that the UI gives information about the disk which means that one can easier recognize which disk is which...

Not really, really that's the way *all* tools should behave (when dealing with data recovery).
Basically when you hit a bad sector, a "normal" tool will throw an error and abort or "insist" trying over and over on that same (bad) sector (and thus "stall").
A recovery oriented tool will try a few times to read the bad sector (let's say 5 times) then will understand that the sector is actually bad and write to the target a sector full of 00's INSTEAD and continue to the next sector.
If there is a bunch of bad sectors in some cases it is advised to avoid also the (say) 5 times try on each of them (which will slow considerably the imaging) and simply "jump" a little bit further (and possibly later trying again that zone "backwards"), that is the idea of the DatarescueDD.


jaclaz

#16
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Ok, I got side-tracked but have begun the cloning. Question:

I started the process at 9:43, it's now 10:43 and the software is telling me it's currently on sector 3,374,xxx. "0%" complete. That's after a whole hour. Transfer rate is reading at 0.5MB/s!!!

Source drive is internal SATA. In the software it came up as "ATA", not "SATA". Target drive is external FW400. Still, ATA should at worst transfer 16MB/s I think, and FW400 50MB/s, all theoretical of course.

Any clues as to what I should check?

#17
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

Ok, I got side-tracked but have begun the cloning. Question:

I started the process at 9:43, it's now 10:43 and the software is telling me it's currently on sector 3,374,xxx. "0%" complete. That's after a whole hour. Transfer rate is reading at 0.5MB/s!!!

Source drive is internal SATA. In the software it came up as "ATA", not "SATA". Target drive is external FW400. Still, ATA should at worst transfer 16MB/s I think, and FW400 50MB/s, all theoretical of course.

Any clues as to what I should check?

Well, ATA means both "PATA" and "SATA", I wouldn't see that as a problem, and anyway a "normal" (P)ATA 133 is comparable with a SATA I (150) when it comes to speed.

You never know the speed you can have on a program (unless you are already familiar with it and have some experience).
Much more than that, you are doing the first step of data recovery and the source drive is NOT (evidently) fully functional as it was a bricked drive, later unbricked.
It is also possible that you are hitting a particular zone with "bad" (or - actually worse for speed - "half bad" sectors) and the tool is slowing down to try (desperately) to read them sectors.

There are too many variables in your setup, there is nothing "wrong" at first sight but the interaction of a number of "not known" or "not tested together" items may lead to "whatever".

And mind you it is very possible that by using the recommended OS and tools you would have exactly the same speed :w00t: as the issue is the source drive (or the target one, or a cable or a hardware interface, or in *something else* that I didn't notice :ph34r: ) ...

The "advantage" of using a command line tool (over an "easy" GUI one) is that you can try to image a small part of the disk, see what happens, try with another area, stop and resume, etc..

Really cannot give you any meaningful advice :(.

jaclaz

#18
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Useful advice or not, I appreciate the input. It's currently chugging along and is at 18,1xx,xxx sector, or 2%. I suppose I'll just let this thing run until it's done. But it really does make me worried. If all of these sectors are bad I'm going to cry when I'm done.

Thanks for the input and I'll harass you more once it's done...

/m

#19
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

Useful advice or not, I appreciate the input. It's currently chugging along and is at 18,1xx,xxx sector, or 2%. I suppose I'll just let this thing run until it's done.

Yep, one of the "key" requirements for disk data recovery is "patience" (the other one being "perseverance" ;)).

BUT do check, by just feeling it with a hand, if the disk is warming up "too much" (a highly specialized technical unit of measure :whistle: ) and if it does add a fan to help keep it cool.


But it really does make me worried. If all of these sectors are bad I'm going to cry when I'm done.

Oww, come on :) MacGyver wouldn't cry ;):
Link to image
(for some strange reason the board doesn't like this image's name)




jaclaz

#20
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
So right now it's at 9%, which means I have another week to go. I really wish there was another way...

To reiterate: Trying to recover the data on the source drive (that failed and was unbricked) is playing with fire, right? So that's why I should prefer to use a clone...?

and

What type of risk are we talking if I start working on the source instead? Is it dependent on the operation I perform on it or is it something else at play?

#21
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

So right now it's at 9%, which means I have another week to go. I really wish there was another way...

To reiterate: Trying to recover the data on the source drive (that failed and was unbricked) is playing with fire, right? So that's why I should prefer to use a clone...?

and

What type of risk are we talking if I start working on the source instead? Is it dependent on the operation I perform on it or is it something else at play?

Let's open a few scenarios:
  • the unbricked drive is 100% (or 99.99%) functional (percentage of "good" data) and the only issue is a single sector that was corrupted/wiped/whatever
  • the unbricked drive is (say) 55.32% :w00t: functional and the remaining 44.68% cannot be recovered in any way
  • the unbricked drive is (say) 55.32% functional BUT the remaining 44.68% can be read/imaged BUT NOT fixed (made accessible) while still on the same drive
  • in any of the above, the recovering procedure introduces some "fixes", and either by mistake or by "wrong suggestion/approach" (or by bad luck/Murphy's Law) these "fixes" may cause a chain reaction that deletes (or anyway makes not anymore recoverable) more data
  • in any of the above cases, since the drive has "bricked" itself at least once before, AND we don't know the exact reason why this happened there are MORE probabilities that it will re-brick itself soon, AND, since the unbricking wasn't actually really entirely successful - which could BTW mean that the cure for a "specific" illness by pure luck temporarily and partially cured the actual different unknown illsness the drive suffers from - we have NO idea if a further UNbricking will be possible at all :ph34r: .
Obviously if you are in case 1. or 2. having an image is only a precaution and not really *needed* (whilst anyway advised).
If you are in case 3. making an image/clone starts to make more sense.
BUT since cases 4. and 5. apply to ALL the previous ones the idea of making an image/clone starts to look like a really *needed* step.... :whistle:

Mind you Murphy's Law could well apply to the actual cloning procedure or to the "target" drive that while you are imaginfg to it - for any reason - decides to brick itself (or right after you have concluded the imaging)....
...and it is also possible that the drive has only a total of (say) three hours of life left which could be used more usefully in attempting to recover selected key data instead of "wasting" them cloning an area of the disk that contains unneeded data.....

The imaging/cloning procedure is the "standard" one as it has been the one (normally) being the less risky, but there aren't guarantees on any kind that it will work "better" than a "direct recovery" attempt or that it will work at all, if the cloning works, at least you have a "second chance", nothing more.

Decisions, decisions always decisions..... :(

While the disk cloning is running you should be able to start getting a few "key" sectors from both the source and the target drive, not knowing the specific software you are now running I cannot swear it will be possible but it should (i.e. the disks should not be "locked").
If you could get by using HDhacker:
http://dimio.altervista.org/eng/
the MBR (first sector of the \\.\PhysicalDrive)
or alternatively use the rawcopy as mentioned earlier:
http://www.msfn.org/...ost__p__1007536
Actually if you could get with the rawcopy the first 100 sectors of the disks (both source and target disk) by using:

rawcopy 51200 \\.\PhysicalDriven C:\driven.bin

(twice once for the target and once for the source) we could have already have some data to look at and also have a way to verify that the cloning is working (at least for the initial 100 sectors)
But again it is difficult to say :unsure: , though UNprobable, it is possible that performing this action may somehow "disturb" the ongoing cloning....

jaclaz

#22
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
I have now cloned my unbricked drive.

What would my next move be?

#23
jaclaz

jaclaz

    The Finder

  • Developers
  • 13,394 posts
  • OS:none specified
  • Country: Country Flag

I have now cloned my unbricked drive.

What would my next move be?

See what is the issue (on the clone).
Make a copy of the basic sectors the MBR and the PBR.
The MBR is "easy", it is the first sector of the disk, CHS 0/0/1 or LBA 0.
A suitable tool to make a copy of it is HDhacker:
http://dimio.altervista.org/eng/
you want the first sector of the \\PhysicalDriven
or you can use the mentioned rawcopy:
rawcopy 512 \\.\PhysicalDrive1 C:\drive1.bin
To get the right n try having a look at the disk in "disk management". If you have only a disk in your PC, it will be PhysicalDrive0 and the "clone" you attach to it will be PhysicalDrive1.
While you are at it, can you see the Partitions(s)/Volume(s) in it? (LogicalDrive(s)).
If yes, you need a copy also of the first sector of it (them), but since you are running 7, that sector may be locked.
If this is the case, you might want to try this other software CLONEDISK:
http://reboot.pro/8480/
http://labalec.fr/erwan/?page_id=42
or a tool to dismount the drive(s)/Partition(s)/Volume(s):
http://reboot.pro/12413/
and then use direct disk access (rawcopy, etc.) to copy the PBR(s).

Once you have the MBR and the PBR(s) copies compress them in a .zip file and attach them to your next post.
If you have difficulties in getting the PBR's attach just the MBR and I will give you more detailed instructions on how to get the PBR(s).

AFTER having got these copies, you can start TESTDIDK following this guide:
http://www.cgsecurit...sk_Step_By_Step
You WANT a log file.
If the disk was parittioned under VIsta :ph34r: or 7 you want to answer "Y" to the questions if irt should look for Partitions created under Vista.
If you are lucky, the procedure might fix the issue.

Report.

jaclaz

#24
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
Hi,

here's the latest update of what I've done;

The clone was "Disk 2" and shows up as one contiguous block in "Disk Management" and reads "Unallocated".

HDHacker read teh first sector and gives the following readable "text" message:

"Invalid partition table. Error loading operating system. Missing operating system", plus a bunch of other stuff.




mbr attached...

Attached Files


Edited by mattiasnyc, 30 October 2012 - 04:02 PM.


#25
mattiasnyc

mattiasnyc

    Newbie

  • Members
  • 27 posts
  • OS:Windows 7 x64
  • Country: Country Flag
For the record, I'm not sure I fully comprehend the procedure in getting the PBR (unless it stands for Pabst Blue Ribbon, in which case I know how to but just don't want to).

Would it be unwise to move along to the next step with only a copy of the MBR and NOT the PBR?




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users



How to remove advertisement from MSFN