Jump to content

Need help with data recovery on HDD


Recommended Posts

Ok, I got side-tracked but have begun the cloning. Question:

I started the process at 9:43, it's now 10:43 and the software is telling me it's currently on sector 3,374,xxx. "0%" complete. That's after a whole hour. Transfer rate is reading at 0.5MB/s!!!

Source drive is internal SATA. In the software it came up as "ATA", not "SATA". Target drive is external FW400. Still, ATA should at worst transfer 16MB/s I think, and FW400 50MB/s, all theoretical of course.

Any clues as to what I should check?

Link to comment
Share on other sites


Ok, I got side-tracked but have begun the cloning. Question:

I started the process at 9:43, it's now 10:43 and the software is telling me it's currently on sector 3,374,xxx. "0%" complete. That's after a whole hour. Transfer rate is reading at 0.5MB/s!!!

Source drive is internal SATA. In the software it came up as "ATA", not "SATA". Target drive is external FW400. Still, ATA should at worst transfer 16MB/s I think, and FW400 50MB/s, all theoretical of course.

Any clues as to what I should check?

Well, ATA means both "PATA" and "SATA", I wouldn't see that as a problem, and anyway a "normal" (P)ATA 133 is comparable with a SATA I (150) when it comes to speed.

You never know the speed you can have on a program (unless you are already familiar with it and have some experience).

Much more than that, you are doing the first step of data recovery and the source drive is NOT (evidently) fully functional as it was a bricked drive, later unbricked.

It is also possible that you are hitting a particular zone with "bad" (or - actually worse for speed - "half bad" sectors) and the tool is slowing down to try (desperately) to read them sectors.

There are too many variables in your setup, there is nothing "wrong" at first sight but the interaction of a number of "not known" or "not tested together" items may lead to "whatever".

And mind you it is very possible that by using the recommended OS and tools you would have exactly the same speed :w00t: as the issue is the source drive (or the target one, or a cable or a hardware interface, or in *something else* that I didn't notice :ph34r: ) ...

The "advantage" of using a command line tool (over an "easy" GUI one) is that you can try to image a small part of the disk, see what happens, try with another area, stop and resume, etc..

Really cannot give you any meaningful advice :(.

jaclaz

Link to comment
Share on other sites

Useful advice or not, I appreciate the input. It's currently chugging along and is at 18,1xx,xxx sector, or 2%. I suppose I'll just let this thing run until it's done. But it really does make me worried. If all of these sectors are bad I'm going to cry when I'm done.

Thanks for the input and I'll harass you more once it's done...

/m

Link to comment
Share on other sites

Useful advice or not, I appreciate the input. It's currently chugging along and is at 18,1xx,xxx sector, or 2%. I suppose I'll just let this thing run until it's done.

Yep, one of the "key" requirements for disk data recovery is "patience" (the other one being "perseverance" ;)).

BUT do check, by just feeling it with a hand, if the disk is warming up "too much" (a highly specialized technical unit of measure :whistle: ) and if it does add a fan to help keep it cool.

But it really does make me worried. If all of these sectors are bad I'm going to cry when I'm done.

Oww, come on :) MacGyver wouldn't cry ;):

Link to image

(for some strange reason the board doesn't like this image's name)

jaclaz

Link to comment
Share on other sites

So right now it's at 9%, which means I have another week to go. I really wish there was another way...

To reiterate: Trying to recover the data on the source drive (that failed and was unbricked) is playing with fire, right? So that's why I should prefer to use a clone...?

and

What type of risk are we talking if I start working on the source instead? Is it dependent on the operation I perform on it or is it something else at play?

Link to comment
Share on other sites

So right now it's at 9%, which means I have another week to go. I really wish there was another way...

To reiterate: Trying to recover the data on the source drive (that failed and was unbricked) is playing with fire, right? So that's why I should prefer to use a clone...?

and

What type of risk are we talking if I start working on the source instead? Is it dependent on the operation I perform on it or is it something else at play?

Let's open a few scenarios:

  1. the unbricked drive is 100% (or 99.99%) functional (percentage of "good" data) and the only issue is a single sector that was corrupted/wiped/whatever
  2. the unbricked drive is (say) 55.32% :w00t: functional and the remaining 44.68% cannot be recovered in any way
  3. the unbricked drive is (say) 55.32% functional BUT the remaining 44.68% can be read/imaged BUT NOT fixed (made accessible) while still on the same drive
  4. in any of the above, the recovering procedure introduces some "fixes", and either by mistake or by "wrong suggestion/approach" (or by bad luck/Murphy's Law) these "fixes" may cause a chain reaction that deletes (or anyway makes not anymore recoverable) more data
  5. in any of the above cases, since the drive has "bricked" itself at least once before, AND we don't know the exact reason why this happened there are MORE probabilities that it will re-brick itself soon, AND, since the unbricking wasn't actually really entirely successful - which could BTW mean that the cure for a "specific" illness by pure luck temporarily and partially cured the actual different unknown illsness the drive suffers from - we have NO idea if a further UNbricking will be possible at all :ph34r: .

Obviously if you are in case 1. or 2. having an image is only a precaution and not really *needed* (whilst anyway advised).

If you are in case 3. making an image/clone starts to make more sense.

BUT since cases 4. and 5. apply to ALL the previous ones the idea of making an image/clone starts to look like a really *needed* step.... :whistle:

Mind you Murphy's Law could well apply to the actual cloning procedure or to the "target" drive that while you are imaginfg to it - for any reason - decides to brick itself (or right after you have concluded the imaging)....

...and it is also possible that the drive has only a total of (say) three hours of life left which could be used more usefully in attempting to recover selected key data instead of "wasting" them cloning an area of the disk that contains unneeded data.....

The imaging/cloning procedure is the "standard" one as it has been the one (normally) being the less risky, but there aren't guarantees on any kind that it will work "better" than a "direct recovery" attempt or that it will work at all, if the cloning works, at least you have a "second chance", nothing more.

Decisions, decisions always decisions..... :(

While the disk cloning is running you should be able to start getting a few "key" sectors from both the source and the target drive, not knowing the specific software you are now running I cannot swear it will be possible but it should (i.e. the disks should not be "locked").

If you could get by using HDhacker:

http://dimio.altervista.org/eng/

the MBR (first sector of the \\.\PhysicalDrive)

or alternatively use the rawcopy as mentioned earlier:

Actually if you could get with the rawcopy the first 100 sectors of the disks (both source and target disk) by using:

rawcopy 51200 \\.\PhysicalDriven C:\driven.bin

(twice once for the target and once for the source) we could have already have some data to look at and also have a way to verify that the cloning is working (at least for the initial 100 sectors)

But again it is difficult to say :unsure: , though UNprobable, it is possible that performing this action may somehow "disturb" the ongoing cloning....

jaclaz

Link to comment
Share on other sites

  • 2 weeks later...

I have now cloned my unbricked drive.

What would my next move be?

See what is the issue (on the clone).

Make a copy of the basic sectors the MBR and the PBR.

The MBR is "easy", it is the first sector of the disk, CHS 0/0/1 or LBA 0.

A suitable tool to make a copy of it is HDhacker:

http://dimio.altervista.org/eng/

you want the first sector of the \\PhysicalDriven

or you can use the mentioned rawcopy:

rawcopy 512 \\.\PhysicalDrive1 C:\drive1.bin

To get the right n try having a look at the disk in "disk management". If you have only a disk in your PC, it will be PhysicalDrive0 and the "clone" you attach to it will be PhysicalDrive1.

While you are at it, can you see the Partitions(s)/Volume(s) in it? (LogicalDrive(s)).

If yes, you need a copy also of the first sector of it (them), but since you are running 7, that sector may be locked.

If this is the case, you might want to try this other software CLONEDISK:

http://reboot.pro/8480/

http://labalec.fr/erwan/?page_id=42

or a tool to dismount the drive(s)/Partition(s)/Volume(s):

http://reboot.pro/12413/

and then use direct disk access (rawcopy, etc.) to copy the PBR(s).

Once you have the MBR and the PBR(s) copies compress them in a .zip file and attach them to your next post.

If you have difficulties in getting the PBR's attach just the MBR and I will give you more detailed instructions on how to get the PBR(s).

AFTER having got these copies, you can start TESTDIDK following this guide:

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

You WANT a log file.

If the disk was parittioned under VIsta :ph34r: or 7 you want to answer "Y" to the questions if irt should look for Partitions created under Vista.

If you are lucky, the procedure might fix the issue.

Report.

jaclaz

Link to comment
Share on other sites

  • 1 month later...

Hi,

here's the latest update of what I've done;

The clone was "Disk 2" and shows up as one contiguous block in "Disk Management" and reads "Unallocated".

HDHacker read teh first sector and gives the following readable "text" message:

"Invalid partition table. Error loading operating system. Missing operating system", plus a bunch of other stuff.

mbr attached...

MBR_HardDisk2.7z

Edited by mattiasnyc
Link to comment
Share on other sites

For the record, I'm not sure I fully comprehend the procedure in getting the PBR (unless it stands for Pabst Blue Ribbon, in which case I know how to but just don't want to).

Would it be unwise to move along to the next step with only a copy of the MBR and NOT the PBR?

Link to comment
Share on other sites

For the record, I'm not sure I fully comprehend the procedure in getting the PBR (unless it stands for Pabst Blue Ribbon, in which case I know how to but just don't want to).

Would it be unwise to move along to the next step with only a copy of the MBR and NOT the PBR?

Well, in your particular case you simply "cannot" (in the sense of "easily") get the PBR.

The MBR you just posted is partially corrupted, hence the disk manager cannot find any LogicalDrive (the PBR is first sector of the LogicalDrive) on the disk/image and HDhacker simply doesnt know which sector to get.

For whatever reasons, the Partition Tables in the MBR you posted are completely 00ed out.

At first sight the MBR CODE is seemingly that of 2K/XP.

You can try running Testdisk (remember to use the /log) since the original disk seems like having being partitioned under XP, reply N (No) to the question if the disk was partitioned under Vista.

Report BEFORE telling Testdisk to write anythng.

jaclaz

Link to comment
Share on other sites

Thanks jaclaz,

I will try Testdisk today. Does it take hours to do its thing or is it a matter of minutes? (I have to work from home today because of the hurricane)

The initial detection (if any is found :ph34r:) of the PBR/bootsector should take a few seconds.

If no bootsector is found where it normally is (sector 63 on XP - if I recall correctly it was just a single "huge" partiton) it may take much longer as it will have to scan the whole disk, on a perfectly functional SATA II 500 Gb disk I would say less than one hour, though, for the whole scan.

jaclaz

Link to comment
Share on other sites

The initial detection (if any is found :ph34r:) of the PBR/bootsector should take a few seconds.

If no bootsector is found where it normally is (sector 63 on XP - if I recall correctly it was just a single "huge" partiton) it may take much longer as it will have to scan the whole disk, on a perfectly functional SATA II 500 Gb disk I would say less than one hour, though, for the whole scan.

jaclaz

I will try this and NOT write anything until I've posted results here. One more thing:

You can try running Testdisk (remember to use the /log) since the original disk seems like having being partitioned under XP,

What do you refer to when you say "use the /log"? That particular sign/word ("/log") doesn't appear on the "testdisk step by step" guide page.

Link to comment
Share on other sites

What do you refer to when you say "use the /log"? That particular sign/word ("/log") doesn't appear on the "testdisk step by step" guide page.

I am more used to work on command line, it is simply faster, open a command prompt, navigate to the directory where TESTDISK is, type on command line

testdisk_win.exe /log

press [ENTER]

If you double click on testdisk_win.exe you will anyway be prompted to do that:

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#Log_creation

you want to Create a log.

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...