[jaclaz]

Well, what testdisk may have found is a partition image formatted as FAT, the disk, should have been partitioned (how?, most probably in one big partition ) and that partition formatted as NTFS.

It is like the FOURTH time that I am asking you to copy first 100 sectors and post them , I won't ask for them a fifth one .

For the record, I asked for them:

• in post #21 on 22 August 2012
  
• in post #35 on 02 November 2012
  
• in post #39 on 05 November 2012

Maybe it's time you just do it.

jaclaz

[mattiasnyc]

I believe what is attached is what you're looking for... Or hope rather...

Pulled a 17-hour overnight work session so my brain has been pure garbage for the past couple of days. The joy of working in television. Anyway, let me know if the file is what you were looking for. I had a hard time finding out how to operate the **** program. I love command prompts as long as I know what the hell I'm doing which is not the case here. So just so you know what I did...:

1. Searched for "dsfo", found and downloaded, put .exe file in new folder called "apps" on C
2. Went to command prompts and typed in:

C:\apps\dsfo \\.\PhysicalDrive6 0 51200 F:\drive6

where "PhysicalDrive6" was the damaged drive ID and "F" is a USB flash drive. I based the syntax off of what you wrote in a different thread, so I'm hoping it's accurate. I couldn't get rawcopy to work at first, probably because I screwed up the syntax.

Attached File(s)

•  drive6.7z (554bytes)
  Number of downloads: 2

[jaclaz]

Yep , the command is correct, but the result is far from "good".

The first sector is the MBR (which you already have posted) with all it's code but with no DATA in the partition table.
All the rest are 00's sectors .

Here the A025 I mentioned has disappeared

Questions:

• Is there any chance that that disk was originally partitioned under Vista or 7?
  
• Do you remember how it was partitioned originally? (Like a single NTFS volume, several volumes, which filesystems, etc.?)

jaclaz

[mattiasnyc]

Q1: not really. I've never touched vista in my life, and 7 was just an os i messed sound with on the drive i have up and running now. It would be epic if it wasnt xp.

Q2: i only recall having worked with one partition. I have a system with at least 4 drives normally so my usage is pretty compartmentalized. So i think it was one partition only.

On it was xp x64, and it was fat or ntfs i suppose, but can unfortunately not recall which one.

[jaclaz]

mattiasnyc, on 03 December 2012 - 06:27 AM, said:

Q1: not really. I've never touched vista in my life, and 7 was just an os i messed sound with on the drive i have up and running now. It would be epic if it wasnt xp.

Q2: i only recall having worked with one partition. I have a system with at least 4 drives normally so my usage is pretty compartmentalized. So i think it was one partition only.

On it was xp x64, and it was fat or ntfs i suppose, but can unfortunately not recall which one.

Well, it cannot mathematically be FAT12 or 16 and logically it cannot be FAT32 either, since XP has dumbed down it to 32 Gb max size.
Which leaves us with NTFS.
So, if there was a single NTFS partition (or at least the first partition was NTFS and not very, very small) the $MFT must exist (and exist at a specific address).
This address is in these cases:
786432*8+63=6291456+63=6291519

Try getting Tiny Hexer and open the disk, then go to absolute sector 6291519. (and check a few sectors after it), but if DMDE didn't find anytihing it is really improbable that *something* exists.
http://www.softpedia...iny-hexer.shtml

I am starting to think that *somehow* the original disk has issues that were not solved by the "unbricking".

jaclaz

[mattiasnyc]

thanks, will do.

[mattiasnyc]

Hi, downloaded and installed "tiny hexer". Again, this is an application that is way beyond intuitive for a non-programmer/hacker/whatever.

Could you tell me what to type and where in steps? I don't even know where to start. (or alternatively let me know if there's a quick guide and what its name would be so I could learn the stuff).

[jaclaz]

Tiny hexer is GUI, not command line.
It works more or less like *any* editor, the main difference is that when you operate on a disk or on disk image to avoid using too much memory it loads by default a sector at a time.

• File->Disk->Open Drive
  
• Choose "right" \\.\PhysicalDriven
  
• Press OK
  
• File->Disk->Goto Sector
  
• Replace by typing or pasting the highlighted text "+0x100" with "6291519" (without quotes)
  
• Press OK
  
• Use Shift+F8 to go forward and Shift+F7 to go back (one sector at the time)

What do you see?
All 00's and "dots" or you can read at very beginning of sectors "FILE0" and some text here and there? (like "$.M.F.T.", "$.M.F.T.m.i.r.r.o.r.", etc.)?
Post a screenshot (if it is not all 00's) of sector 6291519 the windows should have a title like >\\.\PhysicalDriven , sector 6291519/xxxxxxxxxxx

Once you are there:

• Edit-> Find/Replace
  
• write (or copy from here) in the "Enter text or hex data to search for" box this: "46494C4530" (without quotes) that is the hex of FILE0, and every two sectors in the $MFT there is an occurrence of "FILE0"
  
• Click on Find button
  
• A new popup will appear asking you to "Search following sector(s)", click on Yes (a few times, for the first few sectors), then press "yes to all", if no hit is found within a few minutes, click on "Cancel"

jaclaz

[mattiasnyc]

All zeroes.....

[jaclaz]

mattiasnyc, on 04 December 2012 - 11:57 AM, said:

All zeroes.....

Hmmm.
I guess you are stuck, then

Without partition data, nor bootsector data, nor $MFT the only thing that may work is file-based recovery, but as said I start to suspect that your drive is either "really" "all 00's or *somehow* it went in some kind of "failure" mode and simply outputs 00ed sectors.

Try again from the start, describe what happened BEFORE you posted here:

mattiasnyc, on 16 August 2012 - 03:54 PM, said:

Found this place, went through steps to get it back.

What symptoms did the drive have, which exact steps you performed, etc., etc.

jaclaz

[mattiasnyc]

Went to boot my computer and it wouldn't go past POST. BIOS couldn't find OS or drive. This was as I mentioned the OS drive and I didn't touch it prior to shutting down. I never initialize drives "willy nilly". The words "initialize", "erase", "format" etc throw up red flags in my brain and I've yet to be dumb enough to clean a drive from data. I'm plenty dumb in other ways to make up for it though.

Then I went to the thread called " The Solution for Seagate 7200.11 HDDs" and went through the instructions and "unbricked" it. The symptoms of my drive conformed to the ones the "unbricking" would potentially solve.

The drive then spun up properly and got detected by the OS. After that I tried absolutely nothing else but instead posted in this thread.

I'm guessing "file based recovery" is some sort of time consuming scan where the software tries to intelligently piece together what binary constitutes a file, and what type of file that would be... Would that be the next step?

Thanks again for your help and patience.

[jaclaz]

mattiasnyc, on 04 December 2012 - 02:37 PM, said:

Went to boot my computer and it wouldn't go past POST. BIOS couldn't find OS or drive. This was as I mentioned the OS drive and I didn't touch it prior to shutting down. I never initialize drives "willy nilly". The words "initialize", "erase", "format" etc throw up red flags in my brain and I've yet to be dumb enough to clean a drive from data. I'm plenty dumb in other ways to make up for it though.

Yes, OK, but were BSY or LBA0 symptoms?

mattiasnyc, on 04 December 2012 - 02:37 PM, said:

Then I went to the thread called " The Solution for Seagate 7200.11 HDDs" and went through the instructions and "unbricked" it. The symptoms of my drive conformed to the ones the "unbricking" would potentially solve.

Which EXACT commands did you send to it in the Hyperterminal (or whatever you used)?

mattiasnyc, on 04 December 2012 - 02:37 PM, said:

The drive then spun up properly and got detected by the OS. After that I tried absolutely nothing else but instead posted in this thread.

Yes, the issue here is that your drive behaves "strangely".
The MBR CODE is there, exactly where it should be, but the data in it have been "00ed". <- this is "queer", usually either the "whole" MBR is there or it has been completely (not just 16 bytes of it) 00ed.
Also, it seems like all the sectors you accessed are all 00's (wiped).
I am suspecting that - for *any* reason - the disk has gone in some kind of "loop" and - besides the MBR - only "provides" the same bunch of 00ed sectors , no matter which sector you try to access.

mattiasnyc, on 04 December 2012 - 02:37 PM, said:

I'm guessing "file based recovery" is some sort of time consuming scan where the software tries to intelligently piece together what binary constitutes a file, and what type of file that would be... Would that be the next step?

Yep, that is the idea, that has a big caveat, though.
Provided that the disk is not all 00's, any file that was contiguous should normally be retrieved without issues, whilst any file that was fragmented will most probably result as either corrupted or "partial".
The "reference" tool is PHOTOREC (the companion of TESTDISK):
http://www.cgsecurit...g/wiki/PhotoRec
(it is not just for photos)

mattiasnyc, on 04 December 2012 - 02:37 PM, said:

Thanks again for your help and patience.

No prob.

Let's try again to see if some data can actually be read on that disk.
Open the disk in Tiny Hexer and search, starting from sector 0 the hex 4D5A90 (which equates to "MZ<nop>", i.e. the header for executable files, one of the most common filetypes on a "system" disk).
If you don't find a hit within (say) first 50000 sectors it is likely that there is the "all 00's issues.
Are you trying to access the "original, unbricked" disk or the clone of it? (can it be, if the latter, that the cloning failed?)

jaclaz