Welcome to MSFN

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.


Sign in to follow this  
Followers 0
themagicone

Trying to get a 7200.11 to work

14 posts in this topic

Alright I have a 7200.11 that went into the BSY state. Followed the wonderful directions listed. It didn't go perfectly smooth - first try was unable to clear smart and I couldn't get the partition rebuild to work. But now I am able to "see" the drive in windows, in drive manager but I can't mount it nor do anything to it. If I try loading Parted Magic boot loader it freezes if the drive is attached. Most drive recovery software causes the drive to "click" and do a sata reset. Now I found a program that so far has been doing a good job at seeing the data. Problem is it can't recover file names so all I get is file000.ext. I've tried re-doing the m0,2,2,0,0,0,0,22 command, it completes in 0 seconds. Doesn't do anything. Now I know I have the data, be it in a poor way, so that I am happy for. Does anyone have any recommendations on rebuilding it so I can access it via Linux or Windows and get file names? It was a EXT3 partition I believe, it was from a Iomega NAS device.

0

Share this post


Link to post
Share on other sites

Alright I have a 7200.11 that went into the BSY state. Followed the wonderful directions listed. It didn't go perfectly smooth - first try was unable to clear smart and I couldn't get the partition rebuild to work. But now I am able to "see" the drive in windows, in drive manager but I can't mount it nor do anything to it. If I try loading Parted Magic boot loader it freezes if the drive is attached. Most drive recovery software causes the drive to "click" and do a sata reset. Now I found a program that so far has been doing a good job at seeing the data. Problem is it can't recover file names so all I get is file000.ext. I've tried re-doing the m0,2,2,0,0,0,0,22 command, it completes in 0 seconds. Doesn't do anything. Now I know I have the data, be it in a poor way, so that I am happy for. Does anyone have any recommendations on rebuilding it so I can access it via Linux or Windows and get file names? It was a EXT3 partition I believe, it was from a Iomega NAS device.

Check (have never tried it on an EXT3) DMDE:

http://softdm.com/

for FAT/NTFS I find it an excellent tool (though not the easiest/most intuitive one around).

In any case BEFORE any attempt you should IMAGE the disk "as is" (possibly twice) with dd or similar.

If you search a bit in this same subforum you will easily find related thread talking of ddrescue/dd_rescue (Linux) or DataRescue DD (Windows).

Once you have the image(s) besides DMDE you may want to try directly TESTDISK, if it is a "simple" partition issue it will likely solve it, otherwise you are back to use "file based" recovery (that most probably - just like PHOTOREC) will have filenames lost :(.

There are post-processing tools for PHOTOREC output that help identify/verify (at least) the filetype and thus give the "right " extension, but the filename will be still lost.

If you are familiar with Linux there may be other tools for fixing/repairing an EXT 2 or 3 filesystem. :unsure:

You also may want to have a go with this one (this should be the "simpler" to use - if the kind of damage is not too seious):

http://www.diskinternals.com/linux-recovery/

jaclaz

0

Share this post


Link to post
Share on other sites

Thanks. I'm trying Diskinternals. I couldn't let it search for partitions as it just caused the "click" and SATA reset error. Currently it has found 300k files plus folders. Tried running TESTDISK but was taking forever, 1 hour to go 1%. I have patience but not 4 days worth. I really think everything data wise is fine, just the MBR/Partition table is destroyed. Not sure how to restore it.

0

Share this post


Link to post
Share on other sites

Tried running TESTDISK but was taking forever, 1 hour to go 1%. I have patience but not 4 days worth.

Well, you need another (much, much bigger) supply of patience.

If the drive "clicks" it means that it went beserk (as it's most common now) because of some "serious" error.

Attempting direct recovery from that device (i.e. as opposed to "from a copy/image") is a big risk and often, even if the "fix" worked the disk is NOT in a good state and access to it may be painfully slow and/or the presence of "bad sectors" or mis-mapping may be the cause of the slowness.

As said he advice is to image the disk (slowly or as slowly as the disk requires) and then work (quickly) on the image.

I really think everything data wise is fine, just the MBR/Partition table is destroyed. Not sure how to restore it.

Well this is an assumption :ph34r: (in this case not supported by any evidence), if just the MBR and/or Partition table were corrupted, you would have no clicks and TESTDISK would have taken no more than a few minutes (unless a deep search would have become necessary).

jaclaz

0

Share this post


Link to post
Share on other sites

I let diskinternals run all night and it found everything but missing file names. Started running DataRescue for an image but all I get is read errors/CRC.

0

Share this post


Link to post
Share on other sites

I let diskinternals run all night and it found everything but missing file names. Started running DataRescue for an image but all I get is read errors/CRC.

Yep, which may also mean that what was recovered by the diskinternals run is simply "garbage" (or it may mean that having running the diskinternals tool on the original disk made it unreadable, due to overheating, simple wear and what not.

Try fully recovering (from the ones obtained by using the diskinternals tool) a few files that do have some metadata including filename.

MS Word .doc files - as an example - do store inside the file the name under which they were last saved, see:

http://www.forensicfocus.com/Forums/viewtopic/t=9729/

It is also possible that DatarescueDD has some issues with the disk controller or with the environment you are running it in.

A "second opinion" (and a third, fourth, etc.) with other imaging tools is then needed.

You can also try to "image in sections" attempting both "forward" and "reverse" direction, see:

http://reboot.pro/topic/15040-data-recovery-off-clicking-disk/

http://reboot.pro/topic/15040-data-recovery-off-clicking-disk/?p=133567

jaclaz

0

Share this post


Link to post
Share on other sites

Thanks. The files disk internal recovered were openable in word, etc. Everything seemed intact. The meta data info is good. I'm doing this for a non-profit that does not have any money or insurance for a pro data recovery service. I completely understand I could be doing more harm that good. Once I get all files onto the new drive, be it missing files names and directories, I am going to try DataRescue again for an image.

0

Share this post


Link to post
Share on other sites

Ran TESTDISK overnight on deepscan. Found only 1 partition, wrote that and that didn't work. Disk is still showing as three partition but 2 say unallocated space. Ran a few more recovery programs but still unable to recover any file names. This drive was from a IOMEGA NAS device and research has told me it was a linux partition. I am not sure how Linux stores files names. There is only a few bad sectors on the drive, may be that is where that info was stored? I am not sure. I know if I try to put the drive back into the NAS device, it just causes the click problem. Still can't load a linux thumb drive with the drive attached, it causes it to freeze.

0

Share this post


Link to post
Share on other sites

I got the drive repaired to the point it is easily read. Found out the data was stored on a XFS partition. Tried xfs_repair, tried ufs explorer, nothing. Photorec gets me everything but a few missing files less the file names. I am not sure why I can't repair the xfs partition.

0

Share this post


Link to post
Share on other sites

Share this post


Link to post
Share on other sites

I have been doing this in linux. Repaired most of the drive. Files still have no names. Moving to another linux build to try some heavy duty tools. I am determined!

0

Share this post


Link to post
Share on other sites

Files still have no names... Whew!

I found some "conceptual" information on XFS at the following -

http://csweb.cs.wfu.edu/~torgerse/Kokua/SGI/007-2825-012/sgi_html/ch03.html

http://csweb.cs.wfu.edu/~torgerse/Kokua/SGI/007-2825-012/sgi_html/ch05.html

http://linux-xfs.sgi.com/projects/xfs/papers/xfs_white/xfs_white_paper.html

http://oss.sgi.com/projects/xfs/papers/xfs_filesystem_structure.pdf

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.