[themagicone]

Alright I have a 7200.11 that went into the BSY state. Followed the wonderful directions listed. It didn't go perfectly smooth - first try was unable to clear smart and I couldn't get the partition rebuild to work. But now I am able to "see" the drive in windows, in drive manager but I can't mount it nor do anything to it. If I try loading Parted Magic boot loader it freezes if the drive is attached. Most drive recovery software causes the drive to "click" and do a sata reset. Now I found a program that so far has been doing a good job at seeing the data. Problem is it can't recover file names so all I get is file000.ext. I've tried re-doing the m0,2,2,0,0,0,0,22 command, it completes in 0 seconds. Doesn't do anything. Now I know I have the data, be it in a poor way, so that I am happy for. Does anyone have any recommendations on rebuilding it so I can access it via Linux or Windows and get file names? It was a EXT3 partition I believe, it was from a Iomega NAS device.

[jaclaz]

themagicone, on 19 January 2013 - 02:42 PM, said:

Alright I have a 7200.11 that went into the BSY state. Followed the wonderful directions listed. It didn't go perfectly smooth - first try was unable to clear smart and I couldn't get the partition rebuild to work. But now I am able to "see" the drive in windows, in drive manager but I can't mount it nor do anything to it. If I try loading Parted Magic boot loader it freezes if the drive is attached. Most drive recovery software causes the drive to "click" and do a sata reset. Now I found a program that so far has been doing a good job at seeing the data. Problem is it can't recover file names so all I get is file000.ext. I've tried re-doing the m0,2,2,0,0,0,0,22 command, it completes in 0 seconds. Doesn't do anything. Now I know I have the data, be it in a poor way, so that I am happy for. Does anyone have any recommendations on rebuilding it so I can access it via Linux or Windows and get file names? It was a EXT3 partition I believe, it was from a Iomega NAS device.

Check (have never tried it on an EXT3) DMDE:
http://softdm.com/
for FAT/NTFS I find it an excellent tool (though not the easiest/most intuitive one around).

In any case BEFORE any attempt you should IMAGE the disk "as is" (possibly twice) with dd or similar.

If you search a bit in this same subforum you will easily find related thread talking of ddrescue/dd_rescue (Linux) or DataRescue DD (Windows).

Once you have the image(s) besides DMDE you may want to try directly TESTDISK, if it is a "simple" partition issue it will likely solve it, otherwise you are back to use "file based" recovery (that most probably - just like PHOTOREC) will have filenames lost .
There are post-processing tools for PHOTOREC output that help identify/verify (at least) the filetype and thus give the "right " extension, but the filename will be still lost.
If you are familiar with Linux there may be other tools for fixing/repairing an EXT 2 or 3 filesystem.

You also may want to have a go with this one (this should be the "simpler" to use - if the kind of damage is not too seious):
http://www.diskinter...linux-recovery/

jaclaz

[themagicone]

Thanks. I'm trying Diskinternals. I couldn't let it search for partitions as it just caused the "click" and SATA reset error. Currently it has found 300k files plus folders. Tried running TESTDISK but was taking forever, 1 hour to go 1%. I have patience but not 4 days worth. I really think everything data wise is fine, just the MBR/Partition table is destroyed. Not sure how to restore it.

[jaclaz]

themagicone, on 19 January 2013 - 04:56 PM, said:

Tried running TESTDISK but was taking forever, 1 hour to go 1%. I have patience but not 4 days worth.

Well, you need another (much, much bigger) supply of patience.
If the drive "clicks" it means that it went beserk (as it's most common now) because of some "serious" error.
Attempting direct recovery from that device (i.e. as opposed to "from a copy/image") is a big risk and often, even if the "fix" worked the disk is NOT in a good state and access to it may be painfully slow and/or the presence of "bad sectors" or mis-mapping may be the cause of the slowness.
As said he advice is to image the disk (slowly or as slowly as the disk requires) and then work (quickly) on the image.

themagicone, on 19 January 2013 - 04:56 PM, said:

I really think everything data wise is fine, just the MBR/Partition table is destroyed. Not sure how to restore it.

Well this is an assumption (in this case not supported by any evidence), if just the MBR and/or Partition table were corrupted, you would have no clicks and TESTDISK would have taken no more than a few minutes (unless a deep search would have become necessary).

jaclaz

[themagicone]

I let diskinternals run all night and it found everything but missing file names. Started running DataRescue for an image but all I get is read errors/CRC.

[jaclaz]

themagicone, on 20 January 2013 - 08:23 AM, said:

I let diskinternals run all night and it found everything but missing file names. Started running DataRescue for an image but all I get is read errors/CRC.

Yep, which may also mean that what was recovered by the diskinternals run is simply "garbage" (or it may mean that having running the diskinternals tool on the original disk made it unreadable, due to overheating, simple wear and what not.

Try fully recovering (from the ones obtained by using the diskinternals tool) a few files that do have some metadata including filename.
MS Word .doc files - as an example - do store inside the file the name under which they were last saved, see:
http://www.forensicf...ewtopic/t=9729/

It is also possible that DatarescueDD has some issues with the disk controller or with the environment you are running it in.
A "second opinion" (and a third, fourth, etc.) with other imaging tools is then needed.
You can also try to "image in sections" attempting both "forward" and "reverse" direction, see:
http://reboot.pro/to...-clicking-disk/
http://reboot.pro/to...-disk/?p=133567

jaclaz

[themagicone]

Thanks. The files disk internal recovered were openable in word, etc. Everything seemed intact. The meta data info is good. I'm doing this for a non-profit that does not have any money or insurance for a pro data recovery service. I completely understand I could be doing more harm that good. Once I get all files onto the new drive, be it missing files names and directories, I am going to try DataRescue again for an image.

[jaclaz]

Maybe something like this:
http://www3.telus.ne...rank/index.html
could be of use.
It seemingly has file-renaming capabilities based on metadata, at least for most common files.

jaclaz

[themagicone]

Ran TESTDISK overnight on deepscan. Found only 1 partition, wrote that and that didn't work. Disk is still showing as three partition but 2 say unallocated space. Ran a few more recovery programs but still unable to recover any file names. This drive was from a IOMEGA NAS device and research has told me it was a linux partition. I am not sure how Linux stores files names. There is only a few bad sectors on the drive, may be that is where that info was stored? I am not sure. I know if I try to put the drive back into the NAS device, it just causes the click problem. Still can't load a linux thumb drive with the drive attached, it causes it to freeze.

[themagicone]

I got the drive repaired to the point it is easily read. Found out the data was stored on a XFS partition. Tried xfs_repair, tried ufs explorer, nothing. Photorec gets me everything but a few missing files less the file names. I am not sure why I can't repair the xfs partition.

[jaclaz]

themagicone, on 23 January 2013 - 07:57 AM, said:

Tried xfs_repair

Hmmm, queer.
I thought that XFS had non-that-bad recovery capabilities.
Have you gone through:
http://xfs.org/index.php/XFS_FAQ
Particularly:
http://xfs.org/index...e_capability.3F


What happens running xfs_check?

jaclaz

[submix8c]

http://en.wikipedia.org/wiki/XFS

http://www.ehow.com/...-partition.html
http://blog.perrygeo...n-from-windows/
http://www.overclock...ad.php?t=587134

Shouldn't you be doing this under Linux? Or a Windows Guest on a Linux Host?

edit - more info -
http://www.linuxjour...om/article/9449

How are you "accessing" it under Windows?

This post has been edited by submix8c: 23 January 2013 - 10:36 AM

[themagicone]

I have been doing this in linux. Repaired most of the drive. Files still have no names. Moving to another linux build to try some heavy duty tools. I am determined!

[submix8c]

Files still have no names... Whew!

I found some "conceptual" information on XFS at the following -
http://csweb.cs.wfu...._html/ch03.html
http://csweb.cs.wfu...._html/ch05.html
http://linux-xfs.sgi...hite_paper.html

http://oss.sgi.com/projects/xfs/papers/xfs_filesystem_structure.pdf