Hard drive turned raw.. file system got corrupted.. urgent help

**hellman** · 29.06.12, 11:20

it says format to use hard drive to use it
last night when i went to sleep it was fine.. next morning i wake up then thhis happened
its 2 tb with a power adapter seagate..

is there any way to fix filesysytem without formatting?
getback for ntfs finished search within 3 minutes n showed 3 gb of data

get back for fat is still runung from past 1 hour and its still 1 %
says directory 0 starts,2 conts, 168778 possible
files identified 1117 starts, 0 usrdef

is my data gone? i don't care about stupid drive... i care about data ,my pics.... 1.4 tb was full
anon my friend your nightmare became my reality...

waiting for master rzor to jump in

**gu5t3r** · 29.06.12, 12:10

There is no point in running GetDataBack for NTFS and FAT. Either you had NTFS filesystem or FAT filesystem.
Try also TestDisk (TestDisk - CGSecurity). I remember few years ago that this tool worked better for me than GetDataBack.

Maybe you partition table somehow got erased, it happened to me few days ago...
Try to restore partition table with TestDisk, it workd fine for me.

The last thing I can think of are bad sectors, for that try running HDD Regenerator.

**anon** · 29.06.12, 14:32

Remember WinHex? It could also help here.

Just remember rule no. 0 of data recovery - don't write anything to the disk you want to recover from.

**cirulilu** · 29.06.12, 16:02

it could be problem with the files system. try this tool Partition Find and Mount — free partition recovery software. it helped me once in recovering files from usb flash. it should find the partition on the hard drive, mount it as a new drive and you could make backup of the files.
after that format the drive and restore the files.

**Master Razor** · 29.06.12, 21:20

waiting for master rzor to jump in

I'm flattered. Thanks for the confidence.

Well, it could be anything but most frequently is a thing called overlapping. One partition exceeds its borders, coming into another partition which comes into another and so on, breaking the table.
Now, for the partition table to be 'validated' the bios checks for a specific number of bytes at the end of the MBR. Those are 55 AA.
You could use any hex program to load the entire contents of the disk and search for the above at the end of sector 0 (MBR is stored only there).

Code:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

This is the end of the mbr. If it's not there then that's one of the possibilities.

Your partition entry (1st) will start at 1be meaning byte 446 (the start of the partition table). Meaning row 1b0 in column 0E. It will be easy to stop as this will start with number "80" for bootable.

Mine looks like this

Code:

80 2D 18 00 07 88

Check these and see if they exist. If not, will try to remake them.

If you prefer an alternative approach you could try TestDisk with these options:
Expert mode: Yes
Cylinder boundary : No
Allow partial last cylinder : Yes

And I would advise you make a raw copy of that disk BEFORE USING ANYTHING ELSE using a program like CloneZilla (bootable linux live cd). It will clone as-is so that if you make a mistake you can restore the original.

**cheetah** · 29.06.12, 23:26

first of all try mounting the device using a ubuntu live cdor another linux. usually this will give you access to your files. if this doesn't work, try the above tips :)

**hellman** · 30.06.12, 18:33

Originally Posted by Master Razor

Well, it could be anything but most frequently is a thing called overlapping. One partition exceeds its borders, coming into another partition which comes into another and so on, breaking the table.
Now, for the partition table to be 'validated' the bios checks for a specific number of bytes at the end of the MBR. Those are 55 AA.
You could use any hex program to load the entire contents of the disk and search for the above at the end of sector 0 (MBR is stored only there).

Code:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

This is the end of the mbr. If it's not there then that's one of the possibilities.

Your partition entry (1st) will start at 1be meaning byte 446 (the start of the partition table). Meaning row 1b0 in column 0E. It will be easy to stop as this will start with number "80" for bootable.

Mine looks like this

Code:

80 2D 18 00 07 88

Check these and see if they exist. If not, will try to remake them.

i did'nt understood much by this
but i opened it in winhex n here's the snapshot

Originally Posted by Master Razor

If you prefer an alternative approach you could try TestDisk with these options:
Expert mode: Yes
Cylinder boundary : No
Allow partial last cylinder : Yes

And I would advise you make a raw copy of that disk BEFORE USING ANYTHING ELSE using a program like CloneZilla (bootable linux live cd). It will clone as-is so that if you make a mistake you can restore the original.

where would i make back up of 1.3 tb ..

will collect money ..will take a month or two.. i spend everything last in last 2 weeks ..i went up in mountains on tour with friends

clonezilla will make back up right?
what's up with linuxboot live cd?u mean i should install ubuntu n then try plugging the hdd?

and test disk will fix my filesystem without messing my data?

m scared for my pics n music videos man... 700 gb of music videos dammit

---------- Post added at 17:33 ---------- Previous post was at 17:31 ----------

Originally Posted by gu5t3r

There is no point in running GetDataBack for NTFS and FAT. Either you had NTFS filesystem or FAT filesystem.
Try also TestDisk (TestDisk - CGSecurity). I remember few years ago that this tool worked better for me than GetDataBack.

Maybe you partition table somehow got erased, it happened to me few days ago...
Try to restore partition table with TestDisk, it workd fine for me.

The last thing I can think of are bad sectors, for that try running HDD Regenerator.

thnx for d reply .. will lok into it

Originally Posted by anon

Remember WinHex?

for some reason its just showing me only the hex codes nothing else

**Master Razor** · 30.06.12, 19:26

i did'nt understood much by this

It's very simple. In your image you have:
1. boot indicator (0D)
2. beginning head, sector and cylinder (0A,42,4F)
3. system indicator (which is the filesystem) (4F)
4. ending head, cilinder and sector (54,4D,47)
5. starting sector (52,20,69,73)
6. size of partition (20,63,6F,6D)

In the parentheses you have your values.

In red I marked possible errors as folows:

1. boot indicator is the byte that tells the bios if the partition is active or not. To be a valid partition it should contain 80 (for active) or 00 (for a non-os partition. example: for data storage)
2. system indicator is the filesystem type. If you would of had NTFS it should of been 07. As you can see in the partition types

Strange that the filesystem ID is a duplicate of the last value.
Probably this was done by a program or by some HDD errors. Could be a bad block that was swapped with a fresh block but the data on it was lost. Thus the duplicate appeared. Just a theory...

My guess is that if you'll change the system indicator from 4F to 07 it will work as usual.

what's up with linuxboot live cd?u mean i should install ubuntu n then try plugging the hdd?

No. I meant CloneZilla is a linux based live cd. It will make a backup of your partition AS-IS (including any problems on it).

for some reason its just showing me only the hex codes nothing else

It's a hex editor. Should it show anything else than hex values?

and test disk will fix my filesystem without messing my data?

TestDisk does exactly the same thing we're doing manually: correcting the mbr by editing its hex values. No one can guarantee that a program, any program will work without any consequences. That is why the standard answer always is: BACKUP YOUR DATA FIRST.
Everything is based on trial and error. Even for the smartest IT pro alive.

**hellman** · 30.06.12, 19:59

Originally Posted by Master Razor

It's very simple. In your image you have:
1. boot indicator (0D)
2. beginning head, sector and cylinder (0A,42,4F)
3. system indicator (which is the filesystem) (4F)
4. ending head, cilinder and sector (54,4D,47)
5. starting sector (52,20,69,73)
6. size of partition (20,63,6F,6D)

In the parentheses you have your values.

In red I marked possible errors as folows:

1. boot indicator is the byte that tells the bios if the partition is active or not. To be a valid partition it should contain 80 (for active) or 00 (for a non-os partition. example: for data storage)
2. system indicator is the filesystem type. If you would of had NTFS it should of been 07. As you can see in the partition types

Strange that the filesystem ID is a duplicate of the last value.
Probably this was done by a program or by some HDD errors. Could be a bad block that was swapped with a fresh block but the data on it was lost. Thus the duplicate appeared. Just a theory...

My guess is that if you'll change the system indicator from 4F to 07 it will work as usual.

No. I meant CloneZilla is a linux based live cd. It will make a backup of your partition AS-IS (including any problems on it).

It's a hex editor. Should it show anything else than hex values?

TestDisk does exactly the same thing we're doing manually: correcting the mbr by editing its hex values. No one can guarantee that a program, any program will work without any consequences. That is why the standard answer always is: BACKUP YOUR DATA FIRST.
Everything is based on trial and error. Even for the smartest IT pro alive.

ok i have decided to wait 1 month and collect money.. some from my sis n buY new 2 tb hard drive,,

last thing razor do u think my data is alive in there? :FEAR:

THEN i'll experiment

**Master Razor** · 30.06.12, 21:46

last thing razor do u think my data is alive in there? :FEAR:

Yes. High probability your data is safe and sound.
Your HDD is not failing so there's no reason to replace it (if that's your intention).

**Master Razor** · 01.07.12, 14:40

Hellman: Could please make another screenshot? This time do it as Open Disk - Physical Media - Drive x .
What you showed is the partition entry itself.

**hellman** · 01.07.12, 16:11

Originally Posted by Master Razor

Yes. High probability your data is safe and sound.
Your HDD is not failing so there's no reason to replace it (if that's your intention)
Could please make another screenshot? This time do it as Open Disk - Physical Media - Drive x .
What you showed is the partition entry itself. .

thnk god.. i got scared coz getback for ntfs failed.. it showed 3 gb data only
my intension is just to recover data not to replace it .. i don't even care about the drive seriously... i'm getting new drive to back up raw data via clonezilla

i think u demanded this right

**Master Razor** · 01.07.12, 17:14

Thanks for screenshot but it is not complete. For future reference, it should end with a line (similar to your first screenshot). The lines indicates the end of the sector.
1. Open Disk - Physical Media - Drive x
2. Edit -> Copy Sector -> Editor Display

Paste the data here.

Off topic: what is it with you guys and external drives? They seem to fail for no reason...

**hellman** · 01.07.12, 20:55

Originally Posted by Master Razor

Thanks for screenshot but it is not complete. For future reference, it should end with a line (similar to your first screenshot). The lines indicates the end of the sector.
1. Open Disk - Physical Media - Drive x
2. Edit -> Copy Sector -> Editor Display

Paste the data here.

sorry my bad
here it is

Code:

Offset       0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000000000   33 C0 8E D0 BC 00 7C 8E  C0 8E D8 BE 00 7C BF 00   3ÀŽÐ¼.|ŽÀŽØ¾.|¿.
000000010   06 B9 00 02 FC F3 A4 50  68 1C 06 CB FB B9 04 00   .¹..üó¤Ph..Ëû¹..
000000020   BD BE 07 80 7E 00 00 7C  0B 0F 85 0E 01 83 C5 10   ½¾.€~..|..…..ƒÅ.
000000030   E2 F1 CD 18 88 56 00 55  C6 46 11 05 C6 46 10 00   âñÍ.ˆV.UÆF..ÆF..
000000040   B4 41 BB AA 55 CD 13 5D  72 0F 81 FB 55 AA 75 09   ´A»ªUÍ.]r..ûUªu.
000000050   F7 C1 01 00 74 03 FE 46  10 66 60 80 7E 10 00 74   ÷Á..t.þF.f`€~..t
000000060   26 66 68 00 00 00 00 66  FF 76 08 68 00 00 68 00   &fh....fÿv.h..h.
000000070   7C 68 01 00 68 10 00 B4  42 8A 56 00 8B F4 CD 13   |h..h..´BŠV.‹ôÍ.
000000080   9F 83 C4 10 9E EB 14 B8  01 02 BB 00 7C 8A 56 00   ŸƒÄ.žë.¸..».|ŠV.
000000090   8A 76 01 8A 4E 02 8A 6E  03 CD 13 66 61 73 1C FE   Šv.ŠN.Šn.Í.fas.þ
0000000A0   4E 11 75 0C 80 7E 00 80  0F 84 8A 00 B2 80 EB 84   N.u.€~.€.„Š.²€ë„
0000000B0   55 32 E4 8A 56 00 CD 13  5D EB 9E 81 3E FE 7D 55   U2äŠV.Í.]ëž.>þ}U
0000000C0   AA 75 6E FF 76 00 E8 8D  00 75 17 FA B0 D1 E6 64   ªunÿv.è..u.ú°Ñæd
0000000D0   E8 83 00 B0 DF E6 60 E8  7C 00 B0 FF E6 64 E8 75   èƒ.°ßæ`è|.°ÿædèu
0000000E0   00 FB B8 00 BB CD 1A 66  23 C0 75 3B 66 81 FB 54   .û¸.»Í.f#Àu;f.ûT
0000000F0   43 50 41 75 32 81 F9 02  01 72 2C 66 68 07 BB 00   CPAu2.ù..r,fh.».
000000100   00 66 68 00 02 00 00 66  68 08 00 00 00 66 53 66   .fh....fh....fSf
000000110   53 66 55 66 68 00 00 00  00 66 68 00 7C 00 00 66   SfUfh....fh.|..f
000000120   61 68 00 00 07 CD 1A 5A  32 F6 EA 00 7C 00 00 CD   ah...Í.Z2öê.|..Í
000000130   18 A0 B7 07 EB 08 A0 B6  07 EB 03 A0 B5 07 32 E4   .*·.ë.*¶.ë.*µ.2ä
000000140   05 00 07 8B F0 AC 3C 00  74 09 BB 07 00 B4 0E CD   ...‹ð¬<.t.»..´.Í
000000150   10 EB F2 F4 EB FD 2B C9  E4 64 EB 00 24 02 E0 F8   .ëòôëý+Éädë.$.àø
000000160   24 02 C3 49 6E 76 61 6C  69 64 20 70 61 72 74 69   $.ÃInvalid parti
000000170   74 69 6F 6E 20 74 61 62  6C 65 00 45 72 72 6F 72   tion table.Error
000000180   20 6C 6F 61 64 69 6E 67  20 6F 70 65 72 61 74 69    loading operati
000000190   6E 67 20 73 79 73 74 65  6D 00 4D 69 73 73 69 6E   ng system.Missin
0000001A0   67 20 6F 70 65 72 61 74  69 6E 67 20 73 79 73 74   g operating syst
0000001B0   65 6D 00 00 00 63 7B 9A  5E 29 B9 4A 00 00 80 20   em...c{š^)¹J..€ 
0000001C0   21 00 07 FE FF FF 00 08  00 00 00 78 E0 E8 00 00   !..þÿÿ.....xàè..
0000001D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............Uª

here snapshot too

Originally Posted by Master Razor

what is it with you guys and external drives? They seem to fail for no reason..

its not that we mess up with it or we're complete noobs .... its just pure bad luck in my case

**Master Razor** · 09.07.12, 18:14

If you haven't backed up the drive folow below:
Download Parted Magic

Run: Go to: Extras Menu -> Clonezilla
Select:

Device-to-Image ->
local-dev -> *See if you can locate your usb drive here. If not, go back and select usb.
select the drive to hold the result ->
select the folder to hold the image ->
select Expert ->
select savedisk ->
select ntfsclone > partimage ->
select -c -j2 -ntfs-ok
select -z0 for the fastest backup
confirm choice (entr y) ->

The entire procedure will take 2 ~ 3 hours if we don't use compression at all. Maybe more. depends on the speed of the drive and how filled is it.