Hard drive turned raw.. file system got corrupted.. urgent help

Printable View

Show 40 post(s) from this thread on one page

29.06.12, 11:20
hellman

Hard drive turned raw.. file system got corrupted.. urgent help

it says format to use hard drive to use it
last night when i went to sleep it was fine.. next morning i wake up then thhis happened
its 2 tb with a power adapter seagate..

is there any way to fix filesysytem without formatting?
getback for ntfs finished search within 3 minutes n showed 3 gb of data

get back for fat is still runung from past 1 hour and its still 1 %
says directory 0 starts,2 conts, 168778 possible
files identified 1117 starts, 0 usrdef

is my data gone? i don't care about stupid drive... i care about data ,my pics.... 1.4 tb was full
anon my friend your nightmare became my reality... :cry:

waiting for master rzor to jump in
29.06.12, 12:10
gu5t3r

There is no point in running GetDataBack for NTFS and FAT. Either you had NTFS filesystem or FAT filesystem.
Try also TestDisk (TestDisk - CGSecurity). I remember few years ago that this tool worked better for me than GetDataBack.

Maybe you partition table somehow got erased, it happened to me few days ago...
Try to restore partition table with TestDisk, it workd fine for me.

The last thing I can think of are bad sectors, for that try running HDD Regenerator.
29.06.12, 14:32
anon

Remember WinHex? It could also help here.

Just remember rule no. 0 of data recovery - don't write anything to the disk you want to recover from.
29.06.12, 16:02
cirulilu

it could be problem with the files system. try this tool Partition Find and Mount — free partition recovery software. it helped me once in recovering files from usb flash. it should find the partition on the hard drive, mount it as a new drive and you could make backup of the files.
after that format the drive and restore the files.
29.06.12, 21:20
Master Razor

Quote:

waiting for master rzor to jump in

I'm flattered. Thanks for the confidence.

Well, it could be anything but most frequently is a thing called overlapping. One partition exceeds its borders, coming into another partition which comes into another and so on, breaking the table.
Now, for the partition table to be 'validated' the bios checks for a specific number of bytes at the end of the MBR. Those are 55 AA.
You could use any hex program to load the entire contents of the disk and search for the above at the end of sector 0 (MBR is stored only there).

Code:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

This is the end of the mbr. If it's not there then that's one of the possibilities.

Your partition entry (1st) will start at 1be meaning byte 446 (the start of the partition table). Meaning row 1b0 in column 0E. It will be easy to stop as this will start with number "80" for bootable.

Mine looks like this

Code:

80 2D 18 00 07 88

Check these and see if they exist. If not, will try to remake them.

If you prefer an alternative approach you could try TestDisk with these options:
Expert mode: Yes
Cylinder boundary : No
Allow partial last cylinder : Yes

And I would advise you make a raw copy of that disk BEFORE USING ANYTHING ELSE using a program like CloneZilla (bootable linux live cd). It will clone as-is so that if you make a mistake you can restore the original.
29.06.12, 23:26
cheetah

first of all try mounting the device using a ubuntu live cdor another linux. usually this will give you access to your files. if this doesn't work, try the above tips :)
30.06.12, 18:33
hellman

Quote:

Originally Posted by Master Razor

Well, it could be anything but most frequently is a thing called overlapping. One partition exceeds its borders, coming into another partition which comes into another and so on, breaking the table.
Now, for the partition table to be 'validated' the bios checks for a specific number of bytes at the end of the MBR. Those are 55 AA.
You could use any hex program to load the entire contents of the disk and search for the above at the end of sector 0 (MBR is stored only there).

Code:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

This is the end of the mbr. If it's not there then that's one of the possibilities.

Your partition entry (1st) will start at 1be meaning byte 446 (the start of the partition table). Meaning row 1b0 in column 0E. It will be easy to stop as this will start with number "80" for bootable.

Mine looks like this

Code:

80 2D 18 00 07 88

Check these and see if they exist. If not, will try to remake them.

i did'nt understood much by this
but i opened it in winhex n here's the snapshot
http://i847.photobucket.com/albums/a...h/Untitled.jpg

Quote:

Originally Posted by Master Razor

If you prefer an alternative approach you could try TestDisk with these options:
Expert mode: Yes
Cylinder boundary : No
Allow partial last cylinder : Yes

And I would advise you make a raw copy of that disk BEFORE USING ANYTHING ELSE using a program like CloneZilla (bootable linux live cd). It will clone as-is so that if you make a mistake you can restore the original.

where would i make back up of 1.3 tb .. :dabs:
will collect money ..will take a month or two.. i spend everything last in last 2 weeks ..i went up in mountains on tour with friends :dabs:
clonezilla will make back up right?
what's up with linuxboot live cd?u mean i should install ubuntu n then try plugging the hdd?

and test disk will fix my filesystem without messing my data?

m scared for my pics n music videos man... 700 gb of music videos dammit

---------- Post added at 17:33 ---------- Previous post was at 17:31 ----------

Quote:

Originally Posted by gu5t3r

There is no point in running GetDataBack for NTFS and FAT. Either you had NTFS filesystem or FAT filesystem.
Try also TestDisk (TestDisk - CGSecurity). I remember few years ago that this tool worked better for me than GetDataBack.

Maybe you partition table somehow got erased, it happened to me few days ago...
Try to restore partition table with TestDisk, it workd fine for me.

The last thing I can think of are bad sectors, for that try running HDD Regenerator.

thnx for d reply .. will lok into it

Quote:

Originally Posted by anon

Remember WinHex?

for some reason its just showing me only the hex codes nothing else
30.06.12, 19:26
Master Razor

Quote:

i did'nt understood much by this

It's very simple. In your image you have:
1. boot indicator (0D)
2. beginning head, sector and cylinder (0A,42,4F)
3. system indicator (which is the filesystem) (4F)
4. ending head, cilinder and sector (54,4D,47)
5. starting sector (52,20,69,73)
6. size of partition (20,63,6F,6D)

In the parentheses you have your values.

In red I marked possible errors as folows:

1. boot indicator is the byte that tells the bios if the partition is active or not. To be a valid partition it should contain 80 (for active) or 00 (for a non-os partition. example: for data storage)
2. system indicator is the filesystem type. If you would of had NTFS it should of been 07. As you can see in the partition types

Strange that the filesystem ID is a duplicate of the last value.
Probably this was done by a program or by some HDD errors. Could be a bad block that was swapped with a fresh block but the data on it was lost. Thus the duplicate appeared. Just a theory...

My guess is that if you'll change the system indicator from 4F to 07 it will work as usual.

Quote:

what's up with linuxboot live cd?u mean i should install ubuntu n then try plugging the hdd?

No. I meant CloneZilla is a linux based live cd. It will make a backup of your partition AS-IS (including any problems on it).

Quote:

for some reason its just showing me only the hex codes nothing else

It's a hex editor. Should it show anything else than hex values?

Quote:

and test disk will fix my filesystem without messing my data?

TestDisk does exactly the same thing we're doing manually: correcting the mbr by editing its hex values. No one can guarantee that a program, any program will work without any consequences. That is why the standard answer always is: BACKUP YOUR DATA FIRST.
Everything is based on trial and error. Even for the smartest IT pro alive.
30.06.12, 19:59
hellman

Quote:

Originally Posted by Master Razor

It's very simple. In your image you have:
1. boot indicator (0D)
2. beginning head, sector and cylinder (0A,42,4F)
3. system indicator (which is the filesystem) (4F)
4. ending head, cilinder and sector (54,4D,47)
5. starting sector (52,20,69,73)
6. size of partition (20,63,6F,6D)

In the parentheses you have your values.

In red I marked possible errors as folows:

1. boot indicator is the byte that tells the bios if the partition is active or not. To be a valid partition it should contain 80 (for active) or 00 (for a non-os partition. example: for data storage)
2. system indicator is the filesystem type. If you would of had NTFS it should of been 07. As you can see in the partition types

Strange that the filesystem ID is a duplicate of the last value.
Probably this was done by a program or by some HDD errors. Could be a bad block that was swapped with a fresh block but the data on it was lost. Thus the duplicate appeared. Just a theory...

My guess is that if you'll change the system indicator from 4F to 07 it will work as usual.

No. I meant CloneZilla is a linux based live cd. It will make a backup of your partition AS-IS (including any problems on it).

It's a hex editor. Should it show anything else than hex values?

TestDisk does exactly the same thing we're doing manually: correcting the mbr by editing its hex values. No one can guarantee that a program, any program will work without any consequences. That is why the standard answer always is: BACKUP YOUR DATA FIRST.
Everything is based on trial and error. Even for the smartest IT pro alive.

ok i have decided to wait 1 month and collect money.. some from my sis n buY new 2 tb hard drive,,

last thing razor do u think my data is alive in there? :FEAR:

THEN i'll experiment
30.06.12, 21:46
Master Razor

Quote:

last thing razor do u think my data is alive in there? :FEAR:

Yes. High probability your data is safe and sound.
Your HDD is not failing so there's no reason to replace it (if that's your intention).
01.07.12, 14:40
Master Razor

Hellman: Could please make another screenshot? This time do it as Open Disk - Physical Media - Drive x .
What you showed is the partition entry itself.
01.07.12, 16:11
hellman

Quote:

Originally Posted by Master Razor

Yes. High probability your data is safe and sound.
Your HDD is not failing so there's no reason to replace it (if that's your intention)
Could please make another screenshot? This time do it as Open Disk - Physical Media - Drive x .
What you showed is the partition entry itself. .

thnk god.. i got scared coz getback for ntfs failed.. it showed 3 gb data only
my intension is just to recover data not to replace it .. i don't even care about the drive seriously... i'm getting new drive to back up raw data via clonezilla

i think u demanded this right
http://i847.photobucket.com/albums/a.../Untitled2.jpg
01.07.12, 17:14
Master Razor

Thanks for screenshot but it is not complete. For future reference, it should end with a line (similar to your first screenshot). The lines indicates the end of the sector.
1. Open Disk - Physical Media - Drive x
2. Edit -> Copy Sector -> Editor Display

Paste the data here.

Off topic: what is it with you guys and external drives? They seem to fail for no reason...
01.07.12, 20:55
hellman

Quote:

Originally Posted by Master Razor

Thanks for screenshot but it is not complete. For future reference, it should end with a line (similar to your first screenshot). The lines indicates the end of the sector.
1. Open Disk - Physical Media - Drive x
2. Edit -> Copy Sector -> Editor Display

Paste the data here.

sorry my bad
here it is

Code:

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 000000000 33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00 3ÀŽÐ¼.|ŽÀŽØ¾.|¿. 000000010 06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00 .¹..üó¤Ph..Ëû¹.. 000000020 BD BE 07 80 7E 00 00 7C 0B 0F 85 0E 01 83 C5 10 ½¾.€~..|..…..ƒÅ. 000000030 E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00 âñÍ.ˆV.UÆF..ÆF.. 000000040 B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09 ´A»ªUÍ.]r..ûUªu. 000000050 F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74 ÷Á..t.þF.f`€~..t 000000060 26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00 &fh....fÿv.h..h. 000000070 7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13 |h..h..´BŠV.‹ôÍ. 000000080 9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00 ŸƒÄ.žë.¸..».|ŠV. 000000090 8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1C FE Šv.ŠN.Šn.Í.fas.þ 0000000A0 4E 11 75 0C 80 7E 00 80 0F 84 8A 00 B2 80 EB 84 N.u.€~.€.„Š.²€ë„ 0000000B0 55 32 E4 8A 56 00 CD 13 5D EB 9E 81 3E FE 7D 55 U2äŠV.Í.]ëž.>þ}U 0000000C0 AA 75 6E FF 76 00 E8 8D 00 75 17 FA B0 D1 E6 64 ªunÿv.è..u.ú°Ñæd 0000000D0 E8 83 00 B0 DF E6 60 E8 7C 00 B0 FF E6 64 E8 75 èƒ.°ßæ`è|.°ÿædèu 0000000E0 00 FB B8 00 BB CD 1A 66 23 C0 75 3B 66 81 FB 54 .û¸.»Í.f#Àu;f.ûT 0000000F0 43 50 41 75 32 81 F9 02 01 72 2C 66 68 07 BB 00 CPAu2.ù..r,fh.». 000000100 00 66 68 00 02 00 00 66 68 08 00 00 00 66 53 66 .fh....fh....fSf 000000110 53 66 55 66 68 00 00 00 00 66 68 00 7C 00 00 66 SfUfh....fh.|..f 000000120 61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00 00 CD ah...Í.Z2öê.|..Í 000000130 18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07 32 E4 .*·.ë.*¶.ë.*µ.2ä 000000140 05 00 07 8B F0 AC 3C 00 74 09 BB 07 00 B4 0E CD ...‹ð¬<.t.»..´.Í 000000150 10 EB F2 F4 EB FD 2B C9 E4 64 EB 00 24 02 E0 F8 .ëòôëý+Éädë.$.àø 000000160 24 02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 $.ÃInvalid parti 000000170 74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 tion table.Error 000000180 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 loading operati 000000190 6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E ng system.Missin 0000001A0 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst 0000001B0 65 6D 00 00 00 63 7B 9A 5E 29 B9 4A 00 00 80 20 em...c{š^)¹J..€ 0000001C0 21 00 07 FE FF FF 00 08 00 00 00 78 E0 E8 00 00 !..þÿÿ.....xàè.. 0000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª

here snapshot too
http://i847.photobucket.com/albums/a...ganbath/ni.jpg

Quote:

Originally Posted by Master Razor

what is it with you guys and external drives? They seem to fail for no reason..

its not that we mess up with it or we're complete noobs .... its just pure bad luck in my case :cry:
09.07.12, 18:14
Master Razor

If you haven't backed up the drive folow below:
Download Parted Magic

Run: Go to: Extras Menu -> Clonezilla
Select:

Device-to-Image ->
local-dev -> *See if you can locate your usb drive here. If not, go back and select usb.
select the drive to hold the result ->
select the folder to hold the image ->
select Expert ->
select savedisk ->
select ntfsclone > partimage ->
select -c -j2 -ntfs-ok
select -z0 for the fastest backup
confirm choice (entr y) ->

The entire procedure will take 2 ~ 3 hours if we don't use compression at all. Maybe more. depends on the speed of the drive and how filled is it.

Show 40 post(s) from this thread on one page