All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: Sytem and boot partitions damaged Toshiba Harddisk MQ01ABD07
PostPosted: April 20th, 2017, 15:55 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
Made an image of bad drive using DD Rescue
Copied image to new hard drive
Scanned new hard drive with testdisk and was unable to reconstruct partitions due to the MFTS not matching

Any advice on how to reconstruct MFTS?


Attachments:
2017-04-20 12_11_20-UFS Explorer Professional Recovery - version 5.6 (64 bit).png
2017-04-20 12_11_20-UFS Explorer Professional Recovery - version 5.6 (64 bit).png [ 91.91 KiB | Viewed 838 times ]
Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 20th, 2017, 21:40 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
What I mean by bad I mean relocate sector retry count exceeding maximum. Is this question correctly interpreting the situation?


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 5:24 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3058
Location: Massachusetts, USA
How successful was the ddrescue image? How many unread sectors and where on the drive were they?

If there were no unreads, then what is the problem background? Volume formatting/overwriting?

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 8:39 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
labtech wrote:
How successful was the ddrescue image? How many unread sectors and where on the drive were they?

If there were no unreads, then what is the problem background? Volume formatting/overwriting?


The DDrescue reported 3 bad sectors and was unable to recover 130k of data, I ran it in reverse since the problem area was at the begining of the drive. When it reached the problem area I canceled and ran ddrescue in foward scanning mode until it reached the problem area and canceled it said that I recovered data except 131 k that it would not recover in the problem area.


The boot and the system partions are both not recognizable to the system so I assume they are in the problem area. The laptop was upgraded to windows 10 when the problem started happening. I booted the laptop before doing the data recovery and it starts to boot the widows logo but hangs there on boot.

One thing I should mention is the recover slowed significantly and hour or so into the recovery, I let it run though until it reached the problem area when I ran ddrescue in forward mode it sped up significantly 3mbs a second as opposed to 1 meg a second.

Below is the log file of the ddrescue:


Code:
# Rescue Logfile. Created by GNU ddrescue version 1.19
# Command line: ddrescue -d /dev/sdd /media/slim/recovery/slim.img /media/slim/recovery/slim.logfile
# Start time:   2017-04-10 10:26:10
# Current time: 2017-04-10 10:27:38
# Copying non-tried blocks... Pass 1 (forwards)
# current_pos  current_status
0x04430000     ?
#      pos        size  status
0x00000000  0x04430000  +
0x04430000  0xF54DB0000  ?
0xF591E0000  0x0FC00000  +
0xF68DE0000  0x00010000  *
0xF68DF0000  0x16690000  +
0xF7F480000  0x00010000  *
0xF7F490000  0x73280000  +
0xFF2710000  0x00010000  *
0xFF2720000  0xDF2B20000  +
0x1DE5240000  0x00010000  *
0x1DE5250000  0x3EE8E0000  +
0x21D3B30000  0x00010000  *
0x21D3B40000  0x8CD519E000  +


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 9:01 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 15:04 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3058
Location: Massachusetts, USA
trinsic wrote:
I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?

Not sure, sorry.

If it only 3 bad sectors, then it should not be a big deal and the drive should present a fairly complete file tree.

Have you run a scan with UFS or a another tool on the image/drive?

Also, are you sure the volumes aren't encrypted?

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 16:16 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9620
Location: Australia
The mapfile is regularly updated. The meaning of each status character is as follows:

Code:
Character    Meaning
-----------------------------------------
'?'       non-tried block
'*'       failed block non-trimmed
'/'       failed block non-scraped
'-'       failed block bad-sector(s)
'+'       finished block

https://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html

Code:
#      pos        size      status
  0x00000000    0x04430000  +  finished block
  0x04430000   0xF54DB0000  ?  non-tried block
0xF591E0000    0x0FC00000  +  finished block
0xF68DE0000    0x00010000  *  64KiB failed block non-trimmed
0xF68DF0000    0x16690000  +  finished block
0xF7F480000    0x00010000  *  64KiB failed block non-trimmed
0xF7F490000    0x73280000  +  finished block
0xFF2710000    0x00010000  *  64KiB failed block non-trimmed
0xFF2720000   0xDF2B20000  +  finished block
0x1DE5240000    0x00010000  *  64KiB failed block non-trimmed
0x1DE5250000   0x3EE8E0000  +  finished block
0x21D3B30000    0x00010000  *  64KiB failed block non-trimmed
0x21D3B40000  0x8CD519E000  +  finished block


"pos" is the byte offset into your physical drive.

The last finished block spans the area from 145GB to 750GB.

    0x21D3B40000 bytes = 145.29 GB
    (0x21D3B40000 + 0x8CD519E000) bytes = 750.16 GB

The non-tried block is located between 72MB and 66GB.

    0x04430000 bytes = 71.5 MB
    (0x04430000 + 0xF54DB0000) bytes = 65.92 GB

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 16:30 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
labtech wrote:
trinsic wrote:
I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?

Not sure, sorry.

If it only 3 bad sectors, then it should not be a big deal and the drive should present a fairly complete file tree.

Have you run a scan with UFS or a another tool on the image/drive?

Also, are you sure the volumes aren't encrypted?

I think DDRescue didn't copy everything off the drive so I am running it again, Thank you.
I do not think the partitions were encrypted.


Last edited by trinsic on April 21st, 2017, 16:33, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 21st, 2017, 16:32 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
fzabkar wrote:
The mapfile is regularly updated. The meaning of each status character is as follows:

Code:
Character    Meaning
-----------------------------------------
'?'       non-tried block
'*'       failed block non-trimmed
'/'       failed block non-scraped
'-'       failed block bad-sector(s)
'+'       finished block

https://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html

Code:
#      pos        size      status
  0x00000000    0x04430000  +  finished block
  0x04430000   0xF54DB0000  ?  non-tried block
0xF591E0000    0x0FC00000  +  finished block
0xF68DE0000    0x00010000  *  64KiB failed block non-trimmed
0xF68DF0000    0x16690000  +  finished block
0xF7F480000    0x00010000  *  64KiB failed block non-trimmed
0xF7F490000    0x73280000  +  finished block
0xFF2710000    0x00010000  *  64KiB failed block non-trimmed
0xFF2720000   0xDF2B20000  +  finished block
0x1DE5240000    0x00010000  *  64KiB failed block non-trimmed
0x1DE5250000   0x3EE8E0000  +  finished block
0x21D3B30000    0x00010000  *  64KiB failed block non-trimmed
0x21D3B40000  0x8CD519E000  +  finished block


"pos" is the byte offset into your physical drive.

The last finished block spans the area from 145GB to 750GB.

    0x21D3B40000 bytes = 145.29 GB
    (0x21D3B40000 + 0x8CD519E000) bytes = 750.16 GB

The non-tried block is located between 72MB and 66GB.

    0x04430000 bytes = 71.5 MB
    (0x04430000 + 0xF54DB0000) bytes = 65.92 GB


Thank you, that helps a lot


Top
 Profile  
 
 Post subject: Re: Sytem and boot partitions damaged Toshiba Harddisk MQ01A
PostPosted: April 22nd, 2017, 0:54 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
So running DDRescue a second time picked everything up. Thanks guys


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 33 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group