Sytem and boot partitions damaged Toshiba Harddisk MQ01ABD07

[trinsic]

Made an image of bad drive using DD Rescue
Copied image to new hard drive
Scanned new hard drive with testdisk and was unable to reconstruct partitions due to the MFTS not matching

Any advice on how to reconstruct MFTS?

Attachments

[trinsic]

What I mean by bad I mean relocate sector retry count exceeding maximum. Is this question correctly interpreting the situation?

[labtech]

How successful was the ddrescue image? How many unread sectors and where on the drive were they?

If there were no unreads, then what is the problem background? Volume formatting/overwriting?

[trinsic]

How successful was the ddrescue image? How many unread sectors and where on the drive were they?

If there were no unreads, then what is the problem background? Volume formatting/overwriting?

The DDrescue reported 3 bad sectors and was unable to recover 130k of data, I ran it in reverse since the problem area was at the begining of the drive. When it reached the problem area I canceled and ran ddrescue in foward scanning mode until it reached the problem area and canceled it said that I recovered data except 131 k that it would not recover in the problem area.


The boot and the system partions are both not recognizable to the system so I assume they are in the problem area. The laptop was upgraded to windows 10 when the problem started happening. I booted the laptop before doing the data recovery and it starts to boot the widows logo but hangs there on boot.

One thing I should mention is the recover slowed significantly and hour or so into the recovery, I let it run though until it reached the problem area when I ran ddrescue in forward mode it sped up significantly 3mbs a second as opposed to 1 meg a second.

Below is the log file of the ddrescue:

Code:

# Rescue Logfile. Created by GNU ddrescue version 1.19
# Command line: ddrescue -d /dev/sdd /media/slim/recovery/slim.img /media/slim/recovery/slim.logfile
# Start time:   2017-04-10 10:26:10
# Current time: 2017-04-10 10:27:38
# Copying non-tried blocks... Pass 1 (forwards)
# current_pos  current_status
0x04430000     ?
#      pos        size  status
0x00000000  0x04430000  +
0x04430000  0xF54DB0000  ?
0xF591E0000  0x0FC00000  +
0xF68DE0000  0x00010000  *
0xF68DF0000  0x16690000  +
0xF7F480000  0x00010000  *
0xF7F490000  0x73280000  +
0xFF2710000  0x00010000  *
0xFF2720000  0xDF2B20000  +
0x1DE5240000  0x00010000  *
0x1DE5250000  0x3EE8E0000  +
0x21D3B30000  0x00010000  *
0x21D3B40000  0x8CD519E000  +

[trinsic]

I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?

[labtech]

I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?

Not sure, sorry.

If it only 3 bad sectors, then it should not be a big deal and the drive should present a fairly complete file tree.

Have you run a scan with UFS or a another tool on the image/drive?

Also, are you sure the volumes aren't encrypted?

[fzabkar]

The mapfile is regularly updated. The meaning of each status character is as follows:

Code:

Character    Meaning
-----------------------------------------
'?'       non-tried block
'*'       failed block non-trimmed
'/'       failed block non-scraped
'-'       failed block bad-sector(s)
'+'       finished block

https://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html

Code:

#      pos        size      status
  0x00000000    0x04430000  +  finished block
  0x04430000   0xF54DB0000  ?  non-tried block
0xF591E0000    0x0FC00000  +  finished block
0xF68DE0000    0x00010000  *  64KiB failed block non-trimmed
0xF68DF0000    0x16690000  +  finished block
0xF7F480000    0x00010000  *  64KiB failed block non-trimmed
0xF7F490000    0x73280000  +  finished block
0xFF2710000    0x00010000  *  64KiB failed block non-trimmed
0xFF2720000   0xDF2B20000  +  finished block
0x1DE5240000    0x00010000  *  64KiB failed block non-trimmed
0x1DE5250000   0x3EE8E0000  +  finished block
0x21D3B30000    0x00010000  *  64KiB failed block non-trimmed
0x21D3B40000  0x8CD519E000  +  finished block

"pos" is the byte offset into your physical drive.

The last finished block spans the area from 145GB to 750GB.

0x21D3B40000 bytes = 145.29 GB
(0x21D3B40000 + 0x8CD519E000) bytes = 750.16 GB

The non-tried block is located between 72MB and 66GB.

0x04430000 bytes = 71.5 MB
(0x04430000 + 0xF54DB0000) bytes = 65.92 GB

[trinsic]

I looked at the logfile and it doesn't show any information when I ran it in reverse mode is it possible that it was showing me it was reading the disk but it really wasn't?

Not sure, sorry.

If it only 3 bad sectors, then it should not be a big deal and the drive should present a fairly complete file tree.

Have you run a scan with UFS or a another tool on the image/drive?

Also, are you sure the volumes aren't encrypted?

I think DDRescue didn't copy everything off the drive so I am running it again, Thank you.
I do not think the partitions were encrypted.

Last edited by trinsic on April 21st, 2017, 16:33, edited 1 time in total.

[trinsic]

The mapfile is regularly updated. The meaning of each status character is as follows:

Code:

Character    Meaning
-----------------------------------------
'?'       non-tried block
'*'       failed block non-trimmed
'/'       failed block non-scraped
'-'       failed block bad-sector(s)
'+'       finished block

https://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html

Code:

#      pos        size      status
  0x00000000    0x04430000  +  finished block
  0x04430000   0xF54DB0000  ?  non-tried block
0xF591E0000    0x0FC00000  +  finished block
0xF68DE0000    0x00010000  *  64KiB failed block non-trimmed
0xF68DF0000    0x16690000  +  finished block
0xF7F480000    0x00010000  *  64KiB failed block non-trimmed
0xF7F490000    0x73280000  +  finished block
0xFF2710000    0x00010000  *  64KiB failed block non-trimmed
0xFF2720000   0xDF2B20000  +  finished block
0x1DE5240000    0x00010000  *  64KiB failed block non-trimmed
0x1DE5250000   0x3EE8E0000  +  finished block
0x21D3B30000    0x00010000  *  64KiB failed block non-trimmed
0x21D3B40000  0x8CD519E000  +  finished block

"pos" is the byte offset into your physical drive.

The last finished block spans the area from 145GB to 750GB.

0x21D3B40000 bytes = 145.29 GB
(0x21D3B40000 + 0x8CD519E000) bytes = 750.16 GB

The non-tried block is located between 72MB and 66GB.

0x04430000 bytes = 71.5 MB
(0x04430000 + 0xF54DB0000) bytes = 65.92 GB

Thank you, that helps a lot

[trinsic]

So running DDRescue a second time picked everything up. Thanks guys