All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 17 posts ] 
Author Message
 Post subject: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 7th, 2018, 2:18 
Offline

Joined: January 7th, 2018, 1:58
Posts: 2
Location: India
Hey guys,

I need some help to recover my photos and other important data stuck in a WD external drive. Unfortunately my 1TB WD My Passport external HDD all of a sudden stopped working while transferring some files. When I replugged it in it started showing the typical "Do you want to format it" message.

I read a few threads on the internet which suggested that its a usual problem with WD hard drives and can be rectified by using a tool called "EASEUS Partition master". So I downloaded the free version. It was able to pickup the external hdd and showed that it has 171GB used space and also the filesystem is NTFS. I tried to change the label of the drive as suggested in that thread but it did not work. Finally I used the "Check for errors" option thinking that it will check for errors and report back. Instead the software went ahead and ran a chkdsk.
The Chkdsk deleted just one entry and everything else was reported as normal.
Partition recovery reported "No errors Found" but suddenly instead of NTFS I was seeing the partition as RAW. I knew immediately it was a terrible mistake to run this scan.

Now I have initiated a Photorec scan to look only for JPG images but although it has recovered some photos it is taking forever to complete. After 3 days of scanning it says only 0.5% is complete.

I haven't yet formatted the hard drive so I am hoping that if I can recover the MFT somehow then the recovery can be fast. I have read on the internet that DMDE is very effective for this purpose but I am unsure about how to use it and dont want to mess things further.

Guys, I would really appreciate if anyone can point me in the right direction.

@fzakbar - I tried to PM you because I know you are real expert when it comes to restoring the MFT but I dont have enough rights yet to use the PM.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 7th, 2018, 17:03 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
Looks like the drive itself might have further problems like a "slow issue"....

What is the full model of the drive ? Can you post some S.M.A.R.T. values screen captures ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 16:25 
Offline

Joined: October 24th, 2014, 4:57
Posts: 219
Location: Remote Raid Help on planet Earth
Spildit wrote:
Can you post some S.M.A.R.T. values screen captures ?


Exactly. This is first thing TS should to check. Bad idea to start logical scan before check of hardware conditions.

Use software like CrystalDiskInfo, HDDScan etc. to check S.M.A.R.T. condition first. All yellow/red markers should take attention.

_________________
http://www.alfadatarecovery.com


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 17:00 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2071
Location: Ontario, Canada
Are you sure that the drive is healthy?

Partition Showing as RAW

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 17:52 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 17:58 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
rogfanther wrote:
I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.


Assuming you can clone the drive at a decent speed .... Most likely you can't if the drive is suffering from a "slow issue" caused by RE-LO list loaded to drive RAM and drive attempting to process defects in the background ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 18:19 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Spildit wrote:
rogfanther wrote:
I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.


Assuming you can clone the drive at a decent speed .... Most likely you can't if the drive is suffering from a "slow issue" caused by RE-LO list loaded to drive RAM and drive attempting to process defects in the background ....


But we still have not determined that, since some "internet threads" have prompted the OP to run strange procedures in the drive. Maybe was just some corrupted filesystem. Maybe not and it really is the slow responding problem. We need the OP to give more information and follow some recomendations so that the problem can be correctly diagnosed.

Or, as he states that there is important data, send the drive to a professional before things get to the point of no return.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 18:29 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
rogfanther wrote:
Spildit wrote:
rogfanther wrote:
I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.


Assuming you can clone the drive at a decent speed .... Most likely you can't if the drive is suffering from a "slow issue" caused by RE-LO list loaded to drive RAM and drive attempting to process defects in the background ....


But we still have not determined that, since some "internet threads" have prompted the OP to run strange procedures in the drive. Maybe was just some corrupted filesystem. Maybe not and it really is the slow responding problem. We need the OP to give more information and follow some recomendations so that the problem can be correctly diagnosed.

Or, as he states that there is important data, send the drive to a professional before things get to the point of no return.


I don't think that this would happen on a good working drive :

sameer_recovery wrote:
Now I have initiated a Photorec scan to look only for JPG images but although it has recovered some photos it is taking forever to complete. After 3 days of scanning it says only 0.5% is complete.


_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 8th, 2018, 19:14 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Here he doesn´t complain about the time it takes :

sameer_recovery wrote:
Instead the software went ahead and ran a chkdsk.
The Chkdsk deleted just one entry and everything else was reported as normal.
Partition recovery reported "No errors Found" but suddenly instead of NTFS I was seeing the partition as RAW. I knew immediately it was a terrible mistake to run this scan.




I agree with you, a normal drive should not take so much time in photoroec ( but we don´t know which kind of machine he is using, to where he is recovering the files with photorec, if he is using a laptop and connecting both drives through USB that would slow things a lot .....

Either way, an easy way to the OP check this would be to boot a live linux cd and read ( or go ahead and patch ) the relevant modules with hddsupertool, then retry the cloning . If thins improve markedly, then we can be observe if it was just a case for the SlowFix or if there are another problems.

But if the OP doesn´t post enough information , we can only bet.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 3:49 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 155
Location: France
Quote:
I agree with you, a normal drive should not take so much time in photoroec ( but we don´t know which kind of machine he is using, to where he is recovering the files with photorec, if he is using a laptop and connecting both drives through USB that would slow things a lot .....

Even in USB2 (can't possibly be USB1 right ?) a 1TB HDD can get entirely copied in a single day. At worst it will have an average rate of 20MB/s, that's about 50000s for completion, or 14 hours.

Quote:
Here he doesn´t complain about the time it takes :

CHKDSK with the basic /F switch only examines the system files (MFT, bitmap...), which are typically located at the begining of a partition, and at the begining of the storage unit if there's only one partition, so if there are damaged areas only after 10GB or so, or a damaged head on a platter side which happens to contain no system files, couldn't it be consistent with a fast CHKDSK scan and a slow Photorec scan ?


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 11:23 
Offline

Joined: January 7th, 2018, 1:58
Posts: 2
Location: India
Hey Guys,

Sorry for the delay in response. I was travelling and could not respond.

Here is the SMART information :

Model: WDC WD10JMVW-11AJGS0
Firmware: 01.01A01
Serial: WD-WX11E33SJ103
LBA: 1953458176 (1000 GB)

Screenshot from hddscan :
Image


As suggested, I will be doing a clone before doing anything else with this hard drive. Can someone please recommend a reliable tool for making a clone.

Also, Regarding the speed issue I am connecting using my laptop using USB 2.0. The laptop is running on windows 7 but has less RAM (2GB). Does RAM matter in recovery? I had changed the settings of photorec before running the scan to only scan for jpeg files thinking that would speed up but that doesnt seem to help.

Here is the screenshot from photorec.
Image

I really appreciate all the responses and the help. Please let me know if any more information is required or you want me to try out something.

Thanks


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 15:52 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
Not to mention that the drive might not have a USB PCB and might have an enclosure with a bridge board and the problem might be related to that as well .... We don't even know the model of the drive...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 17:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10835
Location: Australia
The SMART report indicates that the drive has serious physical problems, ie lots of bad sectors.

I would start by backing up the drive's firmware modules, particularly modules 02 and 32.

http://www.sdcomputingservice.com/hddsupertool
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod02?attredirects=0&d=1
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod32?attredirects=0&d=1
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod_all?attredirects=0&d=1

Then we could patch 02 and 32 to "fix" the slow issue.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 17:52 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
In my opinion, yes, using usb in a slow computer, low on ram, that would increase the time.

As Frank observed from the smart logs you posted, the drive has problems. So after making the changes for the slow fix, you can try again the cloning ( preferrable ) or running photorec.

I prefer the older ( not WiP ) versions of photorec. The newer versions seem to hang in some disks here, or throw errors and abort.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 18:33 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
As already stated the drive most likely is indeed suffering from the slow issue.

You have a USB only PCB so you can try with HDDSuperTool or WDMarvel (this one is not free) to "patch" module 02 and clear module 32, of course assuming the data is not that important or you can't pay for professional data recovery service.

If the tools can bypass the USB bridge board and manage to reach SA by USB and patch the module 02 then you can try to clone (again by usb) using something like hddsuperclone.

The screen capture from hddscan S.M.A.R.T. shows pending sectors and some already re-located sectors. Pending sectors (RE-LO list) is loaded to RAM and on your drive because of firmware way to deal with that list (bad implementation) the drive will be extremely SLOOOWWWW.

No point intro attempting to clone the drive if you can't patch the firmware to "bypass" that slow problem ....

A professional with $6000 tools like PC-3000 with DE would use a SATA compatible PCB, gain access to SA, patch the firmware and use DE to extract the data decrypting on the fly.

You don't have a $6000 PC-3000 so you can pray and try HDDSuperClone or WDMarvel. WDMarvel have USB-ATA apss trough as well. You can try to "patch" module 02 by disabling re-location. You will need a paid version of it. You can test with the DEMO to see if you can access to SA. You have to select USB option on the software.

Or... us HDDSuperTool .... It's free.

If both tools fail then most likely you will need a SATA compatible PCB to patch SA and things get complicated as moving ROM code will be required, etc ....

Again best choice would be to send the drive to someone with tools and experience ....

You can read about the Slow Issue here :

http://www.hddoracle.com/viewtopic.php?f=86&t=848

This would be how i would handle a SATA drive with slow responding problem :

http://www.hddoracle.com/viewtopic.php? ... t=60#p9874

This is my research on the slow issue :

http://www.hddoracle.com/viewtopic.php?f=59&t=1456

And this is a real case of a user with USB only drive like yours that manage to "fix" a problem related with the slow issue with hddsupertool :

viewtopic.php?f=1&t=32501

Good Luck !

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 19:13 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 155
Location: France
The drawback with Photorec is that all the metadata is lost, it just looks for file signatures and extracts files on the fly, naming them after the number of the 1st sector they occupy. All the directory structures, all the original file names, all the timestamps and other attributes, are lost. And in case of fragmentation, there's little chance that it will assemble all fragments in one single file (it does attempt to but with a rudimentary method, only works in very simple cases, e.g. if a file has just two chunks separated by another non-fragmented file), so fragmented files would end up truncated, thus partially or totally unreadable, even if all their sectors are still readable from the source.

So, if at all possible, use something like ddrescue, in conjunction with ddr_utilities : with ddru_ntfsbitmap (part of ddr_utilities) you can create a mapfile which will set ddrescue to exclude the empty sectors from the clone, based on the $Bitmap system file (huge time saving as well as strain saving on the HDD if it's far from full – if for instance you had 500GB of free space you will avoid spending precious minutes or hours or even days copying 500GB of zeroes or remnants from deleted files), and you can also attempt to extract the whole MFT first. The MFT (Master File Table) is a very important system file which contains all the metadata, i.e. the directory structures, file names, timestamps and so on. So, first get the whole MFT if at all possible – but don't insist too much if it contains many bad sectors, it could further wear a drive which is already in a very bad condition (likewise, if the bitmap file proves too hard to get don't insist and skip that step altogether – get what you can as quick as you can run, don't bother too much sorting out women and children, you'll count 'em once the rescue teams abandon and say no more can be done ! :)) ; then clone or image the drive, using the mapfile so as to restrict the copy to the currently allocated sectors.
Once it's finished, or once it becomes so excruciatingly slow that it's no longer worth the hassle, if you could recover the whole MFT, then using ddru_ntfsfindbad (also part of ddr_utility) with the logfile from ddrescue as input you can get a list of files containing sectors which couldn't be recovered, that way you can know what is truly lost (helps the grieving process...), sort out the important from the trivial stuff, and see if you can recover important files which have been corrupted, if for instance you happen to have them on a CD/DVD somewhere, or on a remote server, or if you copied them to a friend or family member, whatever...
You could also open the logfile in ddrescueview and make a screenshot (even as the clone is running : just make copy the logfile – it's a good idea anyway to copy it at regular intervals as it can sometimes get corrupted, HDDSuperClone does that automatically), post it here, it might help someone to make a more informed diagnostic and provide you specific recommandations.

Connecting both the source and destination in SATA or eSATA or at least USB 3 would certainly be preferable, but with so many bad sectors (FD59 = 64857 pending sectors, B0D = 2829 reallocated sectors) you'll be happy if you can reach 35MB/s anyway (which is the approximate maximum transfer rate in USB 2.0), so, speed-wise, it's kind of a moot point. But I've read that USB controlers could pose problems of their own, when attempting to copy data from a failing HDD. Even if you only have a laptop computer with only USB 2.0 ports and only one SATA slot, you could remove its internal HDD (which is safer anyway), place the failing one in its SATA slot, and connect the destination HDD to a USB port, that should be more reliable – but it will be tricky if you have to do a power cycle, i.e., if the failing HDD stops responding and it's necessary to shut it down, then start it up again. If I remember correctly, HDDSuperClone has the ability to send the HDD a power cycle command (making it unnecessary to physically unplug it), but I haven't tried that, and I don't know if HDDSuperClone can run a copy with a mapfile generated by ddru_ntfsbitmap, or if it offers a similar functionality. The author of that tool is a member of that board, maybe he'll be able to provide you specific tips relevant to your particular case.


EDIT 1 : Sorry, I hadn't seen the “USB only PCB” bit of information. If that really is the case forget the last paragraph (but it may be useful in other situations).


EDIT 2 : Of course what I wrote above doesn't contradict Spildit's recommandations above, this is a very specific issue and I have no direct experience with it. My intervention was mainly a response to rogfanther's post :

Quote:
In my opinion, yes, using usb in a slow computer, low on ram, that would increase the time.
As Frank observed from the smart logs you posted, the drive has problems. So after making the changes for the slow fix, you can try again the cloning ( preferrable ) or running photorec.


Top
 Profile  
 
 Post subject: Re: HDD went RAW. Havent't formatted. Need DMDE help!
PostPosted: January 9th, 2018, 19:30 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9660
Location: Portugal
@abolibibelot this is an ....WD10JMVW-11AJGS0 drive ....

So the PCB is ..... USB only .... Like this :

Attachment:
3.jpg
3.jpg [ 16.75 KiB | Viewed 1963 times ]


Good luck connecting that by SATA !!!

And if you bypass the USB bridge board or if you replace it with a SATA PCB you will end up with ..... ENCRYPTED DATA !!! So forget about that ...

Oh .... And those pending sectors are loaded to RAM and the drive is processing them consuming all the MCU resources so when you attempt to clone the drive guess what ? The drive will be too busy processing those blocks and have it's RAM loaded with all of that code / overlays and ..... you won't get more than 1MB/Sec and that is if you are lucky and if you don't hit bad spots because it can be even slower ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 17 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: danidmh and 38 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group