Switch to full style
Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
Post a reply

HDD went RAW. Havent't formatted. Need DMDE help!

January 7th, 2018, 2:18

Hey guys,

I need some help to recover my photos and other important data stuck in a WD external drive. Unfortunately my 1TB WD My Passport external HDD all of a sudden stopped working while transferring some files. When I replugged it in it started showing the typical "Do you want to format it" message.

I read a few threads on the internet which suggested that its a usual problem with WD hard drives and can be rectified by using a tool called "EASEUS Partition master". So I downloaded the free version. It was able to pickup the external hdd and showed that it has 171GB used space and also the filesystem is NTFS. I tried to change the label of the drive as suggested in that thread but it did not work. Finally I used the "Check for errors" option thinking that it will check for errors and report back. Instead the software went ahead and ran a chkdsk.
The Chkdsk deleted just one entry and everything else was reported as normal.
Partition recovery reported "No errors Found" but suddenly instead of NTFS I was seeing the partition as RAW. I knew immediately it was a terrible mistake to run this scan.

Now I have initiated a Photorec scan to look only for JPG images but although it has recovered some photos it is taking forever to complete. After 3 days of scanning it says only 0.5% is complete.

I haven't yet formatted the hard drive so I am hoping that if I can recover the MFT somehow then the recovery can be fast. I have read on the internet that DMDE is very effective for this purpose but I am unsure about how to use it and dont want to mess things further.

Guys, I would really appreciate if anyone can point me in the right direction.

@fzakbar - I tried to PM you because I know you are real expert when it comes to restoring the MFT but I dont have enough rights yet to use the PM.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 8th, 2018, 16:25

Spildit wrote: Can you post some S.M.A.R.T. values screen captures ?


Exactly. This is first thing TS should to check. Bad idea to start logical scan before check of hardware conditions.

Use software like CrystalDiskInfo, HDDScan etc. to check S.M.A.R.T. condition first. All yellow/red markers should take attention.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 8th, 2018, 17:00

Are you sure that the drive is healthy?

Partition Showing as RAW

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 8th, 2018, 17:52

I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 8th, 2018, 18:19

Spildit wrote:
rogfanther wrote:I´m curious about those "internet threads that suggest it is a problem with WD" and whatever it is that says to change the partition Label .....

If the drive contains "photos and important data", then send it to a professional while there are still good chances.

Having said that, your first action now that things are starting to get worse is to ( try to ) make a clone of the drive to another one, then work in the clone to try to recover your files.


Assuming you can clone the drive at a decent speed .... Most likely you can't if the drive is suffering from a "slow issue" caused by RE-LO list loaded to drive RAM and drive attempting to process defects in the background ....


But we still have not determined that, since some "internet threads" have prompted the OP to run strange procedures in the drive. Maybe was just some corrupted filesystem. Maybe not and it really is the slow responding problem. We need the OP to give more information and follow some recomendations so that the problem can be correctly diagnosed.

Or, as he states that there is important data, send the drive to a professional before things get to the point of no return.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 8th, 2018, 19:14

Here he doesn´t complain about the time it takes :

sameer_recovery wrote: Instead the software went ahead and ran a chkdsk.
The Chkdsk deleted just one entry and everything else was reported as normal.
Partition recovery reported "No errors Found" but suddenly instead of NTFS I was seeing the partition as RAW. I knew immediately it was a terrible mistake to run this scan.




I agree with you, a normal drive should not take so much time in photoroec ( but we don´t know which kind of machine he is using, to where he is recovering the files with photorec, if he is using a laptop and connecting both drives through USB that would slow things a lot .....

Either way, an easy way to the OP check this would be to boot a live linux cd and read ( or go ahead and patch ) the relevant modules with hddsupertool, then retry the cloning . If thins improve markedly, then we can be observe if it was just a case for the SlowFix or if there are another problems.

But if the OP doesn´t post enough information , we can only bet.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 9th, 2018, 3:49

I agree with you, a normal drive should not take so much time in photoroec ( but we don´t know which kind of machine he is using, to where he is recovering the files with photorec, if he is using a laptop and connecting both drives through USB that would slow things a lot .....

Even in USB2 (can't possibly be USB1 right ?) a 1TB HDD can get entirely copied in a single day. At worst it will have an average rate of 20MB/s, that's about 50000s for completion, or 14 hours.

Here he doesn´t complain about the time it takes :

CHKDSK with the basic /F switch only examines the system files (MFT, bitmap...), which are typically located at the begining of a partition, and at the begining of the storage unit if there's only one partition, so if there are damaged areas only after 10GB or so, or a damaged head on a platter side which happens to contain no system files, couldn't it be consistent with a fast CHKDSK scan and a slow Photorec scan ?

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 9th, 2018, 11:23

Hey Guys,

Sorry for the delay in response. I was travelling and could not respond.

Here is the SMART information :

Model: WDC WD10JMVW-11AJGS0
Firmware: 01.01A01
Serial: WD-WX11E33SJ103
LBA: 1953458176 (1000 GB)

Screenshot from hddscan :
Image


As suggested, I will be doing a clone before doing anything else with this hard drive. Can someone please recommend a reliable tool for making a clone.

Also, Regarding the speed issue I am connecting using my laptop using USB 2.0. The laptop is running on windows 7 but has less RAM (2GB). Does RAM matter in recovery? I had changed the settings of photorec before running the scan to only scan for jpeg files thinking that would speed up but that doesnt seem to help.

Here is the screenshot from photorec.
Image

I really appreciate all the responses and the help. Please let me know if any more information is required or you want me to try out something.

Thanks

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 9th, 2018, 17:11

The SMART report indicates that the drive has serious physical problems, ie lots of bad sectors.

I would start by backing up the drive's firmware modules, particularly modules 02 and 32.

http://www.sdcomputingservice.com/hddsupertool
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod02?attredirects=0&d=1
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod32?attredirects=0&d=1
http://www.sdcomputingservice.com/hddsupertool/scripts/wd_royl_dump_mod_all?attredirects=0&d=1

Then we could patch 02 and 32 to "fix" the slow issue.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 9th, 2018, 17:52

In my opinion, yes, using usb in a slow computer, low on ram, that would increase the time.

As Frank observed from the smart logs you posted, the drive has problems. So after making the changes for the slow fix, you can try again the cloning ( preferrable ) or running photorec.

I prefer the older ( not WiP ) versions of photorec. The newer versions seem to hang in some disks here, or throw errors and abort.

Re: HDD went RAW. Havent't formatted. Need DMDE help!

January 9th, 2018, 19:13

The drawback with Photorec is that all the metadata is lost, it just looks for file signatures and extracts files on the fly, naming them after the number of the 1st sector they occupy. All the directory structures, all the original file names, all the timestamps and other attributes, are lost. And in case of fragmentation, there's little chance that it will assemble all fragments in one single file (it does attempt to but with a rudimentary method, only works in very simple cases, e.g. if a file has just two chunks separated by another non-fragmented file), so fragmented files would end up truncated, thus partially or totally unreadable, even if all their sectors are still readable from the source.

So, if at all possible, use something like ddrescue, in conjunction with ddr_utilities : with ddru_ntfsbitmap (part of ddr_utilities) you can create a mapfile which will set ddrescue to exclude the empty sectors from the clone, based on the $Bitmap system file (huge time saving as well as strain saving on the HDD if it's far from full – if for instance you had 500GB of free space you will avoid spending precious minutes or hours or even days copying 500GB of zeroes or remnants from deleted files), and you can also attempt to extract the whole MFT first. The MFT (Master File Table) is a very important system file which contains all the metadata, i.e. the directory structures, file names, timestamps and so on. So, first get the whole MFT if at all possible – but don't insist too much if it contains many bad sectors, it could further wear a drive which is already in a very bad condition (likewise, if the bitmap file proves too hard to get don't insist and skip that step altogether – get what you can as quick as you can run, don't bother too much sorting out women and children, you'll count 'em once the rescue teams abandon and say no more can be done ! :)) ; then clone or image the drive, using the mapfile so as to restrict the copy to the currently allocated sectors.
Once it's finished, or once it becomes so excruciatingly slow that it's no longer worth the hassle, if you could recover the whole MFT, then using ddru_ntfsfindbad (also part of ddr_utility) with the logfile from ddrescue as input you can get a list of files containing sectors which couldn't be recovered, that way you can know what is truly lost (helps the grieving process...), sort out the important from the trivial stuff, and see if you can recover important files which have been corrupted, if for instance you happen to have them on a CD/DVD somewhere, or on a remote server, or if you copied them to a friend or family member, whatever...
You could also open the logfile in ddrescueview and make a screenshot (even as the clone is running : just make copy the logfile – it's a good idea anyway to copy it at regular intervals as it can sometimes get corrupted, HDDSuperClone does that automatically), post it here, it might help someone to make a more informed diagnostic and provide you specific recommandations.

Connecting both the source and destination in SATA or eSATA or at least USB 3 would certainly be preferable, but with so many bad sectors (FD59 = 64857 pending sectors, B0D = 2829 reallocated sectors) you'll be happy if you can reach 35MB/s anyway (which is the approximate maximum transfer rate in USB 2.0), so, speed-wise, it's kind of a moot point. But I've read that USB controlers could pose problems of their own, when attempting to copy data from a failing HDD. Even if you only have a laptop computer with only USB 2.0 ports and only one SATA slot, you could remove its internal HDD (which is safer anyway), place the failing one in its SATA slot, and connect the destination HDD to a USB port, that should be more reliable – but it will be tricky if you have to do a power cycle, i.e., if the failing HDD stops responding and it's necessary to shut it down, then start it up again. If I remember correctly, HDDSuperClone has the ability to send the HDD a power cycle command (making it unnecessary to physically unplug it), but I haven't tried that, and I don't know if HDDSuperClone can run a copy with a mapfile generated by ddru_ntfsbitmap, or if it offers a similar functionality. The author of that tool is a member of that board, maybe he'll be able to provide you specific tips relevant to your particular case.


EDIT 1 : Sorry, I hadn't seen the “USB only PCB” bit of information. If that really is the case forget the last paragraph (but it may be useful in other situations).


EDIT 2 : Of course what I wrote above doesn't contradict Spildit's recommandations above, this is a very specific issue and I have no direct experience with it. My intervention was mainly a response to rogfanther's post :

In my opinion, yes, using usb in a slow computer, low on ram, that would increase the time.
As Frank observed from the smart logs you posted, the drive has problems. So after making the changes for the slow fix, you can try again the cloning ( preferrable ) or running photorec.
Post a reply