All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 43 posts ]  Go to page Previous  1, 2, 3  Next
Author Message
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 21st, 2018, 9:42 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Quote:
– Between two valid $MFTMirr MFT records, only the timestamps and two other bytes are different (those two bytes are identical, I don't know what they are yet, apparently it's called “fixup” in DMDE).

The fixup is a check to make sure the record is valid and not corrupt. The pattern is dictated in the beginning of the record, then bytes 511-512 and 1023-1024 (the last 2 bytes in each 512 byte block) should also have the matching pattern. The pattern needs to match in all three places, but otherwise is randomly generated so you can make it what you want.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 21st, 2018, 20:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
This might be one important thing to check in the $Volume MFT record.

Locating the NTFS "dirty bit":
http://www.hddoracle.com/viewtopic.php?f=117&t=2126&p=14046#p14046

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 4:14 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
By searching a known volume ID (from the 2TB partition shown above) in the entire system partition (C:), I found out that these IDs (or labels) were stored at least in the “xxxxxx.automaticDestinations-ms” files, in this directory :
C:\Users\[user_name]\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\
I have no idea what these files are, it looks as though they keep track of the locations where files were copied or downloaded... The partition's ID/label is preceded by the name of the machine in the current Windows install, just above there's the path of a file which ended up on the corresponding volume, and the name of that volume (that one is named after the HDD's model reference and serial number, “WD20EARX WCAZAJ971138”). So, remembering that I've used that drive regularly about a year ago, and its letter was “K:”, I searched inside an “AutomaticDestinations” file with a modified date in September 2017, large enough to contain “something”, an occurrence of the string “K:”, and indeed found many, with what must be the original volume ID, and the original volume's name (which I had forgotten but now I remember) was “Stockage”.

Regarding the LSN :
“The field in the upper right at offset 0x08 labeled $Logfile Sequence Number or LSN is how the MFT refers to the most recent change recorded in the $logfile. Each $logfile record has an associated LSN, however the LSN is updated in the file record to correspond to the most recent change. There is no record that I'm aware of that shows what LSNs a file record previously had. The MFT Record Number is a unique identifier for this file record, and if we have a way to link a change to it then it becomes easy to associate historical changes we recover to indicate which MFT file record they are referencing.
The $USNJrnl keeps the MFT Record Number to indicate which file it is operating on and the Parent Record number to reflect what directory that MFT file record resided in. If a $logfile entry records a change then that change can be easily linked back to the MFT file record number's LSN if it's the last change made to that file record.”
Found this here :
http://www.hecfblog.com/2013/01/ntfs-tr ... nside.html

“This is a 48 bit number that is incremented every 16 bits when each record is added”
http://amanda.secured.org/ntfs-mft-reco ... ng-parser/

“The $MFT record carries the $LogFile sequence number (LSN) in its header, which links the $MFT record to the corresponding chain of operational records in the $LogFile.”
(Found here.)

Now I would have to delve into the $LogFile to get that value, but according to the “NTFS documentation” PDF :
“Little is known about the LogFile's structure.”
“The logrecord supposedly contains a sequence of variable sized records. The structuring of those is not clear.”
:shock:

The article linked above (hecfblog.com) gives more details, there should be a reference to the MFT cluster number in each $LogFile header – but I don't know where exactly those headers are supposed to be found, the $LogFile appears as a huge garbled mess, I can't find any occurrence of “$Volume” inside (ASCII / Unicode), I don't know where to look for at this point. It's probably not that important, but I'd prefer not to overlook anything, so if anyone has a clue...
Image


@maximus
Quote:
The fixup is a check to make sure the record is valid and not corrupt. The pattern is dictated in the beginning of the record, then bytes 511-512 and 1023-1024 (the last 2 bytes in each 512 byte block) should also have the matching pattern. The pattern needs to match in all three places, but otherwise is randomly generated so you can make it what you want.

Alright, thank you for that. Any idea about the “LSN” value ?

@fzabkar
Quote:
This might be one important thing to check in the $Volume MFT record.
Locating the NTFS "dirty bit":

What should I check exactly ? Should it be set to “dirty” or not ?
In my case the entire MFT record has been wiped, and the aim is to reconstruct it as accurately as possible... If there's an inconsistency, but the filesystem is parsable again, I'll probably get a warning and a CHKDSK analysis should fix the abnormal values. In any case it would probably be wise to run CHKDSK even if it works flawlessly at the first attempt.
I haven't written to the partition yet, but I have built an almost complete 3072 bytes file in WinHex, corresponding to the 3 missing MFT records.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 10:59 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
As far as the LSN value, I would say set it to zero if you can't figure out what it should be. Maybe that is something that chkdisk can fix. I don't have any idea about the LOG file, nor do I (and probably everybody else on here) have much interest in it, as it is not important for data recovery :)

EDIT: I should say that is not important to data recovery, unless you are using CHKDISK to, uh, "recover" the data :)

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 16:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
abolibibelot wrote:
@fzabkar
Quote:
This might be one important thing to check in the $Volume MFT record.
Locating the NTFS "dirty bit":

What should I check exactly ? Should it be set to “dirty” or not ?
In my case the entire MFT record has been wiped, and the aim is to reconstruct it as accurately as possible... If there's an inconsistency, but the filesystem is parsable again, I'll probably get a warning and a CHKDSK analysis should fix the abnormal values. In any case it would probably be wise to run CHKDSK even if it works flawlessly at the first attempt.
I haven't written to the partition yet, but I have built an almost complete 3072 bytes file in WinHex, corresponding to the 3 missing MFT records.

I was thinking that you wouldn't want Windows to automatically launch CHKDSK. That's what happens when the dirty bit is set. It occurred to me that patching the patient FS with an MFT record from a donor might inadvertently set this bit, especially as it does not seem to be a well known parameter.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 18:35 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
As far as the LSN value, I would say set it to zero if you can't figure out what it should be. Maybe that is something that chkdisk can fix. I don't have any idea about the LOG file, nor do I (and probably everybody else on here) have much interest in it, as it is not important for data recovery :)

Alright then, if noone here has any clue, that's about the best I can do ! :)
But what I discovered is : looking at the MFT record of a file created recently on a valid partition, I copied the LSN value (hex, little endian), searched that value inside the $LogFile of that partition, and there it is. Since the $LogFile is only 64MB in size, it does not retain all information :
“When the log file fills up, the records at the beginning are purged (by modifying the oldest_lsn to a higher value presumably) and writing begins at the beginning of the file. Effectively, the log file is viewed as a circular entity.” (from “NTFS documentation” PDF linked by fzabkar 20180620 23:25)
“Both the $logfile and the $usnjrnl are circular with a max size, so there is a finite amount of data each will keep before it begins to overwrite themselves.” (article linked above)
So whatever the log value for $Volume was, it's irrelevant now since the corresponding record has most likely been “purged” a long time ago.

Quote:
I should say that is not important to data recovery, unless you are using CHKDISK to, uh, "recover" the data :)

I've already made a full recovery for safety (and it's a recovery of a recovery actually as I said earlier). But still, knowing that sort of stuff (how NTFS metafiles are structured and organized) could be a significant time saver in a situation like this. Suppose you (you being : a professional data recovery technician) receive a drive in this exact state, with one partition which is no longer accessible and no help from CHKDSK or TestDisk, discover as I did that this is due to only 3 missing MFT records, why go through the hassle of extracting the whole contents, re-formatting, re-transfering everything, if it can be effectively fixed by copying those sectors from a valid partition and changing a few key values ? Or maybe professional softwares can deal with this kind of issues automatically ?

Apparently the $LogFile is of great value for forensic purposes, but I understand that this is not the primary focus on this forum.

***

So I did it, I applied my “patch” : CHKDSK worked right away, but (launched at first without the /F switch so in read-only) reported errors in index $O of file 25 (file 25 being $ObjId), and an error in the record for file 3 (file 3 being $Volume). Then, I tried to parse $ObjId/$O, hoping to find the correct value, to no avail. I did find 3 or 4 variations of the first value I had found in “faef7def55a1d4b.automaticDestinations-ms”, which I tried one by one, but CHKDSK gave the same output. Then I realized that there were a gazillion of variations of that very value in “faef7def55a1d4b.automaticDestinations-ms”, differing by the first two characters, so that couldn't be the actual ID. Then, I don't know why, I had the idea of looking inside System Volume Information : on a valid partition, I opened “tracking.log”, and right at the begining there's the name of the machine on that system, followed by the 16 characters ID found in $Volume. So I copied the value from “tracking.log” on the corrupted partition, pasted it into $Volume (in both $MFT and $MFTMirr), launched CHKDSK again... no error this time ! The partition was still not accessible, probably because it had to be properly re-mounted. I launched CHKDSK with the /F switch (which requires to unmount the volume), it found no error as before, and then the partition became accessible again. Ouf ! :)

Attachment:
ST2000DM001-1ER164 CHKDSK 20180622 1.png
ST2000DM001-1ER164 CHKDSK 20180622 1.png [ 19.28 KiB | Viewed 12542 times ]

(The first command was executed before the patching : CHKDSK couldn't identify the state and version of the volume and aborted.)
Attachment:
ST2000DM001-1ER164 CHKDSK 20180622 2.png
ST2000DM001-1ER164 CHKDSK 20180622 2.png [ 20.36 KiB | Viewed 12542 times ]

(I renamed the volume “Stoc” instead of “Stockage” as it was called before, so as to have the same number of characters as in the $Volume MFT record from another partition named “TEMP”, to stay on the safe side and avoid an error due to some unexpected offset, and to be sure that the “used size” value would match, since I don't fully understand the structure of the record.)

***

Now, does anybody else – aside from “Spildit” – think that this drive could still have a “silent” hardware issue, despite the fact that the S.M.A.R.T. status shows currently no worrying value ? I know now that this range of drive has a bad reputation, but can I still trust this particular unit, for now ?
Attachment:
ST2000DM001 Z4Z0T7LY HD Sentinel SMART Ultra ATA CRC Error Count.png
ST2000DM001 Z4Z0T7LY HD Sentinel SMART Ultra ATA CRC Error Count.png [ 157.71 KiB | Viewed 12542 times ]

My main HDD is a ST2000DX001... it's not that I like to live dangerously, but when I bought those two I had no idea that Seagate drives had acquired such a bad reputation lately ! It's got a pristine S.M.A.R.T. status currently. I've had another ST2000DM001, purchased used, which I used three years before it started to misbehave – that's when I cloned it onto the ST2000DX001. Reliability aside, what I like about those drives is that they're excellent performers (max reading rate above 200MB/s) while being relatively silent for 7200rpm models.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 19:18 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
I agree with the others in that you should fully erase/reformat this drive a couple times to see if any bad sector arises, then trash the drive.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 19:39 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
@abolibibelot, congratulations ... I think. :-)

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 20:06 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
viewtopic.php?f=1&t=36995

Well, you could show rocky horror pictures from any brand / model of drive, couldn't you ? In this particular case nothing is said about the conditions in which the drives were used, perhaps they sustained vibrations or shocks way beyond their specifications... or perhaps not, but pictures are not enough to tell the whole story. It's a bit like showing a chest radiography from a russian guy who was born in Tchernobyl in 1986, smokes like a mofo since the age of 12 and works in an asbestos disposal facility, and saying, see, russians have bad lungs ! :)
I'm willing to trust the near unanimous opinion expressed on this forum that these drives have an inferior design, are made with lesser quality materials, and are generally less reliable statistically than their counterparts from other brands (although it's not very clear which ones – only HGST seems to have a stellar reputation here, but I've seen one fail badly, and as far as I know way fewer units are sold worldwide compared to the two giants Seagate and WD), but some statements about Seagate are clearly blown out of proportion. Caricature can be funny for a while but it doesn't help in approaching the truth. If all Seagate drives were so bad and utterly unreliable, the company would face a huge worldwide backlash and would soon disappear, if all this is true, if they haven't produced a drive in 10 years that lasted 6 months, how can it be explained that the company is still a major player in this field ?

@rogfanther
Quote:
I agree with the others in that you should fully erase/reformat this drive a couple times to see if any bad sector arises, then trash the drive.

You mean, trash it even if no bad sector arises ? :shock: Or only if that were to happen ? Do you recommand this because this is a Seagate “DM” drive, because there was this (apparently strictly logical) issue, or both ?

@fzabkar
Quote:
@abolibibelot, congratulations ... I think. :-)

Thanks! :)
(I'm quite proud indeed since the assistance was rather scarce... I can't say that I fully understand the structure of those metafiles yet, it's frighteningly complex, but that's quite encouraging. And I have the feeling that even among data recovery experts, many would have considered this a lost cause, or at least “not worth the trouble”.)


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 20:20 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
I recommend to test, a couple times, with the long test option from the seagate test tool, or some complete erase/writes/test with mhdd or victoria.

If after all of that the disk passes with an "ok" from the tool, then I would say you can use it, with your *own* data in it, and that it would be better to not store valuable data in it.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 20:46 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
[quote="abolibibelot" And I have the feeling that even among data recovery experts, many would have considered this a lost cause, or at least “not worth the trouble”.)[/quote]


Thats because they are experts, and they work in data recovery. The job is recovering the data. The most trusted way would be to just extract with R-Studio, for example. Why mess with direct editing of the partitions when not necessary , and possibly making another customer wait ?


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 22:50 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
No they wouldn't.
They would simple hook up the drive to something like PC-3000 DE or even use simple methods like open the drive with R-Studio and directly extract the data.
Yes, nobody would bother to fix the partition by hand because it's a time waste and no-one in it's right mind would even "consider" to re-use that drive even more "gamble" with that chkdsk !
You were very lucky so far and that's it.

Quote:
Thats because they are experts, and they work in data recovery. The job is recovering the data. The most trusted way would be to just extract with R-Studio, for example. Why mess with direct editing of the partitions when not necessary , and possibly making another customer wait ?

What I did was relatively painstaking because I'm relatively new to this, but knowing what I know now I could probably fix a similar issue in a fraction of the time necessary to extract the whole contents (although it's a wise safety measure, especially if there's any doubt about the drive's fitness status) and write it back (if it turns out that the drive is fine). I'm wondering what a “regular” computer repair technician – i.e. not a data recovery expert – would do in a case like this, if a client brings a drive in the exact same state and wants it “fixed”.

As for CHKDSK, I understand that this tool is often derided here, as it can mess things up pretty badly in some situations (yet many computer repair technicians foolishly swear by it as if it was some kind of HDD panacea !), and should never be used on a drive with even minor physical issues, but it still has its purpose, which is to fix small inconsistencies in an NTFS volume, that can appear randomly for a variety of reasons on a perfectly working drive, and by themselves cause trouble / data loss if they're not taken care of, meaning, if the filesystem stays in an inconsistent state.

And as for considering to re-use the drive, currently I'm more worried about the state of a WD30EZRX with 23 “pending” sectors (the one I used for the safety backup of the ST2000DM001).
Attachment:
WD30EZRX 201806230444 SMART pending.png
WD30EZRX 201806230444 SMART pending.png [ 147.95 KiB | Viewed 13004 times ]


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 23rd, 2018, 8:58 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Quote:
What I did was relatively painstaking because I'm relatively new to this, but knowing what I know now I could probably fix a similar issue in a fraction of the time necessary to extract the whole contents (although it's a wise safety measure, especially if there's any doubt about the drive's fitness status) and write it back (if it turns out that the drive is fine). I'm wondering what a “regular” computer repair technician – i.e. not a data recovery expert – would do in a case like this, if a client brings a drive in the exact same state and wants it “fixed”.

And what would happen if you rebuilt it, then ran CHKDISK and it wiped out half of the files in the MFT? Or if the MFT was fragmented and you only got the first part? Then it becomes a case of raw file recovery, which is now going to take much longer and the files won't be named or sorted. And if the files were fragmented, ouch! That is not the way to make a customer happy. And that is why nobody here would do it that way.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 23rd, 2018, 10:11 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
+2TB to maximus

Mr Belot, it seems you keep thinking in terms of fixing disks. The focus people that work with recovery use is in the *data*, not the disks.

To more or less use and translate something that I explain to people here, you can avoid eating a doughnut a day, and you will save enough money to pay for another hard disk in a month or two. But no matter how much you try to save, you will not be able to get all the people that were in a party, with the same clothes, in the same positions, to take those same pictures. Can you make somebody marry again so that you can take those lost pictures ? Don´t think so.

That´s why recovering the files, even if takes a day or two longer, is the preferred action. Hard disks can easily be bought. Data cannot ( the work of months ? data from experiments that now have to be run again ? )

Sure, understanding the inner workings of filesystems is good and very useful, for the times it is necessary. It just isn´t the best option for all cases. Actually, it is the option just for some very small % of cases.

To use a somewhat related case I got myself into once : With the customer talking too much about how good technicians do not need to format computers, how someone he knows at Microsoft said they do not need to format computers, etc.
And I was naive/inexperienced/distracted, whatever, and went with his ideas that time. And after 2 o 3 hours suffering with his very hosed computer, still had to backup and reinstall windows. Had I taken the correct approach in the case, to backup and restore, after what he had described as the cause of the problem, I would have ended earlier and the service would have been profitable, with the same end results achieved. Now I chalk that as a lesson to have learnt something, but it is a true lesson anyway.

Sometimes one can cross the river in a boat, instead of building a bridge.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 24th, 2018, 4:41 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
@maximus
Quote:
And what would happen if you rebuilt it, then ran CHKDISK and it wiped out half of the files in the MFT? Or if the MFT was fragmented and you only got the first part? Then it becomes a case of raw file recovery, which is now going to take much longer and the files won't be named or sorted. And if the files were fragmented, ouch! That is not the way to make a customer happy. And that is why nobody here would do it that way.

There's the possibility of making a backup copy of all system files before proceeding with an in-place fix attempt, which I did roughly by extracting the first 5GB with WinHex – but indeed, it should be stressed (if someone reads this in the future) that this is not always enough to get the whole MFT, which can itself be fragmented, I learned it the hard way ! And it's indeed the wise thing to extract the data first in a situation like this (or make a complete clone). In this particular case, right now I'm trying to re-organize all my data in consistent and sensible way, I've had several HDD failures or pre-failures (including that WD30EZRX), I'm rather short on money, so I had a good incentive to at least try to make it work that way ; and maybe I was lucky but it did work (I took the time to do some research and carefully prepare this, so it was not just sheer luck either, although I'm willing to admit that an issue like this could have been hiding something worse).


@rogfanther
Quote:
+2TB to maximus

Mr Belot, it seems you keep thinking in terms of fixing disks. The focus people that work with recovery use is in the *data*, not the disks.

To more or less use and translate something that I explain to people here, you can avoid eating a doughnut a day, and you will save enough money to pay for another hard disk in a month or two. But no matter how much you try to save, you will not be able to get all the people that were in a party, with the same clothes, in the same positions, to take those same pictures. Can you make somebody marry again so that you can take those lost pictures ? Don´t think so.

That´s why recovering the files, even if takes a day or two longer, is the preferred action. Hard disks can easily be bought. Data cannot ( the work of months ? data from experiments that now have to be run again ? )

Sure, understanding the inner workings of filesystems is good and very useful, for the times it is necessary. It just isn´t the best option for all cases. Actually, it is the option just for some very small % of cases.

To use a somewhat related case I got myself into once : With the customer talking too much about how good technicians do not need to format computers, how someone he knows at Microsoft said they do not need to format computers, etc.
And I was naive/inexperienced/distracted, whatever, and went with his ideas that time. And after 2 o 3 hours suffering with his very hosed computer, still had to backup and reinstall windows. Had I taken the correct approach in the case, to backup and restore, after what he had described as the cause of the problem, I would have ended earlier and the service would have been profitable, with the same end results achieved. Now I chalk that as a lesson to have learnt something, but it is a true lesson anyway.

Sometimes one can cross the river in a boat, instead of building a bridge.

Alright, that's a clear enough explanation.
(“Aboli bibelot” comes from a poem by Stéphane Mallarmé, for what it's worth.)
Regarding the lost pictures, maybe there should be a new business for “life's staple moments reenactment”, where people would do just that, reenact graduation ceremonies, parties, weddings, just for the sake of re-creating lost digital files ! :) Anyway, as I've read somewhere, “nostalgia is a mental clitoris, don't abuse it”, and George Carlin made a good point about the overwhelming tendency nowadays to record and document everything, to the point that one has to wonder if people are able to actually live things and remember them anymore (and I know that first hand, being a major offender in the digital memories hoarding department !).


Quote:
If you don't need the data on this drive just zero fill it or run secure erase. All sectors should be written to. If the sectors are found to be bad they will be moved to G-List. If the sectors can be re-used they will be removed from RE-LO list.
If you keep on using this drive you will risk to get the "slow issue" very shortly as your re-lo list is growing ...

I know that these bad sectors are all located on the same ~4GB MKV file (at first there was only 1, then I copied a bunch of MKV movies to this drive, the count went back to 0, but then when I copied those files to another drive the count rose to 16, and SynchronizeIt reported CRC errors on that one file, the others copied just fine) ; then, just to verify if those sectors were truly bad, hoping that they would be cleared once again (although unlikely at this point), or to assess the level of damage and pinpoint the exact location of those bad sectors, I tried to copy that file with Roadkil Unstopable Copier, which increased the count to 23 (knowing the location of the file on the partition and the location of the bad area within the file, I determined that they were in the interval of sectors 5406621249-5406621675) ; so, for now, I just let that file on the drive in a special folder with a name saying that it contains bad sectors, lest I forget. It seems to be that this is the safest course of action if I want that drive to stay stable and keep using it for temporary / unimportant stuff. When I copied 2TB worth of files (from the ST2000DM001), the S.M.A.R.T. status didn't move. If I do a complete zero-fill / secure erase, it will try to access those sectors again, and those nearby which may be weak as well, even if the currently identified bad sectors are reallocated the heads will come flying extremely close to this area later on and most likely increase the damage, which I do not want.

Quote:
But of course you might want to use chkdsk on this drive as well just for the fun of it ...

Now I get the feeling that you're being almost sarcastic... :roll:


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 25th, 2018, 1:43 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
That is why people move PBAs to the P-List or use Self-Scan.

What does PBA stand for ?
I don't get the sarcasm here... Most people don't do anything at all with a failing HDD until it suddenly stops functioning for good... At least I know that this one has a problem (relatively minor for now), and I'm taking it into account (I won't use that drive to store important data).
The question is : when a weak area with contiguous bad sectors starts to develop, and sectors identified as bad at a T time are reallocated (moved to G-list if I get this right, P-list being for factory-detected defects), and the drive is used regularly again, what happens later on when heads attempt to access the sectors nearby, very close to those which are no longer “active” ? Isn't there a high risk that some of them will also get identified as weak, increasing the “pending sectors” count again, and worsening the situation ? (This is what happened with a ST3000DM001 : it had 16 bad sectors, but remained stable for months, being used everyday, then I could backup all the data on it except six video files, identified with HD Sentinel and Defraggler[*], and it's only when I tried to copy those six files, which contained contiguous bad sectors, that it failed rapidly and badly...) Isn't it wiser, in that particular situation, if there's a single file containing that bad area, to just let it on the drive and not touch it anymore ?

[*] Nooo, I'm not crazy enough to have attempted a defragmentation on a HDD with bad sectors (and a Seagate at that to add insult to injury ! :)), it's just that I discovered a nice feature this program has, which can be tremendously useful in that kind of situation : after an analysis (based on the MFT so it's quick and doesn't require to scan the whole drive surface), just clicking on a “block” on its map gives a list of the files contained in that “block” (even non-fragmented files). I haven't found another tool which could provide that information so clearly (I imagine that professional tools can do that and more but I can't afford any of them right now, so I make do with what's available). So, after identifying a few bad sectors LBA with HD Sentinel, I could isolate other files contained within the same area, put them in a separate folder so as to copy them last.

Quote:
:lol: :lol: :lol:

Heeey, you're laughing ! You think I'm funny, huh, you think I'm funny ? :shock:


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 6:01 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
With thos sort of Sea"junk" as soon as the platter is on that condition it doesn't matter if you are reading near of far the bad sector as all the platter will be gone !!!

I told you about my experience (it may not be statistically significant but it's real and I've seen it) : this ST3000DM001 (apparently the most dreaded model of recent years among DR professionals) remained stable for months until I specifically tried to access those files which contained bad areas (incidentally, once I had identified them, I first tried moving them with a simple cut and paste, but this caused Windows Explorer to parse them – those were MP4 video files – so as to generate a preview, and this was enough to add a bunch of “pending” sectors, so I had to move them through command line). I haven't tried to open it, now that it's totally toast, maybe I'll do it at some point and post pictures if what I find is interesting.
Is this pattern of deep rings on the platters' surface specific to those Seagate models, or can this happen as well with other models from other brands ? Is there a known trend of operating conditions (heat, vibrations...) which induce that kind of severe failure, or can it happen even in perfect conditions ? (It must be difficult even for professonals to assess the real conditions under which a drive operated, aside from the basic informations recorded by S.M.A.R.T. self-check routines... sometimes it must be like being an emergency doctor and trying to figure out how a dude could end up with four screwdrivers up his butt, after said self-deluded dude came complaining about an unexplained “pain in the ass” !)

Quote:
People don't do anything at all ... they should !!!

To be fair, the information is rather scarce on this subject, unless one is specifically (and painstakingly) looking for it on forums and whatnot. HDDs (or even computers, at least desktop ones) don't come with an operating manual, there's no common practice of bringing those devices to a maintenance professional on a regular basis, for routine check, as it's the case for cars for instance, and even on specialized forums there's a lot of B.S. as you surely know.
I've known people who were either working or studying in some area of informatics yet who thought that HDDs were nigh indestructible... that it was perfectly safe for instance to bump the computer case while in operation... And just this Sunday, I tried to remotely help a woman who had put an anoucement on a classified ads website saying that she had mistakenly deleted one video file, an interview shot with a Canon 5D for an upcoming documentary she's working on, hadn't used the SD card since, and was hoping to find someone who could recover it for a cheap price ; I thought that it would be a quick and easy task, proposed to do it for 10€... but in the meantime she had brought the SD card to her friend who works in networking, who supposedly knew his stuff about teh computerz... the guy used Recuva... and Recuva, although a surprisingly efficient recovery software in my experience considering that it's free (I haven't tried the commercial version yet) has one big caveat : it is not fool-proof, it issues no warning when a fool attempts to do the foolish thing, extract files to the very same device and volume... and indeed he did, I saw it right away... and so all I could do was painstakingly show her with WinHex that what used to be the begining of MVI_4917.mov was now overwritten with some portion of MVI_4904.mov (Recuva has this nice feature of reporting by which other file a deleted file has been overwritten, which is lacking in prominent higher-end softwares like R-Studio) and was thus lost for good... :? Same thing happened a few months ago... at least this time I'll get the payment, but it's still frustrating ! I told her that an important thing in such an activity is to know one's limits. (She must hate her friend now...) I also installed her a duplicate remover (DoubleKiller Pro, streamlined but powerful), showed her how I use it to make sure that files from a memory card have been flawlessly copied, and actually copied in the first place (she said she was tired that evening, must have made a mouse selection which was not large enough to include that file, then deleted everything right away, realized it later on) before deleting them, but she seemed to think that it was already an overwhelmingly technical task when there are so many things already to deal with when making movies, the script, the lighting, the shooting, the editing and so on... Things get so specialized these days, and there are so many informations to absorb in any serious endeavour, that it's almost impossible for most people to get everything right from the micro-level to the macro-level, some things have to be discarded, left to chance, or handed out to specialists when things go awry.

Quote:
But it's very good as well that people don't care and continue to use drives in bad condition ... that is how data recovery firms can make a fortune !

I may have the wrong impression, but from what I read here, it doesn't seem to be that big a business, and if some cases are relatively easy to solve, thus generate a relatively high income / effort ratio, others are much more intricate and don't get paid much more, so it averages out to a price which is “about right” for mere sustainability. Perhaps the larger data recovery companies which get contracts with other large companies are more profitable, but then they're less likely (I guess) to get regular computer users as clients.

Quote:
Assume a TRACK with 500 sectors.
5 Sectors are bad.
You write a file that is fragmented it stores itself on the 5 bad sectors + 10 sectors on that track + the rest is stored on another place.
If hat you are saying is true you are safe, correct ?
Now let's say that you do have a single sector on the same track that is part of your windows installation as is used all the time, for example explorer.
Now everytime you run your computer and your os need to load that specific file it places the heads of the drive on the track with the bad sectors and even if the head goes above the sectors that are bad withou reading them the phisical proximity to that bad spot is exactle the same as if the sector were to be read ... and you keep moving your heads above those bad sectors ... so what ?

This particular drive is used to store data only. Previously it was the backup of another WD30EZRX (which is still fine), to store TV recordings, then I transfered everything to a pair of bigger drives, verified/deleted everything, then I used it to temporarily store MKV files, which were thus copied sequentially (non-fragmented), and 4GB represents a quite large area, so I think that there's a good degree of confidence for the issue to be limited to that single file, for now. I'll see how it turns out. I would have proceeded differently if it had been a general-purpose drive full of files of any size and possibly fragmented.

Quote:
I would say if it's a Seagate F3 arch just trash it. If it's a Seagate ST-10 just self-scan it. Those are VERY GOOD DRIVES.

What models / capacity does “ST-10” refer to ? My porn collection is on a ST31500541AS, I need to know, is it at risk ? 8)


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 18:23 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
- If you do open that DM drive just don't even think about ever using it again to store anything at all. The drive will just be "gone" as soon as you open it outside a HEPA 100 aseptic room.

I wonder if I'm really passing as stupid enough to do something as foolish as opening a drive to just “look inside” in the hopes of recovering data, or if those are just generic words of caution aimed at anyone who could read that thread, now or in the future... As I said, I recovered as much as possible from that drive, it is now in a very unstable state, there's nothing more I could do with my current tools. A few months ago I created a thread about it (and another Seagate on the way out), my first one here actually, shortly after working on it to the best of my abilities (and making a mistake in the process by failing to clone the whole MFT first, but managed to fix it anyhow) ; I asked if there was anything else I could do (essentially hoping to get at least some of those six corrupted files in their entirety, as I could backup all the rest in time, flawlessly it seemed), apparently not (and even a professional couldn't fix bad sectors anyway), so at this point I consider it bricked. I'm still learning, but I think that I'm past the point of doing such a foolish thing and hoping a positive outcome.


Quote:
Data recovery is a very high profitable business if you are clever !!! Check for example eBay for people operating there. People can charge for example $300 for simple file un-deletion and those services still sell.

Well, that's not being clever, that being a crook ! :)


Quote:
Also if you check prices of firmware recovery on data recovery firms the price is normally at the same level of head swaps and if not it's on the same level of hardware repair and never on the cheaper level like logic recovery.

From what I've seen the average fee for strictly firmware-related failures is about half that of hardware-related failures (like 350 / 700). I have no direct experience in either, but it seems like the actual “active” time spent on the task can be similar, or even sometimes higher for intricate firmware failures (since the cloning or extracting operations can be done asa “background tasks”, while doing something else). Swapping head stack assemblies might require more experience, but once it's acquired, the time actually spent on the task is the main factor to determine how profitable it is.


Quote:
Also you can buy a bunch of drives in non-tested condition or even get those for free from people working on the IT field check those drives and sell them for $$$.

Again, that seems more akin to crook practices than respectable business activity...


Quote:
If you sell those drives with a note that they are special for data recovery guys and if you include some extra info like microjogs on WD drives you can even get that price higher for each drive that you do sell.

What exactly are microjogs ? If it really adds a special value for special purposes and requires special skills to get those informations, it's different.


Quote:
Even if you do have bad drives with damaged heads you can still sell the PCB for "data recovery" and still ask even more money for those PCBs that you would ask for the entire drive.

Again, crook practices, unless it's a very rare model.


Quote:
Even if you do get just a single case of firmware damage it will get you some considerable amount of $$$. Only "problem" might be head swaps that you do need to use parts- You can outsource those. Many people do only logic data recovery and imaging like using DDI4, etc ... And outsource the clean room work to bigger firms. Even so if you do charge $300 for those logic recoveries you will get considerable amount of $$$ very fast ...

Your initial remark was about using the self-check feature, in order to prevent some kinds of failures. Do firmware failures fall in that category, of failures which can be predicted / prevented by self-check routines ? From what I could gather, they tend to happen quite suddenly on the contrary, in which case it's kinda moot. (But, granted, having a proper backup solution and some common sense can prevent any kind of data loss, to quote someone's signature here : “a backup a day keeps the DR away”...)
As for the “$$$ very fast” claim, are there that many cases on average, relative to the average number of data recovery technicians in an average city ? And how many are basic enough to be solved (or totally screwed up sometimes alright ! :)) by regular computer repair technicians, who usually charge much less for a “logic” failure recovery ?


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 19:31 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
There is much difference between someone doing this on the back of his garage, and that will just tell the customer that it was impossible to recover his data, and the professional business, that have to pay taxes, personnel, and will not survive with telling those kind of excuses.

As for crook business ? That would be not informing the customer about costs and the possibility of increase in the price due to unknown things that will only appear after the service starts. If you explain what needs to be explained, tell the truth, and the customer agrees, it is a correct business.

And lets not degenerate this into another of those discussions about the right to define prices and the (sometimes low) value people place in the data recovery work. This kind of thing usually ends up on unpoliteness from many sides.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 22:41 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
Are you saying that you do want to recover the 6 files on the drive that are "stored" on the sectors that now are "bad" ? It might be possible at least partially. You will get the parts of the files that are stored on the good sectors and if you do patch sysfile 93 to stop re-location, etc you can use something like PC-3000 DE and do multiple reads on those bad sectors to see if hopefully one of the reads can get some data. If not at least you will still have the rest of the file. If it's a movie you might get away with just a little bit of damage (missing frames) ...

That's what I asked about months ago in that other thread I linked. Last time I tried to work on it, the “reallocated” count was indeed constantly rising, even when the drive was idle. What tools are necessary to patch sysfile 93 ? (Maybe you already replied that, I didn't re-read the whole thread, but there was a lot of new information to process, and the general feeling from the replies I got was quite discouraging.) I don't have PC-3000 DE and certainly couldn't afford it right now. Most I could do is try again with ddrescue or HDDSuperClone. All six files are TV recordings, which were available online for just one week. I could find one on eMule P2P network (strictly identical file, same size and checked with WinHex) ; among the others, some are severely damaged, some have only a few small bad spots (see the ddrescueview[*] screenshots in that SuperUser thread linked above), one of them has only one bad 4KB cluster : I was hoping to at least get that one 100% recovered, for OCDness' sake, but indeed, just one missing cluster is barely noticeable.
I still consider myself lucky, especially now that I know about those drives' reputation to deteriorate quickly once they start to have issues. And anyway I'm hoarding so many such TV recordings (documentaries, movies and whatnot) that I'm actually watching a very small proportion of them, so I might have never watched those ones anyway ! :) We live in crazy hectic times, it's become strictly impossible to keep up with everything, and it's getting worse on a daily basis...

[*] I had the idea of using ddrescue's own “generate” mode to generate logfiles purposefully aimed at locating the bad spots within each file, and showing them simply and clearly when opened in ddrescueview. I don't know if there's another commonly used method to do this, but that one works like a charm. Copied from the SuperUser thread :
“I had the idea to use ddrescue's “generate” mode, which creates logfiles (or mapfiles as they're called now) by parsing the output and considering that totally empty sectors are unread sectors, marked “?”, the rest being marked “+”. Since ddrescue expects an input file and an output file, but only the output file is actually parsed in that mode, I created dummy input files with this command, which copies only 1MB but extends the size to the size of the output files (just to save time and space) :
ddrescue -s 1048576 -x 883789824 201707222358.mp4 201707222358copy.mp4
Then I ran the “generate” command :
ddrescue -G 201707222358copy.mp4 201707222358.mp4 201707222358-generate.log
And then I opened those files with ddrescueview [...].”


Quote:
You don't even have to go to eBay fo find "what looks like high" prices for data recovery - viewtopic.php?f=3&t=36887

Very interesting thread. I've found these statements to be relevant to what I wrote earlier :
“The money I make on donors is what pays for my time spent wiping, testing and keeping inventory on thousands of drives.”
“One possibility is to apply a "no result - no fee" or a "no result - small administrative fee" policy and take more margins on you work in order to cover the risk of an unsuccessful recovery.”
“For a short while, I contemplated sharing that risk, i.e., if the recovery is successful, they pay the full cost of the donor and I keep the donor, but if not, I absorb half the donor's cost and also keep the donor. Given the high cost of donors, I've decided that's just not feasible for a small-time DR shop like mine. If they don't want to pay for the donor no matter the recovery outcome, I'll just wish them best of success with whatever they decide to do.”
And the whole last post is about the idea of balancing out the price asked for each client with the risk of unrecoverable failure which costs time and sometimes parts with little to no reward. So just looking at the “profit” generated for re-selling drives, or to perform an easy task, is not enough to get a broader picture of how profitable the whole venture is.


Quote:
Another example - viewtopic.php?f=3&t=36904 - Flash pen drives, way smaller than usb - Logical (up to 32Gb) - $175 ; Minor (logical/quick physical fix) - $350 CAD.

Indeed that seems quite high, even in Canadian Dollars. But the first post says that increasing the price results in having less clients, all else being equal. And there is competition, so after some time the prices tend to average out, at least in populated areas where such services are relatively easy to find. Also, large capacity flash memory based devices are relatively new, the knowledge and tools required to deal with them are still rare, and as the last post says it's still a small part of the DR business — all those factors contribute to explain why the fees are higher in proportion of the device's capacity (which by the way must be weakly correlated with the amount of “active” work required for the whole task).


Quote:
This sort of recovery normaly is done by the use of R-Studio or similar to copy the data that can be recovered to another place.

And how do you explain that people are willing to pay such a high fee to get it done by a professional, if they have the possibility of doing it themselves by paying about half that price for an advanced software which they can keep for later use ? Or even using a free software, since something like Recuva (free version) is enough to get back deleted files in most situations (although it's not fool-proof as I said and can cause disasters by itself). On the other hand, I know for a fact that many people renounce paying for a professional recovery, even for important personal files, and prefer to either bring the device to 10 friends / relatives / colleagues who claim to be “good with computers”, or hastily read forums on teh Internetz and attempt some do-it-yourself method, then another, and so on... or directly open the drive hoping that it can be fixed like a car engine, y'know, tightening some bolt, putting some grease... at which point even a professional recovery becomes nigh impossible.


Quote:
The problem with head stack replacement is that you do need parts and often those parts will get damaged. You don't have to worry about that with firmware. With PCBs it's easier because even if you do have to buy/use a donor one it's not very often that the new PCB will get damaged and you can re-use it for the next job. Heads will last 3-4 jobs and will end up dying. Some Seagate DM will typicaly require 3 sets of heads to clone ...

Yes, I understand that this basically what you do, i.e. firmware fixing / PCB replacing, and I get why it's generally less tricky. But with the fees you ask, and the average amount of cases you get in a year, do you consider this activity “highly profitable”, “profitable”, or merely “sustainable” ?


Quote:
The more data you can provide about a drive like pre-amp, firmware, etc the more chances are for a "professional" to get the "match" that he needs. If you list a drive as "Samsung 500 GB" and you don't add extra info like firmware, pre-amp type, etc data recovery people trying to find a particular drive for PCB/HEAD swap will not know if the drive that you are listing is compatible for what they want or not ...

Alright, but that's still a large amount of work, as quoted above, and it requires large investments at the begining to deal with enough drives in order to present a complete enough catalog for professional to choose units according to their constantly changing needs. So I don't see this as a quick and easy way to get rich by exploiting people's ignorance and carelessness (even if those two things can be found in spades !).


Quote:
You can sell PCB of your broken drives and get some $$$ out of it !!! Looks reasonable. You can even offer ROM transference/adaptation fee and you are good to go ! Just try it !

I've seen people looking for PCBs on classified ads websites, but usually they expect to pay about 10€ for one. (And besides I suspect that most of them expect this to be the cure when their drive's actual failure is completely unrelated with the PCB. Sometimes I answer to such an anouncement just to ask them basic questions about their drive's symptoms, and imply that replacing the PCB might not be any useful.)


Quote:
There are firmware failures that are easy to predict, like when you start to see several pending sectors on some WD drives

Like, how many pending sectors should be raising alarms, and on which particular models ?


Quote:
or when you pick up a F3 ARCH drive you know that those will fail for sure !

Well, again, that's a bit exaggerated, since some of these drives work fine for years, and misrepresenting the global situation, since drives from all brands and models do fail no matter what, even when used in the best possible conditions. I now know that they are generally reputed as having an inferior design or being made with inferior materials, I will certainly check the ones I have regularly, just like I regularly check all my HDDs, I will take it into account when deciding which type of data goes to which drive (I have drives from almost every current manufacturer, except Toshiba — I've had one in the past, purchased new, which failed after just a few months, and the customer service was non-existant, I had to ask the seller for a refund, and was kinda lucky I could get it at all because said online seller disappeared shortly thereafter : that alone is a good reason to avoid that brand altogether), but I see no reason to just dump drives which are still operating perfectly, or re-sell them to people who most likely won't know anything about it (and I sure will have a hard time selling them if I say in the anouncement : “I'm selling all my Seagate hard disk drives because the overwhelming consensus among professionals on HDDGuru is that they are utter and complete crap, good luck with those P.O.J.” !).


Quote:
Also as i stated just buy a lot of drives, like for example 20 drives for $40 or $50 and then refurb those drives and sell them for $20 or $30 each ... same for PCBs if you can't "recover" the drive .... Now advertize some data recovery work, get something like R-Studio and start to charge people lololol

Well, those are tempting ideas, I'll think about it ! :) But advertising is definitely not my strong point, and it seems to be a crucial part in such a venture...


Quote:
Of course that if you already have something like an IT business you can for example start to offer "basic" data recovery services. Just clone the drives with hddsuperclone and extrat the data with R-Studio and you will manage to get at least some cases.

I already did that a few times, but so far it's been excruciatingly painstaking tasks for the money I asked. Last summer, I found a guy who had a 1TB HGST drive which had failed all of a sudden, he said that it was clicking, which sounded bad, I didn't think that I could do anything, but he was adamant that he would not pay the high fee of a “true” professional recovery (here are the prices list of the only data recovery company in the whole region where I live if you're interested), so he gave me “carte blanche” for the 50€ service fee I proposed ; and to my surprise, when insisting a few times, unplugging and plugging it again, the drive would stabilize, I could run ddrescue and start imaging it, albeit very slowly (after reading a ddrescue guide in french mentioning that writing to a NTFS partition was not recommanded and could by itself cause slowdowns for large volumes, I asked about it on SuperUser, proceeded to create an Ext4 partition and resume the cloning, saw only empty data in the preview but didn't know yet that it was perfectly normal, started all over again, surprisingly there were no skipped area at all in the first 150GB or so, as opposed to the first attempt, but then it slowed down to a crawl way before it did on the first attempt). It started to become more unstable, and I gave up after about four days (and I could barely do something else as it was very hot, I tried to keep the drive cool with a laptop computer cooler and cold packs...), it had recovered about 250GB, but by luck the client had only about 200GB worth of data on it, and when I analyzed the output with ddru_ntfsfindbad from ddr_utilities, I found out that only about 130 files in personal folders (i.e. excluding system and programs files) were partially or totally corrupted. So I extracted all the files with R-Studio, and then, by my own initiative, and without charging anything more for it (well, I thought of it as practice, and a compensation for my rookie mistakes, without which I may have been able to get a slightly higher recovery ratio !), noticing that there were many duplicated files on the drive, I set about fixing as much of the damaged files manually, by first detecting them with DoubleKiller (scanning the whole recovery for files with the same size, disabling the CRC analysis), then opening the two or three instances in WinHex, and seeing it the corrupted area(s) from one instance could be copied-pasted from another, and the other way around : in most cases, indeed, either one instance was complete, or two instances were damaged the corrupted sectors were in different spots, so I could rebuild the original complete file. At the end of this quite daunting task, there remained about 20 corrupted files, among which six low quality DVDrip movies, a bunch of unimportant Web pages elements, so only a handful of personal videos were partially or completely unreadable (I also repaired a few MP4 files with a missing index using Grau Video Repair). And then as the dude was dumb enough that he didn't find the recovery, although I had made a complete report with detailed explanations taking into account his very basic knowledge level (he expected to find his personal folder or Windows' “desktop” right away, just like when turning on his computer, not nested deep in the directory tree), I spend an extra hour showing him through remote assistance where his files were, and trying to show him a few tools and tricks to backup them and organize them, which he probably forgot right away... :roll:


Quote:
Even if you can't fix firmware and damaged heads you can still charge $100 or $200 for your logic recovery and pay the taxes and be on the legal size without extra worries as you do already have on IT shop open to the public, etc ...

I currently don't have a legitimate business to begin with, which is indeed making things more complicated... But in my area, I've seen data recovery fees by computer repair shops or freelance technicians (for logical recovery obviously) closer to 50€ than 100-200€.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 43 posts ]  Go to page Previous  1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: EnigmaSpace and 104 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group