June 21st, 2018, 9:42
– Between two valid $MFTMirr MFT records, only the timestamps and two other bytes are different (those two bytes are identical, I don't know what they are yet, apparently it's called “fixup” in DMDE).
June 21st, 2018, 20:42
June 22nd, 2018, 4:14
The fixup is a check to make sure the record is valid and not corrupt. The pattern is dictated in the beginning of the record, then bytes 511-512 and 1023-1024 (the last 2 bytes in each 512 byte block) should also have the matching pattern. The pattern needs to match in all three places, but otherwise is randomly generated so you can make it what you want.
This might be one important thing to check in the $Volume MFT record.
Locating the NTFS "dirty bit":
June 22nd, 2018, 10:59
June 22nd, 2018, 16:42
abolibibelot wrote:@fzabkarThis might be one important thing to check in the $Volume MFT record.
Locating the NTFS "dirty bit":
What should I check exactly ? Should it be set to “dirty” or not ?
In my case the entire MFT record has been wiped, and the aim is to reconstruct it as accurately as possible... If there's an inconsistency, but the filesystem is parsable again, I'll probably get a warning and a CHKDSK analysis should fix the abnormal values. In any case it would probably be wise to run CHKDSK even if it works flawlessly at the first attempt.
I haven't written to the partition yet, but I have built an almost complete 3072 bytes file in WinHex, corresponding to the 3 missing MFT records.
June 22nd, 2018, 18:35
As far as the LSN value, I would say set it to zero if you can't figure out what it should be. Maybe that is something that chkdisk can fix. I don't have any idea about the LOG file, nor do I (and probably everybody else on here) have much interest in it, as it is not important for data recovery
I should say that is not important to data recovery, unless you are using CHKDISK to, uh, "recover" the data
June 22nd, 2018, 19:18
June 22nd, 2018, 19:39
June 22nd, 2018, 20:06
viewtopic.php?f=1&t=36995
I agree with the others in that you should fully erase/reformat this drive a couple times to see if any bad sector arises, then trash the drive.
@abolibibelot, congratulations ... I think.
June 22nd, 2018, 20:20
June 22nd, 2018, 20:46
June 22nd, 2018, 22:50
No they wouldn't.
They would simple hook up the drive to something like PC-3000 DE or even use simple methods like open the drive with R-Studio and directly extract the data.
Yes, nobody would bother to fix the partition by hand because it's a time waste and no-one in it's right mind would even "consider" to re-use that drive even more "gamble" with that chkdsk !
You were very lucky so far and that's it.
Thats because they are experts, and they work in data recovery. The job is recovering the data. The most trusted way would be to just extract with R-Studio, for example. Why mess with direct editing of the partitions when not necessary , and possibly making another customer wait ?
June 23rd, 2018, 8:58
What I did was relatively painstaking because I'm relatively new to this, but knowing what I know now I could probably fix a similar issue in a fraction of the time necessary to extract the whole contents (although it's a wise safety measure, especially if there's any doubt about the drive's fitness status) and write it back (if it turns out that the drive is fine). I'm wondering what a “regular” computer repair technician – i.e. not a data recovery expert – would do in a case like this, if a client brings a drive in the exact same state and wants it “fixed”.
June 23rd, 2018, 10:11
June 24th, 2018, 4:41
And what would happen if you rebuilt it, then ran CHKDISK and it wiped out half of the files in the MFT? Or if the MFT was fragmented and you only got the first part? Then it becomes a case of raw file recovery, which is now going to take much longer and the files won't be named or sorted. And if the files were fragmented, ouch! That is not the way to make a customer happy. And that is why nobody here would do it that way.
+2TB to maximus
Mr Belot, it seems you keep thinking in terms of fixing disks. The focus people that work with recovery use is in the *data*, not the disks.
To more or less use and translate something that I explain to people here, you can avoid eating a doughnut a day, and you will save enough money to pay for another hard disk in a month or two. But no matter how much you try to save, you will not be able to get all the people that were in a party, with the same clothes, in the same positions, to take those same pictures. Can you make somebody marry again so that you can take those lost pictures ? Don´t think so.
That´s why recovering the files, even if takes a day or two longer, is the preferred action. Hard disks can easily be bought. Data cannot ( the work of months ? data from experiments that now have to be run again ? )
Sure, understanding the inner workings of filesystems is good and very useful, for the times it is necessary. It just isn´t the best option for all cases. Actually, it is the option just for some very small % of cases.
To use a somewhat related case I got myself into once : With the customer talking too much about how good technicians do not need to format computers, how someone he knows at Microsoft said they do not need to format computers, etc.
And I was naive/inexperienced/distracted, whatever, and went with his ideas that time. And after 2 o 3 hours suffering with his very hosed computer, still had to backup and reinstall windows. Had I taken the correct approach in the case, to backup and restore, after what he had described as the cause of the problem, I would have ended earlier and the service would have been profitable, with the same end results achieved. Now I chalk that as a lesson to have learnt something, but it is a true lesson anyway.
Sometimes one can cross the river in a boat, instead of building a bridge.
If you don't need the data on this drive just zero fill it or run secure erase. All sectors should be written to. If the sectors are found to be bad they will be moved to G-List. If the sectors can be re-used they will be removed from RE-LO list.
If you keep on using this drive you will risk to get the "slow issue" very shortly as your re-lo list is growing ...
But of course you might want to use chkdsk on this drive as well just for the fun of it ...
June 25th, 2018, 1:43
That is why people move PBAs to the P-List or use Self-Scan.
June 26th, 2018, 6:01
With thos sort of Sea"junk" as soon as the platter is on that condition it doesn't matter if you are reading near of far the bad sector as all the platter will be gone !!!
People don't do anything at all ... they should !!!
But it's very good as well that people don't care and continue to use drives in bad condition ... that is how data recovery firms can make a fortune !
Assume a TRACK with 500 sectors.
5 Sectors are bad.
You write a file that is fragmented it stores itself on the 5 bad sectors + 10 sectors on that track + the rest is stored on another place.
If hat you are saying is true you are safe, correct ?
Now let's say that you do have a single sector on the same track that is part of your windows installation as is used all the time, for example explorer.
Now everytime you run your computer and your os need to load that specific file it places the heads of the drive on the track with the bad sectors and even if the head goes above the sectors that are bad withou reading them the phisical proximity to that bad spot is exactle the same as if the sector were to be read ... and you keep moving your heads above those bad sectors ... so what ?
I would say if it's a Seagate F3 arch just trash it. If it's a Seagate ST-10 just self-scan it. Those are VERY GOOD DRIVES.
June 26th, 2018, 18:23
- If you do open that DM drive just don't even think about ever using it again to store anything at all. The drive will just be "gone" as soon as you open it outside a HEPA 100 aseptic room.
Data recovery is a very high profitable business if you are clever !!! Check for example eBay for people operating there. People can charge for example $300 for simple file un-deletion and those services still sell.
Also if you check prices of firmware recovery on data recovery firms the price is normally at the same level of head swaps and if not it's on the same level of hardware repair and never on the cheaper level like logic recovery.
Also you can buy a bunch of drives in non-tested condition or even get those for free from people working on the IT field check those drives and sell them for $$$.
If you sell those drives with a note that they are special for data recovery guys and if you include some extra info like microjogs on WD drives you can even get that price higher for each drive that you do sell.
Even if you do have bad drives with damaged heads you can still sell the PCB for "data recovery" and still ask even more money for those PCBs that you would ask for the entire drive.
Even if you do get just a single case of firmware damage it will get you some considerable amount of $$$. Only "problem" might be head swaps that you do need to use parts- You can outsource those. Many people do only logic data recovery and imaging like using DDI4, etc ... And outsource the clean room work to bigger firms. Even so if you do charge $300 for those logic recoveries you will get considerable amount of $$$ very fast ...
June 26th, 2018, 19:31
June 26th, 2018, 22:41
Are you saying that you do want to recover the 6 files on the drive that are "stored" on the sectors that now are "bad" ? It might be possible at least partially. You will get the parts of the files that are stored on the good sectors and if you do patch sysfile 93 to stop re-location, etc you can use something like PC-3000 DE and do multiple reads on those bad sectors to see if hopefully one of the reads can get some data. If not at least you will still have the rest of the file. If it's a movie you might get away with just a little bit of damage (missing frames) ...
You don't even have to go to eBay fo find "what looks like high" prices for data recovery - viewtopic.php?f=3&t=36887
Another example - viewtopic.php?f=3&t=36904 - Flash pen drives, way smaller than usb - Logical (up to 32Gb) - $175 ; Minor (logical/quick physical fix) - $350 CAD.
This sort of recovery normaly is done by the use of R-Studio or similar to copy the data that can be recovered to another place.
The problem with head stack replacement is that you do need parts and often those parts will get damaged. You don't have to worry about that with firmware. With PCBs it's easier because even if you do have to buy/use a donor one it's not very often that the new PCB will get damaged and you can re-use it for the next job. Heads will last 3-4 jobs and will end up dying. Some Seagate DM will typicaly require 3 sets of heads to clone ...
The more data you can provide about a drive like pre-amp, firmware, etc the more chances are for a "professional" to get the "match" that he needs. If you list a drive as "Samsung 500 GB" and you don't add extra info like firmware, pre-amp type, etc data recovery people trying to find a particular drive for PCB/HEAD swap will not know if the drive that you are listing is compatible for what they want or not ...
You can sell PCB of your broken drives and get some $$$ out of it !!! Looks reasonable. You can even offer ROM transference/adaptation fee and you are good to go ! Just try it !
There are firmware failures that are easy to predict, like when you start to see several pending sectors on some WD drives
or when you pick up a F3 ARCH drive you know that those will fail for sure !
Also as i stated just buy a lot of drives, like for example 20 drives for $40 or $50 and then refurb those drives and sell them for $20 or $30 each ... same for PCBs if you can't "recover" the drive .... Now advertize some data recovery work, get something like R-Studio and start to charge people lololol
Of course that if you already have something like an IT business you can for example start to offer "basic" data recovery services. Just clone the drives with hddsuperclone and extrat the data with R-Studio and you will manage to get at least some cases.
Even if you can't fix firmware and damaged heads you can still charge $100 or $200 for your logic recovery and pay the taxes and be on the legal size without extra worries as you do already have on IT shop open to the public, etc ...
Powered by phpBB © phpBB Group.