after partition recovery windows shows raw file system?!

[disaster]

Hi!

I have a WD MyBook Essential 1TB, which device somehow deleted the existing partition (there was only 1). I was able to recovery all my files with R-Studio before using EASEUS Partition Master.
Now after the partition recovery - EASEUS told me it was successfull - the recovery softwers recognise my partition as an usual NTFS file system and both R-Studio and UFSExplorer can read the whole content without any further scans, but not the OS windows7. It shows RAW file system.
How could be solved this issue?

Thanks in advance.

[dmarques]

If you have your data already saved, delete and create a new partition and format it with a valid file system and drive letter.

[disaster]

I don't want to format, so I don't have to copy again 850GB data, since the MFT is probably ok. Any other ideas?

[poehere]

You can try your install disk and see if you can use this to repair your existing OS on your computer. But first like we say copy your data to another HDD and save it there. I would not suggest to try using this resotre function or even the repair function if you do not have your data backed up in this one.

[disaster]

Theres is no OS, it is an external HDD only for data.

[poehere]

simple use RStudio or the other software to read your file structure, copy it off, move it to a new HDD, then you can format this one. Second you can purchase a good recovery progam for partiono and MBR and see what happens but they are not free, Thrid you can try test disk and see what happens on this one too. If you have no luck in your MBR, MFT, or partition of this then copy off this data to another HDD, format it and start over.

[disaster]

I think there is a misunderstanding. As I wrote in the first post, everything is already recovered. I need to see the whole partition in windows again WITH my datafiles WITHOUT formatting etc.
Before using EASEUS non of the recovery programs recognised the partition. Now they do as a NTFS, but windows still not. Testdisk doesn't change anything in this issue.
What can be the problem and what is the solution? I hope now is everything properly explained about the situation (if not, please ask).

[fzabkar]

There could be a mismatch between the data in the boot sector and the partition table.

If so, then a manual reconstruction should be easy.

Could we see the partition table and boot sector with Microsoft's Sector Inspector?
http://www.users.on.net/~fzabkar/SecInspect.zip

Extract the above archive to the one folder and execute the SIrun.bat file. The procedure will generate a report file named SIout.txt.

You may need administrator privileges in order to access the drive.

If the above doesn't work, then use a disc editor to capture the contents of sectors 0, 63, and 2048.

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd/

DMDE Free Edition:
http://softdm.com/download.html

[Vulcan]

I hope now is everything properly explained about the situation (if not, please ask).

OK, I'm asking because some details are still unclear/missing.

I have a WD MyBook Essential 1TB, which device somehow deleted the existing partition

What happened between the last time when the data partition was correctly recognised, and when it was first "deleted"? Or to put it another way, how do you know that there isn't a bigger underlying problem? Partitions don't just "disappear" on their own...

With hindsight, it would have been useful to gather the MBR/partition table contents as soon as the problem occurred, since it is sometimes obvious what happened when the contents of the MBR are examined.

I was able to recovery all my files

Just to get a clear understanding - where did you recover the files to? A different hard disk drive? Are you really, really confident that those "recovered" files are usable? For example, just because you can see the filenames in Windows, does not mean that they have been correctly recovered.

I don't want to format, so I don't have to copy again 850GB data

Please explain why doing a restore back onto the MyBook from wherever you have the recovered files, is such a big problem? For example, if the recovered files are on another hard disk (see question above), then doing a copy of 850GB (especially if you just do an "image restore" of the whole partition containing the recovered files) will typically finish overnight or a bit longer (e.g. 12-15 hours approx time). Doing a "file restore" will take longer, depending on the quantity of files.

If you can please explain your constraints/limitations (i.e. please explain why you can't/won't do what has been suggested already) then that would be helpful - it is because you didn't initially explain that you won't do a restore from your recovered files, that several other members so far recommended exactly that process. Just saying that you don't want to do that restore from where you have the recovered files, does not help to explain your real, full situation & limitations Please help us, to help you we can't "read your mind" to understand why you are so "against" what has been recommended so far!

[disaster]

What happened between the last time when the data partition was correctly recognised, and when it was first "deleted"? Or to put it another way, how do you know that there isn't a bigger underlying problem? Partitions don't just "disappear" on their own...

I thought also partitions don't disappear but it did, this MyBook construction is crap, because it has a hardware encryption, despite that I did not set any password. It means I can not access the files through an internal SATA connection. Nice..
Maybe there is a problem, but I would try the way first without formatting.

With hindsight, it would have been useful to gather the MBR/partition table contents as soon as the problem occurred, since it is sometimes obvious what happened when the contents of the MBR are examined.

I did not have such problem, so I made it according to the step-by-step guides to recover the files.
[/quote]Just to get a clear understanding - where did you recover the files to? A different hard disk drive? Are you really, really confident that those "recovered" files are usable? For example, just because you can see the filenames in Windows, does not mean that they have been correctly recovered.[/quote]
To another hard drives. I have tried a lot of files to access (play music, open pictures etc.) and checked the size, total allocated space. Not to mention, that R-Studio has a big reputation and it worked without any problems during the recovery.

Please explain why doing a restore back onto the MyBook from wherever you have the recovered files, is such a big problem? For example, if the recovered files are on another hard disk (see question above), then doing a copy of 850GB (especially if you just do an "image restore" of the whole partition containing the recovered files) will typically finish overnight or a bit longer (e.g. 12-15 hours approx time). Doing a "file restore" will take longer, depending on the quantity of files.

I don't wanna spend the time, if not necessary, since I can see the whole structure, but something is messed up in the boot sector and partition table. If nothing helps sure, but I can hardly imagine, that it can not be solved differently.

Thanks.

[disaster]

There could be a mismatch between the data in the boot sector and the partition table.

If so, then a manual reconstruction should be easy.

Could we see the partition table and boot sector with Microsoft's Sector Inspector?
http://www.users.on.net/~fzabkar/SecInspect.zip

Extract the above archive to the one folder and execute the SIrun.bat file. The procedure will generate a report file named SIout.txt.

You may need administrator privileges in order to access the drive.

If the above doesn't work, then use a disc editor to capture the contents of sectors 0, 63, and 2048.

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd/

DMDE Free Edition:
http://softdm.com/download.html

I will check this. Thanks.

[disaster]

edit:
I have answered both replies, but the message said it has to be controlled by the moderator?!
if tomorrow cant be read, i will repeat it.

Btw.: getdataback window attached of the file tree

Attachments

[disaster]

There could be a mismatch between the data in the boot sector and the partition table.

If so, then a manual reconstruction should be easy.

Could we see the partition table and boot sector with Microsoft's Sector Inspector?
http://www.users.on.net/~fzabkar/SecInspect.zip

Extract the above archive to the one folder and execute the SIrun.bat file. The procedure will generate a report file named SIout.txt.

You may need administrator privileges in order to access the drive.

If the above doesn't work, then use a disc editor to capture the contents of sectors 0, 63, and 2048.

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd/

DMDE Free Edition:
http://softdm.com/download.html

Attachments

[disaster]

sectors:

Attachments

[fzabkar]

AFAICS, your drive has been partitioned using the MBR partitioning system rather than the default of GUID for current Windows versions.

The partition table at sector 0 is indicating that there is a single NTFS partition (type 07), with a size of 0x745B44AC sectors, starting at LBA 63.

The 16 bytes corresponding to this partition are located at offsets 0x1BE - 0x1CD.

80 01 01 00 07 fe ff ff 3f 00 00 00 ac 44 5b 74

Sector 63 appears to be a valid NTFS boot sector. It is reporting a size of 0x745B44AB sectors, ie 1 less than in the partition table. This is correct.

In short, both the boot sector and MBR appear to be intact. Therefore the problem is in some other area of the file system, perhaps a corrupted MFT.

[disaster]

Thanks for checking. Although im not such an expert, but I understand your explanation. But why doesnt windows recognise the f...in NTFS partition correctly then (why RAW?)
As you have seen, GDB shows the correct tree structure nothing is missing. Im not familiar with every detail in the MFT, but it contains only the information about the files, folders after windows reads the bootsector and recognises the filesystem. In this case windows not even recognises that there is a proper partition.
Can it be anyhow fixed?

[fzabkar]

Windows considers a volume to be raw if it cannot recognise the file system. It then treats the volume as a non-structured bunch of bytes.

One other sector you could check is the backup boot sector at LBA 0x745B44EA (= 1952138474 in decimal). The contents of this sector should match sector 63.

[disaster]

....

To be short:
- it happened only a proper shutdown, and you are right, I don't know if there is a bigger problem with the device, thats one of the reasons i don't want to copy the files again unecessary, before I have an option to fix it
- as for MBR issue, the first thing was to secure all my data if possible
- i recovered the files to different hard drives
- i have checked several recovered music files, pictures etc., checked the size and the total allocated space, so the files are not empty, not to mention that R-Studio has a big reputation among recovery softwares and there occured no serious problems during the process
- i have 3 reasons to try another way then copy the files again
1) see first sentence
2) i don't wanna spend 15 hours to copy again if not necessary
3) if this happens again, maybe I don't need to recovery the files, since they are not damaged obviously, something is messed around by MyBook hardware probably, because of this disgusting encryption feature

thanks for the reply

Last edited by disaster on December 13th, 2010, 4:06, edited 1 time in total.

[disaster]

Windows considers a volume to be raw if it cannot recognise the file system. It then treats the volume as a non-structured bunch of bytes.

Obviously, thats the problem. Is it possible to fix it?

One other sector you could check is the backup boot sector at LBA 0x745B44EA (= 1952138474 in decimal). The contents of this sector should match sector 63.

I will, but I can do it only later, I will post it. Thanks again.

[disaster]

One other sector you could check is the backup boot sector at LBA 0x745B44EA (= 1952138474 in decimal). The contents of this sector should match sector 63.

Attachments