How to rescue data from "corrupted/in-accessible" drive/part

[hansaaa]

Hi... I hope this is the correct forum for this kind of post! If not, please, do not hesitate to let me know where ELSE I can ask this type of stuff! Thanks!

And now, the actual problem/situation I am facing.

I used to have a Windows 7 Laptop, with two, internal (2.5 inch), as far as I know, SATA, hard drives.

This, old, PC, was not in very "nice" shape, hehe. SO, I sent it to repair. I took out the hard drives, because, I was hoping to work with them on my "rental" pc, that is a Windows 8 Laptop, from which I am writing this now.

The two aforementioned SATA drives, apart from the Laptop itself, were also giving problems, mainly things such as "unmountable boot volume" errors, and such, on trying to load the operating system on the old laptop.

Now, as I have mentioned, I got a rental PC/Laptop, for the time being.... So far, I have been able to work WITHOUT the data I had on the two internal HDDs from the old pc.

Now, however, I would like to pull all my data from these two OLD HDDs onto a new, external, HDD, using the rental PC I've got now.

So, what I've done is:

Get a 2.5 inch USB external HDD case, two incase the two OLD HDDs, one at a time.

And: Get a NEW, 1.5 Terabyte, external 2.5 inch TOSHIBA HDD, onto which the data from the two OLD HDDs is supposed to, hopefully go/be pulled into.

So, I have both hooked up to the rental-laptop, at the moment, and, the new TOSHIBA HDD is running, as expected (I just purchased it today, so, this SHOULD be expected, hehe ).

However, the first of the two OLD HDDs, which is partitioned into three partitions, doesn't work as I would HOPE it works.

I have it in the external Casing, hooked up via TWO USB cables (for power reasons, it doesn't seem to run with only ONE USB cable), and open up "computer" under the "windows explorer".

This shows me:

The System HD of the rental PC (C:) OK

The secondary HD of the rental PC (E:) OK

The removable DVD RW Drive of the rental PC (D:) OK

-----------


The NEW Toshiba external drive (1.5TB, F:) OK

AND, it also shows me the three partitions of the OLD internal HD, G:, H:, and I:.

However, unlike the other hard drives, it doesn't show any information on the drives, such as Size in MB or GB, nor any other information, just the drive letters.

If I "click" on any of the three partitions, in order to open them, "windows explorer" tries to open them, loading for, basically, for ever, or, a long time, and, then, at some point, crashes/becomes unresponsive.

So, I can basically not access any DATA/INFO on any of these 3 partitions, on the first of the two old HDDs. At least not, at the moment.

I am now wondering: How can I / what Steps do I need to take, in order to try and get the DATA (xls-files, visual studio projects, etc. pp.) from drives G: H: and I: onto my new external Drive F: (Toshiba).

Do I need to do things like running "chkdsk" on these drives/partitions? Is there any software I can use to try and get the info on these drives? What can I do?

Any, and all help, is VERY much appreciated!!

Thanks!!

Cheers!

C

[lcoughey]

If your old laptop had two hard drives in it, it is very likely that they were setup in a RAID 0 stripe, which means that you have a lot of learning to do before you will be able to recover your data, if you haven't already messed things up.

How valuable is the data on the drives to you? If you are willing and able to pay for a data recovery lab to help out after you have exhausted all your options, you might want to get the help sooner than later. By doing this, your cost is likely to be lower and you will have a much higher chance of getting your files back.

Assuming that your hard drives are somewhat healthy, I'd suspect that a reputable lab would be doing this for under $1000. (assuming the RAID 0 theory, as well)

Depending on your skill set and resources, I may be able to help out remotely, as well.

Edit: Whatever you do, DO NOT RUN CHKDSK!

[jerovsek]

Dear hansaaa,

which modelof notebook is this.
Like lcoughey write , it could be RAID0.
Otherwise
first try to connect drives to winxp machine. If everything will work, then just copy files to Toshiba drive.
Try connect to desktop PC and also try with some other USB to SATA/IDE adapter.
If there is no luck, then ask some expert near you to help you.
Don't use any software or DIY if your data is important to you.

Best regards
JJ

[hansaaa]

Ok. I haven't run chkdsk yet, as, I was suspecting that this MIGHT do non-good things Thanks!

About the value of the data:

Well, putting a value on it is not that easy, BUT, a fair amount of work has gone into some of the "stuff" on the drives, SO, it would be NICE to be able to recover some, or, if possible, all of the data. Unfortunately, at least AT THE MOMENT, I don't really have 1000 or more $ left, which I could use for this.

The notebook model ( in repair, from which the two OLD drives "originate ), is: Toshiba Satellite P300-212. URL: http://www.notebookcheck.net/Toshiba-Sa ... 831.0.html.

I was running Windows 7 on this notebook, as far as I remember, 64-bit. Originally, it had Windows Vista (aaah ) on it.

I was unable, so far, to find this model on the actual Toshiba web site. I purchased it ca. 4 years ago (a bit less, 3 years and 10 months, or so).

The model I have as a rental-pc (on which I would like to run the "back-up/save/whatever"), is: Samsung NP300E5E-A02DE http://www.samsung.com/de/support/model ... oadName=UM.

It is a german model, but, the manual (in English) is available here: http://www.samsung.com/de/support/model ... adName=UM# (attention, 17.13 MB).

It is running Windows 8, 64-bit, as well.

It's specs, are available in "Chapter 6: Appendix" under "Product Specifications", which should be Page Number 133 out of 140 pages, in total!

Jerovsek: You say, it might work if I hook up the two OLD drives to an XP-Machin, rather than a Win7/8 machine?

LCoughey: If you were to walk me through some of it, what would you recommend as next steps? I would hope I could buy you a beer ór so, after that. Maybe we can work something out!

[loki]

If it is raid0 & you haven't ruined your chances already then you would need to research building a virtual raid using software like R-Studio, UFS Explorer or Raid Reconstructor - these are not free software.

If you choose DIY then you accept the risks involved.
Best practice would be to do a sector by sector clone/image of each drive first to a good know drive(s) & then use these images to do your recovery using what ever software you decide.
Do not write, run chkdsk or initialise the drives.
If it is raid0 then it will be easier to rebuild than other raids like raid5 etc.

Another option is to put the drives somewhere safe until you can afford a pro data recovery service


Loki

[mr_spokk]

Are you sure that the drives is not ATA locked? On your old machine did you enter any password before Windows started?

[lcoughey]

As I said, I can provide remote assistance, but not for free.

[hansaaa]

I was NOT entering ANY password, when I "entered" the Operating System, on the old Laptop.

LCoughey:: What are your prices

[fzabkar]

There are freeware RAID reconstruction tools such as DMDE and mdadm. If the file systems are intact, and if the drives are in reasonable physical shape, then a DIY RAID recovery shouldn't be too difficult.

The first thing I would do, other than cloning your drives, would be to examine sector 0 of both drives with a hex editor such as DMDE. If you can post those two sectors, then perhaps we can get you going for free.

[jerovsek]

Hello hansaaa,

I check a little bit, and I found that Toshiba Satellite P300 doesen't support RAID.
Just to clarify things:
when you connect first disk, it display 3 new drives, which are not accessible and no partition and data size is visible .
What shows you, when you connect second disk? Is this one accessible or not, you see partitions or not?

You can try with R-studio demo(great recovery tool) to check if you can recover files. Instal on yoour current notebook without connected disk, then connect it and try
http://www.data-recovery-software.net/D ... load.shtml
If you don't need RAID option it cost 80USD
For external enclosure I suggest you to use enclosure with external power adapter. (http://www.sweburn.com/product.php?productid=1361)
There are also free software solutions on the market.

Be patient and careful. You can also check if there is some datarecovery expert near you. It could cost you much much less then it was mentioned in posts and you will be satisfied.
Everything depends on your knowledge, experiences and how much is your data important to you to play around.
Every step, you will perform is in your hand and risk too

[hansaaa]

@Jerovsek: Okay, I just connected the second disk. At the beginning, it was not available/visible, or anything, in "Windows Explorer". I then checked in disk managemeng (diskmgmt.msc), and the second drive was there, visible, with Status "Healthy" and "Primary Partition", HOWEVER; with no drive letter. So, I assigned it a drive letter ("R:"), and went into Windows Explorer again. At that point in time, the drive became VISIBLE in "Windows Explorer", with Drive letter "R:". However, it behaved just as the other OLD drive, meaning: NO info on size, or anything, ONLY the drive letter. Trying to open it results in the same behavior as with the other drive, i.e. no access, and possible crashing/hanging of Windows Explorer, as well as, general unresponsiveness of some other programs, such as Internet Explorer, etc.

fzabkar: I have now run DMDE on the first of the two OLD drives, (the one with the three partitions, G:, H:, and I:).

This is the results I get:

http://postimg.org/image/bjvtn6601/

How can I get the info for sector zero, so that I can post it here for you to take a look at?

Thanks!!

C

[fzabkar]

The physical size of your drive (976 773 168 sectors) matches the partition table entries, so this confirms that you don't have a RAID, at least not a striped one. Therefore your best DIY option would be to clone your drive, sector by sector, using a tool (eg ddrescue) that understands how to work with bad media, and then run data recovery software against the clone.

[hansaaa]

Ok, ill try ddrescue. I hope, it's fairly straight forward. Do you, already, have any suggestions, for data recovery software, that I can run "against" the clone?

Thanks!

C

[hansaaa]

Hmm, okay, I have gotten the 1.16 tar from http://ftp.jaist.ac.jp/pub/GNU/ddrescue/.


seems I need to build it myself, and also, seems like it is a command-line-tool. I hope I can run this

Do you also have any suggestions for any data recovery software, that I can run "against" the clone, when I have it (hopefully )?

Thanks for your help so far!!

Cheers!

C

[hansaaa]

Hmmm... double post: OOPS!! hehe!

Okay, so I have been able to build ddrescue-1.16, with Cygwin/GCC.

I am running ddrescue.exe, from within Cygwin.

"ddrescue --help" gives output:

a@hans /cygdrive/c/Users/a/Desktop/ddrescue-1.16
$ ddrescue --help
GNU ddrescue - Data recovery tool.
Copies data from one file or block device to another,
trying hard to rescue data in case of read errors.

Usage: ddrescue [options] infile outfile [logfile]
You should use a logfile unless you know what you are doing.

Options:
-h, --help display this help and exit
-V, --version output version information and exit
-a, --min-read-rate=<bytes> minimum read rate of good areas in bytes/s
-A, --try-again mark non-split, non-trimmed blocks as non-tried
-b, --block-size=<bytes> sector size of input device [default 512]
-B, --binary-prefixes show binary multipliers in numbers [SI]
-c, --cluster-size=<sectors> sectors to copy at a time [128]
-C, --complete-only do not read new data beyond logfile limits
-d, --direct use direct disc access for input file
-D, --synchronous use synchronous writes for output file
-e, --max-errors=[+]<n> maximum number of [new] error areas allowed
-E, --max-error-rate=<bytes> maximum allowed rate of read errors per second
-f, --force overwrite output device or partition
-F, --fill=<types> fill given type blocks with infile data (?*/-+)
-g, --generate-logfile generate approximate logfile from partial copy
-i, --input-position=<bytes> starting position in input file [0]
-I, --verify-input-size verify input file size with size in logfile
-K, --skip-size=<bytes> initial size to skip on read error [64 KiB]
-m, --domain-logfile=<file> restrict domain to finished blocks in file
-M, --retrim mark all failed blocks as non-trimmed
-n, --no-split do not try to split or retry failed blocks
-o, --output-position=<bytes> starting position in output file [ipos]
-p, --preallocate preallocate space on disc for output file
-q, --quiet suppress all messages
-r, --max-retries=<n> exit after given retries (-1=infinity) [0]
-R, --reverse reverse direction of copy operations
-s, --max-size=<bytes> maximum size of input data to be copied
-S, --sparse use sparse writes for output file
-t, --truncate truncate output file to zero size
-T, --timeout=<interval> maximum time since last successful read
-v, --verbose be verbose (a 2nd -v gives more)
-x, --extend-outfile=<bytes> extend outfile size to be at least this long
Numbers may be followed by a multiplier: b = blocks, k = kB = 10^3 = 1000,
Ki = KiB = 2^10 = 1024, M = 10^6, Mi = 2^20, G = 10^9, Gi = 2^30, etc...
Time intervals have the format 1[.5][smhd] or 1/2[smhd].
Report bugs to bug-ddrescue@gnu.org
Ddrescue home page: http://www.gnu.org/software/ddrescue/ddrescue.html
General help using GNU software: http://www.gnu.org/gethelp

Are you able to, provide me with any help, on what I need to do to copy the disk, sector by sector, as you said? I will ALSO see, if I can find any additional instructions for this, at the ddrescue web site!

Thanks!!!

C

[Vulcan]

GNU ddrescue is not simple to use safely & effectively - it is very flexible and with that flexibility comes choices and decisions. It took me some time (and practice, and reading the source code) to get comfortable using it for DIY recoveries, where the risks are accepted with low-value data. The command parameters used can also need to be tweaked, depending on the (faulty?) disk's specific behaviour, the specific Linux / Unix version being used (personally I tweak the OS driver tunables a bit too, for added control), and exactly how you are cloning the drive (to a filesystem, or to a raw drive, or to an NFS mount on another system, or ...). The point is that ddrescue is not a "one-click" utility; but in the right hands, with practice & skill, it is very powerful - and it's free.

Personally I don't agree with compiling it to run under Cygwin i.e. still using Windows drivers. One of the main benefits that it offers is that it can be used under Linux / Unix and hence it can get away from the limitations and lack of observability & control imposed by Windows drivers. However that requires the person using it to have enough experience with Linux / Unix to be safe using it. We've seen people here who "dived in" with using cloning software like this, and then overwrote their data by specifying the direction of the clone wrongly, or they overwrote other data that they wanted on the destination disk, as they didn't understand about filesystems vs. disks. As it says in the ddrescue online manual:

Ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely.

From everything I've read in this thread, with respect, I'm not sure that you truly understand the situation. You might be unlucky and this could be the one chance to recover your data; you can't be sure that you can "give this a try and if it doesn't work, then ask a professional". Sometimes that is possible; sometimes that is possible, but only at increased cost; and sometimes that isn't possible at all and the data is unrecoverable due to the DIY attempts, but would have been recoverable if a professional had been given the disk first. So you have to accept the possibility that you might lose your data through your own actions, if you make a mistake, or are just unlucky, if you go down the route of trying DIY. If you are prepared to take the risks of DIY, then by all means carry on - you might by lucky and recover your data yourself

So far, you seem to be reporting 2 disks with similar symptoms. That concerns me a lot (2 drives failing at the same time - unlikely unless there is a common cause), but in the limited time to try to absorb your story, it isn't clear to me whether the reason for this has already been diagnosed.

If the data was low value, and the risks of DIY were really understood & accepted, personally I would be using a known good PC with a SATA interface, to do a little more diagnosis of one of the "problem" drives, using Linux (e.g. gathering the SMART data from the drives, and seeing what error messages were reported for the "problem" drive(s) in the dmesg output during a boot). At the very least, I would not use your current configuration of an external (new and therefore also unproven?) USB enclosure, to contain the "problem" drive(s). Having the "problem" drive(s) SATA-attached allows much better error reporting & handling. We've seen people here who failed to clone a "problem" drive in a USB enclosure, but were successful when that same "problem" drive was SATA-attached (this has been discussed before and should be in the archives somewhere).

I've run out of time, but I hope those comments give you some alternative approaches to think about & consider. Good luck with whatever you decide.

[fzabkar]

Sometimes Ubuntu can mount a file system that Windows reports as RAW.

Ubuntu LiveCD:
https://help.ubuntu.com/community/LiveCD

You can also use Ubuntu's tools to clone a bad drive before working on it with data recovery software.

Ubuntu Rescue Remix:
http://ubuntu-rescue-remix.org/

Install Ubuntu Rescue Remix to a Flash Drive:
http://www.pendrivelinux.com/install-ub ... ash-drive/

Clone a failing Windows hard disk with ddrescue on Ubuntu Rescue Remix:
http://keystoneisit.blogspot.com/2011/0 ... -with.html

[hansaaa]

Well, I guess, Pro Tools, need Pro Users, hehe

I might take a look into your Ubuntu suggestion, but if I don't, I guess I will just try and keep the HDDs until I can afford any type of professional data rescue.

If you would be able to help me on one final question (if the answer is not TOO complicated, and/or time-consuming):

In general, WHY is it not a good idea, to run chkdsk, on a drive that seems to be problematic, such as either one of the two I am/was trying to rescue?

Could there be ANY benefit in running chkdsk on one of the drives, and what kind of risks can there be?

Or, is it basically, an "iditiotic" thing to do, and it will DEFINITELY ruin any data I have on it.

I am just asking, because, basically, I "know" "chkdsk" exists, and I know that Windows sometimes seems to use it to, well, I guess, "check the disk", but I don't really know what it actually does, or, why it can be risky to use it.

In general, I am, unfortunately (;)), not an expert, by any means, on HDD, or Data Storage. I have more expertise in Software Issues, so, I basically, understand how data is stored in bits and bytes, and so on, but have never had a chance to take an in-depth look on how an HDD achieves to store the data, what are the factors that influence/describe an HDDs "inner" mechanisms, and so on, so, I am very thankful for your help in this thread, even though, it seems, that I might not get any further in this issue, unless I go to a professional Data recovery lab (i.e., not "Do-It-Myself"), as, as I said, I am not a pro in this field at all! hehe.

Anyway, thanks again, for all your help and suggestions you have given me! You have been a great help, as far as you probably could've been with anyone with non-pro knowledge on this issue, such as me!

Thanks!

[Vulcan]

Clone a failing Windows hard disk with ddrescue on Ubuntu Rescue Remix:
http://keystoneisit.blogspot.com/2011/0 ... -with.html

Unfortunately that is one of the worse tutorials out there for ddrescue, and definitely not for beginners. As the author himself says:

this is not an idiot-proof guide. Important but obvious steps are omitted.

So personally I don't believe it is suitable for beginners as it misses important explanations of some of the concepts, and is only showing one example of the "automatic" approach to ddrescue recovery, hence it doesn't give any value to the experienced user either. Over the years, I've seen few, really good, ddrescue tutorials.

Could there be ANY benefit in running chkdsk on one of the drives

Don't do that with the original drive(s). In fact you won't be able to do it, until the filesystem type is correctly recognised - but even if you get to that stage, don't do it with the original drive(s).

what kind of risks can there be?

The problem is that chkdsk (& its Linux / Unix equivalent, fsck) could only be any help if they actually change the filesystem metadata (i.e. if they are not using their read-only mode). However you don't know what changes they will make until after they have been done, and those changes are not reversible. We've seen examples here (as have I, with friends & family) who have run chkdsk / fsck and been much worse off afterwards, as files / directories / whole filesystems (volumes in Windows) disappeared, making any subsequent (file signature-based) recovery less successful than it would have been, if they hadn't run chkdsk / fsck first!

This is why (if you have decided to take the risks of DIY recovery attempts) it is definitely recommended to clone the drive(s) (or have a backup, in a non DR situation) first, before using chkdsk. In fact, if there are problems physically reading from the drive(s), then it is really necessary to have a second "good" clone of the data before running chkdsk on one clone, as you can't be sure that you'll be able to successfully clone from the original "problem" drive(s) again, if you don't like what chkdsk does to your first clone. These are the sorts of details which come with experience, but there are lots of nuances depending on exactly what recovery procedure is being used.

In general, a typical DIY approach is to clone the drive(s), preferably using a non-Windows utility; then use recovery software to try to recover the original files from the clone, onto yet another empty drive (or separate volume). Hence even your new 1.5TB drive won't be large enough to hold the 1TB (2x500GB) clones or image files (depending on your choice of cloning approach) and anything more than 500GB of data in total, recovered from the drives by recovery software (if you are successful).

I am very thankful for your help in this thread, even though, it seems, that I might not get any further in this issue

FYI I'm not saying that you can't get further; however I am saying that there are risks due to your lack of experience, and several other factors. That is why I explained earlier that you have important decisions to make, about whether you want to take those risks. There is insufficient information (diagnosis) about what the real underlying problem(s) might be with the drives, for me to be able to make any specific comments. All I can say, as I mentioned before, is that 2 drives with similar behaviour is odd. Perhaps the original laptop was dropped / knocked with both drives in it...

If you want to take a risk and try collecting the full SMART data (including raw values) from at least one (preferably both) of the drives, then that might give more of a clue about the underlying problem(s) - although some problems may not show in that data, unfortunately. I can't predict exactly what that data might show (or not).

[hansaaa]

All I can say, as I mentioned before, is that 2 drives with similar behaviour is odd. Perhaps the original laptop was dropped / knocked with both drives in it...

Hi Vulcan: unfortunately: yes, that was the case, which is WHY, I sent the old laptop to repair (I had a warranty on it, that also covered Droppong, etc. hehe).

So, the old laptop is back, but the drives are still in the same shape, as I took them out, because the warranty does NOT cover data rescue, and, the price they gave me is $599 per data medium/disk, so, a total of over $1000.

I HAVE found cheaper offers out there, but I was at least hoping, something, could be done without taking those "alternatives".

I guess, unless something lucky falls "onto my head", it won't be very easy for me to do this myself, as I have "limited" experience in this. I would like to learn more, but, I don't know if just reading a bunch of "tutorials" on the internet is a good way to go, if I really don't know that much about it to begin with. Again, I am more of a "softie" (software person), hehe Possibly, I will have to go the way of a "data recovery" lab, when I can afford a cheaper one, at some point.

Do you have ANY recommendations about how I can learn more about this?