Only seeing 11GB of 1TB Drive?

[bascotie]

Hi guys,

I'm trying to get data off a 1TB drive. The computer says it needs to be formatted, Recuva says it can't find the file system, and when I image it with DDRescue it 'finishes' after getting only 11GB of it (which I can't read when mounting in OSFMount).

Any ideas why this would be, or if there is a way to recover the data without a specialist?

[MindMergepk]

provide more details; e.g drive brand and model, the symptoms before failure ?

[bascotie]

provide more details; e.g drive brand and model, the symptoms before failure ?

Wow, you guys are fast. Well, I'm doing this for someone else and I don't have many details except the drive info:

Model ST1000LM024
P/N: HN M101MBB/Z4
Samsung Momentus

I don't hear any clicking noises or anything, it sounds like a normally drive when I put it on my sata dock. The computer detects it but says it needs to be formatted.

[fzabkar]

Could we see sector 0? You could use a freeware disc editor such as DMDE.

How do tools such as CrystalDiskInfo detect the drive?

[bascotie]

Thanks Fzabkar,

Here are a couple screenshots, not sure if this is the correct information though:

http://imgur.com/bG5k8w3,b6124Ui#0

You can click "First image and second image" up top to see both. Thanks!

[fzabkar]

Here are direct links to your images:

http://i.imgur.com/b6124Ui.png
http://i.imgur.com/bG5k8w3.png

SMART looks good and DMDE is seeing the full range of sectors, namely 0 - 1953525167. Therefore it's not an HPA issue.

Sector 0 is showing a single 1TB FAT32 partition beginning at sector 2048. However, DMDE's Partitions window is displaying an "x" in the "Indicators" column where it should normally display a "B". This is suggesting that the boot sector is missing (although the copy "C" is still present), which is consistent with the "computer says it needs to be formatted" symptom. I can't yet explain why there is an apparent 11GB capacity limit, though.

DMDE can "Restore the Boot Sector from the Copy", but before you attempt this, could we see sectors 2048 (the boot sector) and 2054 (the copy)? You would need to select Mode -> Hexadecimal.

[bascotie]

Of course Fzabkar, I appreciate any help I can get.

I hope this is the information you requested:

[fzabkar]

I wouldn't try to edit this drive. Sector 2048 looks like a remnant of a 32-bit FAT. This FS structure should follow the boot sector, not precede it.

Perhaps you should connect this drive to a SATA port on your motherboard, just to be absolutely certain that the USB-SATA bridge hardware is not confusing the issue.

Sector 2054 does look like a boot sector copy, and its data are consistent with the data in the partition table. That is, the data are consistent with a 1TB FAT32 volume beginning at sector 2048.

An Examination of the MSWIN4.1 OS Boot Record:
http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm

It might be worth examining sector 63 and the sectors surrounding it just to get an understanding of what actually happened to corrupt the file system.

[bascotie]

Thanks again. I honestly don't think I have the skill to examine sectors at this level. I have tried it on 2 different USB mounts though.

[fzabkar]

If you double-click the partition in DMDE, do you see a file system?

[bascotie]

If you double-click the partition in DMDE, do you see a file system?

I think you did it! By just double clicking on the 'verbatim' partition I see the file structure. Awesome! I recovered one file as a test and it worked. Going to try some more but I can see just about every file it looks like. You've saved me again fzabkar

[fzabkar]

If the files are intact, then, after you have recovered them, you could try to "Restore the Boot Sector from the Copy". BTW, the free version of DMDE has a limit on the number of files it will recover.

[bascotie]

Thanks. You may have sold me on the express version, it looks like it has unlimited file recovery and it's only $20

[MindMergepk]

If you double-click the partition in DMDE, do you see a file system?

I think you did it! By just double clicking on the 'verbatim' partition I see the file structure. Awesome! I recovered one file as a test and it worked. Going to try some more but I can see just about every file it looks like. You've saved me again fzabkar

glad you have recovered the files
nice work "fzabkar"

[fzabkar]

It appears that the first sector of the FAT overwrote the boot sector, while leaving the previous and next sectors untouched (I can only only see the last and first lines of each sector, though). However, I wouldn't count your chickens just yet. ISTM that this type of corruption would be reason to suspect additional corruption elsewhere within the file system, perhaps of an insidious nature. Such corruption only becomes apparent when you try to open the damaged file(s).

[bascotie]

It appears that the first sector of the FAT overwrote the boot sector, while leaving the previous and next sectors untouched (I can only only see the last and first lines of each sector, though). However, I wouldn't count your chickens just yet. ISTM that this type of corruption would be reason to suspect additional corruption elsewhere within the file system, perhaps of an insidious nature. Such corruption only becomes apparent when you try to open the damaged file(s).

Thanks again. So far the recovery is going well and I opened a couple files to check and they had no issues. Everything will be going on a new drive to be safe, though

[bascotie]

So it seems while I was able to recover a lot, a lot of folders had the correct titles but there weren't any pictures inside. Any methods I could use to try and repair those folders?

[fzabkar]

Are you certain that you're not running into a limitation of the free version?

[bascotie]

I bought the paid version so I no longer get the notice about a limit on files I can recover.

[bascotie]

Funny thing.. today I remounted it and tried again, and now I am able to recover the pictures from the drive. I'm still at it so I'll see how it goes