Recovery files from a RAW partition

[petabyte85]

I install my HD 3 TB and he was as RAW, so I ran the Ubuntu from a Live CD and I see my partition with the label, so I open it and all my files were there (Everything fine), I thought I'd copy my files using Ubuntu, but I don't have another HD 3TB, so I thought of trying to solve this using the CHKDSK.

I ran the chkdsk with Administrator Privileges and processe begin... But 36 hours after the progress was still in 77%, so I close the program and come back to Ubuntu, He recognize my partition, displays the label, but now I can't open my partition as before.

I tried to recover my files using various programs and nothing ...

- Windows Disk Management (Show like RAW but with the 3 TB)
- TestDisk (Show only 750 GB)
- MiniTool Partition Wizard Free (Show only 750 GB)
- R-Studio (Show 3 TB)

The HD is recognized in the BIOS with 3TB and the partition is visible to any OS, the same is well physically, the problem is even logical.

I ran chkdsk X: / f / r and now I go wait the time it takes...

- Stop/Break the chkdsk can damage the HD or my files?
- The chkdsk can recove the partition? (The process is very long, but the if can restore the structure partition to NTFS again, it will be worth)
- There's another way to restore the partition to NTFS without loss my data?
- There's another or better tools than I quoted / used above?

[Hyuki]

Stop the chkdsk and get a gparted live iso. Open terminal, run testdisk and follow the instructions.

[Hyuki]

I believe i was a bit unclear. Disregard the last comment. Keep chkdsk running, and if that doesnt help, then comment

[colanco]

I am afraid that CHKDSK I destroy his MFT.

[colanco]

Chkdsk is a very bad option

[fzabkar]

@petabyte85, do your tools report a capacity of 746GiB (800GB)?

If so, then this is symptomatic of a 32-bit LBA limitation.

[petabyte85]

@colanco If the chkdsk destroy the MFT, what is the best way to recover?

I ran the chkdsk X: /f r/ since yesterday.

Correcting error in index $I30 for file 358086.
Correcting error in index $I30 for file 358086.
Sorting index $I30 of the file 358086.
13 percent completed. (1342193 of 1376548 of processed index entries)

- I expect to finish this?
- If the chkdsk damage the MFT the first time when i close the program, is possible to recoverer the MFT using other programs?
- How to pause or close the chkdsk safely? The first time I tried it with ctrl + c, pause, ctrl + alt + del and nothing works, so I the same window.

I should have left to buy another HD 3 TB, then copy my files using the Ubuntu, since I had access at first, but did not know it was going to happen.

@fzabkar Only TestDisk and MiniTool Partition Wizard Free report a capacity of 746 GB, the Windows Disk Management and R-Studio show all capacity 2.73 TB.

- The BIOS recognizes, Windows, Linux and R-Studio recognizes 3 TB.

[petabyte85]

@Spildit How to pause or close the chkdsk safely? The first time I tried it with ctrl + c, pause, ctrl + alt + del and nothing works, so I the same window.

[fzabkar]

@petabyte85, you say that "I install my HD 3 TB and he was as RAW". Does this mean that you transferred your HDD from a different, presumably working computer to your current computer, or perhaps from an external enclosure to an internal environment?

Was TestDisk running under Windows or Linux? I believe that Windows Disk Management gets its capacity information from the drive's partition data (sectors 0, 1 and 2) rather than the device driver, so it is quite possible for Windows to see a 3TB logical volume on a 746GiB physical drive. I don't know about R-Studio, though.

How much data do you have on your drive? Did your problems perhaps start when you wrote data beyond the 2TiB point?

Have you checked the drive's SMART report (eg CrystalDiskInfo) to confirm whether it has a problem with bad sectors? Running CHKDSK in repair mode against a drive with extensive physical problems is potentially disastrous.

[petabyte85]

@fzabkar

My motherboard had a problem and I changed to a new, my new mobo is a N68-S3 FX ASRock.

The MoBO recognized all my 3 HDs on the BIOS:

HD1 - 320 GB
HD2 - 1.5 TB
HD3 - 3 TB

After installing the Windows 7 Ultimate x64, I connected the other 2 HDs and the HD 3 TB was as RAW.

The Windows Disk Management shows how 3TB RAW, so I ran the Ubuntu from a live CD and I see the my partition with the label, I open the partition and I see all my folders and files (All is perfect!) So I back to Windows and to try solve this using the chkdsk / f and waited more than 1 day, so I closed the program, now when I came back to Ubuntu, it recognizes the partition with the label, but when I try to open it now appears this message:

Unable to mount "Partition"

Error mounting: mount exited with code 13: $ MFTMirr does not match $ MFT (record 5)

Failed to mount / dev / input / output error

NTFS is Either inconsistent or there a fault hardware, or it's a SoftRAID fake or Hardware RAID, in the first case run chkdsk / f Windows on, if the device is a software / fake RAID Then first activate and mount diferent device under / mapper / directory.

[HaQue]

try "Partition find and mount". Possible things are at a recovery software stage. R-Studio and GetDataBack are 2 good ones.

[fzabkar]

@petabyte85, clearly CHKDSK has damaged your file system. However, ISTM that you have still not resolved whether the root cause of this damage was a logical problem or a physical one.

IMHO I would start by examining the drive's SMART report with a tool such as CrystalDiskInfo.

http://crystalmark.info/software/Crysta ... dex-e.html

Look for reallocated, pending, or uncorrectable sectors.

I would then attempt to resolve the disparity between the capacities reported by your various tools. I suspect that your SATA driver may be Windows 7's native driver, in which case I would update it to the latest NVIDIA driver.

http://www.asrock.com/mb/NVIDIA/N68-S3% ... ad&os=Win7

Then I would recheck the capacities reported by MiniTool and TestDisk. BTW, I assume you were running the Windows version of TestDisk rather than the Linux version, in which case it might be worth comparing how TestDisk behaves on both platforms.

My suspicion is that CHKDSK has damaged the file system because your current environment is in some way affected by a 32-bit LBA limitation, which means that you effectively have a 3TB logical drive on an 800GB physical drive.

[petabyte85]

@fzabkar

CrystalDiskInfo 5.6.2

ST3000DM001-1CH166 3000,5 GB

Health Status: Good

05 Reallocated Sectors Count - 100 - 100 - 10 000000000000
C5 Current Pending Sector Count - 100 - 100 - 10 000000000000
C6 Uncorrectable Sector Count - 100 - 100 - 10 000000000000

[petabyte85]

Looking for something about how to fix the MFT, I found it:

ntfsprogs is a suite of NTFS utilities based around a shared library. The tools are available for free and come with full source code.

- mkntfs: Create an NTFS volume on a partition
- ntfscat: Print a file on the standard output
- ntfsclone: Efficiently backup/restore a volume at the sector level
- ntfscluster: Given a cluster, or sector, find the file
- ntfsfix: Forces Windows to check NTFS at boot time
- ntfsinfo: Dump a file’s attributes, completely
- ntfslabel: Display or set a volume’s label
- ntfslib: Move all the common code into a shared library
- ntfsls: List directory contents
- ntfsresize: Resize an NTFS volume
- ntfsundelete: Find files that have been deleted and recover them
- ntfswipe: Write zeros over the unused parts of the disk
- ntfsdefrag: Defragment files, directories and the MFT
- ntfsck: Perform consistancy checks on a volume
- nttools: Command-line tools to view/change an offline NTFS volume, e.g. ntfscp, ntfsgrep, ntfstouch, ntfsrm, ntfsrmdir, ntfsmkdir
- ntfsdiskedit: Walk the tree of NTFS ondisk structures (and alter them)

Be careful with these utilities, they might damage the filesystem, or your hard disk !

Does using nftsprogrs I'll have access the partition as the first time before using the chkdsk?

[fzabkar]

@fzabkar

CrystalDiskInfo 5.6.2

ST3000DM001-1CH166 3000,5 GB

Health Status: Good

05 Reallocated Sectors Count - 100 - 100 - 10 000000000000
C5 Current Pending Sector Count - 100 - 100 - 10 000000000000
C6 Uncorrectable Sector Count - 100 - 100 - 10 000000000000

Well, ISTM that your original problem was probably an 800GB capacity issue rather than a physical problem.

[colanco]

Few options to repair the mft after chkdsk. R-studio can be the best option at this moment, if it stays something of the original mft was showing it to him, the rest of the files alone are going to be recoverable in brute

[colanco]

Sorry for my bad english

[petabyte85]

@fzabkar

I installed all drivers of Asrock and after updated with Driver Booster 2, all the drivers are installed and updated.

I installed the GetDataBack Simple and only show 800 GB, I do a simple scan and all my folders and files are there, apparently it's all fine, but what worries me is it is showing only 800 GB, these 800 GB are just a symbolic value? Because all my files together occupy more than 2 TB.

Maybe if I had put the drive in another motherboard would have recognized normal, but do not understand why it was as RAW on Asrock.

Looking for problems installing HD 3 TB on Asrock N68-S3 FX I found this:

Q: I was connected a HDD on N68 series motherboard with 3TB capacity, why the HDD capacity only detect 768GB in Windows 7 installation.

A: Please use Windows 7 installation disk with Service Pack1 (SP1) included.

The Service pack 1 can make Windows 7 recognize all 3 TB?

[petabyte85]

@fzabkar @Spildit @HaQue @colanco

The R-Studio recognized the HD, label, partitions and all 3 TB, I do a scan but when the scan pass 700 GB the erros starting...

Scanning X: position: 745.27 GB

Read disk X: at position 801434509312 failed after 1 attempts: the request can not be executed due to a device- error I/O (1177)

[fzabkar]

Windows support for hard disks that are larger than 2 TB:
http://support.microsoft.com/kb/2581408

Note that Microsoft confuses TB with TiB.

Because the transition to a single-disk capacity of greater than 2 TB has occurred fairly recently, Microsoft has investigated how Windows supports these large disks. The results reveal several issues that apply to all versions of Windows earlier than and including Windows 7 with Service Pack 1 and Windows Server 2008 R2 with Service Pack 1.

To this point, the following incorrect behavior is known to occur when Windows handles single-disk storage capacity of greater than 2 TB:

The numeric capacity beyond 2 TB overflows. This results in the system being able to address only the capacity beyond 2 TB (2TiB ???). For example, on a 3 TB disk, the available capacity may be only 1 TB (800GB ???).

The numeric capacity beyond 2 TB is truncated. This results in no more than 2 TB of addressable space. For example, on a 3 TB disk, the available capacity may be only 2 TB (2TiB ???).

The storage device is not detected correctly. In this case, it is not displayed in either the Device Manager or Disk Management windows.