Help with external hard drive

[pberrett]

Hi all

I have a Seagate SRDOOF2 external hard drive.

I have been using this to back up various files.

When I plugged in my hard drive tonight, Windows came up with a pop up box 'camera upload' asking whether I wanted to import my photos and videos. I simply hit cancel to this.

If I go to windows explorer and click on the drive "D:" I get a message saying that I need to format the disk before I can use it. Naturally I decline this.

If I run diskmgmt.msc I can see the attached result. The drive is visible and has a couple of partitions. The drive appears to be working ok but windows is not recognizing its file structure.

How can I repair this?

cheers Peter

Attachments

[lcoughey]

There is likely media damage and/or a weak head not being able to read key system files.

[drHDD]

If there is no strange sounds from HDD- try to use R-studio to see if it can show your files.

[pberrett]

I have downloaded R-studio. the drive is recognised and the SMART buttons are all showing that everything is fine (green).

The drive is showing up as the majority of space being unrecognized or unformatted. How do I scan for files?

cheers Peter

Attachments

[lcoughey]

So, the drive was in a NAS and not a USB enclosure? It has a file system not recognized by R-Studio. Try UFS Explorer or R-Explorer and see if you can recover with them.

[pberrett]

No it was in a usb enclosure.

[fzabkar]

ISTM that the drive's partition table has been overwritten. AFAICT, the 3 original partitions (FAT32, ext4, and NTFS?) have been replaced by unrecognised 328MiB and 32GiB partitions. It also appears that the original FS metafiles may have been overwritten, suggesting that the drive may have been formatted.

I would use DMDE (freeware disc editor) to examine the disc structure. Could you show us DMDE's Partitions window? There may be a backup NTFS boot sector at the end of the unpartitioned space. The scan should take less than 1 minute.

Edit: The external enclosure appears to be configured with a sector size of 4KiB. The OP appears to have removed the drive from its enclosure, thereby exposing the drive's native 512e sector size. This renders the file systems inaccessible.

41MB x 8 = 328MB
3.95GB x 8 = 31.6GB

[scratchy]

Is this drive marketed as a backup or archive drive? Check if it is one that uses shingle recording technology.

[fzabkar]

ISTM that the OP may have inadvertently cloned a 4GB (512e) image to the external 4Kn drive.

[pberrett]

Here we go. First I read about a tool called Testdisk on the internet. I have run this and this is what comes up. A full scan (which took hours) didn't show anything further. by the way the drive has never been removed from its enclosure.

Attachments

[pberrett]

On a slightly more positive note I downloaded DMDE and here/s the result. I can see what appears to be two partitions marked with a red x.

Someone suggested that I may have inadvertently formatted the drive. It is possible that I recently meant to format a thumb drive and picked the wrong drive number. That would explain my current problems.

Here's the DMDE output

Attachments

[fzabkar]

DMDE's screenshot supports my hypothesis.

I would examine sector 1046144 (4Kn mode) and then drag the vertical scrollbar towards the end of the drive.

Editor -> Goto Offset -> sector 1046144

Do you see anything that looks like data?

Try the following:

r-click the "boot" volume
select Open Volume
expand the Root

Do you see a file/folder structure?

Repeat for the $Noname 03 volume.

[pberrett]

The three attached files are the results of the 3 searches you asked me to do.

The first one looks like data but I don't know what that means.

The second looks like a thumbdrive file structure and the last like a Linux file structure.

Nothing though that looks like the structure of the windows accessible folders I had previously.

cheers Peter

Attachments

[fzabkar]

The two partitions suggest that a 4GB Raspberry Pi bootable image was cloned to the external drive.

When examining the sector contents, I would select Mode -> Hexadecimal/Text. If the vertical scrollbar finds hex data, then your original data may still be present, albeit without the original file system.

I would try an NTFS or FAT search, or whichever file system was on the drive before it was corrupted. Alternatively, PhotoRec is a freeware tool that can recover raw data.

[pberrett]

The drive is about 1/3 full of hexadecimal data so that is positive.

I started a FAT search but it was searching at a rate of about 1.3GB per minute which would take about 15 hours or so to search. is there a quicker way?

cheers Peter

[fzabkar]

Ideally you should clone your drive, sector by sector, and then work on the clone. That said, are you sure that the original file system was FAT? The usual setup is NTFS for a Windows system.

[pberrett]

It was an external drive. I presumed it was formatted as FAT but I will scan for NTFS.

[pberrett]

One other quick question.

Is there any harm in removing my external disk drive from its enclosure and connecting it directly to my computer via SATA link? I presume that I could access the disk much more quickly this way than by using USB.

[fzabkar]

If your drive was formatted as NTFS, then DMDE should have found (or will find?) a backup boot sector at the end of the volume.

Removing the drive from the enclosure would expose the drive's native 512e sector size, which means that any 4Kn file system would be inaccessible in the normal way. I don't know whether this would complicate DMDE's data recovery. A raw data search would still be OK, though.

[fzabkar]

@ pberrett, DMDE can search for several file systems including ...

HFS+/HFSX support including complex HFS search
NTFS extended search (FS structures and file signatures based)
ExFAT extended search (FS structures and file signatures based)
Extfs extended search (FS structures based)
FAT search

Full Scan (multiple FS and RAW search, improved interface)

http://dmde.com/changelog.html