MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: Displays as RAW but I can see NTFS partition with programs
PostPosted: October 30th, 2011, 17:53 
Offline

Joined: October 30th, 2011, 16:34
Posts: 4
Location: Tennessee, US
I have windows 7 on my computer. I plugged in my 2Tb HDD, used it, then unmounted it. During the unmount it told me that the drive was in use a couple times, then it unmounted. I plugged it back in later and now my computer shows it as "Local Disk". I opened Computer Manager, went to Disk Management, and the HDD shows as RAW. Using the program Active@UNDELETE I view my HDDs and the HDD displays as two partitions, the small unallocated partition and the Primary NTFS that looks perfectly normal like it should. Then I noticed that under Logical Drive Capacity it says that the HDD is full, it's is not even close to being full. I then scanned the HDD with Active@UNDELETE and I can see all my files. I have looked for an answer but I am not asking Professor Google the right question to get the answer I am looking for. So am I correct in thinking that my partition table is corrupted? If so, how do I correct the issue? I'm not sure if my Hirens disk has anything on it that will help me. I don't have Partition magic but could download it or Active@Partition Recovery. Any help will be much appreciated. Thanks


Attachments:
Active@UNDELETE view.jpg
Active@UNDELETE view.jpg [ 203.97 KiB | Viewed 11211 times ]
Disk Management.jpg
Disk Management.jpg [ 118.38 KiB | Viewed 11211 times ]
Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 5:00 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2821
Location: Kuwait
this is Smartware hdd
if u used the utility to format it, then its all gone my friend
chances are below zero

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 8:42 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3547
Location: Greece
But OP says they can see the files.
If you can see the files using active undelete why don't you just recover them to another drive?

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 12:16 
Offline

Joined: October 30th, 2011, 16:34
Posts: 4
Location: Tennessee, US
I have recovered the files. I would like to fix the issue rather then format. I would also like to figure out why this happened. Corrupted partition table or what? What gets me is that the program sees the HDD as it should be, right when it starts up, without me scanning for any problems. Shows a excellent, healthy, NTFS drive like I would expect to see if it was working. Im going to continue looking for an answer as opposed to formating.


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 13:35 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2138
Location: England
cashby wrote:
I have recovered the files.

So assuming you don't mind if you now make things worse and potentially end up having to re-format, then...

cashby wrote:
I would like to fix the issue rather then format.

The utility you probably need to try to "fix" the issue if, as I suspect, this situation is the result of filesystem damage (caused during unmount), is "chkdsk". Be sure that you understand the potential consequences of using this (see first comment above).

cashby wrote:
Corrupted partition table or what?

Based on your comments so far, this seems unlikely IMHO, but I haven't seen you explain the original partition layout before "the problem" happened, to then compare with the partition layout now. As I mention above, I suspect filesystem damage, based on the info supplied so far.


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 17:49 
Offline

Joined: October 30th, 2011, 16:34
Posts: 4
Location: Tennessee, US
chkdsk will not run because my computer sees the drive as a RAW drive. The Active@Delete picture above shows how everything was before the issue, it's the same as it is now. The program sees it properly but I cant seem to get a computer to see it that way. I do see that the boot sector shows all 0s


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 19:39 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2138
Location: England
cashby wrote:
chkdsk will not run because my computer sees the drive as a RAW drive. [...] I do see that the boot sector shows all 0s

Assuming you're referring to the partition boot sector (a.k.a. volume boot record etc.), then that explains why Windows report it as a raw filesystem, and why chkdsk won't run. I believe that leaves you having to do manual filesystem analysis & editing (with all the risks & requirements that has), to achieve your aim of not formatting that partition - I can't think of any other options for you, within the limits you have set.

Since you say you've already recovered the files, I don't understand your reluctance about reformatting the affected partition, but I wish you good luck in your challenge of avoiding that! :)


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 21:04 
Offline

Joined: October 30th, 2011, 16:34
Posts: 4
Location: Tennessee, US
I've formatted thousands of drives. I'd rather take the time to learn why something happened and how to fix it, getting a better knowledge and understanding of how the devices that I am using work. If I run across this again in the future and it's a HDD with programs and an OS then I might be able to fix it as opposed to recovering all the files and having to reload the software. Since it looks like it is the partition boot sector, any suggestions on how I go about fixing that? Are there any programs that will help? I came across a couple places that were explaining it while I was digging for an answer, I'm going to start looking again for them, sounds like I might be in for a lot of work. Any help in that department would be appreciated as well. Thanks for all the answers and suggestions so far.


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: October 31st, 2011, 22:27 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2138
Location: England
cashby wrote:
I've formatted thousands of drives. I'd rather take the time to learn why something happened and how to fix it

Unfortunately fixing this current situation (symptom) does not tell you exactly why it happened (cause). Obviously something unusual happened during your attempt to unmount the filesystem, and from what you've said, the partition boot sector (as a minimum) got overwritten, but fixing this doesn't explain exactly why that overwriting occurred. :(

cashby wrote:
If I run across this again in the future and it's a HDD with programs and an OS then I might be able to fix it as opposed to recovering all the files and having to reload the software.

There's no guarantee that exactly the same result will occur again and so this effort may not be reusable, but it's your time, your data, your choice :)

cashby wrote:
Since it looks like it is the partition boot sector, any suggestions on how I go about fixing that? Are there any programs that will help?

I don't use Windows (if I can avoid it), but on WinXP, you may be able to use MS "fixboot" - MS has a KB article on that. I don't know what the Win7 equivalent is. Also TestDisk has some useful functionality for NTFS boot sector problems.

However, the partition boot sector may not be the only affected part of the filesystem - if you're lucky and it is only this, then great! If not, then you're back into manual examination, chkdsk, and all that...

Good luck!


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: November 1st, 2011, 6:52 
Offline

Joined: July 7th, 2010, 4:45
Posts: 924
Location: UK
cashby wrote:
chkdsk will not run because my computer sees the drive as a RAW drive. The Active@Delete picture above shows how everything was before the issue, it's the same as it is now. The program sees it properly but I cant seem to get a computer to see it that way. I do see that the boot sector shows all 0s



I just had a external drive that showed as RAW & yes chkdsk will not run. What I used was testdisk:

Sorry for the basic intructions but some people like a walk through.

Run testdisk
Press enter
Select your disk & press enter
Select Intel & press enter
Select Advanced & press enter
Select partition with the * & press enter
Testdisk then showed that the drives boot sector & backup boot sector didnt match
Testdisk then gives the option to rebuild the boot sector from the back up
Unplug the drive & then reconnect it & i then had access to the files

Remember that its up to you if you try DIY & so is the risks.


Loki


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: November 1st, 2011, 23:05 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia
I'd just like to add that before you unleash any data recovery software on any drive, I'd first examine its critical file system areas with a hex editor.

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

First examine the MBR at LBA 0. The partition table will tell you where the volume boot sectors are located. Then examine each boot sector.

Here is my favourite resource on the subject:
http://thestarman.pcministry.com/asm/mbr/index.html

Often you can manually reconstruct a damaged MBR or VBR. IMHO it's much safer and much more satisfying to do it this way.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Displays as RAW but I can see NTFS partition with progra
PostPosted: November 2nd, 2011, 5:24 
Offline

Joined: July 7th, 2010, 4:45
Posts: 924
Location: UK
fzabkar wrote:
I'd just like to add that before you unleash any data recovery software on any drive, I'd first examine its critical file system areas with a hex editor.



Hi fzabkar,

I checked to see if FTK Imager could list & access the files ok which it did & it also showed the partition as FAT32. I then spent 7 hours imaging the drive & then 5 mins to repair it using test disk. I could of went straight to test disk but if something went wrong it would only make matters worse.

My number one rule is always make a sector by sector image first before any attempt of repair


Loki


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 29 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group