jaclaz

Backspace? You cannot actually "cancel" an input, you can go back and overwrite it. jaclaz

Switch everything off (yes, physically remove power to everything, wait some sixty seconds before re-applying power, reboot the PC - just in case) and start again from scratch. No harm should have been made. BUT be very careful, and I mean VERY careful when you type commands (BEFORE pressing [ENTER] check, double check and triple check everything) this time you gave a non-existing command, but there are DESTRUCTIVE commands that are valid and that can botch the disk for good . jaclaz

@JorgeA Please re-read, slowly this time , this post (AND links in it): You cannot use/trust a source only because - casually - it has the same opinion as you have. MInd you, the guys over there seem all like very nice peeps, and possibly their software is the third best thing in life after sliced btread and ice cream , but they are seemingly too young and enthusiastic (which are very nice characteristics, BTW) to be able to provide any unbiased opinion or meaningful data. Right now (and no offence whatever intended to the good guys ) the one in their team that I would trust more (generally speaking, not on PC related technology ) would be Speedy : http://blog.soluto.com/2013/01/a-peek-inside-soluto-hq/ And BTW, the good Soluto guys did choose Azure (coincidence? ): http://blog.soluto.com/2013/01/an-apology-from-the-soluto-team/ In the spoiler the most relevant part: jaclaz

Well, you are back to #1, so seemingly the (put here any adjective heavily offending your customer's mental capabilities) guy provided you with the wrong disk? However, nothing prevents you from re-writing ONLY the (good) DATA of the MBR you had before on the current MBR (which has now the McAfee CODE). Of course IF part of the CODE contains a form of checksum, it won't work, but trying doesn't harm anyone. In a MBR offsets: 0-445 Code (including Disk Signature on Windows NT OS at bytes 440-443) 446-509 DATA partition table, 4 parttiion table entries, each 16 bytes 510-511 Magic bytes 55AA So basically you have to copy bytes at offsets 440-443 (4 bytes, the disk signature) and bytes 446-509 (48 bytes, the partition table) from the "old" MBR and replace the corresponding bytes on the "new" McAfee one. Next step would be to create THREE copies (images) of the disk, wipe (write with 00's) the area where the "middle missing partition" is, then format with the same OS originally used (I believe 7) the "missing partition in the middle" as NTFS, then attempt installing the encryption using the same keys. Then compare the three of them, two at a time. If they result (at least the first few sectors) substantially similar, then you may have a chance. Explanation: When you format two filesystems you do it (obviously) one after the other, the result is that the freshly formatted filesystem will never be identical, because the volume serial (which is misteriously created by the OS on a semi-random base) will be different and expecially on NTFS filesystem structures will have different timestamps. The point is if the encryption algorithm (the "initial loading part") uses just the provided keyfiles and/or password or it uses a "salt" based on "specific data": What you can reproduce is: size of the volume position of the volume of disk contents of it's first few sectors (but not the volume serial) if anything else (like the volume serial or current date/time or date/time of any filesystem structure) has a role in the encryption algorithm yu will have different results (and thus you won't be able to recreate the original "headers"). There is a possibility, still, (again it may depend on the exact version of the software used), at least in older releases there was the possibility of accessing a ("sound") encrypted volume without original key and password by using a "tech access" and a "daily code" (or something like that). Such an approach may work even with the headers of a "different" volume, but it is really hard to say. JFYI : jaclaz

The "basic error" (besides the various attempts you made - particularly erasing the G-list), is/was to assume that an unbricked disk: still has a perfectly functional filesystem can still boot a "complex" OS like a NT one as it did before the bricking Both the above are gratuitious assumptions. The whole point is WHY did it "brick itself" originally, if it bricked because of the original issue with the log entry, then those assumptions may be correct, if it bricked itself for any other reason those are VERY unlikely to represent reality. The only thing that you can do (and that you should have done BEFORE attempting booting from the disk and before attempting accessing files on it's filesystem) is to image the disk on another disk (you will need a slightly larger disk, NTFS formatted (if using Windows) or EXT3/4 formatted (if using Linux) or clone it to a similarly sized disk, surely functional. You would normally use datarescuedd (Windows) or dd_rescue or ddrescue (Linux) and try to image the whole disk, if needed in "chunks". Once the filesystem has been transferred (hopefully successfully and the whole of it) on a surely functional media, then you start attempting recovery of the filesystem (if possible) or recovery of the files in it (still as possible). If you need help in doing the above, please start a new thread, as once the disk is not anymore BSY or LBA0, it exits the scope of the present thread. jaclaz

Definitely: http://www.theverge.com/2013/5/21/4352596/the-xbox-one-is-always-listening For a firm established since 1975, i.e. 38 (thirty-eight) years ago, it is good to know that they had privacy as a top priority for more than ten years, the issue is whether they are last ten years or so or from 1975 to 1985.... jaclaz

Well, if you cannot afford a tool like the mentioned one: http://forum.hddguru.com/viewtopic.php?t=17926&start= At least get some "medicine blisters", at least Scott Moulton: http://myharddrivedied.com/ can move heads with them: (please remember to count the number of platters of the disks shown in the above video) Naaah, the air being "condensed" is the least of the issues here. jaclaz

Yes, but usually (cannot say specifically) there is an option in the encryption software to "convert" the encrypted disk to non-encrypted without booting it. I am not familiar with McAfee encryption software, and there are more versions of it than stars in the sky, if I recall correctly, how exactly did you write the bootsector? Maybe the emergency disk "unencrypted" the existing bootsector (which was altered before) instead of replacing it with the original one. But the partitioning would never be affected by any change to the PBR or VBR or bootsector, if the partitioning layout changed it means that the McAfee Emergency disk changed the MBR! Still following - no offence intended towards the guy that encrypted that disk, that surely did that in perfect good faith - my theory that on average users of encryption solution don't know enough about data preservation, it could be that what was given to you was the recovery disk generated on another machine. I mean, a "normal" MBR (and/or PBR/VBR/bootsector) is made of two parts, code and data. It is possible that the *whatever* the emmrgency disk wrote was the "right" code (generic) but the "wrong" data (belonging to another machine). Yes, but 100 Mb is the "default" for Windows 7, an OEM (like Toshiba) might well have decided that a larger one was needed/smart/whatever. Out of the three partitions 1st and 3rd were OK, so I doubt that You need to check if Mcafee (or a third party) provides a solution to "convert the disk" to unencrypted (without changing/restoring/whatever) the MBR or the bootsector. jaclaz

What about forfiles? http://ss64.com/nt/forfiles.html jaclaz

Bad burn? http://www.bleepingcomputer.com/forums/t/81736/error-installing-windows/ jaclaz

Good. Which drive letter gets the partition on the external disk drive? Let's say it is E:\. Open a command prompt. In it type: CD /D E:\ [ENTER] then: DIR [ENTER] How much space does it see as available? jaclaz

Ah, well, that explains a lot, giving plenty info on the EXACT procedure used. jaclaz

To continue: You ignored what the Win2flash tool intended scope is (and its instructions/documentation) and managed to attempt making your internal disk an "install disk for XP" . Now a couple of questions: You mentioned a WinPE, which WinPE is it? Is it on a boot CD/DVD or on a USB stick? (or however can you move it to a USB stick or other NON-read-only device?) jaclaz

No, the encrypted partition was simply "not mountable" (either due to the encryption or to the corruption) the Kaspersly, besides having stupidly written on the [system] partition (NOT on the [HDDRECOVERY] one) is innocent. The "stupidly" may be referred BOTH to the good Kaspersky guys and to the good guy that attempted running an Antivirus on a disk where there was an encryption/partition issue AND having that machine connected to the Internet . It is more likely that the "bootsect.exe /nt60 all /force" has made some damages. Rule of the thumb (for next time ) is to NEVER (and when I say NEVER, I do mean NEVER) write anything before having made an image (at least of what you are going to overwrite, like the MBR and the PBR's). Consider how - particularly Notebooks with "recovery partition" and or with hard disk encryption connected to the motherboard - may use non-standard MBR code (less likely non-standard PBR code) and possibly also use some of the hidden sectors, but what the heck, we are talking here of saving a bunch of sectors, not necessarily image the whole disk (for which one may be unable to provide a big enough storage space). JFYI : http://en.wikipedia.org/wiki/Primum_non_nocere jaclaz

Nonsense of the day: http://www.pcworld.com/article/2038912/windows-8-wont-hit-critical-mass-in-enterprises-forrester-says.html "better shape"? Either an infrastructure (whatever it is ) is "compatible" with Windows 8 or it is not. And no, I cannot see ANY way in which an infrastructure with ONLY Windows 7 "clients" may be in any way "in better shape" than one that has already been tested and found working for several years with XP's and at least 2 years already with BOTH XP's and Windows 7's. One thing is "complete migration" to Windows 7 (that I believe very few companies did) as well as "no windows 7 machines" (that I also believe very few companies are into) and another is "mixed environments with any possble flavour/type of XP, Vista and 7 + Server 2003 and Server 2008 and Server 2008 R2 - and possibly even a couple 2K servers" which is most probably the "average" situation. jaclaz

You are welcome . Re-thinking about the Read-only that cannot be cleared, maybe it is because as soon as you put the disk online volume on it were mounted to a drive letter. Maybe all volumes need to be unmounted to allow to change the read-only status? jaclaz

Oh duh, you obviously didn't use a clean garage and updated the firmware of the engine management Oh, yes, I did, I also cleaned VERY thoroghfully both sides of the crack that divided the piston in two halves, really. Still it didn't work. jaclaz

Hmmm. Cannot really say what is preventing the thingy to change attributes. Check this: http://blogs.technet.com/b/askcore/archive/2011/06/02/my-disk-is-read-only-help.aspx but that should only affect USB drives. Is there anything worth of note in the event log (if it exists in your PE)... jaclaz

See if this fits: http://www.1-4a.com/rename/ jaclaz

Sure, not at all negating the fact, only highlighting it's foolishness . Then you have an image of the disk before the various Windows recovery attempts? No, the Kaspersky live CD scan (which - again - seems a lot like NOT having been on a LiveCD since data about it are written to the hard disk) would have NOT done *any* harm, rest assured. Yep, the whole point is to understand WHICH EXACT form of encryption is it and if there are tools (from the manufacturer of the encryption tool or by third parties) capable of recovering a disk in that situation. In theory it could be something trifling, like the need to re-write some MBR (or hidden sectors) code, or something that has no way to recover. Your next step is to understand *somehow* which specific encryption was it. jaclaz

Yeah, sure , with that set of instructions you are good to go. Remember that you need unpowdered latex gloves and a VERY "clean and dust-free room indoors", as a matter of fact you would actually need something like a small clean room, *like* the one hinted about here: Good luck for the cleaning with compressed air *any* head on a multiplatter disk, and particularly those on non-first platter and the underside one of first platter . JFYI, and OT, last time I had a faulty piston on my car, it didn't start working after I cleaned it . jaclaz

BUT how exactly /which tool was used to encrypt the volume/drive? Bitlocker? Those would only change the "code" part of the MBR and of the PBR's, since it was originally Windows 7 made, the result would be again Windows 7, but I have no idea if bitlocker (if it is that that was used) actually encrypts the PBR also and or if it stores any further back up copy. BUT, yes, the combined effect of all the tools you ran could well have made things worse, though the issue (since start) was an issue with the bootsector. I personally find encryption (generally speaking) "totally unneeded, utterly foolish and a perfect way to lose data", but of course opinions may vary on it . Besides being of no actual use (just so you know, "they" are not after you, if they were, they would have already got you ) to the "common user" it implies a far more accurate management of data (and backup strategies), something that the "common user" will never be able to do, being by definition also not capable of implementing a "plain" data backup strategy. And of course doing *any* of the things you did to a failed disk without first imaging it has been - let's say - a most uncommon procedure (if you need I can be much more explicit than that). IF it was bitlocker, there are a few tools to recover those, but whether they will work (at all or in this case) cannot say. See: http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/bitlocker-corrupted-drive/f2d6addf-5e9d-427e-9857-ffb5a750dfcb jaclaz

Sure, professional repair. I would call you more "stubborn" than "curious", but that's OK. My bad , consider the previous "60-100 US $" range as "80-120 US$" instead: http://www.newegg.com/Product/ProductList.aspx?Submit=ENE&N=100007603%20600003269%20600003316&IsNodeId=1&name=1.5TB a dramatic 20-30% increase that makes the option slightly less convenient . jaclaz

Are you now ? Picky today? , actually, to be in-line with the previous typo: Picky oday? jaclaz

Sure, that means that the head (actually head arm) is not stuck anywhere. Yep, and again this means that the head cannot find what it is looking for and "goes" astray. In your case it happens at around 30%, which on a multiplatter disk, can be a single head gone, or a side gone (actual platter surface - unlikely to happen without "carrying with it the head" as well) or the SA/firmware partially corrupted, no real way to know, and in any case NOT a DIY job, particularly on a Seagate 500 Gb or any multiplatter disk. A 500 Gb disk (brand new) costs around 60-100 US $. A professional repair (if possible) would likely go in the US$ 1000-2000 range. The tools needed to repair go in the 5000-10000 US$ (without the NEEDED training, which will more than double that figure). Hard as it may be, sometimes you need to call it a loss and go ahead. jaclaz