Jump to content

onlit4regs

Member
 View Profile  See their activity

  • Posts

    35

  • Joined

  • Last visited

  • Donations

    0.00 USD 

  • Country

    France

 Content Type 

Posts posted by onlit4regs

    still no partition on Seagate after successful unbrick

    in Hard Drive and Removable Media

    Posted

    testdisk have seen the NTFS partition of 500Go, said structure OK.

    when pressing "P", there is only one directory displayed, and when entering it, it's empty .... :angry:

    Try having a look at the "my500GB.img" with dmde:

    http://softdm.com/

    even if it is a tool that is not ( like TESTDISK) suitable to be used with a less then advanced knowledge of the NTFS filesystem, you should be able to understand if there is an issue with the $MFT or with the actual filesystem contents. :unsure:

    Another thing that you could do is to extrract some sectors starting from 6,291,519 and use on them this tool:

    http://www.forensicfocus.com/Forums/viewtopic/t=8010/

    http://code.google.com/p/mft2csv/

    just to understand if the $MFT contains valid data or if it is "the issue".

    If this latter is the case, PHOTOREC may still be able to find many files....

    jaclaz

    softdm shows me all the files and directories of my hard drive, but trying to recover a dozen of files results with unreadable files. :angry:

    I tried making a new image with ddrescue, with direct SATA connection in my PC. it started faster than the previous one on USB, but it is still running, since 72 hours !!! :blink:

    only 24,5Go done .... so much errors: "unable to satisfy request because of an I/O error".

    I have stopped the process.

    about the last thing you asked, I'm not sure to understand what you really want me to do. Extract how many sectors from 6291519 ? and then, mft decode ? or mft2csv ?

    thanks a lot for your help. I'm getting less and less hope to recover anything :unsure:

    0

    still no partition on Seagate after successful unbrick

    in Hard Drive and Removable Media

    Posted

    testdisk have seen the NTFS partition of 500Go, said structure OK.

    when pressing "P", there is only one directory displayed, and when entering it, it's empty .... :angry:

    Try having a look at the "my500GB.img" with dmde:

    http://softdm.com/

    even if it is a tool that is not ( like TESTDISK) suitable to be used with a less then advanced knowledge of the NTFS filesystem, you should be able to understand if there is an issue with the $MFT or with the actual filesystem contents. :unsure:

    Another thing that you could do is to extrract some sectors starting from 6,291,519 and use on them this tool:

    http://www.forensicfocus.com/Forums/viewtopic/t=8010/

    http://code.google.com/p/mft2csv/

    just to understand if the $MFT contains valid data or if it is "the issue".

    If this latter is the case, PHOTOREC may still be able to find many files....

    jaclaz

    softdm shows me all the files and directories of my hard drive, but trying to recover a dozen of files results with unreadable files. :angry:

    I tried making a new image with ddrescue, with direct SATA connection in my PC. it started faster than the previous one on USB, but it is still running, since 72 hours !!! :blink:

    only 24,5Go done .... so much errors: "unable to satisfy request because of an I/O error".

    I have stopped the process.

    about the last thing you asked, I'm not sure to understand what you really want me to do. Extract how many sectors from 6291519 ? and then, mft decode ? or mft2csv ?

    thanks a lot for your help. I'm getting less and less hope to recover anything :unsure:

    0

    still no partition on Seagate after successful unbrick

    in Hard Drive and Removable Media

    Posted

    hi,

    thanks for your reply and your time !

    testdisk have seen the NTFS partition of 500Go, said structure OK.

    when pressing "P", there is only one directory displayed, and when entering it, it's empty .... :angry:

    I think I'll try again the image processing of the hard drive this week-end, I've done it with USB connexion, but I'll try with direct SATA connexion, to see if it can go up to 500gb image. I'll tell you what.

    thanks again ;)

    0

    still no partition on Seagate after successful unbrick

    in Hard Drive and Removable Media

    Posted

    I attach the HDHACKER first sector of logical drive and first sector of physical drive, if this can help.

    At first sight there is nothing "wrong" in them.

    BUT how exactly (under which OS, with which tools) was the disk partitioned originally?

    The sectors you posted seems like a "normal" XP partitioned (French), single NTFS:

    #0 07 80 0 1 1 1023 254 63   63 976768002

    The data in the bootsector is as well "standard":

     3      0003   OEM String:    NTFS  
    11     000B    Bytes per sector:     0200   512
    21     0015    Media type:             F8   248
    24     0018    Sectors per Head:     003F   63
    26     001A    Number of Heads:      00FF   255
    28     001C    Sectors Before:   0000003F   63
    40     0028    Total Sectors:                000000003A384C01   976768001
    48     0030    LCN for $MFT::                00000000000C0000   786432
    56     0038    LCN for $MFTMirr::                0000000003A384C0   61048000
    64     0040    Clusters per $MFT record:            000000F6   246
    68     0044    Clusters per Index record:            00000001   1
    72     0048    Volume Serial:    6424B80A24B7DD6C

    Which OS are you running/can run?

    Ideally you should try imaging the disk on a (larger) device as a file, first thing, do you have (or can buy) a 640 or 750 Gb disk?

    You could check with a disk viewer/editor the presence at the designed addresses of the $MFT and of it's mirror.

    $MFT is at 63+786432*8=sector 6,291,519

    $MFT Mirror is at 63+61048000*8=sector 488,384,063

    The first sector of both should begin with "File0" or in hex "46494C4530".

    jaclaz

    thanks a lot for your message jaclaz.

    it was originally parted in windows XP (French), with standard XP storage manager.

    I have a 1Tb hard drive available for imaging, and I am running actually Win 7 Pro x64, but I can also plug it again on my win XP.

    I'll try to give a look at the MFT with disk editor and I'll tell you.

    0

    still no partition on Seagate after successful unbrick

    in Hard Drive and Removable Media

    Posted · Edited by onlit4regs

    hi,

    My 500Gb Seagate 7200.11 had the famous bug of BSY state, it wasn't seen in BIOS.

    I have successfully made the unbrick trick with serial cable, hyper terminal and so on. Now the drive is seen in the BIOS (and with the right size).

    But Windows see a RAW partition on it.

    I've tried easus recovery, it has seen all my files, but any restore of any file results in an unreadable file. (nothing was writen on the faulty disk at the moment)

    I've tried testdisk, it has seen the partition, I have made "WRITE PARTITION TABLE" to the faulty disk, and reboot. same thing under windows.

    so now, what can I do ?

    I attach the HDHACKER first sector of logical drive and first sector of physical drive, if this can help.

    thanks a lot for your help :hello:

    HDHACKER.zip

    0

    The Solution for Seagate 7200.11 HDDs

    in Hard Drive and Removable Media

    Posted

    I've tried in order:

    - easus data recovery FREE edition: it has seen all my files with right size, but when restoring files, they are unreadable

    - I tried testdisk: it has seen the partition , I've done a WRITE partition table, reboot, and nothing better in Windows

    - I tried booting in knoopix, but It can't see the disk also.

    Hmmm. :rolleyes:

    The general idea is to ask for help BEFORE writing anything TO the disk.

    anybody has a magic idea ???

    There are no "magic ideas" :no: , there are only a few "common ideas" :w00t: , that are actually procedures to attempt recovering the data :yes: .

    Mind you it is very possible that by using an UNsuitable tool in an UNsuitable way, even if the firmware unbricking procedure was successful you effectively corrupted the disk contents beyond any possible recovery :(.

    What you should do now would be:

    1. STOP fiddling with the disk
    2. make a dd-like image of it
    3. start a new thread asking for assistance in the recovery

    An example of the procedure involved is given here (and links within):

    jaclaz

    thanks a lot for your answer jaclaz, I'll do what you suggest, see you in another thread ! ;)

    it's quite encouraging that you didn't write the disk was totally unrecoverable :lol:

    0

    The Solution for Seagate 7200.11 HDDs

    in Hard Drive and Removable Media

    Posted

    hi all,

    first of all, thanks a lot for this thread and the information about fixing this hard drive issue.

    I have a Seagate Barracuda 500GB, and I've done what was explained , and the operation was finished without errors. My hard drive is now seen in my BIOS (and with right size)

    BUT, Windows see no partition on it and don't display its size.

    I've tried in order:

    - easus data recovery FREE edition: it has seen all my files with right size, but when restoring files, they are unreadable

    - I tried testdisk: it has seen the partition , I've done a WRITE partition table, reboot, and nothing better in Windows

    - I tried booting in knoopix, but It can't see the disk also.

    anybody has a magic idea ???

    thanks a lot

    0
×
×
  • Create New...