nthnl

Hello Jacklaz, I will use the ddrescue command again tonight and will see if there will be any change. Regarding the size of the files, when I do ls -ltrh shows as: clean_disk_image.bin - 931.5G clean_disk_image.bin_orig - 931.5G But when I do "du -h" it reports: 562Gb And it seems to be correct because when only the single image was residing on the disk it showed 281Gb. The actual copy of the image was done by "cp". I believe the -S option works very much like "Thin provisioning". Regarding the ddrescue.log - I have not tampered with it by any means. It is what the tool generated. When the new attempt completes I will upload the new log. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, Sorry for the delay in my reply but I had some high priority tasks that I needed to attend to. I have now made two copies of the original broken disk. I used the same command as before (ddrescue -r=3 -n -S -v ..) but this time I wrote the image to a file instead of imaging the whole healthy drive. I also made a copy of the image created so we can make changes and still have a original copy. I also have the ddrescue.log from the creation of the image and I will attach it to this post. As of your last request I also extracted the 9000 sectors and the resulting file is 2.2 Mb in size so I have uploaded it to a file sharing service: http://dox.bg/files/dw?a=cc18af51f9 Please let me know if there is anything else that I can provide. Thank you in advance. Kind Regards, Mihail Velikov System Administrator ddrescue.log.tar.gz

Hello Jacklaz, Well no, TESTDISK only showed 2 files on the disk prior to the repair and they were in the $RECYCLEBIN folder. Yes I understand that Windows automounts the disk, but unfortunately when I was making the copy of the drive I didn't think about that and thus just made a clone of the drive. I am ok with providing you the first 128 clusters but first I will wait for TESTDISK to complete the search and see if it will fix anything. If not then I will make an image of the original hard drive and use it to send you the clusters required. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, What I did initially was to make a 1:1 copy of the broken disk on another drive. I didn't make a binary file, but just pure byte by byte copy with DD. The file that you sent me was applied on the secondary disk and not on the original broken one. As I have the original 100 bytes file we can always revert the changes. I have already run chkdsk yesterday and it failed to repair the file system with the error message in my previous post. I read about chkdsk and it seems that initially it only tries to find the files and index them before actually trying to repair the filesystem. Then it estimates how much space will be required and if it is enough then the actual repair will start. As the error message that I received says that there is not enough free space for the recovery of the filesystem I do not believe that it changes anything on the drive. Unfortunately I do not have another 1Tb drive laying around and I am really pesimistic that the company will be OK ordering another one as I can't really promise any results. I will try now if TESTDISK can repair the filesystem and see how it goes. Update: Ok I run TESTDISK and it reports that the bootsector is OK. I tried the Repair FAT option but it didn't do anything and by this I mean that it scanned the system and reported nothing. After that I used the rebuild bootsector and it completed successfully very fast (like 10 seconds). After this I tried the Repair FAT option but to no avail. The next thing I did was a scan for the partition and then > Write partition structure to disk. Currently it is "Searching root cluster" and prompted me a few times with results but as I am not sure which one is the correct one I pressesed A(bort interactive mode). Thank you again for the help. Kind Regards, Mihail Velikov

Hello Jacklaz, Thank you very much for your help. I wrote the file to the disk and now it seems that Windows knows that this is a FAT filesystem and it shows that there are 652Gb free out of 931Gb which is very good. The problem is now that when I open the drive it seems to be empty. Should I run chkdisk on it or is there any other way to recover the files and structure? Note: Ok, I run the chkdsk toold on the drive and it says: This disk contains file system errors that Windows cannot fix. Insufficient disk space to recover lost data. 292081760 KB in 256422 recovered files. Windows found problems with the file system that could not be corrected. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, Indeed you are correct - the file that I uploaded is wrong . No idea actually how that happened as I used the same procedure -> select the block of text -> copy in to new file. I have done this again and now it seems to be correct. Let me know if you still need me to upload the 100mb file. Note: I did the search on my device for the B9 F5 00 00 BA F5 00 00 and ideed it can be found at 586 and 238995. Kind Regards, Mihail Velikov System Administrator 238896 - 238995.zip

Hello Jacklaz, First - thank you very much for the detailed explanation - as of now I have read it twice and it still doesn't make full sense but I will get the hang of it. Second - I have attached the information that you required. Thank you very much for your help and please excuse me for taking so much of your valuable time. Kind Regards, Mihail Velikov System Administrator sectors.zip

Hello Jacklaz, Yes I know how to use a Hex tool. I downloaded one and I am currently viewing the disk. So basically here is what I found: 1. From Sector 238504 to sector 238895 - completely empty. 2. Sector 238503 is like 60% written. 3. I went from Sector 238400 till 238505 no match for the 96 or 97 sectors. So basically between sector 238400 to sector 238895 there are no copies of the 96/97 sectors Could you please explain how are the sectores per FAT calculated? Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, I have attached the file that you requested. In the mean time I will try and repair the disk with TestDisk and see how it goes. Note1: I used the DMDE tool to index the files and directories and it found a lot of usefull files (the programs know about cyrilic symbols). The problem is that I have like 150 Gb of text files and I can't really save them 1 by 1. The bigger problem I think is that I did not find a way to save the index of the disk, so even if I want to buy the software I will still need to wait for it for whole another day to do the indexing again. Note2: I run the TestDisk and it reported that both my primary and backup boot sectors are bad and only had the option to Rebuid BS. I quit the menu and went back to do a deeper search. Kind Regards, Mihail Velikov System Administrator 100sec.tar

Hello Jacklaz, I left the drive last night to complete the full indexing of the directories but unfortunately the computer applied updates and rebooted. FML right? I am not really in the mood to wait for it for a whole another day so I used the FAT1 and FAT2 tables that it got but unforutnately it found only around 950 Mb of useful data. I guess the full indexing will be required anyway. Anyway I will run the full indexing process again and I hope it will complete properly this time. After it finishes I will extract the bootsectors and upload it here. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, I run the DMDE tool on the new drive aaaaand gues what -> again I see the errors that the previous disk gave me. I do not belive this is a disk issue as it is brand new. I am currently doing a full scan on the hard drive with DMDE for file and director fragmest and it is currently on 85% (started it around 8 hours ago). Regarding the recovery.log - unfortunately I didn't save it. I was runing the parted magic boot cd which operates in the RAM and I didn't attach a working disk to copy it to (my bad ..). I will see how the DMDE will do - before doing the full check it was actually giving me nearly the same folder structure as the software I initially used to recover files. If it still fails I will go ahead and run testdisk and try to repair the drive. All in all I am quite happy to learn a lot of new things about HDD recovery - god know when I will need it again Kind Regars, Mihail Velikov

Hello Jacklaz, I run the ddrescue on my disk and here is the output. root@partedmagic:/dev# ddrescue -r 3 -n -v --force /dev/sdb /dev/sda recovery.log GNU ddrescue 1.17 About to copy 1000 GBytes from /dev/sdb to /dev/sda Starting positions: infile = 0 B, outfile = 0 B Copy block size: 128 sectors Initial skip size: 128 sectors Sector size: 512 Bytes Press Ctrl-C to interrupt rescued: 1000 GB, errsize: 1372 kB, current rate: 0 B/s ipos: 180815 MB, errors: 21, average rate: 31125 kB/s opos: 180815 MB, time since last successful read: 20 m Finished I will now try to see if the data is structured better than before from the healthy drive. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, Indeed you are correct - > better safe than sorry. Reading the disk is extremely slow so I will do an image when the new drive arrives and see if I can extract any useful data from it. Regarding the actual drive it is: Samsung Model: HN-M101MBB (1Tb/5400rpm/8M) LBA 1,953525,168 1TB REV. A S/N: S2R8J9BB901504 P/N: C7612-G14A-A47PT As soon as I have any news I will update the thread. Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, Ok, I will order another drive, because I don't have one that big on my disposal right now. The check of the FAT tables just completed and here are the results: FAT table size in bytes: 122065408 radio box 1: FAT1: 4096-122065408: 100% OK; 30%OK, 0 % bad, 69% empty, 0% unknown radio box2: FAT2: 4096-122064896: 99% OK; 29% OK, 0% bad, 70% empty, 0% unknown radio box3: do not use FAT tables check box: check (do not use bad sectors) Any idea which one should I choose or should I just end task the application then make the image of the drive? Kind Regards, Mihail Velikov System Administrator

Hello Jacklaz, Thank you very much for your advice. I do not believe that the software I used made any changes to the disk - although I might be wrong. About TestDisk - yes, I tried to write to the disk but it failed so I am not sure if it actually wrote anything to start with. I will try the DMDE tool and see how it goes. If I can make a better backup of the drive it would be great. Update: I am running DMDE and it gives a log of errors looking like that (only the Sectors are different, also note that the drive is directly connected to the sata port on the motherboard): LUN#0 Sector 63(try 2): WinError 23. Data error (cyclic redundancy check). Update 2: DMDE reports this is a FAT32 File System and is currently testing FAT tables - still gives a lot of error like the one above. Kind Regards, Mihail Velikov System Administrator