Jump to content

Lost partition with value data

ozzyboy

By ozzyboy
in Software Hangout

 Share

Recommended Posts

ozzyboy

ozzyboy

Posted
Posted

Hi guys, my first post here...unfortunately with a big problem.:(

My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...

I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ... :(

I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing :(

Also I've tried with Partition Table Doctor 3.5 ...also nothing...

What do you recommand me?!!! ..Is there any chance to recover my files?!

Please need help !!! :worthy:

In Disk Management it look like that (after scan with active).

238fcaca34cc202c99a74254202cb489.jpg


kang roy

kang roy

Posted
Posted
Hi guys, my first post here...unfortunately with a big problem.:(

My external usb Hdd, Hitachi 120GB, lost his partition. Yesterday after remove saftely another usb memory stick (4GB), I got a message, "Is in use and if I want really to remove him, it's possible to lost data"...

I've ignored that message...and after 10minutes, when I wanted to look for something in my ext HDD, wasn't there ... :(

I already have tried with Active@partition Recovery, After 6hours of scan in DOS, active@ found nothing :(

Also I've tried with Partition Table Doctor 3.5 ...also nothing...

What do you recommand me?!!! ..Is there any chance to recover my files?!

Please need help !!! :worthy:

In Disk Management it look like that (after scan with active).

238fcaca34cc202c99a74254202cb489.jpg

there are some troubled hdd like this, it is likely that problems with its own hdd, such as bad sectors, and also fit in time to copy the files may copy files bad sector, the way this work should be cloned into an empty hdd,, , has completed a new clone in its use of data recovery software that tough if you can use forensic software,,,

ozzyboy

ozzyboy

Posted
  • Author
Posted (edited)

Thank's all, for your interest. Right now I'm trying with with TestDisk...

@nitropuppy, nice flag :)...OK, It's not the first time when I have problem like this..I always used Active partition recovery, but this time unsuccesfully. Like I said after 3 hour scanning 81h(with ctr+enter), it found me one unlocated partition(111GiB), then I scanned for another 3-4 hours, this unlocated partition, but found nothing... :(

@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...

l.e. It seems testdisk also found nothing: what's next? :unsure:

ef2bd1f983970dbf0ae75984fee37e2a.jpg

Edited by ozzyboy
jaclaz

jaclaz

Posted
Posted
@jaclaz I follow your directions...1st link seams to be a little hard to me...but I'll try if testdisk fails...

l.e. It seems testdisk also found nothing: what's next? :unsure:

The general idea is not "I am skipping what you suggested because it's a little hard...." :whistle:

Post some details on how the drive was partitioned/formatted before (size of partitions, filesystem used, etc.)

http://www.msfn.org/board/index.php?showtopic=133933

Also you should read this:

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Try the deeper search, and next time, instead of the screenshots, post testdisk.log (of course you should ALWAYS create a Log at the beginning of each seesion with Testdisk)

jaclaz

ozzyboy

ozzyboy

Posted
  • Author
Posted

jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...

The HDD is sata 2 on external rack, conectivity with pc is through usb...

The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....

DigeratiPrime

DigeratiPrime

Posted
Posted
jaclaz, thx and I'm sorry, dont get me wrong ...that conclusition, was at first look, I'll read careffuly from those links and i'll be back if I'm not understand...

The HDD is sata 2 on external rack, conectivity with pc is through usb...

The HDD capacity is 120GB, real capacity is 111GiB all formatted NTFS (just one partition), I don't remember exacly, I think it was primary, and logical....

Well if it was just one partition then it was either a single primary partition or a logical inside an extended partition.

What I would do is if possible is clone the drive as is right now, before attempting any further recovery. Then I would if possible remove the drive from the enclosure and connect it directly via IDE/SATA. Also open the disk with a disk editor like HxD to browse the sectors in hex and make sure they're not all zeros.

Can you tell us the model of the drive?

jaclaz

jaclaz

Posted
Posted

I need to know:

  • under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.
  • which specific app was used to create the partition.
  • the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one

That drive should have (IF formatted under XP with Disk management):

  • a MBR at offset 0 sectors
  • IF Primary a bootsector starting at offset 63
    OR
  • IF Logical inside Extended a EPBR at offset 63 and a PBR at offset 126

Additionally, being NTFS, a copy of the bootsector should be as last sector of the partition.

extract first 200 sectors (200x512=102,400 bytes) with dsfo (read the given thread where a howto is given), compress the output file in a zip and attach the archive to your next post.

jaclaz

ozzyboy

ozzyboy

Posted
  • Author
Posted (edited)

HI jaclaz, I just have read it, your 1st reference link, and for now I want to colne entire hdd. I'll put him into another pc on sata cable, and will be the 2nd hdd on that pc...so it will be Physical drive 1...right?

The tool I'll need to use it for backup is dsfok toolkit, right?!

Then, I follow your command:

dsfo \\.\PHYSICALDRIVE1 0 0 C:\dsfok\hddfull.img

After that I'll wait for a while...until I've got a message like:

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

=========================================================

I need to know:

* under which OS that drive was originally Partitioned (and formatted) like DOS, Linux, XP, Vista, 7, etc.

* which specific app was used to create the partition.

* the exact size of the drive (I mean bytes, not Gb or Mb or Kb) <-this may be a tough one]

I partitioned about 6 months ago, and I dont remember details. I think it was on windows or maybe, I used some tool from Hiren Boot Cd, I don't remember, how I created the partition... Sorry :unsure:

Also, I dont know how to get the exact size, in bytes. Below is a picture with hdd, maybe it will hepl somehow..

7306896252c492f8f4e126eed89038c0.jpg

I'll be back with extracted sector!!

Thx a lot for your help!!

Edited by ozzyboy
jaclaz

jaclaz

Posted
Posted

ozzyboy be careful. :ph34r:

YES, if there is just one hard disk on the second PC (and no card readers, attached USB Mass Storage devices, or virtual drives loaded) it will be PhysicalDrive1.

Please take into account that the resulting C:\dsfok\hddfull.img will be around 120 Gb in size!

You'd better make sure that you C:\ drive on the second machine:

  1. has enough space
  2. is formatted as NTFS

About size, you will have it as output of the dsfo command, when you do the dd-like image:

OK, xxxxxxx bytes, xxxxs, MD5 = xxxxxxx

(jolt down these data)

The CHS geometry results from the picture you posted: 16383/16/63, which gives us a:

16383x16x63=16,514,064 sectors x 512 bytes=8,455,200,768 bytes but it isn't useful, as it is the "fake" geometry for the "last CHS limit", which is:

8,455,716,864

http://www.pcguide.com/ref/hdd/bios/sizeGB8-c.html

From here:

http://www.pubbs.net/openbsd/200904/43615/

> wd0 at pciide0 channel 0 drive 0: <HITACHI HTS541612J9SA00 3H>

> wd0: 16-sector PIO, LBA48, 114473MB, 234441648 sectors

234,441,648x512=120,034,123,776

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.

Geometry should be:

14593x255x63=234,436,545 sectors

234,441,648-234,436,545=5,103 unallocated sectors

234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

jaclaz

ozzyboy

ozzyboy

Posted
  • Author
Posted

@ nitropuppy, Sorry, I didn't know that it is warez... :blink: Accept my apology!

@ jaclaz, Thx again, I have 52in1 internal card reader, in floppy place, but I'll disconnect from usb and yes, I have just one HDD....About freespace, I have to delete something...For now I have only 110GB free.

If you are sure that you did NOT partition it under Vista or Windows 7, AND that you created just one big partition, the partition data is predictable.

Geometry should be:

14593x255x63=234,436,545 sectors

234,441,648-234,436,545=5,103 unallocated sectors

234,436,545-63=234,436,482x512=120,031,478,784 sized partition, which windows should have "seen" as 111 or 112 Gb (do you remember this number in Explorer)?

Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?

jaclaz

jaclaz

Posted
Posted
Sorry, I don't remember that. I never was curious about his size. But if you look in the firt post, picture made in disk management, the size seems to be 111,79GB. Is that relevat?

Yep :), it is an indirect confirmation we are dealing with the "right" numbers.

So partition data should be:

80-07-0-1-1-1023-254-63-63-234436482

Let's see if Testdisk finds anything, first.

Post the 200 sectors, it is very possible that we can get some confirmation from them.

jaclaz

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...