jaclaz Posted August 16, 2010 Share Posted August 16, 2010 If you could state HOW the drive was previously partitioned (like how many partitions, which type, which filesystems, etc.) and under WHICH operating system ( Linux, 2K/XP, Vista , 7, etc.) it would be a plus, as it is likely that we can find the actual bootsectors manually....Do I get it was a single partition NTFS, Primary, partitioned and formatted under XP? Make a copy of first 100 sectors, compress the resulting file in a .zip and attach it to your next post (or upload to a file sharing site an post the link):get the dsfok toolkit:http://members.ozemail.com.au/~nulifetv/freezip/freeware/unzip in a new directory, say C:\dsfokOpen a command prompt and navigate to that directory.Now, you must be sure that you get the "right" physicaldrive number n(if you have just one hard disk, it will be "0", and the USB device will probably be "1" if you have one of those stoopid card readers this number may be incremented accordingly)Run following command:dsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.imgIf the drive was previously attached (working) to your machine, open Regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices and export the whole key.add it to the compressed file.State which drive letter the hard disk drive partition had assigned before.jaclaz Link to comment Share on other sites More sharing options...
tb582 Posted August 16, 2010 Author Share Posted August 16, 2010 If you could state HOW the drive was previously partitioned (like how many partitions, which type, which filesystems, etc.) and under WHICH operating system ( Linux, 2K/XP, Vista , 7, etc.) it would be a plus, as it is likely that we can find the actual bootsectors manually....Do I get it was a single partition NTFS, Primary, partitioned and formatted under XP? Make a copy of first 100 sectors, compress the resulting file in a .zip and attach it to your next post (or upload to a file sharing site an post the link):get the dsfok toolkit:http://members.ozemail.com.au/~nulifetv/freezip/freeware/unzip in a new directory, say C:\dsfokOpen a command prompt and navigate to that directory.Now, you must be sure that you get the "right" physicaldrive number n(if you have just one hard disk, it will be "0", and the USB device will probably be "1" if you have one of those stoopid card readers this number may be incremented accordingly)Run following command:dsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.imgIf the drive was previously attached (working) to your machine, open Regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices and export the whole key.add it to the compressed file.State which drive letter the hard disk drive partition had assigned before.jaclazI'll work on the above, but that deeper scann with testdisk finished and didn't find anything Link to comment Share on other sites More sharing options...
tb582 Posted August 16, 2010 Author Share Posted August 16, 2010 Make a copy of first 100 sectors, compress the resulting file in a .zip and attach it to your next post (or upload to a file sharing site an post the link):get the dsfok toolkit:http://members.ozemail.com.au/~nulifetv/freezip/freeware/unzip in a new directory, say C:\dsfokOpen a command prompt and navigate to that directory.Now, you must be sure that you get the "right" physicaldrive number n(if you have just one hard disk, it will be "0", and the USB device will probably be "1" if you have one of those stoopid card readers this number may be incremented accordingly)Run following command:dsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.imgjaclazI can't seem to get the syntax right as nothing ever outputs Link to comment Share on other sites More sharing options...
jaclaz Posted August 17, 2010 Share Posted August 17, 2010 I can't seem to get the syntax right as nothing ever outputsdsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.imgCan you see the difference between a "simple" path with NO spaces and a path like C:\Program Files (x86)\ ....You know, one of those paths that should never be used on command line or if really needed should be put inside double quotes? Try EXACTLY the command suggested including it's simple path, if it doesn't work, it may be a 7 (x64? ) kind of problem.Use this other app, which is GUI:http://www.boot-land.net/forums/index.php?showtopic=7783http://www.datarescue.com/photorescue/v3/drdd.htmyou stil want roughly first 100 sectors.jaclaz Link to comment Share on other sites More sharing options...
tb582 Posted August 17, 2010 Author Share Posted August 17, 2010 I take it this isn't good? Link to comment Share on other sites More sharing options...
jaclaz Posted August 18, 2010 Share Posted August 18, 2010 What the heck are you running? That screenshot tells you that you have I/O errors around sector 1600400 hex, which means around sector 23,069,696 which means around bytes:23,069,696x512=11,811,684,352i.e aroud 12 Gb!You need first 51,200 bytes or 51,200/512=100 sectors.You told the program to image first 51,200 Mbytes!http://www.datarescue.com/photorescue/v3/drdd.htmRange Selection: there are two ways to select the portion of the damaged media that DrDD will attempt to read: by size, or by allocation units (commonly referred to as sectors). In this case, we are attempting to read 175.000 MBs starting at 100.000 MBs and ending at 275.000 MBs. The default selection is to backup the whole device. Coarse interval selection is achieved through the MBs interval boxes. Fine grained interval selection is achived through the Sectors interval boxes. This feature would typically be used with a hard drive that suffers from bad sectors or a memory card that locks up because if a defective memory bank.In the LOWER set of boxes SECTORS, you want to have 0-100-100 (in the UPPER set of boxes, Mbytes, you will see 0-1-1 which is a rough approximation of the very small amount of needed sectors)jaclaz Link to comment Share on other sites More sharing options...
tb582 Posted August 19, 2010 Author Share Posted August 19, 2010 ok - I used DD here's the outputimage0-51200.zip Link to comment Share on other sites More sharing options...
jaclaz Posted August 20, 2010 Share Posted August 20, 2010 ok - I used DD here's the outputHmmm, I presume the drive has already died. The file contains ONLY FF's.No way out "from a distance", unless a pro has a look at it and diagnoses what the problem is.Several things may have happened, some easily fixable, some fixable but out of your reach (even if guided) and some stil fixable but only by a pro with the adequate hardware and software, plus a limited number of things that could have made the disk completely unrecoverable.Any "strange" noise coming from the disk when it spins up?Like a vibration or repeating attempts to read (click/click/click)?jaclaz Link to comment Share on other sites More sharing options...
tb582 Posted August 21, 2010 Author Share Posted August 21, 2010 ok - I used DD here's the outputHmmm, I presume the drive has already died. The file contains ONLY FF's.No way out "from a distance", unless a pro has a look at it and diagnoses what the problem is.Several things may have happened, some easily fixable, some fixable but out of your reach (even if guided) and some stil fixable but only by a pro with the adequate hardware and software, plus a limited number of things that could have made the disk completely unrecoverable.Any "strange" noise coming from the disk when it spins up?Like a vibration or repeating attempts to read (click/click/click)?jaclaz :( Nope - it honestly sounds completely fine. Link to comment Share on other sites More sharing options...
jaclaz Posted August 22, 2010 Share Posted August 22, 2010 Normally a "wiped" hard disk is ALL 00's, as well a "pristine one" contains in non-used sectors 00's (and NOT FF's).When there is "localized" problems (like a bunch of bad sectors, like the ones you seem to have around sectors 1600400) usually other parts of the hard disk remain readable/are untouched.But it could well be a defective head. Unfortunately it is not easy to even diagnose it "remotely".You can try opening the \\.\physicaldrive in a disk editor (tiny hexer suggested):http://www.boot-land.net/forums/index.php?showtopic=8734and search for the first occurrence of 0000.File->disk->Open drive->(choose correct \\.\PhysicalDrivenThen Edit->Find/Replace->0000->FindPress "yes to all" to continue scanning past the first sector.jaclaz Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now