WD3200BEVT-60ZTC0 suddenly Raw?

[MichaelP]

Hallo

I have searched Google a Little, and found this site, and I can see you are pretty hardcore about drives which are strange..

I have my laptop, and after a update (Windows 8 to 8.1) my computer won´t boot anymore.

The strange part is that during the update (i was not at my computer when it was updating, it turned off)

When I use Disk Part to reveal my drive, I can see my drive with Windows 8 is now a Raw Drive, and not a NTFS.

Can you help me fix that, without formatting the drive?

Here is a Logfile from testdisk quick scan.

http://www29.zippyshare.com/v/24558047/file.html

(somehow I´m not permitted to use THIS site uploader?)

Edited November 19, 2013 by MichaelP

[jaclaz]

Good.

But you will need to provide some background, like how you remember your disk was partitioned, and the like.

Essentially the "relevant" part of the .log is:

HFS+ magic value at 35726/24/11
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [Reserveret til systemet]
Warning: number of heads/cylinder mismatches 224 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 19 (NTFS) != 63 (HD)
2 P HPFS - NTFS 12 223 20 35726 24 10 573732864

Bad relative sector.
3 P HFS 35726 24 11 38913 5 4 51197952

The "red" part is very possibly just a "glitch in the matrix", or however should not influence your booting.

You seem like having the "typical" Windows 7 (or possibly 8) "boot" partition (what the good MS guys call "system") of 204800 sectors, which has some wrong geometry settings (this partition is normally hidden/not assigned a drive letter) and a second partition (which is the actual "system" and "data" partition).

So you originally had just the "C:" drive, correct?

If you re-run TESTDISK and press the P button when you have highlighted either the #1 or the #2 partitions, you should be able to see the "root" directory of each partition.

in #1 you should be able to see at least:

BOOTMGR <- file

\boot\ <- directory

in #2 you should be able to see the previous contents of your "C:" drive.

Now, a good idea would be, before doing anything else/any attempt to repair, to make a copy a few "key" sectors.

To do this, the easiest would probably be Hdhacker:

http://dimio.altervista.org/eng/index.html

The general way of operation is:

1. first select (on the left side) WHAT you want
2. click on the "Load Sector" Button
3. click on the "Save Sector" Button and save the file on ANOTHER volume/disk/device

You will be accessing the \\.\Physicaldrive, normally the first disk will be \\.\PhysicalDrive0, the second disk (it seems from the TESTDISK log that you have two disk on the machine on which you are attempting the repair) will be \\.\PhysicalDrive1 and the third disk you will be trying to extract the data should be \\.\Physicaldrive2 (you can check in Disk Management, the numbering of Disks is the same)

HDhacker uses the convention of numbering sectors starting from 1 (unlike "normal" LBA notation).

You want to save sectors:

1 <- the MBR for the extension of 1 sector

2049 <- the PBR of first partition for the extension of 16 sectors

206848 <- (hopefully) the bootsectormirr of first partition for the extension of 1 sector

206849 <- the PBR of second partition for the extension of 16 sectors

572939712 <- (hopefully) the bootsectormirr of second partition for the extension of 1 sector

then you compress the resulting 5 files (please meaningfully named ) into a .zip archive, upload it to zippy or the like and post a link to the file.

With these data I should be able to suggest (hopefully) next steps to take.

jaclaz

[MichaelP]

Hello Again

Sorry for taking so long...

My HDD was as you wrote, C-drive only, with Windows 8 x64.

I had been trying to get the 5 files out you want, but when I will load the last sector, I get an error (Overflow?), and the program shuts Down.

http://www42.zippyshare.com/v/8042366/file.html

It only has 4 files then :/

[jaclaz]

Sorry for the delay, for whatever reason the board did not notify me (or I missed it) about your reply.

The files you sent are OK (though you made just extension of 1 sectors for all of them).

It is very possible that you cannot get that last sector because of a miscalculation on my side or simply because it is "outside reach" of the Hdhacker .

With the data you posted the "right" sector is 573939712 (for the fifth file).

However there is nothing "wrong" with those sectors if not - as TESTDISK reported the geometry in the bootsector of the seond partition, but that would only create issues if you were booting from it (while you are actually booting from the first one).

What happens when you choose the partition and press P in TESTDISK?

jaclaz