www.deadharddrive.com

Sea Pea

Windows recently lost sight of my 200 GB hard drive and I need help to find out why and hopefully fix. The BIOS sees the drive, and Windows 7 device manager reports the drive is "not initialized", capacity 190,782mb, 0 mb unallocated. Therefore I can't see any files. I've download at least 20 data recovery utilities, some freeware, others demo versions, and they all seem to report the same thing; no deleted partitions, and no files found. I don't see how this is possible, the disk was full of data, so I'm hoping there's a simple explanation somewhere. The drive appears to be running fine; it feels like it's running, not making any noise, and those "miracle utilities" have all looked like they're finding nothing wrong with the drive (sectors & tracks are being read, etc). It behaves just like a brand new unformatted drive would. Even if I tried to wipe a disk this clean, I don't know how I could. Does anybody have any ideas that can help me?

Sea Pea · Posted: Fri Jul 01, 2011 11:29 am Post subject:

I was hoping for at least one reply Crying or Very sad

.Can anybody suggest what could have possibly happened?

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

[quote="Sea Pea"]I was hoping for at least one reply :cry: .Can anybody suggest what could have possibly happened?[/quote]
You could use a disc editor such as DMDE to examine the MBR and partition table in sector 0.

DMDE (DM Disk Editor and Data Recovery Software):
http://softdm.com/download.html

Go to Tools -> Copy Sectors

Click Device in the Source tab. First Sector should be 0. Change Number of Sectors to 1. The Last Sector should adjust itself automatically.

Choose File in the Destination tab. DMDE will select a filename of "sec_0_1.ima". Click OK.

The file should be 512 bytes in size. Could you please upload it?

Sea Pea · Posted: Sat Jul 09, 2011 2:37 am Post subject:

Thank you so much for replying fzabkar. I loaded DMDE and followed your instructions. The file was created, although the following error message occured during file creation: Disk#0 Sector 0 (try 2):WinError 0x02. The system cannot find the file specified. (abort, retry, ignore,ignore all, parameters). I selected Ignore all and a file was created 512 bytes. Perhaps the error was meaningless. Dumb rookie question; how do I upload a file?

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

You could upload your file to one of the many online file sharing services.

BTW, when creating the IMA file, you should specify a destination drive that is different to the problem drive. In fact you should not write anything to the problem drive.

Sea Pea · Posted: Sat Jul 09, 2011 12:47 pm Post subject:

Here's the link to the file created. Nothing has been written to the drive since the problem surfaced. http://dl.dropbox.com/u/34766104/sec_0_1.ima

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

Sector 0 is empty, ie it contains all zeros. That's why the drive is being reported as uninitialised.

In DMDE, choose Mode -> Hexadecimal, and then drag the vertical slider from the beginning to the end of the drive. Do you see anything other than zeros?

BTW, sorry for my slow reply. I didn't receive an email notification for your reply to this thread.

Sea Pea · Posted: Tue Jul 12, 2011 2:17 am Post subject:

I have interesting information fzabkar. When I first looked at the sectors, they were all zeros. As I scrolled down the page I would constantly get the error message I got earlier, about being unable to read a file. I then looked at another hard drive to see what it should look like, and there was lots of data. I returned to the 200gb problem drive, and there is now data! I see in the text to the right of the hex "ST3200822A" which I believe is my seagate 200GB drive. It's still not visible in Windows though. I think the drive may be giving me a window of opportunity but I don't know how to take advantage...

Sea Pea · Posted: Tue Jul 12, 2011 2:41 am Post subject:

Here's a screen print showing some of the data on the drive. I could be misreading the information in the dialog box, but doesn't it look like a partition was found? I'm afraid to power the unit down. Then again, I'm afraid to keep the drive spinning longer than necessary.

http://dl.dropbox.com/u/34766104/Seagate200GBHex.JPG

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

LBA 1 through LBA 7 appear to contain some identification information about your drive. Was it ever part of a RAID?

There are two byte-swapped text strings, namely "TS230028A2" (= ST3200822A) and ".310" (= 3.01). These are the model number and firmware version, respectively. I have no experience with RAID setups, but I'm wondering whether these are the "metadata" that identify a particular drive in an array.

Normally, in an MBR partitioned drive, sector 0 (LBA 0) contains the MBR boot code and the partition table. Sector 63 is usually the boot sector of the first primary partition. Sectors 1 through 62 are normally zeros.

Here are examples of each:

Windows 2000 and Windows XP MBR ( Master Boot Record ):
http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

Disk Editor View of NTFS Boot Sector for Win 2K and XP:
http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm

Could you show us the contents of sector 63?

You could also use DMDE to search for your boot sector(s). Go to Tools -> Search For Special Sector and choose Boot Sector.

Can you recall whether your file system was FAT32 or NTFS?

Sea Pea · Posted: Tue Jul 12, 2011 12:55 pm Post subject:

The drive was never part of a RAID. I'm guessing it's NTFS but I don't recall. I did a fair amount of video editing on the drive so I'm guessing NTFS. Thanks for the boot record links. Quite interesting but slow reading for me... I got some bad news this morning. DMDE is again reporting all zeros. Just prior to that, DMDE reported a boot record error on the drive. Now nothing. So, I think my drive still has all it's data, maybe the FAT is corrupted, and I have an intermittent but persistent hardware problem reading the drive. Shouldn't I somehow make an image of the drive and use that to play with? If so, should I buy another hard drive (I could use one anyway) and ghost the image on that? Any ideas on how I can read the drive or what software to use?

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

The links to Starman's Realm were only intended to give you a visual indication of what an NTFS boot sector and Win XP MBR look like, to help you to recognise them in DMDE's sector views.

As for cloning your drive, you need to [b][i]image[/i][/b] your drive sector-by-sector using a tool that knows how to work around bad sectors, and then use data recovery software on the clone.

Some freeware cloning tools are ...

dd_rescue: http://www.garloff.de/kurt/linux/ddrescue/
ddrescue: http://www.gnu.org/software/ddrescue/ddrescue.html

Comparison between ddrescue and dd_rescue:
http://www.forensicswiki.org/wiki/Ddrescue

Ddrescue can perform multipass cloning. It clones the easy sectors on the first pass, and attempts the more difficult ones on subsequent passes. It can also clone your drive in reverse, thereby disabling lookahead caching. It keeps a log, allowing it to resume after an interruption.

The following thread discusses various freeware and commercial cloning tools:
http://forum.hddguru.com/the-best-disk-cloning-hardware-software-t10396.html

Sea Pea · Posted: Thu Jul 14, 2011 11:49 am Post subject:

Thanks for the info fzabkar. I appreciate your help. I'm not familiar with Linix, so this may take me a while. Windows products haven't been any help (did I say I tried 20 or so of their rescue utils?) so I'll try anything.
Here's an observation that I find interesting: I looked at the drive with DMDE 4 times (give or take). The first time; all zero's Second time; zero's, clicked on another drive, then went back to drive, to full of data; third time;zero's, clicked on another drive then went back, tiny bit of data, fourth time;zero's, clicked on another drive then went back, teeny tiny bit of data. The rescue products I tried all found no data at all, even though two of the utils ran for well over 8 hours. I wonder if something happens during a first read of the drive that's special, and that if nothing is found immediately, maybe nothing will be found at all. If so, I like the fact that one of those util's you mentioned will piece together data with subsequent attempts.

fzabkar · Deadharddrive regular +3 Joined: 02 Apr 2010 Posts: 210

Sorry, Sea Pea. I'm still not receiving email notifications for this thread.

In any case I don't believe I can help you. Your "data" don't look right to me. In fact I'm wondering whether you are seeing some "artifact" rather than actual sector views. If sectors 0 and 63 show the same strange information as you posted previously, then I doubt that you will be able to achieve anything.

corbingravely · Posted: Mon Jun 08, 2015 9:11 am Post subject:

I think there is an even better solution. Try connecting the HDD parallel to a working one. Maybe some of you friends can help you. Then try defragmenting the hard disk. And then format it completely. The problem with this is that you will lose all the data. If you want your data, then the best thing is to go for the service centers.

----------------------------------
CORBIN GRAVELY
Primary school in Muscat
----------------------------------