Damaged hard drive

[yaro137]

My disk that was keeping the system partiton started failing on me to
the point that now I can't even get whole the way to Windows. It
starts loading but then it bluescreens with some error. Same with Safe
mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
installation but it wouldn't run on that drive. Possibly too many bad
blocks.
When I then connected the disk to another PC it the system recognizes
it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
but it doesn't work. Any idea what else can I try to get some data of
that drive?
yaro

[Craig Coope]

On Fri, 24 Jul 2009 04:07:54 -0700 (PDT), yaro137
> wrote:

>My disk that was keeping the system partiton started failing on me to
>the point that now I can't even get whole the way to Windows. It
>starts loading but then it bluescreens with some error. Same with Safe
>mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
>installation but it wouldn't run on that drive. Possibly too many bad
>blocks.
>When I then connected the disk to another PC it the system recognizes
>it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
>but it doesn't work. Any idea what else can I try to get some data of
>that drive?
>yaro

Why you plug it into another PC can you boot from that PCs OS and then
"explore" your busted drive whilst in Windows?

--
The Zero ST

[R. McCarty]

You actions may have actually reduced any chance of recovery.

When a drive is failing ( did you actually check the SMART table ? )
you need to make one, concerted effort at recovery. Depending on
the level of errors you have to choose perhaps one of two methods:
1.) Boot to a Linux distro and copy critical data only. (Docs, Mail).
2.) Use a Boot Media disk of Acronis True Image and attempt a
image using an optional setting to ignore disk errors. This has
maybe a 35-50% chance of successfully completing. The key
here is to get a image ( or a large portion ) and then attempt
to get critical files from it and not the source drive.

If the second PC only detects a 31-Gig partition then I'd say your
chances of recovery are pretty low.

"yaro137" > wrote in message
...
> My disk that was keeping the system partiton started failing on me to
> the point that now I can't even get whole the way to Windows. It
> starts loading but then it bluescreens with some error. Same with Safe
> mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
> installation but it wouldn't run on that drive. Possibly too many bad
> blocks.
> When I then connected the disk to another PC it the system recognizes
> it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
> but it doesn't work. Any idea what else can I try to get some data of
> that drive?
> yaro

[yaro137]

No, I couldn't see the contents when connecting it to another PC.
Actually when I tried accessing it the system asked me if I want to
format it.
Thought Ghost will ignore any bad sectors but as you suggest I'll try
getting to it from sime Linux Live CD
or through that Acronics product. For the moment the disk seems to be
stable. Just can't get to the data.
I checked that error and one off the possibilities points to a boot
sector virus. However if it was so wouldn't
the fix* commands fix it?
yaro

[Jim[_33_]]

On Fri, 24 Jul 2009 04:07:54 -0700 (PDT), yaro137
> wrote:

>My disk that was keeping the system partiton started failing on me to
>the point that now I can't even get whole the way to Windows. It
>starts loading but then it bluescreens with some error. Same with Safe
>mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
>installation but it wouldn't run on that drive. Possibly too many bad
>blocks.
>When I then connected the disk to another PC it the system recognizes
>it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
>but it doesn't work. Any idea what else can I try to get some data of
>that drive?
>yaro

And the error says .................?

[Bennett Marco]

yaro137 > wrote:

>My disk that was keeping the system partiton started failing on me to
>the point that now I can't even get whole the way to Windows. It
>starts loading but then it bluescreens with some error. Same with Safe
>mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
>installation but it wouldn't run on that drive. Possibly too many bad
>blocks.
>When I then connected the disk to another PC it the system recognizes
>it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
>but it doesn't work. Any idea what else can I try to get some data of
>that drive?
>yaro

You waited too long after you realized you had disk problems.

Next time you'll know better.

[yaro137]

The error is 0x00...7B(0xF8981524, 0xC00...34,000...,000...)
Also in safe mode it hangs on something called JGOGO.sys
yaro

[Paul]

yaro137 wrote:
> The error is 0x00...7B(0xF8981524, 0xC00...34,000...,000...)
> Also in safe mode it hangs on something called JGOGO.sys
> yaro

JGOGO.sys is a JMicron JMB363 driver file. Perhaps the disk is
connected to the JMicron port ?

This is the approach I'd use.

First, have *two* spare disks at your disposal.

1) Copy the entire disk (all 250GB) sector by sector, to a spare disk.
That is as insurance, that you won't lose any data while working on the drive.
You can use "dd" disk dump, either in a Linux LiveCD environment,
or you can use a Windows port of "dd" ( http://www.chrysocome.net/dd )

2) Once the data is secure, you have two options for recovery.

2a) Repair the structures on the broken disk.

2b) Use a file scavenger to extract files and copy them to a spare disk.

*******

To repair structures on the disk, give TestDisk a try. If the drive
had a single partition of size 250GB, and you're absolutely sure of
that, then TestDisk can scan the disk, and see that file system,
and TestDisk will be able to write a correct partition table.
If that part worked, perhaps chkdsk could repair any other damage.
If the repair fails at any point, you have your "dd" backup copy to
use, to restore things again. If TestDisk wrote a wrong partition
table, and you ran chkdsk, it could make an awful mess. Whicn is why
you made a backup copy first.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

*******

These are some file scavengers. These will attempt to locate files on the
broken drive, and copy them to a spare drive. Use this, if TestDisk is
not working properly or you suspect things are really messed up.
Make sure the spare disk has enough room to hold the scavenged files.

http://www.cgsecurity.org/wiki/PhotoRec

http://www.pricelesswarehome.org/WoundedMoon/win32/driverescue19d.html

*******

The 31GB number, could be indicating you've placed a jumper on the IDE
drive in an incorrect location. That jumper location is called
"clip", since it clips capacity to around 33GB or so. So perhaps
the number you're seeing, when connected to the second computer,
is because you put the jumper on the wrong pins ? Go to the web
site for the disk drive, and get the jumper block diagram.

You should also enter the BIOS and see if the identity of
the 250GB broken drive is correct or not. In some failure cases,
the drive will report a new smaller capacity, which is a sign of
serious trouble. Disk drives rely on storage of size and identity
information, at location "sector -1". If the drive controller is
not able to read that information, default information from the
disk controller firmware is used instead. I've seen this on a
40GB drive, that suddenly started saying it was a 10G drive and
its name was "Falcon" instead of Maxtor model xxxx. The ratio
of those two numbers, is the number of surfaces on all the platters.

Disk drive manufacturers provide diagnostic programs, and you
can run a program like that, to see how healthy the drive is.
You need to know what brand the drive is, to get a utility
which will do a good job of testing.

The first priority, is to back up the broken drive. You can
use "dd" for that, because it doesn't care about the state
of the partition table. It will just copy everything. If
the drive has bad sectors, there is another program called
"dd_rescue" which ignores bad sectors, and can speed up the
copy process, if "dd" is having problems.

Once you have your backup made, you can test with the
diagnostic program, repair the partition table,
scavenge files or whatever you want. If you screw up
the original broken 250GB drive, you can use "dd" to copy
the entire 250GB back to it later. Take note of the size
information from the drive, so that you can use block count and
size parameters properly when copying with "dd".

Example - copying 80GB drive to 300GB drive. 80GB drive is "broken".
Harddisk0 is the source. Harddisk1 is the destination.
The destination drive is bigger, so there is enough room to
hold the backup.

dd if=\\?\Device\Harddisk0\Partition0 of=\\?\Device\Harddisk1\Partition0

Record the exact amount of data copied. It is possible to control
exactly how much data is transferred, using block size and count
parameters. The product of bs*count should be equal to your disk
total size. The disk total size should be factorable, so two
exact numbers can be used that when multiplied together, equal
the total disk capacity of the target. Here, I'm copying back
the data, and defining exactly how much data I want copied.
Hopefully 1M * 80000 = 80GB. You can also use numbers like
bs=1048576 if you want more precision in what you're doing.
The disk size quantity should be factorable into two smaller
numbers. ("dd" commands tend to run a bit faster, if you use
block size and count parameters.)

dd if=\\?\Device\Harddisk1\Partition0 of=\\?\Device\Harddisk0\Partition0 bs=1M count=80000

Those are examples of doing it in Windows, on a second computer. In
Linux, it would look like this. The disk names are a bit different.
HDB would be the spare drive, to hold the backup copy. HDA would be
the broken drive. HDB should be bigger than HDA, so there is plenty
of room.

dd if=/dev/hda of=/dev/hdb

Anyway, that is the basic idea.

HTH,
Paul

[yaro137]

Thanks Paul. Great stuff. Hope it works. I've got a spare drive
kicking around and just downloaded Damnsmalllinux. Lets put it to
tests.
yaro

[yaro137]

Oh and I'm pretty sure there were 2 partitions. One for the system and
the other for data.
yaro

[yaro137]

Linux was unable to see the contents of that drive so I quit on that
one.
elemfm was showing hda1 in /mnt folder but it was empty even after
enabling Show Hidden files. Well unless it was only that empty spare
drive which would indicate that it wasnt detecting the other one at
all.
Bios can see the disk identifier just fine and it detects it as
33822MB
drive so roughly 264GB which is bit strange for a 250GB disk.
yaro

[yaro137]

Ok, before I mess something up I thought it would be a good idea to
show the result of running dd --info
Here is what comes:
Win32 Available Volume Information
\\.\Volume{d9b48260-7874-11de-b539-00142a0f8ad6}\
link to \\?\Device\HarddiskVolume1
fixed media
Mounted on \\.\f:

\\.\Volume{6f31b204-9f8b-11dd-acf1-806d6172696f}\
link to \\?\Device\HarddiskVolume2
fixed media
Mounted on \\.\c:

\\.\Volume{64d45d1c-7872-11de-8c2e-806d6172696f}\
link to \\?\Device\HarddiskVolume3
fixed media
Mounted on \\.\e:


NT Block Device Objects
\\?\Device\Floppy0
\\?\Device\Harddisk0\Partition0
link to \\?\Device\Harddisk0\DR0
Fixed hard disk media. Block size = 512
size is 320072933376 bytes
\\?\Device\Harddisk0\Partition1
link to \\?\Device\HarddiskVolume1
Fixed hard disk media. Block size = 512
size is 320070288384 bytes
\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR1
Fixed hard disk media. Block size = 512
size is 79998918144 bytes
\\?\Device\Harddisk1\Partition1
link to \\?\Device\HarddiskVolume2
\\?\Device\Harddisk2\Partition0
link to \\?\Device\Harddisk2\DR2
Fixed hard disk media. Block size = 512
size is 33820286976 bytes
\\?\Device\Harddisk2\Partition1
link to \\?\Device\HarddiskVolume3
Fixed hard disk media. Block size = 512
size is 33820286976 bytes

Virtual input devices
/dev/zero (null data)
/dev/random (pseudo-random data)
- (standard input)

Virtual output devices
- (standard output)


OK so my broken drive is Volume3. Yhe spare one is Volume 1 and the
one that's running the system now is Volume2.
Problem is the tools shows disk0 part 0 and 1 for the spare one where
I'm sure there is only one partition. Also it shows
disk 2 partition 0 and 1. In both cases the partitions are of very
similar size but not exactly the same. What does this mean?
Which of them do I need to dd?
yaro

[db]

well, 32 gigs can get
pretty small real quick.

perhaps, only 32 gigs
of the drive was formatted,

leaving the rest as
unallocated space.

if you look at the
drive via computer
management under
admin tools,

you should gain some
info on that drive.

if there is unallocated
space on the disk,

then either you can
format that space

or increase the size
of the 32 gig partition
so that it can acquisition
the rest of the disk,

or both of the above.

just let us know what
you see in computer
management.


--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen

>
>

"yaro137" > wrote in message ...
> My disk that was keeping the system partiton started failing on me to
> the point that now I can't even get whole the way to Windows. It
> starts loading but then it bluescreens with some error. Same with Safe
> mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
> installation but it wouldn't run on that drive. Possibly too many bad
> blocks.
> When I then connected the disk to another PC it the system recognizes
> it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
> but it doesn't work. Any idea what else can I try to get some data of
> that drive?
> yaro

[yaro137]

Unfortunatelly only a healthy 31.5GB basic partition.
However just noticed another strange thing. In My Computer
next to the drive letters I can see their sizes except for that
one drive. It's the Disk Management snap-in that tells me 31.5
Thanks again
yaro

[Paul]

yaro137 wrote:
> Ok, before I mess something up I thought it would be a good idea to
> show the result of running dd --info
> Here is what comes:
> Win32 Available Volume Information
> \\.\Volume{d9b48260-7874-11de-b539-00142a0f8ad6}\
> link to \\?\Device\HarddiskVolume1
> fixed media
> Mounted on \\.\f:
>
> \\.\Volume{6f31b204-9f8b-11dd-acf1-806d6172696f}\
> link to \\?\Device\HarddiskVolume2
> fixed media
> Mounted on \\.\c:
>
> \\.\Volume{64d45d1c-7872-11de-8c2e-806d6172696f}\
> link to \\?\Device\HarddiskVolume3
> fixed media
> Mounted on \\.\e:
>
>
> NT Block Device Objects
> \\?\Device\Floppy0
> \\?\Device\Harddisk0\Partition0
> link to \\?\Device\Harddisk0\DR0
> Fixed hard disk media. Block size = 512
> size is 320072933376 bytes
> \\?\Device\Harddisk0\Partition1
> link to \\?\Device\HarddiskVolume1
> Fixed hard disk media. Block size = 512
> size is 320070288384 bytes
> \\?\Device\Harddisk1\Partition0
> link to \\?\Device\Harddisk1\DR1
> Fixed hard disk media. Block size = 512
> size is 79998918144 bytes
> \\?\Device\Harddisk1\Partition1
> link to \\?\Device\HarddiskVolume2
> \\?\Device\Harddisk2\Partition0
> link to \\?\Device\Harddisk2\DR2
> Fixed hard disk media. Block size = 512
> size is 33820286976 bytes
> \\?\Device\Harddisk2\Partition1
> link to \\?\Device\HarddiskVolume3
> Fixed hard disk media. Block size = 512
> size is 33820286976 bytes
>
> Virtual input devices
> /dev/zero (null data)
> /dev/random (pseudo-random data)
> - (standard input)
>
> Virtual output devices
> - (standard output)
>
>
> OK so my broken drive is Volume3. Yhe spare one is Volume 1 and the
> one that's running the system now is Volume2.
> Problem is the tools shows disk0 part 0 and 1 for the spare one where
> I'm sure there is only one partition. Also it shows
> disk 2 partition 0 and 1. In both cases the partitions are of very
> similar size but not exactly the same. What does this mean?
> Which of them do I need to dd?
> yaro

http://www.chrysocome.net/dd

"Partition0 is the entire disk."

"Partition 0" refers to the entire disk. "Partition 1..N" are
the separate partitions. To back up the entire disk, you
use Partition 0 entry. \\?\Device\Harddisk2\Partition0

Based on the output you've posted above.

\\?\Device\Harddisk0 has one partition using the entire disk (minus enough
for the partition table, and perhaps rounded to the
nearest cylinder). Size = 320,072,933,376 (320GB)

\\?\Device\Harddisk1 has one partition. The size is missing for some reason.
79,998,918,144 is shown for the disk. (80GB)

\\?\Device\Harddisk2 has one partition. Now you claim there are two partitions
on there. Run TestDisk and check. Let it scan the entire
disk looking for partitions. You'll also notice the
entire disk size 33,820,286,976 and the first partition
are exactly the same. If this is an IDE ribbon cable drive,
did you check the jumpers yet ??? I suspect you have a
jumper in the "clip" position. "Clip" jumper is not shown
on the hard drive label. "Clip" jumper location may be
shown using web site information. The size shown cannot
possibly be right.

Please give the exact make and model number of the broken drive.
So I can look it up.

Paul

[Paul]

Paul wrote:
> yaro137 wrote:
>> Ok, before I mess something up I thought it would be a good idea to
>> show the result of running dd --info
>> Here is what comes:
>> Win32 Available Volume Information
>> \\.\Volume{d9b48260-7874-11de-b539-00142a0f8ad6}\
>> link to \\?\Device\HarddiskVolume1
>> fixed media
>> Mounted on \\.\f:
>>
>> \\.\Volume{6f31b204-9f8b-11dd-acf1-806d6172696f}\
>> link to \\?\Device\HarddiskVolume2
>> fixed media
>> Mounted on \\.\c:
>>
>> \\.\Volume{64d45d1c-7872-11de-8c2e-806d6172696f}\
>> link to \\?\Device\HarddiskVolume3
>> fixed media
>> Mounted on \\.\e:
>>
>>
>> NT Block Device Objects
>> \\?\Device\Floppy0
>> \\?\Device\Harddisk0\Partition0 link to
>> \\?\Device\Harddisk0\DR0
>> Fixed hard disk media. Block size = 512
>> size is 320072933376 bytes
>> \\?\Device\Harddisk0\Partition1
>> link to \\?\Device\HarddiskVolume1
>> Fixed hard disk media. Block size = 512
>> size is 320070288384 bytes
>> \\?\Device\Harddisk1\Partition0
>> link to \\?\Device\Harddisk1\DR1
>> Fixed hard disk media. Block size = 512
>> size is 79998918144 bytes
>> \\?\Device\Harddisk1\Partition1
>> link to \\?\Device\HarddiskVolume2
>> \\?\Device\Harddisk2\Partition0
>> link to \\?\Device\Harddisk2\DR2
>> Fixed hard disk media. Block size = 512
>> size is 33820286976 bytes
>> \\?\Device\Harddisk2\Partition1
>> link to \\?\Device\HarddiskVolume3
>> Fixed hard disk media. Block size = 512
>> size is 33820286976 bytes
>>
>> Virtual input devices
>> /dev/zero (null data)
>> /dev/random (pseudo-random data)
>> - (standard input)
>>
>> Virtual output devices
>> - (standard output)
>>
>>
>> OK so my broken drive is Volume3. Yhe spare one is Volume 1 and the
>> one that's running the system now is Volume2.
>> Problem is the tools shows disk0 part 0 and 1 for the spare one where
>> I'm sure there is only one partition. Also it shows
>> disk 2 partition 0 and 1. In both cases the partitions are of very
>> similar size but not exactly the same. What does this mean?
>> Which of them do I need to dd?
>> yaro
>
<<snip>>
>
> Please give the exact make and model number of the broken drive.
> So I can look it up.
>
> Paul

Don't run TestDisk, until you get the jumpering straightened out.
TestDisk will not be able to scan the entire disk, if the "clip"
jumper is what is setting the size to 33,820,286,976. And then it
will not be able to find all partitions and prepare a correct
partition table.

If you're in the middle of TestDisk (windows version) and don't
like the fact there is no "quit" item to exit the program,
you can use <ctrl>-c to quit the program. The program should
be sitting in one of its menus, when you use Control C.

This is how I know your drive is clipped. Download this document.
Look for "66055248 sectors" in the document. That is caused by
the geometry that "clip" caused. 66055248 * 512bytes/sector ==>
33,820,286,976. Your drive is "clipped" right now. Fix it.
Change the jumpers.

http://ibiblio.org/pub/Linux/docs/HOWTO/other-formats/pdf/Large-Disk-HOWTO.pdf

Paul

[yaro137]

Luckily I haven't had the chane to run TestDisk yet as I left the
drive at my friend's.
I'll be getting there soon and check the jumper first thing. Thanks a
lot.
yaro

[yaro137]

Paul you were absolutely right as to the pins.
I remember setting it to a slave drive before connecting
it to my friend's PC but did not realize it limits the drive
to 32GB. I changed it back to master. Now I can see it in
Disk Management as a Foreign disk but I can't import it.
I'll try DSL again. Maybe it can see my drive this time.
yaro

[yaro137]

Well, no luck with DSL again which is strange as I can see hba1 and
hda2
but couldn't find my test.txt file which I created under Windows on my
spare drive
on any of them. Back to dd then :)
yaro

[yaro137]

dd did not work for me. When I run the command it just shows the
banner and stops on that. Doesn't do anything from that point.
I tried recovery console to see if I can fix the mbt again but as only
the recovery console loads the computer reboots. So next step was to
try Windows repair. After pressing F8 to accept the licence it showed
me 2 partitions!!! ... and then rebooted before I managed to do
anything. Isn't that odd? So maybe a virus after all?
yaro

[yaro137]

I forgot to add that I tried Ghost from the boot floppy again but this
time it shows me that it can't find any partitions on that 250 drive.
Yes it can see it as 250GB disk now.
yaro

[yaro137]

I was preparing to run TestDisk and guess what happened.
The disk that was running the system for me started having
similar problems. For now it boots to Windows but after a minute
or so the system restarts. HELP :)
yaro

[Airman]

yaro137 wrote:
> I was preparing to run TestDisk and guess what happened.
> The disk that was running the system for me started having
> similar problems. For now it boots to Windows but after a minute
> or so the system restarts. HELP :)
> yaro

IDE or SATA controller problems?

[yaro137]

IDE but two different computers in a row with similar symptoms?...
wouldn't that be too much of a coincidence?
Anyway I got my friend's drive connected to yet another PC making sure
it won't try to boot from it. Also I removed
RAM chips and BIOS battery from my mates computer to be sure it gets
purged. Then booted into Safe Mode
on that third PC and scanning my friend's drive with Avast Home. Hope
it checks boot sectors of additional drives.
Had to leave it there as it was taking awfully long to get to just 50%
and it's Sat evening.
Still hoping for the best although preparing for the worse. Thought
the AV will pick on something straight away but
it found nothing. Still 50% to go so there is hope.
yaro

[db]

the next step is to go
into the bios and see
what it states about your
disks.

does the bios confirm
you have a 250gig
disk or 40 gig disk?

you might want to press
the key for auto detect
in the bios and see.

or you may want to check
the disk's documentation
to manually enter the
configuration of the disk
in bios, like size, lba, etc.

ultimately, you may have
to simply delete that
partition and recreate
it,

ensuring that you have
designated all of the
space possible to the
partition before formatting.

personally, I would divide
the disk into thirds and make
three partitions.




--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen

>
>

"yaro137" > wrote in message ...
> Unfortunatelly only a healthy 31.5GB basic partition.
> However just noticed another strange thing. In My Computer
> next to the drive letters I can see their sizes except for that
> one drive. It's the Disk Management snap-in that tells me 31.5
> Thanks again
> yaro

[db]

btw:

format the disk
using ntfs and not
fat32.



--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen

>
>

"db" <databaseben at hotmail dot com> wrote in message ...
> the next step is to go
> into the bios and see
> what it states about your
> disks.
>
> does the bios confirm
> you have a 250gig
> disk or 40 gig disk?
>
> you might want to press
> the key for auto detect
> in the bios and see.
>
> or you may want to check
> the disk's documentation
> to manually enter the
> configuration of the disk
> in bios, like size, lba, etc.
>
> ultimately, you may have
> to simply delete that
> partition and recreate
> it,
>
> ensuring that you have
> designated all of the
> space possible to the
> partition before formatting.
>
> personally, I would divide
> the disk into thirds and make
> three partitions.
>
>
>
>
> --
>
> db·´¯`·...¸><)))º>
> DatabaseBen, Retired Professional
> - Systems Analyst
> - Database Developer
> - Accountancy
> - Veteran of the Armed Forces
> - Microsoft Partner
> - @hotmail.com
> ~~~~~~~~~~"share the nirvana" - dbZen
>
>>
>>
>
> "yaro137" > wrote in message ...
>> Unfortunatelly only a healthy 31.5GB basic partition.
>> However just noticed another strange thing. In My Computer
>> next to the drive letters I can see their sizes except for that
>> one drive. It's the Disk Management snap-in that tells me 31.5
>> Thanks again
>> yaro
>

[yaro137]

The BIOS is happily showing me 250GB now.
It was partitioned for the system and data indeed.
However Ghost nor ShadowProtect can't see
any partitions on that disk so I can't back them up.
Before I get my friend's disk sorted I'm scarred to
do anything on that drive.
Thanks
yaro

[db]

well, when you state that
all computer management
shows is the 32 gig partition,

and you see no other
indication of there being
any unallocated space
available on the disk

then something is
screwed up.

-----------------

so you may not have
any choice but to
wipe the disk and ensure
that the proper steps are
taken to partition and
format the disk using
ntfs.

-----------------

what you can do is to
connect that drive to
another pc and use that
other pc to back up the
32 gigs of data.

then use that other
computer to delete
the 32 gig partition
and to recreate new
partition(s).

then format them using
ntfs

once that corrupted drive
has been properly set up
with the partitions and the
ntfs (nt file system)

then restore the backup.

then move that drive out
of the other pc and back
into its home pc.

sometimes, restoration
of backup files isn't flawless,

so if the disk fails to boot
up then simply use a xp cd
to initiate a repair installation

the repair installation will
ensure the system files and
the security features are in
sync with the pc.

------------------

incidentally, I don't recommend
making a single large partition
with that 250 gig disk.

instead, dividing that 250 gigs into
smaller manageable partitions
is safer and more efficient.

so my suggestion is to make
three equal partitions when
repartitioning that drive on
the other pc.
--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen

>
>

"yaro137" > wrote in message ...
> The BIOS is happily showing me 250GB now.
> It was partitioned for the system and data indeed.
> However Ghost nor ShadowProtect can't see
> any partitions on that disk so I can't back them up.
> Before I get my friend's disk sorted I'm scarred to
> do anything on that drive.
> Thanks
> yaro

[yaro137]

Thanks but a couple of post before I mentioned that the 32GB was
unreadable and it was set this way, as Paul pointed out due to
incorrectly set disk jumper. After correcting that The Bios can see a
250GB partition back again but something corrupted the boot
sector. Starting the computer from a Windows CD with only my corrupted
drive connected and trying to run reinstall the system
showed me my both portions for a moment and then the computer
restarted. Same when I tried to get to the Recovery Console.
It restarts before getting to the command prompt so I can't even try
fixboot and fixmbr again. As no data recovery tool can recognize
the partitions although they recognized my 250GB drive correctly I
can't recover anything. I hoped Linux can get to the files but
it can't see any files on any of the drives. Even on the spare disk
when I put a txt file to see if I can find it under Linux I was
unsuccesful.
I'll try another distribution to see whether it works better.
yaro

[yaro137]

Don't know how but at least I've got my friend's PC fixed.
It's either removing the RAM and BIOS battery or the AV although
I can't remember Avast finding any viruses. Will leave my hard drive
for now till I get yet another Linux live CD as the one I tried now
wouldn't
boot.
yaro

[Paul]

yaro137 wrote:
> Don't know how but at least I've got my friend's PC fixed.
> It's either removing the RAM and BIOS battery or the AV although
> I can't remember Avast finding any viruses. Will leave my hard drive
> for now till I get yet another Linux live CD as the one I tried now
> wouldn't
> boot.
> yaro

Now that the correct capacity is reported, you should try TestDisk.
What TestDisk does, is scan the entire disk surface, looking for
structures which resemble partitions. Based on that, it proposes
a new partition table. TestDisk is available for various OSes,
and I even have copies on several Linux distros.

http://www.cgsecurity.org/wiki/TestDisk

You should not accept the new partition table, until you've recorded
the details of the current table. Just in case you need to restore
that table later.

Symantec has a couple utilities from Partition Magic, which are
available for download. They will display partition info while
in Windows. You'd want PQEDIT32, so you can get parameters from
the table, and see whether the current partition table is intact
and makes sense or not. PQEDIT32 shows a table of numbers, and
even if the file systems themselves are damaged, it will still
show you the partition information.

ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

In the display, there is a Partition Type field. If you double click
the Partition Type field, a list of partition types will pop up.
By reading that list, you can decode what kind of partition
corresponds to the number show.

It could be the partition table which is damaged. It could be
one or both of the individual file systems, in the partitions,
which are damaged and unreadable. Since TestDisk is going to
"correct" the partition table, if at that point you ran
CHKDSK and the partition table is not correct, then CHKDSK
could make a mess. Which is why, if trying to do an "in-place
repair" with tools like that, you want your "dd" backup copy
to undo it all.

CHKDSK or the like, is only going to be prepared for things
like FAT32 and NTFS. If there are other partition types present,
you'd need an OS and environment appropriate for them, to recover
them. (I.e. Linux for EXT2 and EXT3).

If you had three partitions, and deleted one of the partitions,
TestDisk can find the remnants of that, and can potentially add
it to the proposed new partition table. That is why you, the
operator, have to decide whether what TestDisk is doing, makes
sense or not.

If you're in TestDisk, and you want to quit the program, and there
is no "Quit" option at that menu level, you can still press
<ctrl>-<C> to stop the program.

Paul

[yaro137]

Thanks for great info Paul. I'll certainly try TestDisk. However as I
mentioned I am
having problems with dd. I run dd --list which showed me all the
volumes connected not
recognizing that my corrupted disk is split into two ntfs partitions
but that's probably fine
as it should copy all the drive bit by bit or rather block by block
anyway. When I run

dd if=\\?\Device\Harddisk0\Partition0 of=\\?\Device
\Harddisk2\Partition0

it gave me the following:

"written by John Newbigin >
This program is covered by the GPL. See copying.txt for details"

and that's all. I didn't seem to do anything so I closed it.
Not sure what I'm doing wrong.
yaro

[Paul]

yaro137 wrote:
> Thanks for great info Paul. I'll certainly try TestDisk. However as I
> mentioned I am
> having problems with dd. I run dd --list which showed me all the
> volumes connected not
> recognizing that my corrupted disk is split into two ntfs partitions
> but that's probably fine
> as it should copy all the drive bit by bit or rather block by block
> anyway. When I run
>
> dd if=\\?\Device\Harddisk0\Partition0 of=\\?\Device
> \Harddisk2\Partition0
>
> it gave me the following:
>
> "written by John Newbigin >
> This program is covered by the GPL. See copying.txt for details"
>
> and that's all. I didn't seem to do anything so I closed it.
> Not sure what I'm doing wrong.
> yaro
>

Your command is copying Harddisk0 to Harddisk2. Is that what you wanted ?
I thought your damaged disk was Harddisk2. You want to copy from
Harddisk2 to some other disk, either disk to disk, or disk to file.
if = "input file or device". of = "output file or device".

OK, try the following. This copies a single sector, the very first
sector, from Harddisk2 and places the result in file C:\small.bin .

dd if=\\?\Device\Harddisk2\Partition0 of=C:\small.bin bs=512 count=1

See if that command works OK. You would see a new file on C: after
the command completes, and the size of the file would be 512 bytes.

*******

The benefit of a disk to disk transfer, as in this (Harddisk2 --> Harddisk3)

dd if=\\?\Device\Harddisk2\Partition0 of=\\?\Device\Harddisk3\Partition0

is if Harddisk2 was in good shape, Harddisk3 would immediately be available
to use. It would appear as a duplicated set of partitions. If Harddisk2
had four partitions, after the copy completed, Harddisk3 would also have
four partitions. If you rebooted at that point, a total of eight partitions
would show up after reboot. The four original partitions, plus the
four copies on the Harddisk3.

If you do the following kind of transfer, where the volume J is a
very large NTFS one, you get a backup, but the backup is only useful for
copying back to some hard drive later. This copies all of Harddisk2
(250GB) to a single file on J: drive. J: in this case, needs to be
NTFS, to get around the 4GB limit of FAT32 volumes.

dd if=\\?\Device\Harddisk2\Partition0 of=J:\large.bin

Later, if you wanted to put the 250GB backup file, back onto
a new hard drive, the command would look like the following.
This copies the large.bin image, to a new hard drive Harddisk3.
Since the large.bin file has the partition table at the front of
the file, when it is written to the new disk, the new disk now
has a partition table as well.

dd if=J:\large.bin of=\\?\Device\Harddisk3\Partition0

I don't see much in the way of debugging options in the "dd"
program. I see a "progress" option, but I don't know what that
does.

Please be careful with the command syntax :-) One mistake
and you could lose a *lot* of data.

Paul

[yaro137]

You're right. I got this the other way round lol.
Will try again today after work and then TestDisk.
Thanks
yaro

[yaro137]

Still creating the large.bin file. It's an old machine so it takes it
aaaages.
but at least it looks like it works now. Thanks Paul.
As only I get there I'll let you know how the DiskTest did.
Cheers
yaro

[yaro137]

It finished copying. Now this is really strange. Windows can see that
320GB drive as a 29.9GB disk. Space used 64MB.
The large.bin file size somehow dropped down to 0KB. In the system log
I found:
"Changing the disk signature of disk 2 because it is equal to the disk
signature of disk 1.!"
and next
"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume D:."
Looks like TestDisk is my last hope.
yaro

[Paul]

yaro137 wrote:
> It finished copying. Now this is really strange. Windows can see that
> 320GB drive as a 29.9GB disk. Space used 64MB.
> The large.bin file size somehow dropped down to 0KB. In the system log
> I found:
> "Changing the disk signature of disk 2 because it is equal to the disk
> signature of disk 1.!"
> and next
> "The file system structure on the disk is corrupt and unusable. Please
> run the chkdsk utility on the volume D:."
> Looks like TestDisk is my last hope.
> yaro

When you did the "dd" copy, there should have been a status message
when the copy was completed. Something about how many bytes or
records were copied.

The spare disk holding the "large.bin" file, should have been formatted
NTFS. If it was formatted FAT32, the copy should have stopped at a size
of 4GB, which would represent a failure to copy the whole thing.

I can't explain why the copied file size is zero. It sounds like it
is pretty important to figure out exactly what happened. You
may not have a good backup at this time.

If you use HDTune 2.55 from hdtune.com , you can do a surface scan of
the damaged disk, and see if any CRC errors are reported. "dd" will
only work well, if there aren't a lot of CRC errors. You would need
to dig up a copy of "dd_rescue", to copy a disk with a lot of CRC
damage. and that might be something you'd do using the Linux OS
and a Linux Live boot CD.

The general syntax for the dd command is like this

dd if=(source) of=(destination) bs=block_size_bytes count=number_of_blocks

If you use the command in the following way, it runs pretty slow. It copies,
until either the source device is exhausted, or there isn't enough room on
the destination device.

dd if=(source) of=(destination)

If you specify a block size, using the "bs" value, the copy process works
in "block size" chunks. This makes the command run much faster, at
say 20MB/sec transfer rate. The trick then, is to make sure that
the block_size * number_of_blocks is such, that all the data was
transferred.

So, let's try and craft some good numbers for "bs" and count. I use
the Linux "factor" program, as a quick way to factor a number. I keep
Linux (Knoppix 6.0) in a Virtual PC session for this purpose.

33820286976 = 2**13 * 3 * 3 * 7 * 19 * 3449
= 516096 * 65531

To copy the disk relatively quickly, the command looks like

dd if=(source) of=(destination) bs=516096 count=65531

When the dd command is complete, it should say "65531 records transferred".

The block side of 516096 is 1008 sectors of 512 bytes each.
If a block size is not specified, it is possible the
transfer operates in chunks of single sectors at a time,
which would cause it to run slower.

Since a lot of DMA transfers are involved, the fact the
computer is old should not be a factor. Direct Memory
Access hardware transfers, remove the burden from the CPU.
And the dd copy command should be using those features on
both the source and destination hard drives.

Paul

[yaro137]

Hi Paul. Good to know that you're still reading this.
I fired up HDTune and it shows me my two partitions
on that corrupted disk. It also points to Spin Up Time
whatever it means failed. Also Realocated Sector
Count is highlighted in yellow although the status
here is OK.
I'm just running the Error Scan on it and at the same
time I reformatted my spare disk (it's NTFS indeed) and
running check disk on it.
yaro

[Paul]

yaro137 wrote:
> Hi Paul. Good to know that you're still reading this.
> I fired up HDTune and it shows me my two partitions
> on that corrupted disk. It also points to Spin Up Time
> whatever it means failed. Also Realocated Sector
> Count is highlighted in yellow although the status
> here is OK.
> I'm just running the Error Scan on it and at the same
> time I reformatted my spare disk (it's NTFS indeed) and
> running check disk on it.
> yaro

The yellow statistics likely are not good. Spin Up Time
problems may not be the fault of the drive (a weak 12V feed
to a drive could also be responsible, such as inside
an external USB enclosure). My current drive isn't perfect
on Spin Up Time, but I'm not concerned about it.

But if I see Reallocated Sectors, that is the
responsibility of the drive alone. So that would be enough
for me to consider retiring the drive, once the data has been
recovered. Reallocated sectors are all part of the drive
maintaining itself, so a couple is not a problem. But
if there is a growth rate observable, that could mean
there is contamination inside the drive.

Some people have opened up the HDA on a dead hard drive, to
find "dust" from the surface of the platter. So it is possible
for a drive to create its own contamination internally, when
something scrapes. While there is an air circulation scheme
and filter pad inside the drive, to take care of small amounts
of contamination, a failure of the platter surface (corrosion,
or a head crash), may pollute the surface of the disk and
cause further problems. The inside of the drive could be
as clean as can be, or it can be quite filthy in there when
the drive fails.

In any case, once you're got your "large.bin" file and it
is the right size, you have less reason to be concerned
about what SMART shows. The "large.bin" file is your
backup, and your insurance if the broken drive fails
completely.

Paul

[yaro137]

That's really strange but HDTune Error Scan gave me a negative result.
It found no damaged sectors. I think I'll give dd another try.
yaro

[yaro137]

So far so good. My large.bin reached 45GB so it went through the first
partition of the corrupted drive and it's still growing.
yaro

[yaro137]

This is taking forever. It's ~90GB now but at least it's still copying
this time.
Hope it'll finish by tomorrow morning.
yaro

[Paul]

yaro137 wrote:
> This is taking forever. It's ~90GB now but at least it's still copying
> this time.
> Hope it'll finish by tomorrow morning.
> yaro

Control Panels:Administrative Tools:Performance

Click the three entries under "Color--Scale--Counter...".
Press the Delete key to get rid of them.

Right-click within the graphing pane, and select "Add Counters".

Using the Performance object menu, select "PhysicalDisk"
Add "Disk Read Bytes/sec" as a counter.

Go back to "Color--Scale--Counter..." and verify a new
entry is there. Right-click the new entry, and select
"Properties". Click "graph". Set Vertical Scale Maximum
to 10000. Click "Apply". Click "OK".

Now, you're looking at a chart of disk read performance.
The full scale value of "10000" is equal to 100MB/sec.
A value of 2000 would be 20MB/sec and so on.

That may help you chart the progress of the transfer
and estimate time of completion. I've used this
before, while using "dd", to see what is going on.

If you use "bs" and "count" parameters, and the
disk interfaces are in DMA mode, the transfer
should go faster. But since you're in the middle of
a transfer, I would not stop now. Finish the current
transfer. The time to experiment with transfer rate,
was right at the very beginning.

Paul

[yaro137]

Whole day and whole night but we've got 224GB. Almost there.
Hope it wont brake right at the end.
yaro

[yaro137]

Finally finished at ~244 GB but dd came up with the following report:

Error reading file: 27 The drive cannot find the sector requested
488395055+0 records in
488395055+0 records out

Possibly just some bad sector.
yaro

[yaro137]

I run testDisk to analyze and that's what I found in the test.log



Fri Jul 31 11:52:22 2009
Command line: TestDisk

TestDisk 6.11.3, Data Recovery Utility, May 2009
Christophe GRENIER >
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.3, Cygwin 1005.25 - May 6 2009 20:35:43
ext2fs lib: 1.41.4, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf
lib: 20080501
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=79998918144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)
=79998918144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)
=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=79982590464
file_pread(4,1,buffer,156248189(9725/254/63)) lseek err Invalid
argument
file_pread(5,1,buffer,488408129(30401/254/63)) lseek err Invalid
argument
Hard disk list
Disk /dev/sda - 79 GB / 74 GiB - CHS 9725 255 63, sector size=512 -
IC35L080AVVA07-0
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 -
SAMSUNG SP2514N

Partition table type (auto): Intel
Disk /dev/sdb - 250 GB / 232 GiB - SAMSUNG SP2514N
Partition table type: Intel

Analyse Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
check_part_i386 2 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * W2K Dynamic/SFS 0 1 1 3915 254 63 62910477
2 P W2K Dynamic/SFS 3916 0 1 30400 254 63 425481525
Backup partition structure
partition_save
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/1/1
filesystem size 62910477
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 3931904
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 3915 254 63 62910477
NTFS, 32 GB / 29 GiB
NTFS at 3916/0/1
filesystem size 425481525
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 26592595
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 3916 0 1 30400 254 63 425481525
[Programy]
NTFS, 217 GB / 202 GiB
file_pread(5,8,buffer,488395084(30401/47/59)) lseek err Invalid
argument
file_pread(5,1,buffer,488395084(30401/47/59)) lseek err Invalid
argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 3915 254 63 62910477
NTFS, 32 GB / 29 GiB
P HPFS - NTFS 3916 0 1 30400 254 63 425481525
[Programy]
NTFS, 217 GB / 202 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 3915 254 63 62910477
2 P HPFS - NTFS 3916 0 1 30400 254 63 425481525
[Programy]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
check_part_i386 2 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
1 * W2K Dynamic/SFS 0 1 1 3915 254 63 62910477
2 P W2K Dynamic/SFS 3916 0 1 30400 254 63 425481525

TestDisk exited normally.


It doesn't look bad I think so why won't that work?
yaro

[yaro137]

I tried importing that disk one more time and the System log gave me
this:

Source: LDM
VINTERNAL Error - The disk group contains no valid configuration
copies (C10000B6).

and next:

Source: LDM
Unspecified error (80004005).

yaro

[yaro137]

Just noticed that TestDisks gives me access to my files on both the
partitions. Cool stuff.
I was able to copy all I need. This is indeed a great tool.
One more time many thanks for your help Paul. If not for you it would
all be gone!
yaro

[Paul]

yaro137 wrote:
> Just noticed that TestDisks gives me access to my files on both the
> partitions. Cool stuff.
> I was able to copy all I need. This is indeed a great tool.
> One more time many thanks for your help Paul. If not for you it would
> all be gone!
> yaro

The log looked reasonable, in that at least it found
some partitions for you. I'm a bit curious though,
why the "dd" didn't complete. You said the HDTune scan
passed without errors, so I would have expected "dd" to
finish as well.

If you need to do this again some time, investigate the
"dd_rescue" program. This runs under Linux, and might
even be included on a Linux Live CD distro. (Linux Live CDs
allow booting a computer and running Linux, without installing
any software on the hard drives.)

http://www.garloff.de/kurt/linux/ddrescue/

Since "dd" copies all the sectors, some of those
sectors may not have files stored in them. The partition
may not be full, in which case "dd" is backing up the
slack (empty) space on the disk. So a failure to read
a sector, doesn't necessarily mean a file got damaged.
It could be a slack sector is unreadable, and no one
would care about that (except if perhaps they were
trying to rescue files accidentally deleted in the
trash can).

The reason I insist on backing up a damaged drive, is I had
an incident, where a data recovery utility damaged the
disk I was working on, making the data impossible to recover.
That happened 20 years ago, and I continue to believe to
this day, in backing up the drive first if possible. There
are no guarantees with data recovery programs, as to what
they'll do, and what bugs they may have.

Glad to hear you got all your data back :-)

Paul