Recover HDD

I accidentally pulled the data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)"
and it wants me to format it before proceeding.

Can I do this Formatting as it wants and will this get me back the HDD
data?
PJ

Peter Jason wrote:

I accidentally pulled the data plug of an online (non
system) HDD, and now the Disk Management shows it to be
"1863.01GB RAW Healthy (Primary Partition)" and it wants me
to format it before proceeding.

Can I do this Formatting as it wants and will this get me
back the HDD data?

Apparently you are in Windows, so it is a secondary drive.

The first thing to do is install a recovery utility and see
if the drive and data are visible to it.

Formatting a drive removes easy access to all data on the
drive. You will no longer see the data in Windows file
manager.

Think before you act. You should have had a backup copy of
the data. If possible, the very first thing you should do is
make a copy of the drive in its messed up form. Now is not
the time to take shortcuts. You risk seriously compounding
your injury. All depending on how important the data is to
you.

In article , er
says...

Peter Jason wrote:

I accidentally pulled the data plug of an online (non
system) HDD, and now the Disk Management shows it to be
"1863.01GB RAW Healthy (Primary Partition)" and it wants me
to format it before proceeding.

Can I do this Formatting as it wants and will this get me
back the HDD data?

Apparently you are in Windows, so it is a secondary drive.

The first thing to do is install a recovery utility and see
if the drive and data are visible to it.

Formatting a drive removes easy access to all data on the
drive. You will no longer see the data in Windows file
manager.

Think before you act. You should have had a backup copy of
the data. If possible, the very first thing you should do is
make a copy of the drive in its messed up form. Now is not
the time to take shortcuts. You risk seriously compounding
your injury. All depending on how important the data is to
you.

John's right. A rash or inexpert move at this juncture could mean you
never see your data again. You need to get this disk to someone who's
familiar with this sort of recovery. And formatting is about the worst
thing you could do.

The chances are the data structures which record details of the
partition are damaged. There are utilities which can repair these -
Acronis Disk Director, Paragon's disk tools. But anyone learning to use
these tools makes mistakes, and you want someone who's already made all
the beginners' mistakes!


--

Phil, London

On Sat, 27 May 2017 07:04:57 -0000 (UTC), John Doe
wrote:

Peter Jason wrote:

I accidentally pulled the data plug of an online (non
system) HDD, and now the Disk Management shows it to be
"1863.01GB RAW Healthy (Primary Partition)" and it wants me
to format it before proceeding.

Can I do this Formatting as it wants and will this get me
back the HDD data?

Apparently you are in Windows, so it is a secondary drive.

The first thing to do is install a recovery utility and see
if the drive and data are visible to it.

Formatting a drive removes easy access to all data on the
drive. You will no longer see the data in Windows file
manager.

Think before you act. You should have had a backup copy of
the data. If possible, the very first thing you should do is
make a copy of the drive in its messed up form. Now is not
the time to take shortcuts. You risk seriously compounding
your injury. All depending on how important the data is to
you.

Sounds like good advice. What about running chkdsk /f on it?

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Peter Jason schreef op 27-05-2017
in :
data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy
(Primary Partition)" and it wants me to format it before proceeding.

You better take an other hobby, computing is clearly not your type.
Each time you are the cause of all your problems (PEBKAC).
Don't worry: Some Mothers Do 'Ave 'Em.

--
MdW.

Peter Jason wrote:
I accidentally pulled the data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)"
and it wants me to format it before proceeding.

Can I do this Formatting as it wants and will this get me back the HDD
data?
PJ

I'll quickly review my "two drive rule" for data recovery.

broken_drive -- spare_drive#1 Make a sector-by-sector copy of the
damaged drive. *If* you use repair-in-place
tools such as TestDisk, CHKDSK, or
similar, if the repair-in-place tool
damages the broken_drive, you have a copy of it.

broken_drive -- scavenger_output The second drive is used to hold
recovered data, from scavenger tools
that do not repair-in-place. In many
cases, you are advised to not write to
the broken_drive at all. This second
drive might be used with Photorec or
Recuva (scavengers).

*******

I'd be using a few different tools.

if the disk is GPT instead of MBR, then some of these tools
won't work.

1) PTEDIT32 (MBR only)

This one shows the partition table.

The MBR has a 0xAA55 signature in the last two bytes,
and that's how the OS keeps track the disk was initialized
at one time. If the MBR is all-zero and no signature is
present, it will prompt you to initialize it. Deny this
operation, if you know there is data on the drive.

PTEDIT32 is just a quick way to see if the partition table
looks damaged.

I don't have a review tool for GPT drives. I think there
can be up to 128 partitions on those (enough that Windows
users will never run out).

2) Disktype (freeware, Cygwin, Linux, no Windows port or binary)

I use the Cygwin version.

If the partition table in the MBR still has its entries,
then disktype "tastes" each partition. On a 0x07 partition,
it's going to look for the letters "NTFS" in the first sector.
The MBR has a pointer to the exact sector where the partition
starts, and on NTFS, the letters "NTFS" are in the first sector.

So Disktype uses the MBR info, to find the correct offset, then
it tells you what kind of partition it is. It uses a "voting"
system. Some file systems have five "features" you can check,
and if all are heathy, Disktype says "NTFS 5 out of 5". That
tells you there are strong indications the partition is NTFS.
If it said "1 out of 5 votes", that means there is some
significant damage.

So again, this is "nice to have info". I like to use
confidence-builder apps when I know the disk itself is not
sick or damaged.

3) TestDisk

This is your primary repair tool.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The first thing to remember about this product, is it is
not a mind-reader. You, the owner of the drive, know how
many partitions were on there. TestDisk has a method of
"scanning" the drive, but you as the owner of the drive,
are the "fail safe system". If you don't like the appearance
of the info TestDisk is proposing, you just ctrl-C and exit.

As an example, I lost the MBR on a drive. I *knew* there were
three partitions. TestDisk found four partitions. The fourth
partition definition (as computed by TestDisk) conflicted with
the third partition. If I had accepted the new MBR calculation,
I would likely have had a permanently corrupted partition on
the drive.

Now, at my leisure, I could use most of the information it
provided, and I think I eventually cooked up some PTEDIT32
edits, to bring all partitions back online properly. TestDisk
helped - but TestDisk lacked sufficient consistency checks, and
the human operator had to look at the numbers and say "Just, No!!!".

Now, that being said, TestDisk has one nice function, It can
copy the files it finds, off the drive. To your spare_drive#2.

Do you see the letter "c" here ? That's the option to copy
one of the directories shown on the screen.

http://www.cgsecurity.org/mw/images/List_files.png

Now, that's a "non-scavenger". It should be using the
available directory info from NTFS, to identify even
fragmented files and copy them.

Tools like Photorec or Recuva, work at the block level
on the assumption all file system pointers are corrupted.
The outcome in that case, can be much worse.

*******

In summary, these are my steps (if it was my drive):

1) dd if=/dev/sda of=/dev/sdb # make a copy of the drive
# in case I screw it up

2) On my second spare drive, create a partition
big enough to hold the TestDisk copy files.

Then, enter TestDisk, list the files, use the
"c" key to copy them. Only you can judge whether
the recovered files now stored on Spare_disk#2 are
valid, and the data recovery operation is complete.

While you could push your luck and try CHKDSK somehow,
that's going to be pretty difficult if the OS insists
a partition is RAW. I would be using the relatively safe
TestDisk file copy operation, to rescue my data.

If that doesn't work... you're in trouble.

I have a data recovery utility that could scan for NTFS
info, but it's likely only a little bit better than
TestDisk, and I have no idea how large a disk it will
handle. There are *plenty* of commercial offerings for
$39.95 that will do the same thing as the ancient freebie
I've got here. Remember, you don't want to repair-in-place,
and any copied files should go onto a second disk.

http://web.archive.org/web/200701010...rescue19d.html

You *can* repair in place... if you do a sector-by-sector
backup of the drive first. If a backup utility claims to
know how to do that, check the execution time. I had one
utility that said "all done" after ten minutes. It took
*hours* for a *real* utility to do the same thing, so I
could immediately tell the first utility was trying
to snow me.

(Drive that does 200MB/sec on outer diameter and
100MB/sec on inner diameter, could be considered to
average at about 150MB/sec. 2000/.15 = 13333 seconds
or 3.8 hours. So you know it can't happen in 10 minutes.)

If the drive is not damaged, I can use this to copy
all the sectors. The only bug this has, it is cannot
seem to detect the end of a USB key used as a source
drive properly. There is a workaround for that, so it's
not a problem.

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

If the drive is damaged (CRC errors), I need gddrescue (Linux).

HTH,
Paul

Lucifer Morningstar wrote:
On Sat, 27 May 2017 07:04:57 -0000 (UTC), John Doe
wrote:

Peter Jason wrote:

I accidentally pulled the data plug of an online (non
system) HDD, and now the Disk Management shows it to be
"1863.01GB RAW Healthy (Primary Partition)" and it wants me
to format it before proceeding.

Can I do this Formatting as it wants and will this get me
back the HDD data?
Apparently you are in Windows, so it is a secondary drive.

The first thing to do is install a recovery utility and see
if the drive and data are visible to it.

Formatting a drive removes easy access to all data on the
drive. You will no longer see the data in Windows file
manager.

Think before you act. You should have had a backup copy of
the data. If possible, the very first thing you should do is
make a copy of the drive in its messed up form. Now is not
the time to take shortcuts. You risk seriously compounding
your injury. All depending on how important the data is to
you.

Sounds like good advice. What about running chkdsk /f on it?

Ouch.

Repair-in-place utilities should be used with great care.

I've read of cases where CHKDSK absolutely trashed an IDE
drive. The reason ? The IDE cable was loose, and every
repair write done by CHKDSK, just ruined everything it
touched. If the user had not attempted CHKDSK in that
case, all the data would still be there today.

When using Repair-In-Place utilities of any sort, you
want a sector-by-sector safety backup of the drive first.
For example, this can do sector-by-sector for you. As
can the Linux (LiveCD) equivalent. If your C: drive is
damaged, you can use the "dd" on any Linux LiveCD instead.

http://www.chrysocome.net/dd

In this case, the OP has a RAW partition, and I somehow
doubt CHKDSK can be made to chow-down, without a mountvol
string or a drive letter. The RAW partition might not have
a letter to work with.

What I'd like to know, is why is the head of the drive
over top of the first sector of the NTFS partition
when stuff like this happens ? You'd think just about
anything *other* than critical sectors would get zorched.
Why is a partition ending up RAW such a high-runner occurrence ?
One of lifes mysteries.

Paul

Machiel de Wit wrote:
Peter Jason schreef op 27-05-2017
in :
data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)" and it wants me to format it before proceeding.

You better take an other hobby, computing is clearly not your type.
Each time you are the cause of all your problems (PEBKAC).
Don't worry: Some Mothers Do 'Ave 'Em.


He uses ESATA to extend the number of disks
his system supports. This means he has some
hotplug options.

A danger with hotplug, is forgetting to use the
Safely Remove, before pulling the cable.

The OP probably has more ESATA gear than anyone here.

I don't even own an ESATA cable :-)

I have a couple USB3 disk enclosures I use instead.

Paul

What about running chkdsk /f on it?

You never should touch the disk, as that will destroy all.
My advice:
Try http://www.easeus.com/datarecoverywizardpro/

I already tried out a lot of (very expensive) tools.
But with EaseUS I always got the best results
You may download a trial version to check whether it meets your needs.
You will need an additional hard disk to store the results.
Depending on the disk size, the recovery may last hours or days

Another approach:
https://free-raw-partition-recovery.en.softonic.com/

Good luck!

Juergen

On 05/27/2017 12:33 AM, Peter Jason wrote:
I accidentally pulled the data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)"
and it wants me to format it before proceeding.

Can I do this Formatting as it wants and will this get me back the HDD
data?
PJ


Windows structures got corrupted. The drive itself may be OK. Do you
have another machine (or bootable OS, like a Linux disk) you can use?
Don't connect it to that Windows system.

--
Mark Lloyd
http://notstupid.us/

"It was well known how profitable this fable of Christ has been to us."
- Pope Leo X (as reported by Rev. Tavlor in the Diegesis)

Paul wrote:
Lucifer Morningstar wrote:
On Sat, 27 May 2017 07:04:57 -0000 (UTC), John Doe
wrote:

Peter Jason wrote:
I accidentally pulled the data plug of an online (non system) HDD,
and now the Disk Management shows it to be "1863.01GB RAW Healthy
(Primary Partition)" and it wants me to format it before proceeding.
Can I do this Formatting as it wants and will this get me back the
HDD data?
Apparently you are in Windows, so it is a secondary drive.
The first thing to do is install a recovery utility and see if the
drive and data are visible to it.
Formatting a drive removes easy access to all data on the drive. You
will no longer see the data in Windows file manager.
Think before you act. You should have had a backup copy of the data.
If possible, the very first thing you should do is make a copy of the
drive in its messed up form. Now is not the time to take shortcuts.
You risk seriously compounding your injury. All depending on how
important the data is to you.

Sounds like good advice. What about running chkdsk /f on it?

Ouch.

Repair-in-place utilities should be used with great care.

I've read of cases where CHKDSK absolutely trashed an IDE
drive. The reason ? The IDE cable was loose, and every
repair write done by CHKDSK, just ruined everything it
touched. If the user had not attempted CHKDSK in that
case, all the data would still be there today.

When using Repair-In-Place utilities of any sort, you
want a sector-by-sector safety backup of the drive first.
For example, this can do sector-by-sector for you. As
can the Linux (LiveCD) equivalent. If your C: drive is
damaged, you can use the "dd" on any Linux LiveCD instead.

http://www.chrysocome.net/dd

In this case, the OP has a RAW partition, and I somehow
doubt CHKDSK can be made to chow-down, without a mountvol
string or a drive letter. The RAW partition might not have
a letter to work with.

What I'd like to know, is why is the head of the drive
over top of the first sector of the NTFS partition
when stuff like this happens ? You'd think just about
anything *other* than critical sectors would get zorched.
Why is a partition ending up RAW such a high-runner occurrence ?
One of lifes mysteries.


Using a live Linux session and install testdisk and see if you can
restore the lost partition would be my strategy. Not sure OP is up to
the task though. testdisk is command line utility. Not the most user
friendly but I have found it to work wonders....

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

On 27/5/2017 1:33 PM, Peter Jason wrote:
I accidentally pulled the data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)"
and it wants me to format it before proceeding.

Can I do this Formatting as it wants and will this get me back the HDD
data?

DO NOT format it so soon. Find a friend who knows more about saving data
in what looks like a damage hard disk.

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
�借貸! ��騙! ��交! �打交! �打劫! �自殺! 請考慮綜� (CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

Jonathan N. Little wrote:
Paul wrote:
Lucifer Morningstar wrote:
On Sat, 27 May 2017 07:04:57 -0000 (UTC), John Doe
wrote:

Peter Jason wrote:
I accidentally pulled the data plug of an online (non system) HDD,
and now the Disk Management shows it to be "1863.01GB RAW Healthy
(Primary Partition)" and it wants me to format it before proceeding.
Can I do this Formatting as it wants and will this get me back the
HDD data?
Apparently you are in Windows, so it is a secondary drive.
The first thing to do is install a recovery utility and see if the
drive and data are visible to it.
Formatting a drive removes easy access to all data on the drive. You
will no longer see the data in Windows file manager.
Think before you act. You should have had a backup copy of the data.
If possible, the very first thing you should do is make a copy of the
drive in its messed up form. Now is not the time to take shortcuts.
You risk seriously compounding your injury. All depending on how
important the data is to you.

Sounds like good advice. What about running chkdsk /f on it?

Ouch.

Repair-in-place utilities should be used with great care.

I've read of cases where CHKDSK absolutely trashed an IDE
drive. The reason ? The IDE cable was loose, and every
repair write done by CHKDSK, just ruined everything it
touched. If the user had not attempted CHKDSK in that
case, all the data would still be there today.

When using Repair-In-Place utilities of any sort, you
want a sector-by-sector safety backup of the drive first.
For example, this can do sector-by-sector for you. As
can the Linux (LiveCD) equivalent. If your C: drive is
damaged, you can use the "dd" on any Linux LiveCD instead.

http://www.chrysocome.net/dd

In this case, the OP has a RAW partition, and I somehow
doubt CHKDSK can be made to chow-down, without a mountvol
string or a drive letter. The RAW partition might not have
a letter to work with.

What I'd like to know, is why is the head of the drive
over top of the first sector of the NTFS partition
when stuff like this happens ? You'd think just about
anything *other* than critical sectors would get zorched.
Why is a partition ending up RAW such a high-runner occurrence ?
One of lifes mysteries.


Using a live Linux session and install testdisk and see if you can
restore the lost partition would be my strategy. Not sure OP is up to
the task though. testdisk is command line utility. Not the most user
friendly but I have found it to work wonders....

It requires you to "add value" with your own brain.

It's great that the application exists, but it does
have some rough edges.

It should be "used for a look first", just like
some AV applications have a separate "scan" and "delete"
feature. Once your "scan" is complete, take your time
and analyze what it is telling you. Don't be in a rush
to just "click any Yes button and trust the developer
to do the right thing". TestDisk is not that kind
of software. That one time I used it, where it produced
a particularly egregious (to me) result, it didn't
even check that two partition definitions were not
overlapping. It should at least be checking the
span on the detections, and making sure the partitions
don't overlap. If the detected partitions overlap, the
program should indicate "untrustworthy result - something
is wrong here - don't click the button".

When you delete a partition in Disk Management (or anywhere
else for that matter), the partition header is left sitting
there. Now, maybe it gets overwritten by some other usage,
at some point. But if it sits there with the letters "NTFS"
and the 0xAA55 signature bytes at the end, TestDisk can
"sniff" that, and find enough of the old partition,
to declare a "false positive".

And the reason for that, is similar to how file deleting
works. When you delete a file, it isn't really deleted.
On a Windows file system, you may find just a single
bit on a filename entry in the $MFT has been altered.
The actual file was not overwritten. This is why
"undelete" utilities exist - they take advantage of
that behavior. TestDisk is in a similar situation - due
to the lack of hygiene when a partition is deleted,
you can "find" the partition later, even when the
definition is no longer valid or desired.

Paul

On Sat, 27 May 2017 10:11:27 +0200, Machiel de Wit wrote:

You better take an other hobby, computing is clearly not your type.
Each time you are the cause of all your problems (PEBKAC).
Don't worry: Some Mothers Do 'Ave 'Em.

Very helpful of you...

--
s|b

On Sat, 27 May 2017 15:33:45 +1000, Peter Jason wrote:

I accidentally pulled the data plug of an online (non system) HDD, and
now the Disk Management shows it to be "1863.01GB RAW Healthy (Primary
Partition)"
and it wants me to format it before proceeding.

Can I do this Formatting as it wants and will this get me back the HDD
data?

Do NOT format the hdd. Friend of mine had the same problem with his
external hdd after there was lightning. I took the drive out of its
case, installed in a PC and then ran TestDisk. There's a step-by-step
guide: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The drive was 2TB, so it took a long time, but in the end I got all data
(+1TB) back. Even some files he had deleted.

--
s|b