Page 1 of 3

Can't read/access hard drive

Posted: 13 May 2012, 10:50
by neelb
Hello,

my wifes HDD has recently failed in her HP Netbook, and I am desperate to as a minimum recover some word files from the drive, which are university assignments. The drive is a Samsung Spinpoint 250GB Model HM250HI

History as a I remember it is:

1) Netbook has recently been dropped, but still booted. Netbook crashed running Windows 7 starter, failed to reboot a couple of times then automatically went into windows recovery and then I presume went into some kind of chdsk, but you couldn't see it progress. Went to bed, following morning netbook didn't even recognise there was a HDD. I suspect that there is physical damage to the HDD.

2) Tried Spinrite, it couldn't detect HDD either !

3) Removed HDD from Netbook, connected up to HP laptop (windows 7) via 2.5HDD USB board. Laptop detected partitions but would not let access them, except for the recovery drive.

4) Ran Testdisk see log below: no screen grabs sorry :(

Sat May 12 18:32:41 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-05-08T10:52:46
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=305130373120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=14623440896
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=108355584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=108191744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=17887657984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=231852736512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=208666624
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - TOSHIBA MK3276GSX, S/N:5 I1D3U0BZ, FW:GS00
Disk /dev/sdb - 250 GB / 232 GiB - CHS 103936 127 37, sector size=512 - SAMSUNG HM250HI, S/N:152D20337A0C

Partition table type (auto): Intel
Disk /dev/sdb - 250 GB / 232 GiB - SAMSUNG HM250HI
Partition table type: Intel

Analyse Disk /dev/sdb - 250 GB / 232 GiB - CHS 103936 127 37
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 1216
NTFS at 0/55/14
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
file_pread(5,4095,buffer,137897(29/43/36)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,137897(29/43/36)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
BAD_RS LBA=409600 122174
NTFS at 87/21/11
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
file_pread(5,4095,buffer,6701057(1426/7/25)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
NTFS at 96456/6/11
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
file_pread(5,2,buffer,488183809(103891/0/1)) ReadFile Data error (cyclic redundancy check).

check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 127 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 37 (HD)
1 * HPFS - NTFS 0 55 14 87 21 10 407552

Bad relative sector.
Warning: number of heads/cylinder mismatches 255 (NTFS) != 127 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 37 (HD)
2 P HPFS - NTFS 87 21 11 96456 6 10 452837376

Warning: Bad starting sector (CHS and LBA don't match)
Warning: number of heads/cylinder mismatches 255 (NTFS) != 127 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 37 (HD)
3 P HPFS - NTFS 96456 6 11 103890 126 36 34936832 [RECOVERY]

Warning: Bad starting sector (CHS and LBA don't match)
check_FAT: can't read FAT boot sector
Invalid FAT boot sector
4 P FAT32 LBA 103890 126 37 103935 123 4 211312
4 P FAT32 LBA 103890 126 37 103935 123 4 211312

Warning: Bad starting sector (CHS and LBA don't match)
search_vista_part: 1

search_part()
Disk /dev/sdb - 250 GB / 232 GiB - CHS 103936 127 37
NTFS at 0/55/14
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
filesystem size 407552
sectors_per_cluster 8
mft_lcn 16981
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,4096,buffer,137896(29/43/35)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,137896(29/43/35)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
HPFS - NTFS 0 55 14 87 21 10 407552
NTFS, blocksize=4096, 208 MB / 199 MiB
NTFS at 87/21/11
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
filesystem size 452837376
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 7602175
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,4096,buffer,6701056(1426/7/24)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6701056(1426/7/24)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
HPFS - NTFS 87 21 11 96456 6 10 452837376
NTFS, blocksize=4096, 231 GB / 215 GiB
NTFS at 96456/6/11
heads/cylinder 255 (NTFS) != 127 (HD)
sect/track 63 (NTFS) != 37 (HD)
filesystem size 34936832
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 96456 6 11 103890 126 36 34936832 [RECOVERY]
NTFS, blocksize=4096, 17 GB / 16 GiB
file_pread(5,16,buffer,488183808(103890/126/37)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,488183808(103890/126/37)) ReadFile Data error (cyclic redundancy check).

file_pread(5,7,buffer,488183809(103891/0/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,488397312(103936/55/14)) lseek err Invalid argument
file_pread(5,1,buffer,488397312(103936/55/14)) lseek err Invalid argument
file_pread(5,2,buffer,488397349(103936/56/14)) lseek err Invalid argument
file_pread(5,1,buffer,488397349(103936/56/14)) lseek err Invalid argument
file_pread(5,2,buffer,488398848(103936/96/33)) lseek err Invalid argument
file_pread(5,1,buffer,488398848(103936/96/33)) lseek err Invalid argument
file_pread(5,7,buffer,488398849(103936/96/34)) lseek err Invalid argument
file_pread(5,8,buffer,488398856(103936/97/4)) lseek err Invalid argument
file_pread(5,3,buffer,488398864(103936/97/12)) lseek err Invalid argument
file_pread(5,3,buffer,488398911(103936/98/22)) lseek err Invalid argument
file_pread(5,8,buffer,488398927(103936/99/1)) lseek err Invalid argument
file_pread(5,11,buffer,488398974(103936/100/11)) lseek err Invalid argument
file_pread(5,2,buffer,488400896(103937/25/9)) lseek err Invalid argument
Warning: the current number of heads per cylinder is 127 but the correct value may be 255.

Results
* HPFS - NTFS 0 55 14 87 21 10 407552
NTFS, blocksize=4096, 208 MB / 199 MiB
P HPFS - NTFS 87 21 11 96456 6 10 452837376
NTFS, blocksize=4096, 231 GB / 215 GiB
P HPFS - NTFS 96456 6 11 103890 126 36 34936832 [RECOVERY]
NTFS, blocksize=4096, 17 GB / 16 GiB

interface_write()
1 * HPFS - NTFS 0 55 14 87 21 10 407552
2 P HPFS - NTFS 87 21 11 96456 6 10 452837376
3 P HPFS - NTFS 96456 6 11 103890 126 36 34936832 [RECOVERY]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

5) On reboot, now my laptop does not see any partitions at all, just one unspecified drive. So it feels like I'm going backwards. I'm running test drive again now, and it is currently analysing cylinders.


Wish I'd found the forum first because Now I think I made a couple of mistakes. I did not check the content by pressing "P" to confirm the partitions were correct, and as you see I did a write. Have I made an irreversible mistake? should I just try photorec and try to recover the word file *.doc. I did try this previously but it looked like it was going to take about a week to complete!

Thanks for any help/advice in advance

Re: Can't read/access hard drive

Posted: 13 May 2012, 11:48
by Fiona
Now I think I made a couple of mistakes.
Never use chkdsk if you have any important piece of data which is not backed up.
Chkdsk only tries to repair a file system but not to recover data.
Chkdsk can make changes to the file system and change data also.
Regardless if you have a backup or not
Any changes are not reversible.
Some users have had a fortune to recover their data using chkdsk, but a lot of users lost their data forever.

Your disk geometry looks not correct.
Normally Netbooks using a geometry of 240 heads per cylinder and 63 sectors per head.
Your values are Heads 127 instead of 240 and sectors are 37 instead of 63.

USB-controller often using a geometry of 255 heads.
Value of sectors should be always 63.

Can you repeat your diagnose only to provide infos from TestDisk Analyse using 255 heads and 63 sectors.
Before you confirm at Analyse check the menu geometry and press enter.
Change the values at heads and sectors to 255 and 63 just as suggested.
Confirm at Ok and run Analyse.
Can you copy the content of the screen or upload a screenshot about the current partition structur!
If all partitions are available, I'll not restore your disk at the moment!
Reason is, I've seen some errors like CRC.
file_pread(5,4096,buffer,6701056(1426/7/24)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6701056(1426/7/24)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
Looks like a damaged file system.
If you recover a faulty file system, windows can read it and hang or doesn't response anymore.
Please run Quick Search.
Any message about partitions which are not recoverable are not interesting.
In case confirm at continue to get to the results of Quick Search.
I'd need these Infos also
If your partitions are displayed green colored, please check them and press p to list your files.
Please let me know, were you able to list your files or did you get an error message?

In case if your files are listed, I consider to copy/backup them first to another intact disk or partition.

Information will follow.

Fiona

Re: Can't read/access hard drive

Posted: 13 May 2012, 12:20
by neelb
Hi Fiona,

thanks for getting back to me so quickly.

I'm currently running testdisk this morning, since I did the partition write yesterday as described in my first post.

I did the analyse and it showed the partitions just I had written them yesterday. I tried to inspect the partitions with "p" but they just errored. I then started a deeper search here is a screen of where I currently am.
current 1.jpg
current 1.jpg (58.53 KiB) Viewed 13476 times
should I leave it to continue, before I continue with your instructions (I reckon its going to be another 7-10 hours to finish?) i do I stop it now?

Also, I'm considering going out and buying another drive so that I can ghost an image of the drive if that is possible. What do you recommend. As I said previously All I need is a few *.doc off this disk (2 years work in those files) everything else is expendible.

Thanks

Re: Can't read/access hard drive

Posted: 13 May 2012, 14:50
by neelb
The windows recovery started automatically when it couldn't boot, there was no questions or options it just did its own think. In future I will not keep trying to rebook, just pull the drive and interrogate as an external drive.

Heres an update of the analysis to now. It really sped up recently. Would this suggest that if I did a file recovery it wouldn't take the 100+ hours that it tells me?
current 2.jpg
current 2.jpg (59.19 KiB) Viewed 13469 times
Should I just let this finish now, then I can change the geometry as you suggest. The deep analysis should hopefully on be a couple more hours?

Re: Can't read/access hard drive

Posted: 13 May 2012, 15:01
by Fiona
If your disk has read errors, TestDisk might hang.
So it's possible that it takes a long time.
Might be an idea to stop your scan.
Repeat your diagnose using the suggested geometry.
I'd need some infos from your partition table (Analyse and your current partition structur).
If your partition table would be intact the to have a try to list your data or diagnose your boot sector to get your data listed.
If you're able to list your data, you can copy them to another intact disk or partition.
If your partition table will bee still wrong, then we should also try 240 heads.
Mostly used on 2.5 inch disks.
Infos;
http://www.cgsecurity.org/wiki/Menu_Geometry

Fiona

Re: Can't read/access hard drive

Posted: 13 May 2012, 15:58
by neelb
OK its finished, here is a print screen before I forget.
current 3.jpg
current 3.jpg (82.69 KiB) Viewed 13464 times
current 4.jpg
current 4.jpg (47.89 KiB) Viewed 13464 times
current 5.jpg
current 5.jpg (48.68 KiB) Viewed 13464 times

Re: Can't read/access hard drive

Posted: 13 May 2012, 16:00
by neelb
current 6.jpg
current 6.jpg (116.13 KiB) Viewed 13462 times
This now looks pretty much as I remember it before I wrote the new partition yesterday

I'll change the geometry, and report back

Re: Can't read/access hard drive

Posted: 13 May 2012, 16:11
by Fiona
Message about both partitions is a damaged file system.
Except your recovery partition.
Your first partition would be probably your boot partition?
Your OS and data probably the second one?

There is another try to get access to your data.
Please go to the menu Advanced instead of Analyse.
Choose your second partition and confirm at Boot with enter.
Run Rebuild BS.
It doesn't change anything but will rebuild a new boot sector in testdisk memory.
As long as you don't write it, you'll not change anything.
After Rebuild BS and only if it was succesful you see the menu list.
Please have another try to list your data.
It only makes sense if the extrapolated and the current boot sector are different.
If TestDisk needs to long to check your file system using Rebuild BS it might indicate a damaged file system.
In this case you'll need datarecovery software.
Infos will follow.

Fiona

Re: Can't read/access hard drive

Posted: 13 May 2012, 16:17
by neelb
Hi again,

based on your answer, should I bother with changing the geometry to 240 heads?
240 heads.jpg
240 heads.jpg (78.32 KiB) Viewed 13459 times
I was just about to when I noticed your reply

Re: Can't read/access hard drive

Posted: 13 May 2012, 16:27
by neelb
Oh,

when I go to advanced it says....
advanced.jpg
advanced.jpg (47.43 KiB) Viewed 13457 times
do I have to do something before hand?