First time poster, make sure to idiot proof everything and lower your IQ a good 20 points.
Anyways, as the title says, my 2TB 7200RPM HDD decided to go raw on me just today.
NOTE: IT IS NOT, AND NEVER HAS BEEN, A BOOT DRIVE; It was a storage drive, I even remember assigning it a simple partition back in the day (2 yrs ago).
This morning, my computer booted to a black screen. Being stupid, I forced powered off, turned of the power supply for 30 sec, and restarted. Please don't laugh, yes I know this is probably why this happened, yes I am ashamed, etc etc etc.
Rebooted to a windows drive repair. My drive has had repair stuff in the past, the odd folder or dll going rogue and needing to be plopped in found.00X, so I thought nothing of it.
Once I was in windows, I knew something was up. File Explorer was slow. And I mean slowwwwwww slow. Took like 3 minutes to load the 'This PC' page.
My storage drive, which I'll call Z from now on, had lost it's name, and had no usage bar under it.
So, like the good little windows user I am, I ran sys /scannow on my C drive (my boot drive) to make sure that file explorer wasn't just wigging out.
Some files were actually problematic and were replaced. Z was still in purgatory however.
I then ran chkdsk Z: /f /r
Took a long ass time, but eventually ended with an error ("...an unspecified error occurred (766f6c756d652e63 470)")
Z was still zonked. So I began to panic.
Started looking up recovery utilities, almost used a few of the scammy ones (iBoysoft, EaseUS, Disk Drill) but eventually landed on Recuva.
Yes, I know Recuva only works for deleted files, yadda yadda.
I ran it, and surprisingly it did come back with some files - deleted files - but files. This suggested to me that the file system wasn't gone, or totally gone.
Eventually, after being dumb for many hours, I came accross TestDisk.
My disk had two partitions: MS Reserved, and MS Data. MS Reserved was duplicated so there were 2 (???).
MS Data had the correct label [Deep Storage] and was NTFS 4096 MB, so I selected it. Lo and behold, all of my files are still there!
Problem was, it was recognized as a EFI partition table. From what I understand, it should be Intel if its a simple NTFS single volume.
The two MS Reserved partitions, which I took to be BS windows tried to put on my drive during chkdsk (I thought that it might have tried to fix it like it would a boot drive), so I wrote just the MS Data as the only partition.
No cigar, windows still wouldn't recognize it as a valid drive.
Disk Management shows an unallocated 16 mb partition, and a healthy 1800~ GB RAW partition now.
I then started pulling some data I knew I didn't want to lose off using TestDisk. Yes, in retrospect I know this could be bad, but I was dumb then (I am still dumb, only dumb later).
I can give the SMART data if its actually useful, but my hard drive is given the Caution label, specifically due to Current Pending Sector count 100/10 and Uncorrectable Sector Count 100/100.
Sorry for the extremely long and rambly post, all I'm trying to do is somehow to get the NTFS file system to be legible, as I'm moving computers (complete lucky/unlucky coincidence) and I want to be able to pull everything off.
I understand my options are:
1. Use TestDisk to pull everything off, or at least the stuff I need provided the drive isn't dying.
2. Try and chkdsk again? Maybe it will work this time if Z has only one Partition?.
3. Use Linux+ddrescue and make a copy, try to pull from there or fix the filesystem. I will likely be purchasing a new hard drive for this for obvious reasons.
If my drive has life left in it, I'd like to just pull off what I need and format it, but if things are dire I don't want to break everything.
Sorry for the long rambly post, it's late and sanity is running low. Any help and advice is appreciated, sorry if the solution is already somewhere on here and I just didn't see it.
Regards, and sincerely yours,
-Dumbass
Windows Storage Drive went Raw, somehow became EFI? Topic is solved
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 4
- Joined: 10 Apr 2022, 07:40
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Windows Storage Drive went Raw, somehow became EFI?
If your recovery system is unstable use one you could trust.WalterSkinner wrote: ↑10 Apr 2022, 08:50 First time poster, make sure to idiot proof everything and lower your IQ a good 20 points.
Anyways, as the title says, my 2TB 7200RPM HDD decided to go raw on me just today.
NOTE: IT IS NOT, AND NEVER HAS BEEN, A BOOT DRIVE; It was a storage drive, I even remember assigning it a simple partition back in the day (2 yrs ago).
This morning, my computer booted to a black screen. Being stupid, I forced powered off, turned of the power supply for 30 sec, and restarted. Please don't laugh, yes I know this is probably why this happened, yes I am ashamed, etc etc etc.
Rebooted to a windows drive repair. My drive has had repair stuff in the past, the odd folder or dll going rogue and needing to be plopped in found.00X, so I thought nothing of it.
Once I was in windows, I knew something was up. File Explorer was slow. And I mean slowwwwwww slow. Took like 3 minutes to load the 'This PC' page.
My storage drive, which I'll call Z from now on, had lost it's name, and had no usage bar under it.
So, like the good little windows user I am, I ran sys /scannow on my C drive (my boot drive) to make sure that file explorer wasn't just wigging out.
Some files were actually problematic and were replaced.
A 2 TB disk as stated above containing one partition (that is probably filling the whole disk) shows up as 4096 MB?Z was still in purgatory however.
I then ran chkdsk Z: /f /r
Took a long ass time, but eventually ended with an error ("...an unspecified error occurred (766f6c756d652e63 470)")
Z was still zonked. So I began to panic.
Started looking up recovery utilities, almost used a few of the scammy ones (iBoysoft, EaseUS, Disk Drill) but eventually landed on Recuva.
Yes, I know Recuva only works for deleted files, yadda yadda.
I ran it, and surprisingly it did come back with some files - deleted files - but files. This suggested to me that the file system wasn't gone, or totally gone.
Eventually, after being dumb for many hours, I came accross TestDisk.
My disk had two partitions: MS Reserved, and MS Data. MS Reserved was duplicated so there were 2 (???).
MS Data had the correct label [Deep Storage] and was NTFS 4096 MB, so I selected it. Lo and behold, all of my files are still there!
This is enough reason to post your Testdisk log file.
Problem was, it was recognized as a EFI partition table. From what I understand, it should be Intel if its a simple NTFS single volume.
Healthy partition means partition having a healthy file system on it. 1800 GB RAW is not healthy.The two MS Reserved partitions, which I took to be BS windows tried to put on my drive during chkdsk (I thought that it might have tried to fix it like it would a boot drive), so I wrote just the MS Data as the only partition.
No cigar, windows still wouldn't recognize it as a valid drive.
Disk Management shows an unallocated 16 mb partition, and a healthy 1800~ GB RAW partition now.
As you had a special need for this data as opposed to the rest of the content of the partition this was not dumb.I then started pulling some data I knew I didn't want to lose off using TestDisk. Yes, in retrospect I know this could be bad, but I was dumb then (I am still dumb, only dumb later).
Please post your smartmontools log file
I can give the SMART data if its actually useful, but my hard drive is given the Caution label, specifically due to Current Pending Sector count 100/10 and Uncorrectable Sector Count 100/100.
viewtopic.php?f=5&t=10910
If everything is filling up the drive completely you would be better off duplicating the drive, but posting the smartmontools log file would be helpful for decision.
Sorry for the extremely long and rambly post, all I'm trying to do is somehow to get the NTFS file system to be legible, as I'm moving computers (complete lucky/unlucky coincidence) and I want to be able to pull everything off.
I understand my options are:
1. Use TestDisk to pull everything off, or at least the stuff I need provided the drive isn't dying.
You can't reverse the chkdsk action. I would run chkdsk on a second duplicate of the drive.
2. Try and chkdsk again? Maybe it will work this time if Z has only one Partition?.
The ddrescue copy serves as a source for data recovery without having to fear that access to a possibly dammaged drive will break it for good.
3. Use Linux+ddrescue and make a copy, try to pull from there or fix the filesystem. I will likely be purchasing a new hard drive for this for obvious reasons.
If my drive has life left in it, I'd like to just pull off what I need and format it,
but if things are dire I don't want to break everything.
-
- Posts: 4
- Joined: 10 Apr 2022, 07:40
Re: Windows Storage Drive went Raw, somehow became EFI?
I should have clarified that this was block size, which appears next to the file system in testdisk. Testdisk shows the capacity to be ~1800 GB which is what I would expect, was like that since I got the drive.A 2 TB disk as stated above containing one partition (that is probably filling the whole disk) shows up as 4096 MB?
This is the testdisk.log, not sure if it got overwritten since I used it a bunch in the same place, but here it is: Here is the backup I made of the partition table before messing with it:This is enough reason to post your Testdisk log file.
It's just what it says in Windows Disk Management, didn't want to leave it out ¯\_(ツ)_/¯Healthy partition means partition having a healthy file system on it. 1800 GB RAW is not healthy.
I read on here that you shouldn't try to read from a weirdly behaving drive unless you know it isn't failing.As you had a special need for this data as opposed to the rest of the content of the partition this was not dumb.
Gotcha boss Here is the crystal disk info screen if that's helpful.Please post your smartmontools log file
There is a 16 MB unallocated partition on the drive now, along with the 1800 GB Raw part. Will that mess things up if I go through with chkdsk? Sorry if this is a dumb question.You can't reverse the chkdsk action. I would run chkdsk on a second duplicate of the drive.
ddrescue won't break the drive itself? just curious.The ddrescue copy serves as a source for data recovery without having to fear that access to a possibly dammaged drive will break it for good.
In any case, thanks so much for your time and response. I know you must get a million of these posts from people who don't know what they are doing (this guy).
Last edited by WalterSkinner on 12 Apr 2022, 00:06, edited 3 times in total.
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Windows Storage Drive went Raw, somehow became EFI?
Please post your smartmontools log file.
-
- Posts: 4
- Joined: 10 Apr 2022, 07:40
Re: Windows Storage Drive went Raw, somehow became EFI?
Uhh I did? Is it not this? Its right above the Crystal Disk pic in my previous post.
https://drive.google.com/file/d/1nEi9jl ... Uxqs_/view
Sorry I am quite dumb, I followed the little tutorial thing here to the best of my ability
It's right under 'Gotcha boss' up there... Maybe I should have given it a more prominent flair idk lol
It's a google drive link and I made sure it has the correct permissions, so should be fine.
https://drive.google.com/file/d/1nEi9jl ... Uxqs_/view
Sorry I am quite dumb, I followed the little tutorial thing here to the best of my ability
It's right under 'Gotcha boss' up there... Maybe I should have given it a more prominent flair idk lol
It's a google drive link and I made sure it has the correct permissions, so should be fine.
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Windows Storage Drive went Raw, somehow became EFI?
You should upload your documentation to this site instead of putting it on any internet site where it gets lost and nobody will profit from your case thereafter.
Your drive is about to die:
You have 192 pending sectors (sectors that can't be read).
As for your ddrescue question, any attempt to duplicate your drive can break it when it's already dammaged.
It's your decision if you want to try to duplicate or not.
After having duplicated the drive the easiest way of recovery is to copy the content of your lost partition to another drive.
Code: Select all
smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w10-21H1] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Seagate BarraCuda 3.5 (SMR)
Device Model: ST2000DM008-2FR102
Serial Number: ZFL1CXM0
LU WWN Device Id: 5 000c50 0c3b396a1
Firmware Version: 0001
User Capacity: 2,000,398,934,016 bytes [2.00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 7200 rpm
Form Factor: 3.5 inches
TRIM Command: Available
Device is: In smartctl database 7.3/5319
ATA Version is: ACS-3 T13/2161-D revision 5
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sun Apr 10 10:22:17 2022 PDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
General SMART Values:
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 0) seconds.
Offline data collection
capabilities: (0x73) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
No Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 201) minutes.
Conveyance self-test routine
recommended polling time: ( 2) minutes.
SCT capabilities: (0x30a5) SCT Status supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000f 081 039 006 Pre-fail Always - 141212760
3 Spin_Up_Time 0x0003 098 098 000 Pre-fail Always - 0
4 Start_Stop_Count 0x0032 096 096 020 Old_age Always - 5049
5 Reallocated_Sector_Ct 0x0033 100 100 010 Pre-fail Always - 0
7 Seek_Error_Rate 0x000f 080 060 045 Pre-fail Always - 89377154
9 Power_On_Hours 0x0032 089 089 000 Old_age Always - 10229h+34m+55.867s
10 Spin_Retry_Count 0x0013 100 100 097 Pre-fail Always - 0
12 Power_Cycle_Count 0x0032 100 100 020 Old_age Always - 929
183 Runtime_Bad_Block 0x0032 100 100 000 Old_age Always - 0
184 End-to-End_Error 0x0032 100 100 099 Old_age Always - 0
187 Reported_Uncorrect 0x0032 001 001 000 Old_age Always - 30157
188 Command_Timeout 0x0032 100 100 000 Old_age Always - 0 0 0
189 High_Fly_Writes 0x003a 100 100 000 Old_age Always - 0
190 Airflow_Temperature_Cel 0x0022 070 050 040 Old_age Always - 30 (Min/Max 22/30)
191 G-Sense_Error_Rate 0x0032 100 100 000 Old_age Always - 0
192 Power-Off_Retract_Count 0x0032 100 100 000 Old_age Always - 36
193 Load_Cycle_Count 0x0032 058 058 000 Old_age Always - 85880
194 Temperature_Celsius 0x0022 030 050 000 Old_age Always - 30 (0 20 0 0 0)
195 Hardware_ECC_Recovered 0x001a 081 064 000 Old_age Always - 141212760
197 Current_Pending_Sector 0x0012 100 100 000 Old_age Always - 192
198 Offline_Uncorrectable 0x0010 100 100 000 Old_age Offline - 192
199 UDMA_CRC_Error_Count 0x003e 200 200 000 Old_age Always - 0
240 Head_Flying_Hours 0x0000 100 253 000 Old_age Offline - 2592h+37m+07.761s
241 Total_LBAs_Written 0x0000 100 253 000 Old_age Offline - 9270379278
242 Total_LBAs_Read 0x0000 100 253 000 Old_age Offline - 26464194745
SMART Error Log Version: 1
ATA Error Count: 32409 (device log contains only the most recent five errors)
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.
Error 32409 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 50 c1 01 00 Error: UNC at LBA = 0x0001c150 = 115024
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 28 30 c1 01 e0 00 00:30:40.740 READ DMA EXT
25 00 20 10 d1 00 e0 00 00:30:40.739 READ DMA EXT
25 00 28 30 81 00 e0 00 00:30:40.739 READ DMA EXT
25 00 08 80 bc b8 e3 00 00:30:40.738 READ DMA EXT
25 00 08 08 bf b8 e3 00 00:30:40.738 READ DMA EXT
Error 32408 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 50 c1 01 00 Error: UNC at LBA = 0x0001c150 = 115024
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 28 30 c1 01 e0 00 00:30:39.001 READ DMA EXT
25 00 20 10 d1 00 e0 00 00:30:39.001 READ DMA EXT
25 00 28 30 81 00 e0 00 00:30:39.000 READ DMA EXT
25 00 08 80 bc b8 e3 00 00:30:39.000 READ DMA EXT
25 00 08 08 bf b8 e3 00 00:30:39.000 READ DMA EXT
Error 32407 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 50 c1 01 00 Error: UNC at LBA = 0x0001c150 = 115024
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 28 30 c1 01 e0 00 00:30:37.279 READ DMA EXT
25 00 20 10 d1 00 e0 00 00:30:37.278 READ DMA EXT
25 00 28 30 81 00 e0 00 00:30:37.278 READ DMA EXT
25 00 08 80 bc b8 e3 00 00:30:37.277 READ DMA EXT
25 00 08 08 bf b8 e3 00 00:30:37.277 READ DMA EXT
Error 32406 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 50 c1 01 00 Error: UNC at LBA = 0x0001c150 = 115024
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 28 30 c1 01 e0 00 00:30:35.558 READ DMA EXT
25 00 20 10 d1 00 e0 00 00:30:35.557 READ DMA EXT
25 00 28 30 81 00 e0 00 00:30:35.557 READ DMA EXT
25 00 08 80 bc b8 e3 00 00:30:35.557 READ DMA EXT
25 00 08 08 bf b8 e3 00 00:30:35.556 READ DMA EXT
Error 32405 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 50 c1 01 00 Error: UNC at LBA = 0x0001c150 = 115024
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 28 30 c1 01 e0 00 00:30:33.866 READ DMA EXT
25 00 20 10 d1 00 e0 00 00:30:33.865 READ DMA EXT
25 00 28 30 81 00 e0 00 00:30:33.865 READ DMA EXT
25 00 08 80 bc b8 e3 00 00:30:33.864 READ DMA EXT
25 00 08 08 bf b8 e3 00 00:30:33.864 READ DMA EXT
SMART Self-test log structure revision number 1
No self-tests have been logged. [To run self-tests, use: smartctl -t]
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
Code: Select all
197 Current_Pending_Sector 0x0012 100 100 000 Old_age Always - 192
As for your ddrescue question, any attempt to duplicate your drive can break it when it's already dammaged.
It's your decision if you want to try to duplicate or not.
After having duplicated the drive the easiest way of recovery is to copy the content of your lost partition to another drive.
-
- Posts: 4
- Joined: 10 Apr 2022, 07:40
Re: Windows Storage Drive went Raw, somehow became EFI?
Edited my above post, sorry! Used to having to link my own stuff from other forums.recuperation wrote: ↑11 Apr 2022, 19:20 You should upload your documentation to this site instead of putting it on any internet site where it gets lost and nobody will profit from your case thereafter.
Eh I'm not surprised, but its good to know for sure. Just as a question for future endeavors, other than large-ish amounts of pending sectors, what are the signs of a failing drive in the SMART data?
In any case, I think I'll pull a few more files off and then give ddrescue a go. Thanks for your help and for being nice (relative to some of the other posts of yours ).
Been in a (unpaid) support job before for software so I sorta get it.
Cheers,
- (Now Slightly Less of a) Dumbass
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Windows Storage Drive went Raw, somehow became EFI?
Here is one:recuperation wrote: ↑11 Apr 2022, 19:20 Your drive is about to die:
Eh I'm not surprised, but its good to know for sure. Just as a question for future endeavors, other than large-ish amounts of pending sectors, what are the signs of a failing drive in the SMART data?
https://static.googleusercontent.com/me ... ilures.pdf
If you have a couple of disks, pull a smartmontools log file for each one and compare how the parameters change over time when you are pulling them again. That gives you an idea which argument changes a lot. Once sleepy figures start to move do enquire!
God sees everything but I rely on the documentation of people asking questions. This posts sums it up:
In any case, I think I'll pull a few more files off and then give ddrescue a go. Thanks for your help and for being nice (relative to some of the other posts of yours ).
viewtopic.php?p=34916#p34916
And here are the most basic questions I would like to be seen answered:
1.Which operating systems can be booted from your computer where the incident happened?
List them all!
2. Which version of Testdisk do you use?
3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]
4. If yes, how is that done?
[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good
5. Is the broken drive a drive where an operating system resides on or is it a data drive?
6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
7. What is the size of your disk?
8. Who is the maker of your failed drive?
9. What is the model?
10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910
12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
13. How many partitions have been on the broken drive, what was their size, what was their file system?
14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
15. Is the partition scheme containing your partitions still visible?
14. Describe the supposed event when your system went from "OK" to "broken"!
15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up
?
16. Do you use encryption, if yes, which one?
17. If you use encryption, what is the scope?
[ ] full drive
[ ] partition
[ ] file container
[ ] single files