Page 1 of 1

Nothing found on a 2TB drive

Posted: 23 Nov 2017, 09:56
by solarsd
Hello,

I need some advice. I have a 2TB WD Caviar Green (WDC WD20EARS-00MVWB0) drive that was in a WD MyBook enclosure for years. I am mostly certain that it had a single NTFS partition that I used to store my documents, pictures, music etc. No encryption was used. A few days ago I was copying some files to it from a Windows 10 machine when it suddenly disconnected and reconnected. After the event the drive showed up as having no partitions and a corrupted MBR (i.e. it no longer ended with 0x55AA, which was reported also by TestDisk). The drive shows up the same on a different computer. I have removed the drive from the enclosure and connected it directly via a SATA cable and it shows up the same. SMART log looks fine (log attached), conveyance test passes, the drive runs not too hot and emits no unusual sounds.

Most of the data on the drive was backed up on a different drive, but due to some bad luck in my backup config a portion of the documents folder was not backed up for over 6 months... I would like to retrieve that data, if possible.

Here's what I've tried:
1) TestDisk regular and deep scan for a partition table and MBR backups on the drive. It found a FAT16 and a FAT32 partition that each were close to 4TB in size, clearly not correct.
2) I then used TestDisk to restore the MBR. I know, silly me, but I thought it's the MBR on a non-bootable disk, so it doesn't matter. With the MBR restored, the drive shows some partitions all of which have unreasonable types and out of range CHS values.
3) I ran GetDataBack NTFS over the entire disk and it reported that it couldn't find a file system. I noticed in the log window that the HEX patterns look very repetitive, with lots of BMP magic numbers (42 4D), even though I haven't stored specifically only BMPs there.
4) I then ran PhotoRec and after a few hours and 20% in it recovered two MP3s that were around 1KB in size and a 2GB gpg keyring file, which is clearly not correct, so I aborted PhotoRec. That was another indication that the drive just seemingly doesn't contain any file data.
5) I opened the drive in HxD and I noticed that it indeed it shows a mixture of repetitive short (~12 bit) bit patterns that are oddly aligned to LBAs in some places, but mostly seemingly random gibberish in others. I know binary HDD contents are kinda gibberish, but in my experience they do contain English strings, gaps of 0s and other regular patterns. In my case it just doesn't look right. (I've attached dumps from a few areas showing the beginning of the drive and a few cases of the alignment to LBAs)

I am out of ideas here. I have recovered failing drives before, either using ddrescue if the problem was mechanical, GetDataBack if it was a filesystem issue, or PhotoRec if the file system could not be recovered, and it was mostly smooth sailing - I would find something and then cut my losses for the rest. In this case it is very strange that I cannot find anything, not even a single file.

I am currently running a SMART long test, though I don't expect anything there.

I have an idea of re-flashing the drive firmware. The idea being that the sudden disconnect somehow corrupted it and that's why drive is returning gibberish. Would that be something reasonable to do?

I realize that at this point I should contact a data recovery company (or rather should have much earlier), but I'm not too confident about that. Given how different we view privacy and the value for private data these days I don't feel OK handing over 2TB of my life to a company with a "Guarantee" of privacy. Besides, this doesn't look like a simple case and a few cost estimates of such difficult cases were €300-€800+, which is a lot considering I do have backups of most of the drive, I'm just not quite sure what is missing. <:

So if anyone has any experience with such a case an advice would be appreciated. I would kindly ask Mr. Grenier in particular to share his insight.

P.S. I'm not sure if the ZIP file got attached, so let me know if it wasn't.

Re: Nothing found on a 2TB drive

Posted: 24 Nov 2017, 10:32
by cgrenier
As you have rewritten the MBR, does the first sector (the MBR) is now ok ? If it's case, it means the disk can read correctly what it has written.
If it's not the case, you really should contact a data recovery company.

Re: Nothing found on a 2TB drive

Posted: 27 Nov 2017, 08:07
by solarsd
The MBR is OK, and after rewriting it the partition table can be read by the OS, but the table itself is corrupted - there seems to be several invalid partitions with unreasonable sizes and CHS values. I think I could rewrite the partition table too and restore the original full-disk NTFS partition, if that would help.

The drive seemingly can write and read back data correctly. But original data cannot be accessed for some reason.