WD20EARX incorrect size

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

WD20EARX incorrect size

#1 Post by pineapple1 »

I was recently hit with some randomware that left a lot of my files encrypted. Trying to recover the original files using Photorec. Currently booting into Ubuntu off of the latest live CD.

I can browse the contents of the 2TB drive with no problem. However, when I start Photorec it shows that the drive is much smaller, only 2GB. It also shows that there are hidden sectors present.

I ran a photorec anyway and was able to recover some files, but not nearly what I was expecting. It also teinated prematurely with an error. I'm guessing this has to do with the incorrect disk size. Is there any way I can get Photorec to show the correct drive size? Any help is much appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: WD20EARX incorrect size

#2 Post by cgrenier »

Try "hdparm -N" or maybe "hdparm --dco-restore" (read the man page first) to check if HPA or DCO area are present and disable them if necessary.

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#3 Post by pineapple1 »

Running hdparm -N /dev/sda2 gives me:

Code: Select all

max sectors = 3907029168/3907029168, HPA is disabled
However, when I run photorec I get:

Code: Select all

Hidden sectors are present
size: 3906820096
User_max: 3907029168
Native_max: 18446744073321613488
Host protected area (HPA) present
I dont want to mess around too much with hdparm without the proper guidance. I'm not real familiar with this and am worried about doing damage to the drive that would make recoving my files more difficult. Thanks for your help. Should I stay on the -N track or try --dco-restore instead? Thanks again!

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#4 Post by pineapple1 »

Before going any further, I decided to make an image of the drive using ddrescue to a second drive. This will allow me to get a little more adventurous with my recovery approach :D. 2TB might take a while though.

After it's done, is there any chance Photorec will recognize the image size correctly, or will it see it exactly as the physical drive? Should I try the --dco-restore option?

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#5 Post by pineapple1 »

After about 50 hours, ddrescue finally finished. I decided to try the --dco-restore option this morning, but it returned an error. HDIO_DRIVE_CMD(dco_restore) failed: Input/output error.

Not sure where to go from here? I just need Photorec to see the correct size drive (2TB) so I can get on with recovery.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: WD20EARX incorrect size

#6 Post by cgrenier »

If you rerun PhotoRec, which does it report ? The copy/paste you have done from PhotoRec about HPA lists 2 TB...

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#7 Post by pineapple1 »

Photorec completed with no errors this time! Looks like it worked. Thanks so much for all of your help!!

Locked