Portable Hard Drive Crash

[CyberDude]

Away on business my portable hard drive crashed - which is frustrating since it not only contains some "Work In Progress" but also the back ups of two other (Windows) machines I used to own.

The drive (500 MB Toshiba) was originally partitioned with two partitions (and a remaining unused area). The first, small partition, is still visible in Windows but the main partition, containing my work, is unreadable and Windows keeps prompting me to format it (which I won't do until I have exhausted all avenues). Using the Disk Managment widget in the Administrator Tools (Vista), I can see that Windows thinks the drive is RAW but it is (and was always) NTFS - ironically conert i: /fs:ntfs also reports that the filesystem is NTFS and doesn't do anything.

I have worked my way through some of the options with TestDisk and I've failed to recover anywhing becasue it reports that the filesystem is damaged - even after I try and repair the Boot Sector, I wasn sucessfull in updating the MBR.

I've attached the log file in the hope that someone there can spot the obvious error that I've overlooked and can help me recover my data (for which I will make a donation to charity).

One final note (which may or may not be noteworthy) - while attaching the ZIP to this posting I noticed that the smaller partition on this disk (E:) is now full (never used to be).

Andrew (aka CyberDude).

[Fiona]

Please don't write anything to your HDD (affected partition) anymore.
As partition type, you used Intel.
But TestDisk automatically recognized EFI GPT.

Code: Select all

Partition table type (auto): EFI GPT
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA MK5061GSYN
Partition table type: Intel

That's why it would be advisable to repeat your diagnose on EFI GPT.
Just repeat your boot sector diagnose at advanced.
Your partition might be renamed.
Please choose your affected partition.
It's probably MS Data (names on GPT are different).
If you press enter at advanced and it appears as Unknown, you can add your file system using Type.
Confirm at boot.
If you see the menu List, please check it to list your data.
You can also use Rebuild BS to have try to rebuild your boot sector and list your data.
Don't use Repair MFT.

Please let me know.

[CyberDude]

Fiona
First of all thanks for your prompt response - much appreciated.

I followed your instructions and noticed that there were a few more partitions detected than the first time I ran TestDesk. Unfortunately before I could examine things further, the laptop blue screened and I was back to square one. I'll try later and let you know how I get on.

[Fiona]

Have you been able to finish your diagnose?
If you get another BSOD please let me know.

Fiona

[CyberDude]

I did try to examine the disk again using the settings you suggested and have attached the log and screen shot from the analysis screens from TestDisk. As I had access to a Linux machine (Ubuntu) I ran the tests on that platform will also include a screen shot from gparted when I can compress the files (and avoid the 256KB upload limit).

I don't think anything can be done to salvage anything from the disk but I would love to be proved wrong.

Thanks for any and all input.

[Fiona]

That diagnose was intended to get another partition containing your data.
Your current log displays a faulty file system on your second partition;

Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.

A safe solution might be datarecovery software.
You could try PhotoRec 6.14.
http://www.cgsecurity.org/wiki/PhotoRec

[CyberDude]

Fiona, again many thanks, I will try the file recovery when I can find another external disk to recover the files to. I guess this will be a long drawn out process.