Recovering a raw HDD - a few questions

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nhsnork
Posts: 1
Joined: 26 Nov 2018, 22:26

Recovering a raw HDD - a few questions

#1 Post by nhsnork »

Long story short:
- a 2 Tb drive, used as a single drive D, turned RAW. Visible in My Computer without volume name and size (demands reformatting when clicked), visible in Disk Management, not processed by chkdsk command.

- Testdisk insistently defaults to "None" partition whereas picking "Intel" doesn't show any partitions, search yields nothing. Granted, the only reason it raises my eyebrow is the footnote that single partition drives shouldn't have "none" type normally.

- picking None ironically shows an "NTFS" partition that can list the files and folders fine. Booting reports boot sector as "OK" and backup BS as "bad"; trying to organize BS, however, "can't overwrite backup boot sector".

So here's what I'm still wondering about after browsing this forum. I assume the next logical step is to try rebuilding BS, but since I'm often at work and can't really leave the PC on for too long in my absence:

- is it possible to roughly estimate how long "Rebuild BS" would take on an almost packed (some 100-150 Gb free IIRC) 2 Tb drive? For reference, a quick search I did on Intel type took a bit over two hours, but I doubt I can just assume the same about what sounds like a more thorough operation.

- if I had to quit for time constraints before Testdisk is finished, would it be safe to interrupt the operation and restart it some other time?

- if rebuilding BS doesn't solve the problem, will it affect the file recovery odds in worst case scenario? Granted, I would like to avoid the latter if possible - as mentioned above, it's almost 2 Tb of data and, short of buying an external 2 Tb drive, I simply don't have room to copy the files or clone the disk to. :roll: :lol:

Thanks in advance for possible tips and comments. Sorry to bother you folks without providing logs and screenshots, but if they're required for better judgement, it'll have to wait at least until Thursday (the one day a week when I normally have most free time to spend at home dealing with this whole predicament).

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering a raw HDD - a few questions

#2 Post by cgrenier »

Your disk hasn't lost its partition table, so it's useless to search for partitions...
As written in https://www.cgsecurity.org/testdisk.pdf you can try "chkdsk /f D:" and if if it doesn't work, select the physicaldrive containing D:, Advanced, select the D: partition, Boot, RebuildBS, List.
If you can see your files, choose Write, confirm, Quit and after a reboot, try again a chkdsk.
If you can't see your files, restart TestDisk, go in Advanced, List, copy your files

ThomasKu
Posts: 1
Joined: 30 Dec 2018, 12:02

Re: Recovering a raw HDD - a few questions

#3 Post by ThomasKu »

First off all: Thanks for this nice utility whose I was using for successfull recovery of an raw hdd.

I didn't know that chkdsk /f drive: works on RAW hdds.

That’s why I tried testdisk_win several times fruitless.

Question:

Why is it possible for some commercials tools to show the file structure without checkdisk /f?


Thanks

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering a raw HDD - a few questions

#4 Post by cgrenier »

If the NTFS boot sector is corrupted, chkdsk will refuse to work on the "raw disk".
Using the NTFS backup boot sector, TestDisk will be able to list the files.
If the MFT table is corrupted, TestDisk, Advanced, Repair MFT, may be able to use its backup. If some MFT records are corrupted, TestDisk will failed to list the files.
Some other data recovery utilities (like scrounge-ntfs) will still be able to list the files by listing only the valid MFT records, they will need to scan the NTFS partition first.

Locked