Help with a main internal drive gone RAW from NTFS

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
oroomar
Posts: 5
Joined: 09 Oct 2019, 06:45
Location: moscow, russia
Contact:

Help with a main internal drive gone RAW from NTFS

#1 Post by oroomar »

Hi, I am new on the sub and I have been trying to learn how to use both the author`s data recovery programs, photorec and testdisk, but I do not know which one to use and in each situation and their differences.

I just got on Sunday night, the main primary partition of my daily use laptop crashed after the computer froze and I had to force shut it off with the power button. The partition is now, according to windows disk manager, in RAW but in photorec it shows as NTFS.

I have been trying to use all partition managers and data recovery programs to try to extract the data because I need to recover my university homeworks. All my personal data is in another logical partition I use as a backup. I just forgot to make copies and backups while doing my homeworks and I really need to retrieve them.

Which is the first step of diagnostics which I need to do for you to be able to help me? I need help, asap, please and thanks a lot. I want to convert the RAW partition back to NTFS so I could get the data back and format it, or just extract the data with any of the specialized programs but they keep crashing while in the long process of extracting the data.
Last edited by oroomar on 15 Oct 2019, 20:16, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Help with a main internal drive gone RAW from NTFS

#2 Post by cgrenier »

You should read "Repairing filesystem" from https://www.cgsecurity.org/testdisk.pdf and if it doesn't work, it still possible to recover your data using PhotoRec, see chapter "Recovering deleted files using PhotoRec" (Use "[Whole]" instead of "[Free]" as you also want to recover non-deleted files).

oroomar
Posts: 5
Joined: 09 Oct 2019, 06:45
Location: moscow, russia
Contact:

Re: Help with a main internal drive gone RAW from NTFS

#3 Post by oroomar »

I tried all of those recovery partition cmd methods last week and they all failed.

I have been using all possible data recovery programs: EaseUS Partition Master and EaseUS Data Recovery Wizard, Stellar Phoenix Windows Data Recovery, GetDataBack for NTFS, Disk Drill, MiniTool Power Data Recovery and Power Data Recovery. They all freeze when reading the disk, loading the disk information and almost never load up. The disk is in an external USB 2 enclosure and I am using a small backup HDD inside the laptop. Image

Only with Minitool I was able to do a successful scan that lasted 4 days in the 100 GB partition but crashed when copying the data from the partition to the backup drive, some 6 GB of personal data, as the rest is just the OS, programs and etc.

oroomar
Posts: 5
Joined: 09 Oct 2019, 06:45
Location: moscow, russia
Contact:

Re: Help with a main internal drive gone RAW from NTFS

#4 Post by oroomar »

https://imgur.com/a/0p1Mtyr

here are some screenshots of to show the condition of the partitions I got.

What to do with each testdisk and photorec? because any kind of data recovery method has not worked

also the raw partitions are too slow to access with a usb connection. would be a good option to quick format the partitions to ntfs and then recover the deleted data?
Last edited by oroomar on 15 Oct 2019, 20:11, edited 1 time in total.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help with a main internal drive gone RAW from NTFS

#5 Post by recuperation »

Check your SMART parameters with smartmontools running the command:
smartctl -a /dev/sdX > broken.txt
Replace "X" by the device in question.
Post '"broken.txt" here.
If smartctl fails use the additional parameter "-d sat,12" or "-d sat,16" or other variants, read the manual.

You can run smartctl from a live linux system like Knoppix on a DVD or a USB stick.

Alternatively remove the faulty drive and connect it to a healthy computer system either internally (best) or using a docking station, an external 2,5'' enclosure has certain disadvantages.

oroomar
Posts: 5
Joined: 09 Oct 2019, 06:45
Location: moscow, russia
Contact:

Re: Help with a main internal drive gone RAW from NTFS

#6 Post by oroomar »

https://imgur.com/a/zQlBfB9

smartctl 7.0 2018-12-30 r4883 [x86_64-w64-mingw32-win7-sp1] (sf-7.0-1)
Copyright (C) 2002-18, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family: Western Digital Scorpio Blue Serial ATA (AF)
Device Model: WDC WD6400BPVT-80HXZT3
Serial Number: WD-WXL1A61W2831
LU WWN Device Id: 5 0014ee 6ac27a29b
Firmware Version: 01.01A01
User Capacity: 640,135,028,736 bytes [640 GB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Device is: In smartctl database [for details use: -P show]
ATA Version is: ATA8-ACS (minor revision not indicated)
SATA Version is: SATA 2.6, 3.0 Gb/s
Local Time is: Tue Oct 15 22:49:52 2019 RST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
AAM feature is: Unavailable
APM level is: 96 (intermediate level with standby)
Rd look-ahead is: Enabled
Write cache is: Enabled
DSN feature is: Unavailable
ATA Security is: Disabled, NOT FROZEN [SEC1]

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (15900) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 156) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x7035) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAGS VALUE WORST THRESH FAIL RAW_VALUE
1 Raw_Read_Error_Rate POSR-K 200 200 051 - 3
3 Spin_Up_Time POS--K 174 171 021 - 2266
4 Start_Stop_Count -O--CK 001 001 000 - 117934
5 Reallocated_Sector_Ct PO--CK 196 196 140 - 34
7 Seek_Error_Rate -OSR-K 001 001 000 - 334487
9 Power_On_Hours -O--CK 051 051 000 - 36077
10 Spin_Retry_Count -O--CK 100 100 000 - 0
11 Calibration_Retry_Count -O--CK 100 100 000 - 0
12 Power_Cycle_Count -O--CK 097 097 000 - 3315
191 G-Sense_Error_Rate -O--CK 001 001 000 - 14557
192 Power-Off_Retract_Count -O--CK 200 200 000 - 629
193 Load_Cycle_Count -O--CK 001 001 000 - 2975337
194 Temperature_Celsius -O---K 109 092 000 - 38
196 Reallocated_Event_Count -O--CK 170 170 000 - 30
197 Current_Pending_Sector -O--CK 194 194 000 - 691
198 Offline_Uncorrectable ----CK 100 253 000 - 0
199 UDMA_CRC_Error_Count -O--CK 200 200 000 - 0
200 Multi_Zone_Error_Rate ---R-- 100 253 000 - 0
||||||_ K auto-keep
|||||__ C event count
||||___ R error rate
|||____ S speed/performance
||_____ O updated online
|______ P prefailure warning

ATA_READ_LOG_EXT (addr=0x00:0x00, page=0, n=1) failed: 48-bit ATA commands not implemented [JMicron]
Read GP Log Directory failed

SMART Log Directory Version 1 [multi-sector log support]
Address Access R/W Size Description
0x00 SL R/O 1 Log Directory
0x01 SL R/O 1 Summary SMART error log
0x02 SL R/O 5 Comprehensive SMART error log
0x06 SL R/O 1 SMART self-test log
0x09 SL R/W 1 Selective self-test log
0x80-0x9f SL R/W 16 Host vendor specific log
0xa0-0xa7 SL VS 16 Device vendor specific log
0xa8-0xb7 SL VS 1 Device vendor specific log
0xc0 SL VS 1 Device vendor specific log
0xe0 SL R/W 1 SCT Command/Status
0xe1 SL R/W 1 SCT Data Transfer

SMART Extended Comprehensive Error Log (GP Log 0x03) not supported

SMART Error Log Version: 1
No Errors Logged

SMART Extended Self-test Log (GP Log 0x07) not supported

SMART Self-test log structure revision number 1
No self-tests have been logged. [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

SCT Status Version: 3
SCT Version (vendor specific): 258 (0x0102)
Device State: Active (0)
Current Temperature: 37 Celsius
Power Cycle Min/Max Temperature: 37/40 Celsius
Lifetime Min/Max Temperature: 25/55 Celsius
Under/Over Temperature Limit Count: 0/0
Vendor specific:
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

SCT Temperature History Version: 2
Temperature Sampling Period: 1 minute
Temperature Logging Interval: 1 minute
Min/Max recommended Temperature: 0/60 Celsius
Min/Max Temperature Limit: -41/85 Celsius
Temperature History Size (Index): 128 (56)

Index Estimated Time Temperature Celsius
57 2019-10-15 20:43 30 ***********
... ..(106 skipped). .. ***********
36 2019-10-15 22:30 30 ***********
37 2019-10-15 22:31 ? -
38 2019-10-15 22:32 30 ***********
39 2019-10-15 22:33 30 ***********
40 2019-10-15 22:34 30 ***********
41 2019-10-15 22:35 31 ************
42 2019-10-15 22:36 ? -
43 2019-10-15 22:37 33 **************
44 2019-10-15 22:38 ? -
45 2019-10-15 22:39 33 **************
46 2019-10-15 22:40 ? -
47 2019-10-15 22:41 33 **************
48 2019-10-15 22:42 ? -
49 2019-10-15 22:43 36 *****************
... ..( 3 skipped). .. *****************
53 2019-10-15 22:47 36 *****************
54 2019-10-15 22:48 ? -
55 2019-10-15 22:49 40 *********************
56 2019-10-15 22:50 37 ******************

SCT Error Recovery Control command not supported

Device Statistics (GP/SMART Log 0x04) not supported

ATA_READ_LOG_EXT (addr=0x11:0x00, page=0, n=1) failed: 48-bit ATA commands not implemented [JMicron]
Read SATA Phy Event Counters failed

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Help with a main internal drive gone RAW from NTFS

#7 Post by recuperation »

oroomar wrote: 15 Oct 2019, 23:11 1 Raw_Read_Error_Rate POSR-K 200 200 051 - 3
3 Spin_Up_Time POS--K 174 171 021 - 2266
4 Start_Stop_Count -O--CK 001 001 000 - 117934
Never seen such a huge figure. Looks like the operating system stops the drive too often.
5 Reallocated_Sector_Ct PO--CK 196 196 140 - 34
First indication of the drive heading into failure.

7 Seek_Error_Rate -OSR-K 001 001 000 - 334487
Another fail indicator.
9 Power_On_Hours -O--CK 051 051 000 - 36077
10 Spin_Retry_Count -O--CK 100 100 000 - 0
11 Calibration_Retry_Count -O--CK 100 100 000 - 0
12 Power_Cycle_Count -O--CK 097 097 000 - 3315
191 G-Sense_Error_Rate -O--CK 001 001 000 - 14557
192 Power-Off_Retract_Count -O--CK 200 200 000 - 629
193 Load_Cycle_Count -O--CK 001 001 000 - 2975337
Seems very high, but I don't know why.
194 Temperature_Celsius -O---K 109 092 000 - 38
196 Reallocated_Event_Count -O--CK 170 170 000 - 30
197 Current_Pending_Sector -O--CK 194 194 000 - 691
Most obvious indication that the drive is on the way to fail.
691 sectors can not be read anymore.
198 Offline_Uncorrectable ----CK 100 253 000 - 0
199 UDMA_CRC_Error_Count -O--CK 200 200 000 - 0
200 Multi_Zone_Error_Rate ---R-- 100 253 000 - 0
You have two options.

The first option is to try to recover the data yourself.
Before using any recovery program you have to duplicate your drive but
the process of copying puts this failing drive under stress.
After duplicating the drive which may take some time as the drive may uncover many other unreadable sectors "pending sectors" you should duplicate the drive another time. The second copy would be your working copy then.
Use ddrescue to duplicate your drive.

The other option - as your data is so important - is to use a professional recovery service.

oroomar
Posts: 5
Joined: 09 Oct 2019, 06:45
Location: moscow, russia
Contact:

Re: Help with a main internal drive gone RAW from NTFS

#8 Post by oroomar »

Well, yes, the computer for the past few years used to crash but for other reasons like memory leakage when using to many programs simultaneously, when having too many browser tabs open, overheating when playing LOL and when being for too long in use it would get really slow and even freeze so I had to shut it off with the power bottom.

I just never thought that shutting down and crashing would cause a massive failure of the boot and file system. Everywhere online it says that when crashing, the worst thing that could happen to windows is to lose your current work data that wasn't saved and not all your stuff

Another thing is that for some time before all of this happened the system was always asking for a deep chkdsk scan and repair that was always cancelled by my keyboard. I spilled some water some time ago over the keyboard and caused some electrical damage. Some keys combination do not work most notably control+c and there is a key that from boot up registers as pressed so it always cancelled the chkdsk when the message of press one key to cancel the process showed up. (It should not be any key to cancel something that important).

Locked