Windows Storage Drive went Raw, somehow became EFI? Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
WalterSkinner
Posts: 4
Joined: 10 Apr 2022, 07:40

Windows Storage Drive went Raw, somehow became EFI?

#1 Post by WalterSkinner »

First time poster, make sure to idiot proof everything and lower your IQ a good 20 points.

Anyways, as the title says, my 2TB 7200RPM HDD decided to go raw on me just today.
NOTE: IT IS NOT, AND NEVER HAS BEEN, A BOOT DRIVE; It was a storage drive, I even remember assigning it a simple partition back in the day (2 yrs ago).

This morning, my computer booted to a black screen. Being stupid, I forced powered off, turned of the power supply for 30 sec, and restarted. Please don't laugh, yes I know this is probably why this happened, yes I am ashamed, etc etc etc.
Rebooted to a windows drive repair. My drive has had repair stuff in the past, the odd folder or dll going rogue and needing to be plopped in found.00X, so I thought nothing of it.
Once I was in windows, I knew something was up. File Explorer was slow. And I mean slowwwwwww slow. Took like 3 minutes to load the 'This PC' page.
My storage drive, which I'll call Z from now on, had lost it's name, and had no usage bar under it.

So, like the good little windows user I am, I ran sys /scannow on my C drive (my boot drive) to make sure that file explorer wasn't just wigging out.
Some files were actually problematic and were replaced. Z was still in purgatory however.
I then ran chkdsk Z: /f /r
Took a long ass time, but eventually ended with an error ("...an unspecified error occurred (766f6c756d652e63 470)")

Z was still zonked. So I began to panic.
Started looking up recovery utilities, almost used a few of the scammy ones (iBoysoft, EaseUS, Disk Drill) but eventually landed on Recuva.
Yes, I know Recuva only works for deleted files, yadda yadda.

I ran it, and surprisingly it did come back with some files - deleted files - but files. This suggested to me that the file system wasn't gone, or totally gone.

Eventually, after being dumb for many hours, I came accross TestDisk.
My disk had two partitions: MS Reserved, and MS Data. MS Reserved was duplicated so there were 2 (???).
MS Data had the correct label [Deep Storage] and was NTFS 4096 MB, so I selected it. Lo and behold, all of my files are still there!
Problem was, it was recognized as a EFI partition table. From what I understand, it should be Intel if its a simple NTFS single volume.
The two MS Reserved partitions, which I took to be BS windows tried to put on my drive during chkdsk (I thought that it might have tried to fix it like it would a boot drive), so I wrote just the MS Data as the only partition.
No cigar, windows still wouldn't recognize it as a valid drive.
Disk Management shows an unallocated 16 mb partition, and a healthy 1800~ GB RAW partition now.
I then started pulling some data I knew I didn't want to lose off using TestDisk. Yes, in retrospect I know this could be bad, but I was dumb then (I am still dumb, only dumb later).

I can give the SMART data if its actually useful, but my hard drive is given the Caution label, specifically due to Current Pending Sector count 100/10 and Uncorrectable Sector Count 100/100.

Sorry for the extremely long and rambly post, all I'm trying to do is somehow to get the NTFS file system to be legible, as I'm moving computers (complete lucky/unlucky coincidence) and I want to be able to pull everything off.
I understand my options are:
1. Use TestDisk to pull everything off, or at least the stuff I need provided the drive isn't dying.
2. Try and chkdsk again? Maybe it will work this time if Z has only one Partition?.
3. Use Linux+ddrescue and make a copy, try to pull from there or fix the filesystem. I will likely be purchasing a new hard drive for this for obvious reasons.

If my drive has life left in it, I'd like to just pull off what I need and format it, but if things are dire I don't want to break everything.
Sorry for the long rambly post, it's late and sanity is running low. Any help and advice is appreciated, sorry if the solution is already somewhere on here and I just didn't see it.

Regards, and sincerely yours,
-Dumbass

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows Storage Drive went Raw, somehow became EFI?

#2 Post by recuperation »

WalterSkinner wrote: 10 Apr 2022, 08:50 First time poster, make sure to idiot proof everything and lower your IQ a good 20 points.

Anyways, as the title says, my 2TB 7200RPM HDD decided to go raw on me just today.
NOTE: IT IS NOT, AND NEVER HAS BEEN, A BOOT DRIVE; It was a storage drive, I even remember assigning it a simple partition back in the day (2 yrs ago).

This morning, my computer booted to a black screen. Being stupid, I forced powered off, turned of the power supply for 30 sec, and restarted. Please don't laugh, yes I know this is probably why this happened, yes I am ashamed, etc etc etc.
Rebooted to a windows drive repair. My drive has had repair stuff in the past, the odd folder or dll going rogue and needing to be plopped in found.00X, so I thought nothing of it.
Once I was in windows, I knew something was up. File Explorer was slow. And I mean slowwwwwww slow. Took like 3 minutes to load the 'This PC' page.
My storage drive, which I'll call Z from now on, had lost it's name, and had no usage bar under it.

So, like the good little windows user I am, I ran sys /scannow on my C drive (my boot drive) to make sure that file explorer wasn't just wigging out.
Some files were actually problematic and were replaced.
If your recovery system is unstable use one you could trust.
Z was still in purgatory however.
I then ran chkdsk Z: /f /r
Took a long ass time, but eventually ended with an error ("...an unspecified error occurred (766f6c756d652e63 470)")

Z was still zonked. So I began to panic.
Started looking up recovery utilities, almost used a few of the scammy ones (iBoysoft, EaseUS, Disk Drill) but eventually landed on Recuva.
Yes, I know Recuva only works for deleted files, yadda yadda.

I ran it, and surprisingly it did come back with some files - deleted files - but files. This suggested to me that the file system wasn't gone, or totally gone.

Eventually, after being dumb for many hours, I came accross TestDisk.
My disk had two partitions: MS Reserved, and MS Data. MS Reserved was duplicated so there were 2 (???).
MS Data had the correct label [Deep Storage] and was NTFS 4096 MB, so I selected it. Lo and behold, all of my files are still there!
A 2 TB disk as stated above containing one partition (that is probably filling the whole disk) shows up as 4096 MB?

Problem was, it was recognized as a EFI partition table. From what I understand, it should be Intel if its a simple NTFS single volume.
This is enough reason to post your Testdisk log file.
The two MS Reserved partitions, which I took to be BS windows tried to put on my drive during chkdsk (I thought that it might have tried to fix it like it would a boot drive), so I wrote just the MS Data as the only partition.
No cigar, windows still wouldn't recognize it as a valid drive.
Disk Management shows an unallocated 16 mb partition, and a healthy 1800~ GB RAW partition now.
Healthy partition means partition having a healthy file system on it. 1800 GB RAW is not healthy.
I then started pulling some data I knew I didn't want to lose off using TestDisk. Yes, in retrospect I know this could be bad, but I was dumb then (I am still dumb, only dumb later).
As you had a special need for this data as opposed to the rest of the content of the partition this was not dumb.

I can give the SMART data if its actually useful, but my hard drive is given the Caution label, specifically due to Current Pending Sector count 100/10 and Uncorrectable Sector Count 100/100.
Please post your smartmontools log file
viewtopic.php?f=5&t=10910


Sorry for the extremely long and rambly post, all I'm trying to do is somehow to get the NTFS file system to be legible, as I'm moving computers (complete lucky/unlucky coincidence) and I want to be able to pull everything off.
I understand my options are:
1. Use TestDisk to pull everything off, or at least the stuff I need provided the drive isn't dying.
If everything is filling up the drive completely you would be better off duplicating the drive, but posting the smartmontools log file would be helpful for decision.

2. Try and chkdsk again? Maybe it will work this time if Z has only one Partition?.
You can't reverse the chkdsk action. I would run chkdsk on a second duplicate of the drive.

3. Use Linux+ddrescue and make a copy, try to pull from there or fix the filesystem. I will likely be purchasing a new hard drive for this for obvious reasons.
The ddrescue copy serves as a source for data recovery without having to fear that access to a possibly dammaged drive will break it for good.

If my drive has life left in it, I'd like to just pull off what I need and format it,
but if things are dire I don't want to break everything.

WalterSkinner
Posts: 4
Joined: 10 Apr 2022, 07:40

Re: Windows Storage Drive went Raw, somehow became EFI?

#3 Post by WalterSkinner »

A 2 TB disk as stated above containing one partition (that is probably filling the whole disk) shows up as 4096 MB?
I should have clarified that this was block size, which appears next to the file system in testdisk. Testdisk shows the capacity to be ~1800 GB which is what I would expect, was like that since I got the drive.
This is enough reason to post your Testdisk log file.
This is the testdisk.log, not sure if it got overwritten since I used it a bunch in the same place, but here it is:
testdisk.log
(7.72 KiB) Downloaded 159 times
Here is the backup I made of the partition table before messing with it:
backup.log
(344 Bytes) Downloaded 137 times
Healthy partition means partition having a healthy file system on it. 1800 GB RAW is not healthy.
It's just what it says in Windows Disk Management, didn't want to leave it out ¯\_(ツ)_/¯
As you had a special need for this data as opposed to the rest of the content of the partition this was not dumb.
I read on here that you shouldn't try to read from a weirdly behaving drive unless you know it isn't failing.
Please post your smartmontools log file
Gotcha boss
smartmon.txt
(9.94 KiB) Downloaded 144 times
Here is the crystal disk info screen if that's helpful.

You can't reverse the chkdsk action. I would run chkdsk on a second duplicate of the drive.
There is a 16 MB unallocated partition on the drive now, along with the 1800 GB Raw part. Will that mess things up if I go through with chkdsk? Sorry if this is a dumb question.
The ddrescue copy serves as a source for data recovery without having to fear that access to a possibly dammaged drive will break it for good.
ddrescue won't break the drive itself? just curious.


In any case, thanks so much for your time and response. I know you must get a million of these posts from people who don't know what they are doing (this guy).
Last edited by WalterSkinner on 12 Apr 2022, 00:06, edited 3 times in total.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows Storage Drive went Raw, somehow became EFI?

#4 Post by recuperation »

Please post your smartmontools log file. :roll:

WalterSkinner
Posts: 4
Joined: 10 Apr 2022, 07:40

Re: Windows Storage Drive went Raw, somehow became EFI?

#5 Post by WalterSkinner »

Uhh I did? Is it not this? Its right above the Crystal Disk pic in my previous post.
https://drive.google.com/file/d/1nEi9jl ... Uxqs_/view

Sorry I am quite dumb, I followed the little tutorial thing here to the best of my ability :|
It's right under 'Gotcha boss' up there... Maybe I should have given it a more prominent flair idk lol
It's a google drive link and I made sure it has the correct permissions, so should be fine.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows Storage Drive went Raw, somehow became EFI?

#6 Post by recuperation »

You should upload your documentation to this site instead of putting it on any internet site where it gets lost and nobody will profit from your case thereafter.

Code: Select all

smartctl 7.3 2022-02-28 r5338 [x86_64-w64-mingw32-w10-21H1] (sf-7.3-1)
Copyright (C) 2002-22, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate BarraCuda 3.5 (SMR)
Device Model:     ST2000DM008-2FR102
Serial Number:    ZFL1CXM0
LU WWN Device Id: 5 000c50 0c3b396a1
Firmware Version: 0001
User Capacity:    2,000,398,934,016 bytes [2.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    7200 rpm
Form Factor:      3.5 inches
TRIM Command:     Available
Device is:        In smartctl database 7.3/5319
ATA Version is:   ACS-3 T13/2161-D revision 5
SATA Version is:  SATA 3.1, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Sun Apr 10 10:22:17 2022 PDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x00)	Offline data collection activity
					was never started.
					Auto Offline Data Collection: Disabled.
Self-test execution status:      (   0)	The previous self-test routine completed
					without error or no self-test has ever 
					been run.
Total time to complete Offline 
data collection: 		(    0) seconds.
Offline data collection
capabilities: 			 (0x73) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					No Offline surface scan supported.
					Self-test supported.
					Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (   1) minutes.
Extended self-test routine
recommended polling time: 	 ( 201) minutes.
Conveyance self-test routine
recommended polling time: 	 (   2) minutes.
SCT capabilities: 	       (0x30a5)	SCT Status supported.
					SCT Data Table supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   081   039   006    Pre-fail  Always       -       141212760
  3 Spin_Up_Time            0x0003   098   098   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   096   096   020    Old_age   Always       -       5049
  5 Reallocated_Sector_Ct   0x0033   100   100   010    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   080   060   045    Pre-fail  Always       -       89377154
  9 Power_On_Hours          0x0032   089   089   000    Old_age   Always       -       10229h+34m+55.867s
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       929
183 Runtime_Bad_Block       0x0032   100   100   000    Old_age   Always       -       0
184 End-to-End_Error        0x0032   100   100   099    Old_age   Always       -       0
187 Reported_Uncorrect      0x0032   001   001   000    Old_age   Always       -       30157
188 Command_Timeout         0x0032   100   100   000    Old_age   Always       -       0 0 0
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   070   050   040    Old_age   Always       -       30 (Min/Max 22/30)
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       36
193 Load_Cycle_Count        0x0032   058   058   000    Old_age   Always       -       85880
194 Temperature_Celsius     0x0022   030   050   000    Old_age   Always       -       30 (0 20 0 0 0)
195 Hardware_ECC_Recovered  0x001a   081   064   000    Old_age   Always       -       141212760
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       192
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       192
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       2592h+37m+07.761s
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       9270379278
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       26464194745

SMART Error Log Version: 1
ATA Error Count: 32409 (device log contains only the most recent five errors)
	CR = Command Register [HEX]
	FR = Features Register [HEX]
	SC = Sector Count Register [HEX]
	SN = Sector Number Register [HEX]
	CL = Cylinder Low Register [HEX]
	CH = Cylinder High Register [HEX]
	DH = Device/Head Register [HEX]
	DC = Device Command Register [HEX]
	ER = Error register [HEX]
	ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 32409 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 50 c1 01 00  Error: UNC at LBA = 0x0001c150 = 115024

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 28 30 c1 01 e0 00      00:30:40.740  READ DMA EXT
  25 00 20 10 d1 00 e0 00      00:30:40.739  READ DMA EXT
  25 00 28 30 81 00 e0 00      00:30:40.739  READ DMA EXT
  25 00 08 80 bc b8 e3 00      00:30:40.738  READ DMA EXT
  25 00 08 08 bf b8 e3 00      00:30:40.738  READ DMA EXT

Error 32408 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 50 c1 01 00  Error: UNC at LBA = 0x0001c150 = 115024

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 28 30 c1 01 e0 00      00:30:39.001  READ DMA EXT
  25 00 20 10 d1 00 e0 00      00:30:39.001  READ DMA EXT
  25 00 28 30 81 00 e0 00      00:30:39.000  READ DMA EXT
  25 00 08 80 bc b8 e3 00      00:30:39.000  READ DMA EXT
  25 00 08 08 bf b8 e3 00      00:30:39.000  READ DMA EXT

Error 32407 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 50 c1 01 00  Error: UNC at LBA = 0x0001c150 = 115024

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 28 30 c1 01 e0 00      00:30:37.279  READ DMA EXT
  25 00 20 10 d1 00 e0 00      00:30:37.278  READ DMA EXT
  25 00 28 30 81 00 e0 00      00:30:37.278  READ DMA EXT
  25 00 08 80 bc b8 e3 00      00:30:37.277  READ DMA EXT
  25 00 08 08 bf b8 e3 00      00:30:37.277  READ DMA EXT

Error 32406 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 50 c1 01 00  Error: UNC at LBA = 0x0001c150 = 115024

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 28 30 c1 01 e0 00      00:30:35.558  READ DMA EXT
  25 00 20 10 d1 00 e0 00      00:30:35.557  READ DMA EXT
  25 00 28 30 81 00 e0 00      00:30:35.557  READ DMA EXT
  25 00 08 80 bc b8 e3 00      00:30:35.557  READ DMA EXT
  25 00 08 08 bf b8 e3 00      00:30:35.556  READ DMA EXT

Error 32405 occurred at disk power-on lifetime: 10229 hours (426 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 50 c1 01 00  Error: UNC at LBA = 0x0001c150 = 115024

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  25 00 28 30 c1 01 e0 00      00:30:33.866  READ DMA EXT
  25 00 20 10 d1 00 e0 00      00:30:33.865  READ DMA EXT
  25 00 28 30 81 00 e0 00      00:30:33.865  READ DMA EXT
  25 00 08 80 bc b8 e3 00      00:30:33.864  READ DMA EXT
  25 00 08 08 bf b8 e3 00      00:30:33.864  READ DMA EXT

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

Your drive is about to die:

Code: Select all

197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       192
You have 192 pending sectors (sectors that can't be read).

As for your ddrescue question, any attempt to duplicate your drive can break it when it's already dammaged.
It's your decision if you want to try to duplicate or not.

After having duplicated the drive the easiest way of recovery is to copy the content of your lost partition to another drive.

WalterSkinner
Posts: 4
Joined: 10 Apr 2022, 07:40

Re: Windows Storage Drive went Raw, somehow became EFI?

#7 Post by WalterSkinner »

recuperation wrote: 11 Apr 2022, 19:20 You should upload your documentation to this site instead of putting it on any internet site where it gets lost and nobody will profit from your case thereafter.
Edited my above post, sorry! :? Used to having to link my own stuff from other forums.
recuperation wrote: 11 Apr 2022, 19:20 Your drive is about to die:
Eh I'm not surprised, but its good to know for sure. Just as a question for future endeavors, other than large-ish amounts of pending sectors, what are the signs of a failing drive in the SMART data?

In any case, I think I'll pull a few more files off and then give ddrescue a go. Thanks for your help and for being nice (relative to some of the other posts of yours :P ).
Been in a (unpaid) support job before for software so I sorta get it.

Cheers,
- (Now Slightly Less of a) Dumbass

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows Storage Drive went Raw, somehow became EFI?

#8 Post by recuperation »

recuperation wrote: 11 Apr 2022, 19:20 Your drive is about to die:

Eh I'm not surprised, but its good to know for sure. Just as a question for future endeavors, other than large-ish amounts of pending sectors, what are the signs of a failing drive in the SMART data?
Here is one:
https://static.googleusercontent.com/me ... ilures.pdf
If you have a couple of disks, pull a smartmontools log file for each one and compare how the parameters change over time when you are pulling them again. That gives you an idea which argument changes a lot. Once sleepy figures start to move do enquire!

In any case, I think I'll pull a few more files off and then give ddrescue a go. Thanks for your help and for being nice (relative to some of the other posts of yours :P ).
God sees everything but I rely on the documentation of people asking questions. This posts sums it up:
viewtopic.php?p=34916#p34916


And here are the most basic questions I would like to be seen answered:
1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

Locked