Help please - HDD got dropped & need to recover files Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
james
Posts: 4
Joined: 31 Oct 2013, 15:11

Help please - HDD got dropped & need to recover files

#1 Post by james »

Hi,

I dropped my laptop. I am reasonably IT literate as work in IT however am stuggling how to use TestDisk to recover my files.

I've taken the HDD out & connected via USB to a new laptop.

I ran first time, saw my connected HDD & did the analyse as was able to see "OS" partition & copy files from my Documents. I still need to copy some other files however it seems as though my HDD has worsened as now when I use TestDisk the following happens. Note that now when I connect my HDD I do see E & F drives after about 7 mins, however no errors occur when I click on them. Windows just spends ages thinking.

1. After pressing enter to create the log, it takes about 15 mins to find the Disks (my main new laptop one & my faulty connected other HDD).
2. I see the disk & when pressing proceed it takes another 5mins or so where it recognises the correct disk type (intel).
3. When I press analyse it takes hours & hours to go through that process even to get to about 7% whereas the first time it did not take this long. As a result I stop as think it will never complete.

questions/help:
1. how can I fix my worsening (I suspect) disk
2. what else should I do or shall I be patient?

thanks very much in advance

james
Posts: 4
Joined: 31 Oct 2013, 15:11

Re: Help please - HDD got dropped & need to recover files

#2 Post by james »

Some more details for who can help...

- When at the "Current Partition structure:" stage I see the below. I've only written the first part of each line. Item 3 is duplicated.

1 P Dell Utility
2 * HPFS - NTFS
Invalid NTFS or EXFAT boot
3 P HPFS - NTFS
3 P HPFS - NTFS

- After pressing Analyse I get this...This section never took so long the first time round.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Analyse cylinder 2910/38912: 07%
Read error at 2909/231/11 (lba=46747648)

FAT16 >32M 0 1 1 12 254 62 208781 [DellUtility]

Your help will be much appreciated as I have ersonal photos and pst files (missing from lasttime I backed up) thanks in advance!

james
Posts: 4
Joined: 31 Oct 2013, 15:11

Re: Help please - HDD got dropped & need to recover files

#3 Post by james »

And here is the log..

I cancelled the last analyse as it was taking over 4 hours & on 7% & have only pasted in the first part of th log as the botom lines were repeating on different buffers.

thanks

Thu Oct 31 14:01:47 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072932864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072932864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=199676133376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=277185822720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=15728640000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=304236290048
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS545050A7E380, S/N:TE854349GJ479R, FW:GG2OA6C0
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HM321HI, S/N:M6116A016V20

Partition table type (auto): Intel
Disk /dev/sdb - 320 GB / 298 GiB - SAMSUNG HM321HI
Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 13/0/52
file_pread(5,4093,buffer,6500355(404/160/16)) ReadFile Incorrect function.

NTFS: Can't read MFT
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P Dell Utility 0 1 1 12 254 63 208782
2 * HPFS - NTFS 13 0 52 1925 59 54 30720000
Invalid NTFS or EXFAT boot
3 P HPFS - NTFS 1925 59 55 38913 48 31 594211504
3 P HPFS - NTFS 1925 59 55 38913 48 31 594211504

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
file_pread(5,16,buffer,32(0/0/33)) ReadFile Incorrect function.

file_pread(5,16,buffer,95(0/1/33)) ReadFile Incorrect function.

FAT16 at 0/1/1
FAT1 : 1-204
FAT2 : 205-408
start_rootdir : 409
Data : 441-208780
sectors : 208781
cluster_size : 4
no_of_cluster : 52085 (2 - 52086)
fat_length 204 calculated 204
file_pread(5,16,buffer,348(0/5/34)) ReadFile Incorrect function.

file_pread(5,1,buffer,348(0/5/34)) ReadFile Incorrect function.

comp_FAT: can't read FAT2

FAT16 at 0/1/1
FAT16 >32M 0 1 1 12 254 62 208781 [DellUtility]
FAT16, blocksize=2048, 106 MB / 101 MiB
file_pread(5,1,buffer,208844(12/254/63)) ReadFile Incorrect function.

file_pread(5,1,buffer,208845(13/0/1)) ReadFile Incorrect function.

file_pread(5,16,buffer,208907(13/0/63)) ReadFile Incorrect function.

file_pread(5,1,buffer,208907(13/0/63)) ReadFile Incorrect function.

file_pread(5,8,buffer,208923(13/1/16)) ReadFile Incorrect function.

file_pread(5,11,buffer,208970(13/1/63)) ReadFile Incorrect function.

file_pread(5,2,buffer,210892(13/32/32)) ReadFile Incorrect function.

file_pread(5,3,buffer,208908(13/1/1)) ReadFile Incorrect function.

file_pread(5,1,buffer,208931(13/1/24)) ReadFile Incorrect function.

file_pread(5,16,buffer,208896(13/0/52)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,208896(13/0/52)) ReadFile Incorrect function.

file_pread(5,15,buffer,208897(13/0/53)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,208959(13/1/52)) ReadFile Incorrect function.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Help please - HDD got dropped & need to recover files

#4 Post by cgrenier »

Use gnu dddrescue to clone the damaged disk to a new empty disk
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk
Once it's done, remove the original disk and try to access your data on the clone.

james
Posts: 4
Joined: 31 Oct 2013, 15:11

Re: Help please - HDD got dropped & need to recover files

#5 Post by james »

Thanks Christophe.

I wish I found that article earlier. I looked but must have missed it. Instead yesterday I purchased "GetDataBack for NTFS" which found/recovered most of the data. On first launch like TestDisk it found the partitions then on the 2nd/3rd/4th it did not. On the 5th attempt it did find it.

Lessons learnt:
- a damaged disk is temperamental. Sometimes tools find the partitions sometimes they don't
- Rather obviously "backup data"!

thanks

Locked