cgsecurity.org

Posted: **24 Jun 2020, 22:41**

Hi all,

I have a WD 1 GB external harddrive which is not starting up anymore in windows.

After reading and watching YouTube I learned that the testdisk tool might help. Followed the initial steps:
- reading harddisk - ok
- looking for errors - no errors
- look for partitions - no partition
- do a quick search -> seems to be a very long search. I get 5 % per day. After running for 48 hours now I'm at 10%. Meaning I have to let it run for 20 days. Should I proceed or should I do already some other steps to recover my personal data on the drive?

Thanks for any help / advise.

Posted: **25 Jun 2020, 07:10**

Unless the disk is connected via USB1, it should be faster.
Can you connect the disk via SATA ?

Posted: **25 Jun 2020, 15:54**

Thanks for your reply.

It seems that the search did find a partition at 16%. It is moving als a bit faster now then the last two days, but still very slow.

Regarding usb I thing it is USB2.0 or 3.0

I am not sure how to connect sata externally, but if you mean directly to motherboard I am not able.
What is your advise?

Posted: **25 Jun 2020, 21:18**

Marweecos wrote: 24 Jun 2020, 22:41 Hi all,

I have a WD 1 GB external harddrive which is not starting up anymore in windows.

Unsufficient description!
If your disk is not rotating anymore you need professional assistance.

After reading and watching YouTube I learned that the testdisk tool might help. Followed the initial steps:
- reading harddisk - ok

??? Did you read the label of the cover? "Reading harddisk" is not something that will tell anybody what you did.

- looking for errors - no errors

Imcomprehensible. How did you check for errors?

- look for partitions - no partition

OK!

- do a quick search -> seems to be a very long search. I get 5 % per day. After running for 48 hours now I'm at 10%. Meaning I have to let it run for 20 days. Should I proceed or should I do already some other steps to recover my personal data on the drive?

If you assume that Testdisk would read the disk continuously (which should not be the case during quick search) your transfer speed is approx. 579 kByte/sec. This is roughly more than a hundred times slower than the native linear transfer rate. Something is pretting wrong here.
Either the disk contains lots of broken sectors or the interface is somehow defective or the disk has a major error.

If your external housing does not provice another interface like E-Sata for instance, you would need to remove the disk from the housing.
The easiest thing would be to put it then into a docking station. You should check the performance of the docking station with a proven healthy disk and run Testdisk to compare speeds.

Posted: **28 Jun 2020, 22:02**

recuperation wrote: 25 Jun 2020, 21:18
Marweecos wrote: 24 Jun 2020, 22:41 Hi all,

I have a WD 1 GB external harddrive which is not starting up anymore in windows.

Unsufficient description!
If your disk is not rotating anymore you need professional assistance.
Hearing the sound of the drive when it is connected and feeling it is spinning. Not sure if there is another method to be 100 sure it is spinning.

After reading and watching YouTube I learned that the testdisk tool might help. Followed the initial steps:
- reading harddisk - ok

??? Did you read the label of the cover? "Reading harddisk" is not something that will tell anybody what you did.
I used smartctl -i and was able to get the harddrive information.

- looking for errors - no errors
Imcomprehensible. How did you check for errors?
Later i did the smartctl -a command and it showed no errors.

- look for partitions - no partition

OK!

- do a quick search -> seems to be a very long search. I get 5 % per day. After running for 48 hours now I'm at 10%. Meaning I have to let it run for 20 days. Should I proceed or should I do already some other steps to recover my personal data on the drive?

If you assume that Testdisk would read the disk continuously (which should not be the case during quick search) your transfer speed is approx. 579 kByte/sec. This is roughly more than a hundred times slower than the native linear transfer rate. Something is pretting wrong here.
Either the disk contains lots of broken sectors or the interface is somehow defective or the disk has a major error.

If your external housing does not provice another interface like E-Sata for instance, you would need to remove the disk from the housing.
The easiest thing would be to put it then into a docking station. You should check the performance of the docking station with a proven healthy disk and run Testdisk to compare speeds.
I will need to buy a docking station then. Any tips for a diy dock station which?

What to do with the invalid or exfat boot partition?

Posted: **28 Jun 2020, 23:33**

As for the SMART status I don't believe you.

Regarding the docking station you did not even mention the model of your WD drive or the size.
It may well be that you have a integrated 2,5'' model with no standard SATA connector so that it will never fit.
If it's a 3,5'' drive you would need to remove it from the housing.

What to do with the invalid or exfat boot partition?

You did not mention such in your initial posting. Where did it come from? Did it fall from the sky?
Anyway, why should there be one on an external drive?

Your documentation of your problem is really bad.
Am I too strict claiming better documentation?

Posted: **29 Jun 2020, 16:49**

recuperation wrote: 28 Jun 2020, 23:33 As for the SMART status I don't believe you.

Sorry if my documentation is bad. I am a newbee and learning day by day. But thanks so far for your help and efforts.

As for the SMART status I don't believe you.

Why not?

Regarding the docking station you did not even mention the model of your WD drive or the size.

Sorry i thought it was visible in the picture in one of my earlier posts. The drive is a WD10JMVW with 1.0Tb.

It may well be that you have a integrated 2,5'' model with no standard SATA connector so that it will never fit.
If it's a 3,5'' drive you would need to remove it from the housing.

It is a 2.5 inch external harddrive.

You did not mention such in your initial posting. Where did it come from? Did it fall from the sky?
Anyway, why should there be one on an external drive?

I thought the pictures were available, but I was the only one who is seeing them. Hope they are visible now.

Posted: **29 Jun 2020, 17:07**

Marweecos wrote: 29 Jun 2020, 16:49
recuperation wrote: 28 Jun 2020, 23:33 As for the SMART status I don't believe you.

Sorry if my documentation is bad. I am a newbee and learning day by day. But thanks so far for your help and efforts.

As for the SMART status I don't believe you.
Why not?

You did not deliver a proof. From experience I know that I cannot rely on oral statements.

Regarding the docking station you did not even mention the model of your WD drive or the size.
Sorry i thought it was visible in the picture in one of my earlier posts. The drive is a WD10JMVW with 1.0Tb.

It may well be that you have a integrated 2,5'' model with no standard SATA connector so that it will never fit.
If it's a 3,5'' drive you would need to remove it from the housing.
It is a 2.5 inch external harddrive.

Yes. Looks like I guessed right unfortunately.
You probably cannot remove the USB-connector to make a SATA connector appear behind. I think it is soldered together.
Now a dockingstation is not an option anymore, rather another computer that seems to be working correctly.

Posted: **29 Jun 2020, 18:16**

recuperation wrote: 29 Jun 2020, 17:07 You did not deliver a proof. From experience I know that I cannot rely on oral statements.

Code: Select all

Using locale 'en_US.utf8'.


Mon Jun 29 11:40:45 2020
Command line: TestDisk /log

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.5.0-kali2-amd64 (#1 SMP Debian 5.5.17-1kali1 (2020-04-21)) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'en_US.utf8'.


Mon Jun 29 11:40:56 2020
Command line: TestDisk /log

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.5.0-kali2-amd64 (#1 SMP Debian 5.5.17-1kali1 (2020-04-21)) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS725050A7E630, S/N:TF0501WH3S35ZR, FW:GH2OA910
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD Elements 10B8, FW:1012
Disk /dev/mapper/MariLinux--vg-root - 491 GB / 457 GiB - 959602688 sectors, sector size=512
Disk /dev/mapper/MariLinux--vg-swap_1 - 8480 MB / 8088 MiB - 16564224 sectors, sector size=512
Disk /dev/mapper/sda5_crypt - 499 GB / 465 GiB - 976236544 sectors, sector size=512
Disk /dev/dm-0 - 499 GB / 465 GiB - 976236544 sectors, sector size=512
Disk /dev/dm-1 - 491 GB / 457 GiB - 959602688 sectors, sector size=512
Disk /dev/dm-2 - 8480 MB / 8088 MiB - 16564224 sectors, sector size=512

Partition table type defaults to Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WD Elements 10B8
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

Code: Select all

mari@MariLinux:~$ sudo fdisk -l
[sudo] password for mari: 
Disk /dev/sda: 465.78 GiB, 500107862016 bytes, 976773168 sectors
Disk model: HGST HTS725050A7
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0xe15e9ef5

Device     Boot  Start       End   Sectors   Size Id Type
/dev/sda1  *      2048    499711    497664   243M 83 Linux
/dev/sda2       501758 976771071 976269314 465.5G  5 Extended
/dev/sda5       501760 976771071 976269312 465.5G 83 Linux

Partition 2 does not start on physical sector boundary.


Disk /dev/mapper/sda5_crypt: 465.52 GiB, 499833110528 bytes, 976236544 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


Disk /dev/mapper/MariLinux--vg-root: 457.59 GiB, 491316576256 bytes, 959602688 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


Disk /dev/mapper/MariLinux--vg-swap_1: 7.92 GiB, 8480882688 bytes, 16564224 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


Disk /dev/sdb: 931.49 GiB, 1000170586112 bytes, 1953458176 sectors
Disk model: Elements 10B8   
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
mari@MariLinux:~$ smartctl -i /dev/sdb
bash: smartctl: command not found
mari@MariLinux:~$ sudo smartctl -i /dev/sdb
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.5.0-kali2-amd64] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Western Digital Elements / My Passport (USB, AF)
Device Model:     WDC WD10JMVW-11AJGS2
Serial Number:    WD-WX61A645CKDT
LU WWN Device Id: 5 0014ee 20a9a9a71
Firmware Version: 01.01A01
User Capacity:    1,000,204,886,016 bytes [1.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ACS-2 (minor revision not indicated)
SATA Version is:  SATA 3.0, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Mon Jun 29 12:09:30 2020 CDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

mari@MariLinux:~$ ^C
mari@MariLinux:~$ sudo smartctl -a /dev/sdb
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.5.0-kali2-amd64] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Western Digital Elements / My Passport (USB, AF)
Device Model:     WDC WD10JMVW-11AJGS2
Serial Number:    WD-WX61A645CKDT
LU WWN Device Id: 5 0014ee 20a9a9a71
Firmware Version: 01.01A01
User Capacity:    1,000,204,886,016 bytes [1.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ACS-2 (minor revision not indicated)
SATA Version is:  SATA 3.0, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Mon Jun 29 12:11:12 2020 CDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Incomplete response, ATA output registers missing
SMART overall-health self-assessment test result: FAILED!
Drive failure expected in less than 24 hours. SAVE ALL DATA.
Warning: This result is based on an Attribute check.
See vendor-specific Attribute list for failed Attributes.

General SMART Values:
Offline data collection status:  (0x00) Offline data collection activity
                                        was never started.
                                        Auto Offline Data Collection: Disabled.
Self-test execution status:      (   0) The previous self-test routine completed
                                        without error or no self-test has ever 
                                        been run.
Total time to complete Offline 
data collection:                (18780) seconds.
Offline data collection
capabilities:                    (0x7b) SMART execute Offline immediate.
                                        Auto Offline data collection on/off support.
                                        Suspend Offline collection upon new
                                        command.
                                        Offline surface scan supported.
                                        Self-test supported.
                                        Conveyance Self-test supported.
                                        Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                                        power-saving mode.
                                        Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                                        General Purpose Logging supported.
Short self-test routine 
recommended polling time:        (   2) minutes.
Extended self-test routine
recommended polling time:        ( 210) minutes.
Conveyance self-test routine
recommended polling time:        (   5) minutes.
SCT capabilities:              (0x7035) SCT Status supported.
                                        SCT Feature Control supported.
                                        SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   123   114   051    Pre-fail  Always       -       78803
  3 Spin_Up_Time            0x0027   132   126   021    Pre-fail  Always       -       4400
  4 Start_Stop_Count        0x0032   094   094   000    Old_age   Always       -       6283
  5 Reallocated_Sector_Ct   0x0033   137   137   140    Pre-fail  Always   FAILING_NOW 2665
  7 Seek_Error_Rate         0x002e   001   001   000    Old_age   Always       -       236572
  9 Power_On_Hours          0x0032   091   091   000    Old_age   Always       -       7007
 10 Spin_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
 11 Calibration_Retry_Count 0x0032   100   100   000    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   099   099   000    Old_age   Always       -       1747
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       339
193 Load_Cycle_Count        0x0032   189   189   000    Old_age   Always       -       35870
194 Temperature_Celsius     0x0022   104   098   000    Old_age   Always       -       43
196 Reallocated_Event_Count 0x0032   001   001   000    Old_age   Always       -       2437
197 Current_Pending_Sector  0x0032   200   198   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0030   100   253   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       3
200 Multi_Zone_Error_Rate   0x0008   100   253   000    Old_age   Offline      -       0

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

mari@MariLinux:~$

Hope this help as evidence

Yes. Looks like I guessed right unfortunately.
You probably cannot remove the USB-connector to make a SATA connector appear behind. I think it is soldered together.
Now a dockingstation is not an option anymore, rather another computer that seems to be working correctly.

Yes it is soldered. What do you mean with another computer that seems to be working? I have a laptop working where I am doing the testdisk quickscan on. What to do with it?

Quicksearch is at 21%. Proceed or stop and do something else to recover data?

Posted: **29 Jun 2020, 19:57**

Marweecos wrote: 29 Jun 2020, 18:16 Yes it is soldered. What do you mean with another computer that seems to be working? I have a laptop working where I am doing the testdisk quickscan on. What to do with it?

The strategy is to exclude error sources. As you pretended your SMART parameters are right, possible sources like cabling, USB-port, notebook hardware or software installation needed to be excluded. This is not necessary anymore based on your SMART data!

Quicksearch is at 21%. Proceed or stop and do something else to recover data?

Stop immediately and duplicate your dying drive as long as this is possible or engage a professional recovery service.
How come you said your SMART data is OK?
I tinted the relevant lines below.
Now you know why I was asking for a proof.
To be honest, the fact that you came here into the forum is always the first reason to be suspicious.

ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 123 114 051 Pre-fail Always - 78803
3 Spin_Up_Time 0x0027 132 126 021 Pre-fail Always - 4400
4 Start_Stop_Count 0x0032 094 094 000 Old_age Always - 6283
5 Reallocated_Sector_Ct 0x0033 137 137 140 Pre-fail Always FAILING_NOW 2665
7 Seek_Error_Rate 0x002e 001 001 000 Old_age Always - 236572
9 Power_On_Hours 0x0032 091 091 000 Old_age Always - 7007
10 Spin_Retry_Count 0x0032 100 100 000 Old_age Always - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age Always - 0
12 Power_Cycle_Count 0x0032 099 099 000 Old_age Always - 1747
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age Always - 339
193 Load_Cycle_Count 0x0032 189 189 000 Old_age Always - 35870
194 Temperature_Celsius 0x0022 104 098 000 Old_age Always - 43
196 Reallocated_Event_Count 0x0032 001 001 000 Old_age Always - 2437
197 Current_Pending_Sector 0x0032 200 198 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 100 253 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 3
200 Multi_Zone_Error_Rate 0x0008 100 253 000 Old_age Offline - 0

cgsecurity.org

Quick search for partition 5% per 24h - wait or do something else?

Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?

Re: Quick search for partition 5% per 24h - wait or do something else?