WD20EARX incorrect size

Using PhotoRec to recover lost data
Post Reply
Message
Author
pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

WD20EARX incorrect size

#1 Post by pineapple1 » 22 Apr 2015, 02:50

I was recently hit with some randomware that left a lot of my files encrypted. Trying to recover the original files using Photorec. Currently booting into Ubuntu off of the latest live CD.

I can browse the contents of the 2TB drive with no problem. However, when I start Photorec it shows that the drive is much smaller, only 2GB. It also shows that there are hidden sectors present.

I ran a photorec anyway and was able to recover some files, but not nearly what I was expecting. It also teinated prematurely with an error. I'm guessing this has to do with the incorrect disk size. Is there any way I can get Photorec to show the correct drive size? Any help is much appreciated.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3497
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: WD20EARX incorrect size

#2 Post by cgrenier » 22 Apr 2015, 07:25

Try "hdparm -N" or maybe "hdparm --dco-restore" (read the man page first) to check if HPA or DCO area are present and disable them if necessary.

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#3 Post by pineapple1 » 22 Apr 2015, 12:23

Running hdparm -N /dev/sda2 gives me:

Code: Select all

max sectors = 3907029168/3907029168, HPA is disabled
However, when I run photorec I get:

Code: Select all

Hidden sectors are present
size: 3906820096
User_max: 3907029168
Native_max: 18446744073321613488
Host protected area (HPA) present
I dont want to mess around too much with hdparm without the proper guidance. I'm not real familiar with this and am worried about doing damage to the drive that would make recoving my files more difficult. Thanks for your help. Should I stay on the -N track or try --dco-restore instead? Thanks again!

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#4 Post by pineapple1 » 22 Apr 2015, 23:58

Before going any further, I decided to make an image of the drive using ddrescue to a second drive. This will allow me to get a little more adventurous with my recovery approach :D. 2TB might take a while though.

After it's done, is there any chance Photorec will recognize the image size correctly, or will it see it exactly as the physical drive? Should I try the --dco-restore option?

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#5 Post by pineapple1 » 25 Apr 2015, 13:07

After about 50 hours, ddrescue finally finished. I decided to try the --dco-restore option this morning, but it returned an error. HDIO_DRIVE_CMD(dco_restore) failed: Input/output error.

Not sure where to go from here? I just need Photorec to see the correct size drive (2TB) so I can get on with recovery.

User avatar
cgrenier
Site Admin
Posts: 3497
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: WD20EARX incorrect size

#6 Post by cgrenier » 27 Apr 2015, 07:01

If you rerun PhotoRec, which does it report ? The copy/paste you have done from PhotoRec about HPA lists 2 TB...

pineapple1
Posts: 5
Joined: 22 Apr 2015, 02:41

Re: WD20EARX incorrect size

#7 Post by pineapple1 » 30 Apr 2015, 01:40

Photorec completed with no errors this time! Looks like it worked. Thanks so much for all of your help!!

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests