WD20EARX incorrect size

[pineapple1]

I was recently hit with some randomware that left a lot of my files encrypted. Trying to recover the original files using Photorec. Currently booting into Ubuntu off of the latest live CD.

I can browse the contents of the 2TB drive with no problem. However, when I start Photorec it shows that the drive is much smaller, only 2GB. It also shows that there are hidden sectors present.

I ran a photorec anyway and was able to recover some files, but not nearly what I was expecting. It also teinated prematurely with an error. I'm guessing this has to do with the incorrect disk size. Is there any way I can get Photorec to show the correct drive size? Any help is much appreciated.

[cgrenier]

Try "hdparm -N" or maybe "hdparm --dco-restore" (read the man page first) to check if HPA or DCO area are present and disable them if necessary.

[pineapple1]

Running hdparm -N /dev/sda2 gives me:

Code: Select all

max sectors = 3907029168/3907029168, HPA is disabled

However, when I run photorec I get:

Code: Select all

Hidden sectors are present
size: 3906820096
User_max: 3907029168
Native_max: 18446744073321613488
Host protected area (HPA) present

I dont want to mess around too much with hdparm without the proper guidance. I'm not real familiar with this and am worried about doing damage to the drive that would make recoving my files more difficult. Thanks for your help. Should I stay on the -N track or try --dco-restore instead? Thanks again!

[pineapple1]

Before going any further, I decided to make an image of the drive using ddrescue to a second drive. This will allow me to get a little more adventurous with my recovery approach . 2TB might take a while though.

After it's done, is there any chance Photorec will recognize the image size correctly, or will it see it exactly as the physical drive? Should I try the --dco-restore option?

[pineapple1]

After about 50 hours, ddrescue finally finished. I decided to try the --dco-restore option this morning, but it returned an error. HDIO_DRIVE_CMD(dco_restore) failed: Input/output error.

Not sure where to go from here? I just need Photorec to see the correct size drive (2TB) so I can get on with recovery.

[cgrenier]

If you rerun PhotoRec, which does it report ? The copy/paste you have done from PhotoRec about HPA lists 2 TB...

[pineapple1]

Photorec completed with no errors this time! Looks like it worked. Thanks so much for all of your help!!