I was recently hit with some randomware that left a lot of my files encrypted. Trying to recover the original files using Photorec. Currently booting into Ubuntu off of the latest live CD.
I can browse the contents of the 2TB drive with no problem. However, when I start Photorec it shows that the drive is much smaller, only 2GB. It also shows that there are hidden sectors present.
I ran a photorec anyway and was able to recover some files, but not nearly what I was expecting. It also teinated prematurely with an error. I'm guessing this has to do with the incorrect disk size. Is there any way I can get Photorec to show the correct drive size? Any help is much appreciated.
WD20EARX incorrect size
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5416
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: WD20EARX incorrect size
Try "hdparm -N" or maybe "hdparm --dco-restore" (read the man page first) to check if HPA or DCO area are present and disable them if necessary.
-
- Posts: 5
- Joined: 22 Apr 2015, 02:41
Re: WD20EARX incorrect size
Running hdparm -N /dev/sda2 gives me:
However, when I run photorec I get:
I dont want to mess around too much with hdparm without the proper guidance. I'm not real familiar with this and am worried about doing damage to the drive that would make recoving my files more difficult. Thanks for your help. Should I stay on the -N track or try --dco-restore instead? Thanks again!
Code: Select all
max sectors = 3907029168/3907029168, HPA is disabled
Code: Select all
Hidden sectors are present
size: 3906820096
User_max: 3907029168
Native_max: 18446744073321613488
Host protected area (HPA) present
-
- Posts: 5
- Joined: 22 Apr 2015, 02:41
Re: WD20EARX incorrect size
Before going any further, I decided to make an image of the drive using ddrescue to a second drive. This will allow me to get a little more adventurous with my recovery approach
. 2TB might take a while though.
After it's done, is there any chance Photorec will recognize the image size correctly, or will it see it exactly as the physical drive? Should I try the --dco-restore option?

After it's done, is there any chance Photorec will recognize the image size correctly, or will it see it exactly as the physical drive? Should I try the --dco-restore option?
-
- Posts: 5
- Joined: 22 Apr 2015, 02:41
Re: WD20EARX incorrect size
After about 50 hours, ddrescue finally finished. I decided to try the --dco-restore option this morning, but it returned an error. HDIO_DRIVE_CMD(dco_restore) failed: Input/output error.
Not sure where to go from here? I just need Photorec to see the correct size drive (2TB) so I can get on with recovery.
Not sure where to go from here? I just need Photorec to see the correct size drive (2TB) so I can get on with recovery.
- cgrenier
- Site Admin
- Posts: 5416
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: WD20EARX incorrect size
If you rerun PhotoRec, which does it report ? The copy/paste you have done from PhotoRec about HPA lists 2 TB...
-
- Posts: 5
- Joined: 22 Apr 2015, 02:41
Re: WD20EARX incorrect size
Photorec completed with no errors this time! Looks like it worked. Thanks so much for all of your help!!