Looking at 400 days to analyse disk...

[goozak]

Hello,

Trying to use TestDisk, but somewhat baffled by how slow it seems...

My situation : A friend brought a damaged laptop to see if I could extract files from the hard disk, along with a USB external drive. I needed space on the USB drive to copy files, so I deleted the content of a folder. The operation hanged and now Windows is unable to access the drive. It somewhat sees it, but Disk Manager and Windows Explorer just hang when trying to access it.

I installed TestDisk and tried to recover the content. It started analyzing the drive, but every cylinder it tries to analyze generate a Read error. A quick calculation tells me that analyzing every cylinder will take more than 400 days ! That seems excessive for a 500 GB drive...

Here's my log :

Code: Select all

Sun Jul  1 19:26:05 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107861504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107861504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=481755660288
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=16777216000
file_pread(4,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HITACHI HTS727550A9E, S/N:XXXXXXXXXXXXXX, FW:JF3Z
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Seagate FreeAgent Go, S/N:XXXXXXXX, FW:0148

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - Seagate FreeAgent Go
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:

Partition: Read error
Ask the user for vista mode
file_pread(5,1,buffer,976768065(60801/0/1)) read err: Invalid argument
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
file_pread(5,8,buffer,32(0/0/33)) read err: Invalid argument
file_pread(5,8,buffer,40(0/0/41)) read err: Invalid argument
file_pread(5,3,buffer,48(0/0/49)) read err: Invalid argument
file_pread(5,3,buffer,95(0/1/33)) read err: Invalid argument
file_pread(5,8,buffer,111(0/1/49)) read err: Invalid argument
file_pread(5,11,buffer,158(0/2/33)) read err: Invalid argument
file_pread(5,2,buffer,2080(0/33/2)) read err: Invalid argument
file_pread(5,2,buffer,51(0/0/52)) read err: Invalid argument
file_pread(5,2,buffer,98(0/1/36)) read err: Invalid argument
file_pread(5,2,buffer,119(0/1/57)) read err: Invalid argument
file_pread(5,2,buffer,169(0/2/44)) read err: Invalid argument

These last lines (file_pread... read err: Invalid argument) go on for every cylinder. I'm only up to 90/60800 and it's been running for 14.25 hours...

Is there any hope ?

Bruno G.

[Fiona]

If you receive read errors TestDisk might hang like windows, explorer etc...
First of all, you should diagnose the disk now, trying to get rid of read errors.
Might be necessary to create an image or clone your disk.
But it would only make sense if there are not too many read errors.
As usually it's not possible to copy data from sectors containing read errors.
Would it be possible to plug the affected disk internally as a test?
It's a try to exclude anything wrong about the enclosure.
Please let me know the model of your external disk.
Some external drives are hardware encrypted through a key chip.
Not even the user noticed it.
Also have a check using CrystalDiskInfo;
http://crystalmark.info/software/Crysta ... ex-e.html/

[goozak]

Thanks for the help Fiona

I've taken the drive out of the enclosure and use the Bytecc USB Drive Mate to connect the naked drive via USB. The drive is a 500 GB Seagate Momentus 5400.6.

This time, Disk Management recognize the drive, although it sees it as RAW. When Windows saw the drive, it offered to format it (which I didn't do, of course).

TestDisk still report read errors for every cylinder analyzed although the operation goes much faster (got to cylinder 475 in a couple of minutes). CrystalDiskInfo doesn't see the drive (it shows only my main hard disk). I've downloaded Seagate's diagnostic program, "SeaTools", which sees the drive, but tests that can be performed all fail.

Dang it ! There is stuff on this drive... Why is it so hard to get it ?

[Fiona]

Read errors prevent data from recovering.
First thing to do might be checking firmware update and diagnosing that disk using manufacturer diagnose tool.
Seagate in the past has had firmware problems.
Checking for a firmware update might be advisable too.
http://knowledge.seagate.com/articles/e ... Q/207931en
If there would be an update available, please let me know.

Fiona

[goozak]

Well, I'm giving up ! Thanks for the help, though

There is no firmware update for the drive.

I even tried to quick-format the drive and that also returned an error - so, there is definitely a read/write problem with the drive, not just random mis-written data.

I've now told my friend about Dropbox for his important files.