External HDD Recovery Effort - Need Help Understanding TestDisk Results...

Toggle sidebar Toggle sidebar
T

trent_brown97

Honorable
Sep 12, 2013
3
0
10,510
Hello all,
I am trying to recover my LaCie External 500GB HDD which seems to be corrupted after a misfortunate event. I was copying a large file to it and the computer crashed and I was forced to manually restart the computer. Now on plugging the drive in to my Windows PC I get the error "Windows needs to format drive K: before you can use it" or something like that, and when I plug it into my MacBook I get the error message "The disk you inserted was not readable by this computer". I have been running test disk to attempt to recover the drive and the data on it, and I need help understanding what all the results I've come up with mean, and if it's actually possible to fix it? I have tried various different routes and have taken screenshots of everything, which I will post.
Any help would be massively appreciated.
Trent.

(This drive was not backed up because it was the biggest drive I owned)

Following are the steps I took on TestDisk and what it showed...
Obviously I selected my Hard Drive and pressed Enter, then I selected Intel/PC because thats what it said the partition type was.
Then I get to the first window:

https://www.dropbox.com/s/fyx8uiw6bdgchh0/Menu.tiff

So I pressed "Advanced" and got this next window:

https://www.dropbox.com/s/3rs89ooeemdiic1/Advanced.tiff

I When I pressed "List" all I got was a screen that says this: "Can't open filesystem. Filesystem seems damaged."

Not very good... So I pressed "Quit" and returned to the previous menu where instead I pressed "Boot".
This is what I got:

https://www.dropbox.com/s/xhedults29qf0v2/Boot.tiff

This is where I got confused. I really have no idea what all those "warnings" mean. However as my next move I pressed "Dump" because I knew what that meant. When I pressed that I got something a little interesting...
It showed me my boot sector and backup boot sector dump, but as I scrolled to the bottom I noticed something strange.
It looked like this:

https://www.dropbox.com/s/gf9ubfdj4t0149y/Boot%20Sector%20Dump.tiff

Now you'll notice if you string all that together it says this: "A disk read error occurred... NTLDR is compressed... Press Ctrl+Alt+Del to restart..." Now I thought that was quite strange. I looked up what the "NTLDR" was and apparently it's a problem to do with an operating system, correct? There is no operating system on my external hard drive is there? Or is that the problem?

I really need help to understand this all, and whether its possible to fix my poor LaCie hard drive. Sorry If I sound like I'm waffling on a bit...
Thanks, Trent.
 
Solution
S
If the drive was not damaged then an MFT repair would be worth a try. But in this case it violates one of the basic tenets of data recovery, run no program that writes to a failing drive.

But you could try the MFT repair and other recovery operations on an image of the drive. Which brings us back to ddrescue. Using ddrescue is not a point and click kind of thing and not easily explained in a forum post. For more info google ddrescue guide.

Also it would be good to experiment with ddrescue on a spare drive first so you understand how it works.
Sort by date Sort by votes
S

S Haran

Distinguished
Jul 12, 2013
219
0
18,910
If you were to try Testdisk on a known good drive. Selecting "List" would show you a listing of your files.
But in your case Testdisk says it can not open the filesystem so I expect the drive is damaged, possibly bad sectors.

The proper way to proceed would be to attempt to take a clone image of the drive and then try to recover from the image.
The ddrescue command from a Linux boot CD is good for taking images of damaged drives.

Note if this is high value data it's best to send it to a data recovery pro as any actions you take may make things worse.
 
Upvote 0 Downvote
T

trent_brown97

Honorable
Sep 12, 2013
3
0
10,510


I didn't realise it would be such a problem because I was only copying a file and the whole thing went kaput.

I took the drive to the Local PC shop (forgot to mention in first post) to see if they could get the data off, and they said that the drive was too damaged to recover anything, which surprised me. They said the only way was to take it to a proper data recovery company which would charge me several thousand dollars judging by the state of my drive. So I figured what have I got to lose? Worst case scenario I don't get any data off. So now I've been trying to get the data by myself.

Originally I thought it would just be a corrupted file, but now it would seem the entire filesystem of the disk is corrupt in some way.

I've tried PhotoRec as well which only managed to recover a small portion of the drive... including several thousand photos... however nothing that I REALLY wanted back...

The data on the drive is not "high value", just all my files I'd rather keep. If all hope is lost I wouldn't spend thousands of dollars getting it back... it's just not worth it.

So this "ddrescue" command... How do you do that? I don't have a Linux Boot CD so where would I get one of those? Or make one? I tried making a disk image with TestDisk and it did it in like 5 seconds, so it obviously didn't work. So can you run me through how to make this clone image?
 
Upvote 0 Downvote
kenrivers

kenrivers

Illustrious
Dec 29, 2010
6,684
6
37,015
I'm not sure whether or not this will help but it might be worth a read: http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

"Rebuilding An NTFS Boot Sector On An NTFS Partition

If both NTFS boot sectors are corrupted and you need to rebuild the NTFS boot sector, TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr). It reads the MFT record size, it computes the cluster size, and it reads the size of the Index Allocation Entry in the root directory index. Using all these values, TestDisk can provide a new boot sector. Finally it lets the user list the files before writing."

Repair An NTFS MFT

"The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT. "
 
Upvote 0 Downvote
S

S Haran

Distinguished
Jul 12, 2013
219
0
18,910
If the drive was not damaged then an MFT repair would be worth a try. But in this case it violates one of the basic tenets of data recovery, run no program that writes to a failing drive.

But you could try the MFT repair and other recovery operations on an image of the drive. Which brings us back to ddrescue. Using ddrescue is not a point and click kind of thing and not easily explained in a forum post. For more info google ddrescue guide.

Also it would be good to experiment with ddrescue on a spare drive first so you understand how it works.
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom