Help recovering a partition from RAW

Toggle sidebar Toggle sidebar
Z

Zack Emmerman

Reputable
Mar 28, 2015
5
0
4,510
Hey all,

One of my hard drives mysteriously converted itself from a working NTFS 4TB drive to an unformatted RAW drive a few days ago (http://gyazo.com/6163ac669fb48d1970edf28b4ef9ef1a).

HDTune shows absolutely no problems with the drive, and I have no reason to suspect the drive is physically failing. After having tried several partition recovery programs to little avail, I tried using DMDE. I have never used the program before. This is the output DMDE has given me (http://gyazo.com/7c286449fd14d57be0a761ee8d6364e9). Any ideas on where I should go from here?
 
Solution
F
@Zack, you appear to have been hit by the typical data loss time bomb that is created when people somehow manage to install a 4TB file system in a configuration which is affected by a 32-bit LBA limitation. This means that your 4TB drive would be detected with a capacity of only 1.8TB.

4 TB - 2 TiB = 1.8 TB

http://www.google.com/search?q=4+TB+-+2+TiB+in+TB

Everything works as expected until you write data beyond the 2TiB point on the drive. When this happens, the data wrap around to sector 0 and trash your file system (at least that's how it looks to me). You appear to have compounded the problem by allowing Windows to reinitialise your drive.

You should begin by updating your SATA driver or BIOS so that Windows can see the full...
Sort by date Sort by votes
Boogieman_WD

Boogieman_WD

Judicious
Jul 31, 2014
6,050
2
35,960
Hi Zack and welcome to the community!
I'm very sorry to hear you're having such issues with your drive. This might happen due to a lot of reasons such as, corrupted data which might corrupt the whole partition, virus/malware, software change etc.
I'd suggest that you try the drive with a different computer to see if the same thing happens again, or at least with a different SATA connection on yours. You could try accessing the drive via Linux Live CD/USB to see if the drive is recognized properly and if you're able to recover your data. Other than that you could try some of the data recovery options, listed in this thread: http://www.tomshardware.co.uk/forum/id-1644496/lost-data-recovery.html
You could also try a professional solution such as a data recovery company: WD Data Recovery Partners
Even though you don't suspect the HDD of having any physical issues, after you've recovered your data, I'd recommend that you download DLG (Data Lifeguard Diagnostic) from here: Data Lifeguard Diagnostic for Windows and run both tests (Quick and Extended) to see what's the situation with the HDD. You could also try scanning for viruses or malware with your anti-virus program as well.

Hope that helps. Please keep me posted.
Boogieman_WD
 
Upvote 1 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,328
724
36,390
@Zack, you appear to have been hit by the typical data loss time bomb that is created when people somehow manage to install a 4TB file system in a configuration which is affected by a 32-bit LBA limitation. This means that your 4TB drive would be detected with a capacity of only 1.8TB.

4 TB - 2 TiB = 1.8 TB

http://www.google.com/search?q=4+TB+-+2+TiB+in+TB

Everything works as expected until you write data beyond the 2TiB point on the drive. When this happens, the data wrap around to sector 0 and trash your file system (at least that's how it looks to me). You appear to have compounded the problem by allowing Windows to reinitialise your drive.

You should begin by updating your SATA driver or BIOS so that Windows can see the full capacity of your drive. I would then examine sector 264192. That's where the boot sector for your data patition is located. DMDE's screenshot appears to be indicating that this sector has been trashed. There is also no backup NTFS boot sector, but that could be because DMDE cannot see the full capacity of the drive. The backup sector would be located at the end of the drive.
 
Upvote 1 Downvote
Solution
Z

Zack Emmerman

Reputable
Mar 28, 2015
5
0
4,510
Thanks for all the help guys. fzabkar - that time bomb theory would fit everything that happened, I was just beginning to go over 2TB when the problems started. I have now managed to save more or less all the data using DMDE onto other hard drives (a few files were lost, nothing important). I've updated my Intel Rapid Storage driver in case that was the problem - my BIOS is up to the latest version. I am now running an extended SMART test and error scans on the disk to be certain there isn't some actual physical problem with it. After I transferred all the data of it, I performed a quick format of the RAW drive and got the 4TB NTFS drive back (Windows sees all 4TB as before, http://gyazo.com/d5b226598b0aa40df2f4b9501b0abbda) - but this is exactly what I did the first time I installed the drive, so what do I need to do to make sure I've not made the same 32-bit LBA mistake again? Here is what DMDE shows after the reformat: http://gyazo.com/a3a6805be59e8a58ef9386c5b1c8b2a3 (ignore the deleted Test partition, that was something I did back when I was trying to fix it).
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,328
724
36,390
I have no personal experience with this problem, but I have witnessed it in several storage forums. User feedback would suggest that the drive is partitioned and formatted in a 48-bit LBA capable environment and subsequently transferred to a 32-bit LBA limited one. This may happen if the drive is prepared with a tool such as GParted under Linux and then run under Windows. It could also happen if the SATA controller is switched between AHCI, RAID or IDE modes in BIOS, or it could happen if the motherboard has two SATA controllers (eg Intel, Marvell, JMicron) and the user swaps SATA ports. Each of these SATA modes and SATA controllers would use different drivers, some of which may not be 48-bit capable.

I would split the data area of your drive into two data partitions. The first should end at the 2TiB boundary, ie at LBA 0xFFFFFFFF (sector 4 294 967 295). The remaining 1.8TiB would be allocated to the second partition. I would then write several GBs of data to partition #2 and confirm that this does not corrupt the file system.

ISTM that a switch from 48-bit LBA mode to 32-bit LBA would be unlikely to occur while the OS is running, so if a drive boots into "48-bit mode", then your data should be safe for that session. To this end, ISTM that a "32-bit problem" would manifest itself as an inability to mount partition #2 at bootup. Partition #1 would still mount and be assigned a drive letter, but partition #2 would either not have a letter or would show up as "raw", or both.
 
Upvote 0 Downvote
Z

Zack Emmerman

Reputable
Mar 28, 2015
5
0
4,510


I think you're exactly right - I reinstalled windows a few weeks before all this happened and must have installed an older version of my SATA driver at the time. I've written well over 2TB to the drive now to make sure the problem is resolved, and nothing happened, so I think the updated driver is working just fine now, thanks for all the help!
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom