Where has my hard drive gone?

Hi all,

I've recently reinstalled windows 7, after this I seem to have lost my main storage drive. It's showing up in the Bios and in Disk Management but not in Windows Explorer. I'm unable to assign a drive letter in Disc Management and it appears to be saying that the hard drive is 4gig and has a partition. I'd really like to get the files from this drive rather than formatting. Please help.

See image of Disc Management...

http://s15.postimage.org/3wi5pf2qf/Untitled.jpg
39 answers Last reply
More about where hard drive gone
  1. It's showing that your HD is 4TB, not 4GB. If that's incorrect, you have a REAL problem.

    I'd try running Recuva, which is a good free data recovery program. You can try that first and if that doesn't turn up your data, you can try testdisk which is more powerful but more advanced. You can google both these programs for download links.
  2. Lol, yeah 4TB. Strangely it's only 2 TB hard drive. Thanks for the advice. I've tried a quick scan on Recuva but nothing. Maybe a deep scan will work.
  3. Yeah, that's a good place to go next. Eventually you'll need to reformat the drive (although if it's being shown as a 4TB drive that's seriously bad news for the health of the drive - I've never even heard of a drive being shown as a larger capacity in disk management.) You can try maybe plugging it into another computer using a SATA-USB cable like this one:

    http://www.newegg.com/Product/Product.aspx?Item=N82E16812232002

    Definitely worth a shot if you don't have a backup.
  4. Thanks for the follow up post. I've decided to buy a similar product to the one you suggested and go that root for now.
  5. ... the Bios and Device Manager both show the hard drive to be 2TB, it's only the disc management that's showing 4TB.
  6. Is it possible that you have two drives connected in JBOD mode in your BIOS? For example, you might have one working 2TB drive plus a second faulty drive which is reporting a bogus 2048 GiB capacity?

    Some faulty drives will report an all-ones LBA count, ie 0xFFFFFFFFFFFF. This equates to 2TiB rather than 2TB.
  7. OK - good luck!
  8. Hi fzabkar, thanks for your input. I don't fully understand your question but... the other drives I have installed are all working fine.
  9. Hi benji720, thanks for all your advice.
    I 'd tried the software you recommended and Recuva didn't seem to be able to find the drive at all. I then tried testdisc and I was able to see the folders on the hard drive but when trying to copy the files it came back with lots of error messages and corrupt file messages etc. It also didn't seem to copy anything. I then tried testdisc again the next day and realized it had copied my files but not to where I had expected. I've now in the process of copying everything onto my other hard drives and It seems a few of the files are corrupt but not many of the important ones. Result!
  10. I do have another question or 2 (maybe I should start another thread) How will I know if the hard drive is faulty? It's still under warranty and I'd like a replacement. Advice?
  11. @wopwopjunkie, when you connect two or more drives in JBOD mode, they are concatenated by the RAID controller and then appear to the OS as one large physical drive. So if you had two 2TB drives in JBOD mode, then the OS would see a single 4TB drive, ie 2 x 1.8TiB. If one of these drives fails, then the OS might see a different capacity. A typical failure mode of WD drives, for example, is that they report a bogus capacity of 2TiB. In such a case your damaged JBOD array would then report a total capacity of 1.8TiB + 2TiB.

    See http://en.wikipedia.org/wiki/Non-RAID_drive_architectures#JBOD
  12. @fzabkar, thanks for the explanation. BBOD = just a bunch of drives - Brilliant!
  13. What is the model and manufacturer of your drive?
  14. Western Digital Caviar Black 2TB SATA 6Gb/s 64MB Cache - OEM (WD2002FAEX) - 5 year warranty purchased April 2011
  15. http://support.wdc.com/product/download.asp?groupid=606&sid=3

    Try that (it should work with all WD drives.) If it the drive has an error, it will give you an error code and you can RMA it to WD. I RMA a bunch of drives every year to all manufacturers and WD is one of the easier to work with. Good luck!
  16. benji720 said:
    http://support.wdc.com/product/download.asp?groupid=606&sid=3

    Try that (it should work with all WD drives.) If it the drive has an error, it will give you an error code and you can RMA it to WD. I RMA a bunch of drives every year to all manufacturers and WD is one of the easier to work with. Good luck!



    Thanks again for your advice. I have run the Data Lifeguard Diagnostics tests, both quick and extended and the drive passed both! The drive is still not visible on Windows Explorer and appears the same in Disk Management i.e no drive letter and showing 2 partitions adding up to around 4 TB. I have also purchased another 2 TB hard drive and this is showing up correctly in both Windows Explorer and Disc Management. I've tried the problematic drive in different sockets on the motherboard and also in an external caddie all with the same results.

    If you have any more advice of what to do it would be greatly appreciated.
  17. I would use a disc editor (in readonly mode) to examine sector 0. That's where the partition information is stored (for MBR partitions). If you can post the contents of sector 0 (in hexadecimal mode), then one of us may be able to help you.

    Roadkil's Sector Editor:
    http://www.roadkil.net/program.php/P24/Sector%20Editor

    HxD - Freeware Hex Editor and Disk Editor:
    http://mh-nexus.de/en/hxd

    DMDE (DM Disk Editor and Data Recovery):
    http://softdm.com/download.html
  18. Thanks fzabkar,

    Thanks for the post and information, I'm sorry it has taken me so long to reply.

    I used HxD and I think I have the information you asked for:

    http://postimage.org/image/jqobrmw8r/
  19. There is a single entry in the partition table at offset 0x1BE - 0x1CD.

    It is telling us that the drive has a single NTFS partition (type 0x07), starting at sector 2048 (= 0x800), with a size of 2,000,396,746,752 bytes (= 0xe8e07800 x 512).

    http://www.google.com/search?q=0xe8e07800+x+512+in+decimal
  20. Thanks again, I really do appreciate your efforts.
    Now, I'm really not sure where to begin with a reply. All I heard was a whooshing sound as the words went over my head.
    What do I have to do so this drive shows up in windows explorer as a 2 TB drive and is usable?
  21. HxD is telling us that the subject drive has 3907029168 sectors. That works out to a total capacity of 1863.02 GB.

    3 907 029 168 x 512 bytes = 1 863.01669 gigabytes

    http://www.google.com/search?q=3907029168+x+512+bytes+in+gigabytes

    This figure corresponds to the size of the first partition of Disk 2, as reported by Disk Management.

    However, Disk Management is identifying this partition as a GPT Protective Partition whereas the partition type is clearly MBR, not GPT. If it were a GPT Protective Partition, then its partition ID would be 0xEE, not 0x07 as we have observed.

    List of partition identifiers for PCs:
    http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

    BTW, the total number of sectors reported by HxD is consistent with WD's datasheet:
    www.wdc.com/wdproducts/library/SpecSheet/ENG/2879-771434.pdf

    Can you now show us the contents of the boot sector (sector 2048)?
  22. That's showing a standard NTFS boot sector. The size of the volume is 0xE8E077FF which is 1 less than the size in the partition table. That is as it should be. The volume begins at sector 2048 and the sector size is 512 bytes. Once again this matches the partition table.

    In short, I don't see anything out of the ordinary for this drive. It looks just like a single, basic 1.8TiB NTFS MBR volume. ISTM that if you installed it in another machine, or installed it in a USB enclosure, you would have access to your data.

    You could confirm the disk layout by dropping back to a CMD Prompt and typing ...

    DISKPART
    LIST DISK

    There are other commands (detail disk, detail partition, detail volume, list partition, list volume) that may shed more light on the problem.

    Here are some references which I found useful:

    An Examination of the Windows 7 VBR (Volume Boot Record):
    http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

    An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
    http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

    An Examination of the Windows 7 MBR:
    http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

    An Examination of Windows 7 and 8 GPT 'Protective' MBR and EFI Partitions:
    http://thestarman.pcministry.com/asm/mbr/GPT.htm

    A Description of the Diskpart Command-Line Utility:
    http://support.microsoft.com/kb/300415
  23. fzabkar said:
    That's showing a standard NTFS boot sector. The size of the volume is 0xE8E077FF which is 1 less than the size in the partition table. That is as it should be. The volume begins at sector 2048 and the sector size is 512 bytes. Once again this matches the partition table.

    In short, I don't see anything out of the ordinary for this drive. It looks just like a single, basic 1.8TiB NTFS MBR volume. ISTM that if you installed it in another machine, or installed it in a USB enclosure, you would have access to your data.

    You could confirm the disk layout by dropping back to a CMD Prompt and typing ...

    DISKPART
    LIST DISK

    There are other commands (detail disk, detail partition, detail volume, list partition, list volume) that may shed more light on the problem.

    Here are some references which I found useful:

    An Examination of the Windows 7 VBR (Volume Boot Record):
    http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

    An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
    http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

    An Examination of the Windows 7 MBR:
    http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

    An Examination of Windows 7 and 8 GPT 'Protective' MBR and EFI Partitions:
    http://thestarman.pcministry.com/asm/mbr/GPT.htm

    A Description of the Diskpart Command-Line Utility:
    http://support.microsoft.com/kb/300415



    Thanks again fzabkar for all you efforts.

    I have been trying out your suggestions and I will post these later if necessary.


    I believe I have made an error of posting the wrong disc information when using HxD.


    Sector 0 should have been...

    http://postimage.org/image/e02qxoptx/


    and Sector 2048 should have been

    http://postimage.org/image/uogrd79jl/
  24. You can see the partition table at offsets 0x1BE - 0x1FD. There are two entries, partition #1 and partition #4. The second and third entries are empty.

    00 00 02 00 EE FF FF FF 01 00 00 00 FF FF FF FF
    ...
    00 00 02 00 DE FE FF FF 01 00 00 00 FF FF FF FF

    The first partition is a "protective MBR" (type 0xEE) and is used to hide GPT partitions from legacy OSes such as Windows XP. Sector 1 contains the actual GPT partition information. Could you upload that for us?

    The other partition is a Dell partition type (0xDE). It is also pointing to sector #1 for some reason. I have seen 0xDE partitions in Dell machines, but only as "recovery" partitions or MediaDirect partitions. I have no idea why it exists on your drive, or whether it has a special purpose. The MBR code looks like a standard Windows 7 MBR, not a Dell proprietary MBR.

    Here are references which may be useful:

    An Examination of the Windows 7 MBR:
    http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

    List of partition identifiers for PCs"
    http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

    EE --- Indication that this legacy MBR is followed by an EFI header
    DE --- Dell PowerEdge Server utilities (FAT fs)
  25. Sector 1 is indicating that the drive has a single 2TB partition. It begins at sector 34 (= 0x22) and ends at sector 0xE8E0888E.

    The capacity of the physical drive appears to be ...

    0xE8E088B0 x 512 = 2 000 398 934 016 bytes

    An Examination of Windows 7 & 8 GPT 'Protective' MBR & EFI Partitions:
    http://thestarman.pcministry.com/asm/mbr/GPT.htm

    FirstUsableLBA = 0x22
    LastUsableLBA = 0xE8E0888E
    AlternateLBA = 0xE8E088AF

    Therefore ISTM that the "DE" partition is bogus and is possibly a remnant of the drive's previous life in a Dell machine. I would first examine sector 34 and confirm that it is in fact an NTFS boot sector. I would also confirm that its data matches the data in sector 1.

    If all is OK, I would then go to sector 0 and zero out the 0xDE partition bytes. That is, replace the first 14 bytes at offset 0x1F0 with 00. Leave the 55 AA bytes at the end. These signature bytes are required to validate the MBR.

    In DMDE you would select Edit -> Edit Mode, make the changes, and then select Edit -> Write Changes. Then reboot to ensure that Windows re-examines the file system.

    Could we now see sector 34?
  26. Sector 34...

    http://s4.postimage.org/qvr1i8xnx/Hard_disc_4_34.jpg

    The thing that's puzzling me is I bought this drive new from Overclockers and I don't own a Dell PC
  27. Your result is puzzling. The first sector of the 2TB partition is blank, and sector 2048 is also blank. This would suggest that the first 1MB or so of the partition is empty?!

    You can see the layout of a GUID Partition Table in the following article:
    http://en.wikipedia.org/wiki/GUID_Partition_Table

    It confirms that LBA 34 is the start of the partition. Maybe we should also examine LBA 2?

    BTW, I still think that deleting the "DE" partition bytes in sector 0 would be advisable. Then perhaps Disk Management will see a 2TB drive instead of a 4TB. If things go wrong, you could easily undo the changes.

    Edit: Is it possible that your data recovery software created the "DE" partition? TestDisk's documentation suggests that it is aware that "DE" is a Dell partition type, so I can't imagine that TestDisk would be responsible.

    http://66.14.166.45/whitepapers/datarecovery/testdisk/TestDisk%20Installtion%20and%20Usage.pdf
  28. Quote:
    Maybe we should also examine LBA 2?



    Sector 2...

    http://s8.postimage.org/k58tk0v5d/Hard_Disc_4_2.jpg


    Quote:
    I would then go to sector 0 and zero out the 0xDE partition bytes. That is, replace the first 14 bytes at offset 0x1F0 with 00. Leave the 55 AA bytes at the end. These signature bytes are required to validate the MBR.


    Please see image below of Sector 0...

    http://s18.postimage.org/i0qaohmsl/Hard_Disc_4_0.jpg

    Am I replacing all of the letters and numbers inside the box with zeros?


    Quote:
    Edit: Is it possible that your data recovery software created the "DE" partition? TestDisk's documentation suggests that it is aware that "DE" is a Dell partition type, so I can't imagine that TestDisk would be responsible.


    I don't think so, although it was a few months ago. As far as I can remember the hard drive was showing to be 4 TB after I reinstalled widows 7.
  29. I'm sorry, I forgot that you were using HxD, not DMDE. In your case you would write zeros to the block of data that you have outlined. Then exit HxD and you will be prompted to save the changes. However, when you Open Disk you must uncheck the "Open as Readonly" box.

    As for sector 2, it shows two partitions.

    The "Microsoft reserved partition" begins at sector 34 (= 0x22) and ends at sector 0x40021.

    The "Basic data partition" begins at sector 264192 (= 0x40800) and ends at sector 3907028991 (= 0xE8E087FF).

    Therefore sector 264192 will probably contain an NTFS boot sector, not sector 34 as I previously thought.

    AFAICT, you have two issues. Deleting the DE partition from sector 0 should clear up the misreporting of the bogus 4TB capacity. The second issue appears to be that there is possibly some file system corruption in the "Basic data partition".

    If you would like to continue with our investigation, then the next step would be to examine sector 264192.
  30. Quote:
    I'm sorry, I forgot that you were using HxD, not DMDE


    No problem, I find HxD simpler to use. I want to unplug my other 2TB drive before I go ahead and do this to remove any doubt that I am playing with the correct drive. I will do this tomorrow evening.

    Quote:
    If you would like to continue with our investigation, then the next step would be to examine sector 264192.


    Hell yeah, we seem to be getting somewhere and I'd really like this hard drive back.

    Sector 264192...

    http://s4.postimage.org/tje3mpkop/Hard_Disc_4_264192.jpg


    Thanks again for taking the time to help me.
  31. That's looking better. It's actually an NTFS boot sector. It confirms that the volume begins at sector 0x40800 and is reporting a size of 0xE8DC7FFF.

    The end of the volume is ...

    0x40800 + 0xE8DC7FFF = 0xE8E087FF

    ... which matches the data in sector 2.

    So all this tends to confirm that the "DE" stuff is not needed.

    BTW, if you don't care about your data and just want your drive back, then you could just delete the stuff in the partition table and rebuild your drive using Disk Management. But that's no fun. :-)
  32. I can't quite believe it. My hard drive is now working. It's showing up in windows explorer, accessible and seems to be all fine.

    I have one final question...

    What do you recommend I do with this drive now i.e format / wipe are there anymore checks I need to carry out to make sure it is functioning correctly?
  33. Use a tool such as HD Sentinel to examine the raw SMART data. Look for reallocated, pending, or uncorrectable sectors.

    You could run a full surface scan with Data LifeGuard (but you have already done that). A complete zero-fill would force any "pending" sectors to be reallocated.

    Run CHKDSK in readonly mode to verify that the file system has no errors.

    Previously you stated that "it seems a few of the [recovered] files are corrupt", so I would re-examine those files. If they turn out to be OK, then this would beg the question, why was TestDisk not able to recover these files in an intact state?

    Assuming everything is OK, that would still leave us with a few puzzling questions.

    Where did the "DE" stuff come from?

    Why did Disc Management use the bogus data in sector 0 to determine the drive's physical capacity instead of asking the drive itself? The ATA standard provides an Identify Device command for this purpose. The drive responds with a 512-byte block of data which includes its model number, serial number, firmware version, capacity in sectors, and its feature set.

    BTW, thanks for your patience and excellent feedback. This was the first time I had examined a GPT drive, so it was a very useful learning experience for me. That said, I was careful not to put your data at risk -- we always had a foolproof undo strategy.
  34. My message from last night wasn't very clear so I wanted to post exactly what I've done (taking advice from fzabkar) to make my hard drive visible on windows explorer and (so far) work normally ...

    Using HxD disc editor (in hexidecimal mode) in sector 0 I zeroed out the 0xDE partition bytes. That is, replaced the first 14 bytes at offset 0x1F0 with 00 leaving the 55 AA bytes at the end.
  35. Quote:
    Use a tool such as HD Sentinel to examine the raw SMART data. Look for reallocated, pending, or uncorrectable sectors.


    I've run HD Sentinel (nice software) and I believe that everything is okay - see image

    http://s3.postimage.org/68xn250of/Hard_Disc_Sentinel.jpg

    Quote:
    Run CHKDSK in readonly mode to verify that the file system has no errors.


    I'm not sure how to do this.

    I am using Tune-Up Disc Doctor http://www.tune-up.com/products/tuneup-utilities/features/check-hard-disk-for-errors/to scan the drive (this will take a few hours) I'll post the results later.

    Quote:
    Previously you stated that "it seems a few of the [recovered] files are corrupt", so I would re-examine those files. If they turn out to be OK, then this would beg the question, why was TestDisk not able to recover these files in an intact state?


    All the files seem to be okay. They were mainly videos and they work fine.

    Quote:
    Where did the "DE" stuff come from?


    No idea. A few months have passed since this all started but as far as I can remember the drive just wasn't visible straight away after reinstalling windows 7.

    Quote:
    Why did Disc Management use the bogus data in sector 0 to determine the drive's physical capacity instead of asking the drive itself? The ATA standard provides an Identify Device command for this purpose. The drive responds with a 512-byte block of data which includes its model number, serial number, firmware version, capacity in sectors, and its feature set.


    Again, no idea. I'll be happy as long as the drive continues to work and just hope this issue doesn't happen again.

    Quote:
    BTW, thanks for your patience and excellent feedback. This was the first time I had examined a GPT drive, so it was a very useful learning experience for me. That said, I was careful not to put your data at risk -- we always had a foolproof undo strategy.


    It's me who should be thanking you. I am glad you have also got something out of helping me.
  36. HD Sentinel's report looks OK to me, too.

    AIUI CHKDSK defaults to readonly mode as long as you don't specify the /r or /f options.

    http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chkdsk.mspx

    "Chkdsk corrects disk errors only if you specify the /f command-line option."

    If you find errors, you will have to use your discretion whether you will allow Microsoft to repair the file system. CHKDSK tends to make a big mess if there are numerous bad sectors.

    As for the "DE" stuff, I notice that the two partition entries (EE and DE) look very similar. I'm wondering if the DE stuff could be Dell's proprietary version of a protective GPT MBR.
  37. Tune-Up Disc Doctor showed no faults with drive.

    I have now deleted everything on the drive.

    CHKDSK screenshot below:

    http://s4.postimage.org/m15vzyjzt/CHKDSK.jpg

    Seems okay.
Ask a new question

Read More

Hard Drives Management Storage