Sign in with
Sign up | Sign in
Your question

Where has my hard drive gone?

Last response: in Storage
Share
October 15, 2012 5:45:35 PM

Hi all,

I've recently reinstalled windows 7, after this I seem to have lost my main storage drive. It's showing up in the Bios and in Disk Management but not in Windows Explorer. I'm unable to assign a drive letter in Disc Management and it appears to be saying that the hard drive is 4gig and has a partition. I'd really like to get the files from this drive rather than formatting. Please help.

See image of Disc Management...

More about : hard drive

October 15, 2012 5:53:57 PM

It's showing that your HD is 4TB, not 4GB. If that's incorrect, you have a REAL problem.

I'd try running Recuva, which is a good free data recovery program. You can try that first and if that doesn't turn up your data, you can try testdisk which is more powerful but more advanced. You can google both these programs for download links.
October 15, 2012 5:57:23 PM

Lol, yeah 4TB. Strangely it's only 2 TB hard drive. Thanks for the advice. I've tried a quick scan on Recuva but nothing. Maybe a deep scan will work.
Related resources
October 15, 2012 6:59:51 PM

Yeah, that's a good place to go next. Eventually you'll need to reformat the drive (although if it's being shown as a 4TB drive that's seriously bad news for the health of the drive - I've never even heard of a drive being shown as a larger capacity in disk management.) You can try maybe plugging it into another computer using a SATA-USB cable like this one:

http://www.newegg.com/Product/Product.aspx?Item=N82E168...

Definitely worth a shot if you don't have a backup.
October 15, 2012 7:37:02 PM

Thanks for the follow up post. I've decided to buy a similar product to the one you suggested and go that root for now.
October 15, 2012 7:39:45 PM

... the Bios and Device Manager both show the hard drive to be 2TB, it's only the disc management that's showing 4TB.
a c 289 G Storage
October 15, 2012 8:15:56 PM

Is it possible that you have two drives connected in JBOD mode in your BIOS? For example, you might have one working 2TB drive plus a second faulty drive which is reporting a bogus 2048 GiB capacity?

Some faulty drives will report an all-ones LBA count, ie 0xFFFFFFFFFFFF. This equates to 2TiB rather than 2TB.
October 16, 2012 12:00:48 AM

OK - good luck!
October 17, 2012 8:22:45 PM

Hi fzabkar, thanks for your input. I don't fully understand your question but... the other drives I have installed are all working fine.
October 17, 2012 8:34:24 PM

Hi benji720, thanks for all your advice.
I 'd tried the software you recommended and Recuva didn't seem to be able to find the drive at all. I then tried testdisc and I was able to see the folders on the hard drive but when trying to copy the files it came back with lots of error messages and corrupt file messages etc. It also didn't seem to copy anything. I then tried testdisc again the next day and realized it had copied my files but not to where I had expected. I've now in the process of copying everything onto my other hard drives and It seems a few of the files are corrupt but not many of the important ones. Result!
October 17, 2012 8:37:17 PM

I do have another question or 2 (maybe I should start another thread) How will I know if the hard drive is faulty? It's still under warranty and I'd like a replacement. Advice?
a c 289 G Storage
October 17, 2012 8:43:58 PM

@wopwopjunkie, when you connect two or more drives in JBOD mode, they are concatenated by the RAID controller and then appear to the OS as one large physical drive. So if you had two 2TB drives in JBOD mode, then the OS would see a single 4TB drive, ie 2 x 1.8TiB. If one of these drives fails, then the OS might see a different capacity. A typical failure mode of WD drives, for example, is that they report a bogus capacity of 2TiB. In such a case your damaged JBOD array would then report a total capacity of 1.8TiB + 2TiB.

See http://en.wikipedia.org/wiki/Non-RAID_drive_architectur...
October 17, 2012 8:46:59 PM

@fzabkar, thanks for the explanation. BBOD = just a bunch of drives - Brilliant!
October 19, 2012 10:08:54 PM

What is the model and manufacturer of your drive?
October 20, 2012 9:15:45 PM

Western Digital Caviar Black 2TB SATA 6Gb/s 64MB Cache - OEM (WD2002FAEX) - 5 year warranty purchased April 2011
October 22, 2012 3:35:35 AM

http://support.wdc.com/product/download.asp?groupid=606...

Try that (it should work with all WD drives.) If it the drive has an error, it will give you an error code and you can RMA it to WD. I RMA a bunch of drives every year to all manufacturers and WD is one of the easier to work with. Good luck!
October 28, 2012 7:30:52 PM

benji720 said:
http://support.wdc.com/product/download.asp?groupid=606...

Try that (it should work with all WD drives.) If it the drive has an error, it will give you an error code and you can RMA it to WD. I RMA a bunch of drives every year to all manufacturers and WD is one of the easier to work with. Good luck!



Thanks again for your advice. I have run the Data Lifeguard Diagnostics tests, both quick and extended and the drive passed both! The drive is still not visible on Windows Explorer and appears the same in Disk Management i.e no drive letter and showing 2 partitions adding up to around 4 TB. I have also purchased another 2 TB hard drive and this is showing up correctly in both Windows Explorer and Disc Management. I've tried the problematic drive in different sockets on the motherboard and also in an external caddie all with the same results.

If you have any more advice of what to do it would be greatly appreciated.
a c 289 G Storage
October 28, 2012 8:24:56 PM

I would use a disc editor (in readonly mode) to examine sector 0. That's where the partition information is stored (for MBR partitions). If you can post the contents of sector 0 (in hexadecimal mode), then one of us may be able to help you.

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector%20Editor

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html
a c 289 G Storage
January 26, 2013 8:00:46 PM

There is a single entry in the partition table at offset 0x1BE - 0x1CD.

It is telling us that the drive has a single NTFS partition (type 0x07), starting at sector 2048 (= 0x800), with a size of 2,000,396,746,752 bytes (= 0xe8e07800 x 512).

http://www.google.com/search?q=0xe8e07800+x+512+in+deci...
January 26, 2013 8:09:05 PM

Thanks again, I really do appreciate your efforts.
Now, I'm really not sure where to begin with a reply. All I heard was a whooshing sound as the words went over my head.
What do I have to do so this drive shows up in windows explorer as a 2 TB drive and is usable?
a c 289 G Storage
January 26, 2013 9:35:35 PM

HxD is telling us that the subject drive has 3907029168 sectors. That works out to a total capacity of 1863.02 GB.

3 907 029 168 x 512 bytes = 1 863.01669 gigabytes

http://www.google.com/search?q=3907029168+x+512+bytes+i...

This figure corresponds to the size of the first partition of Disk 2, as reported by Disk Management.

However, Disk Management is identifying this partition as a GPT Protective Partition whereas the partition type is clearly MBR, not GPT. If it were a GPT Protective Partition, then its partition ID would be 0xEE, not 0x07 as we have observed.

List of partition identifiers for PCs:
http://www.win.tue.nl/~aeb/partitions/partition_types-1...

BTW, the total number of sectors reported by HxD is consistent with WD's datasheet:
www.wdc.com/wdproducts/library/SpecSheet/ENG/2879-77143...

Can you now show us the contents of the boot sector (sector 2048)?
a c 289 G Storage
January 27, 2013 4:46:59 PM

That's showing a standard NTFS boot sector. The size of the volume is 0xE8E077FF which is 1 less than the size in the partition table. That is as it should be. The volume begins at sector 2048 and the sector size is 512 bytes. Once again this matches the partition table.

In short, I don't see anything out of the ordinary for this drive. It looks just like a single, basic 1.8TiB NTFS MBR volume. ISTM that if you installed it in another machine, or installed it in a USB enclosure, you would have access to your data.

You could confirm the disk layout by dropping back to a CMD Prompt and typing ...

DISKPART
LIST DISK

There are other commands (detail disk, detail partition, detail volume, list partition, list volume) that may shed more light on the problem.

Here are some references which I found useful:

An Examination of the Windows 7 VBR (Volume Boot Record):
http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

An Examination of the Windows 7 MBR:
http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

An Examination of Windows 7 and 8 GPT 'Protective' MBR and EFI Partitions:
http://thestarman.pcministry.com/asm/mbr/GPT.htm

A Description of the Diskpart Command-Line Utility:
http://support.microsoft.com/kb/300415
February 3, 2013 7:59:37 PM

fzabkar said:
That's showing a standard NTFS boot sector. The size of the volume is 0xE8E077FF which is 1 less than the size in the partition table. That is as it should be. The volume begins at sector 2048 and the sector size is 512 bytes. Once again this matches the partition table.

In short, I don't see anything out of the ordinary for this drive. It looks just like a single, basic 1.8TiB NTFS MBR volume. ISTM that if you installed it in another machine, or installed it in a USB enclosure, you would have access to your data.

You could confirm the disk layout by dropping back to a CMD Prompt and typing ...

DISKPART
LIST DISK

There are other commands (detail disk, detail partition, detail volume, list partition, list volume) that may shed more light on the problem.

Here are some references which I found useful:

An Examination of the Windows 7 VBR (Volume Boot Record):
http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

An Examination of the Windows 7 MBR:
http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

An Examination of Windows 7 and 8 GPT 'Protective' MBR and EFI Partitions:
http://thestarman.pcministry.com/asm/mbr/GPT.htm

A Description of the Diskpart Command-Line Utility:
http://support.microsoft.com/kb/300415



Thanks again fzabkar for all you efforts.

I have been trying out your suggestions and I will post these later if necessary.


I believe I have made an error of posting the wrong disc information when using HxD.


Sector 0 should have been...

http://postimage.org/image/e02qxoptx/



and Sector 2048 should have been

http://postimage.org/image/uogrd79jl/
a c 289 G Storage
February 3, 2013 9:56:44 PM

You can see the partition table at offsets 0x1BE - 0x1FD. There are two entries, partition #1 and partition #4. The second and third entries are empty.

00 00 02 00 EE FF FF FF 01 00 00 00 FF FF FF FF
...
00 00 02 00 DE FE FF FF 01 00 00 00 FF FF FF FF

The first partition is a "protective MBR" (type 0xEE) and is used to hide GPT partitions from legacy OSes such as Windows XP. Sector 1 contains the actual GPT partition information. Could you upload that for us?

The other partition is a Dell partition type (0xDE). It is also pointing to sector #1 for some reason. I have seen 0xDE partitions in Dell machines, but only as "recovery" partitions or MediaDirect partitions. I have no idea why it exists on your drive, or whether it has a special purpose. The MBR code looks like a standard Windows 7 MBR, not a Dell proprietary MBR.

Here are references which may be useful:

An Examination of the Windows 7 MBR:
http://thestarman.pcministry.com/asm/mbr/W7MBR.htm

List of partition identifiers for PCs"
http://www.win.tue.nl/~aeb/partitions/partition_types-1...

EE --- Indication that this legacy MBR is followed by an EFI header
DE --- Dell PowerEdge Server utilities (FAT fs)
a c 289 G Storage
February 4, 2013 6:39:34 PM

Sector 1 is indicating that the drive has a single 2TB partition. It begins at sector 34 (= 0x22) and ends at sector 0xE8E0888E.

The capacity of the physical drive appears to be ...

0xE8E088B0 x 512 = 2 000 398 934 016 bytes

An Examination of Windows 7 & 8 GPT 'Protective' MBR & EFI Partitions:
http://thestarman.pcministry.com/asm/mbr/GPT.htm

FirstUsableLBA = 0x22
LastUsableLBA = 0xE8E0888E
AlternateLBA = 0xE8E088AF

Therefore ISTM that the "DE" partition is bogus and is possibly a remnant of the drive's previous life in a Dell machine. I would first examine sector 34 and confirm that it is in fact an NTFS boot sector. I would also confirm that its data matches the data in sector 1.

If all is OK, I would then go to sector 0 and zero out the 0xDE partition bytes. That is, replace the first 14 bytes at offset 0x1F0 with 00. Leave the 55 AA bytes at the end. These signature bytes are required to validate the MBR.

In DMDE you would select Edit -> Edit Mode, make the changes, and then select Edit -> Write Changes. Then reboot to ensure that Windows re-examines the file system.

Could we now see sector 34?
a c 289 G Storage
February 4, 2013 7:54:13 PM

Your result is puzzling. The first sector of the 2TB partition is blank, and sector 2048 is also blank. This would suggest that the first 1MB or so of the partition is empty?!

You can see the layout of a GUID Partition Table in the following article:
http://en.wikipedia.org/wiki/GUID_Partition_Table

It confirms that LBA 34 is the start of the partition. Maybe we should also examine LBA 2?

BTW, I still think that deleting the "DE" partition bytes in sector 0 would be advisable. Then perhaps Disk Management will see a 2TB drive instead of a 4TB. If things go wrong, you could easily undo the changes.

Edit: Is it possible that your data recovery software created the "DE" partition? TestDisk's documentation suggests that it is aware that "DE" is a Dell partition type, so I can't imagine that TestDisk would be responsible.

http://66.14.166.45/whitepapers/datarecovery/testdisk/T...
February 5, 2013 6:45:22 PM

Quote:
Maybe we should also examine LBA 2?



Sector 2...





Quote:
I would then go to sector 0 and zero out the 0xDE partition bytes. That is, replace the first 14 bytes at offset 0x1F0 with 00. Leave the 55 AA bytes at the end. These signature bytes are required to validate the MBR.


Please see image below of Sector 0...



Am I replacing all of the letters and numbers inside the box with zeros?


Quote:
Edit: Is it possible that your data recovery software created the "DE" partition? TestDisk's documentation suggests that it is aware that "DE" is a Dell partition type, so I can't imagine that TestDisk would be responsible.


I don't think so, although it was a few months ago. As far as I can remember the hard drive was showing to be 4 TB after I reinstalled widows 7.
a c 289 G Storage
February 5, 2013 7:41:06 PM

I'm sorry, I forgot that you were using HxD, not DMDE. In your case you would write zeros to the block of data that you have outlined. Then exit HxD and you will be prompted to save the changes. However, when you Open Disk you must uncheck the "Open as Readonly" box.

As for sector 2, it shows two partitions.

The "Microsoft reserved partition" begins at sector 34 (= 0x22) and ends at sector 0x40021.

The "Basic data partition" begins at sector 264192 (= 0x40800) and ends at sector 3907028991 (= 0xE8E087FF).

Therefore sector 264192 will probably contain an NTFS boot sector, not sector 34 as I previously thought.

AFAICT, you have two issues. Deleting the DE partition from sector 0 should clear up the misreporting of the bogus 4TB capacity. The second issue appears to be that there is possibly some file system corruption in the "Basic data partition".

If you would like to continue with our investigation, then the next step would be to examine sector 264192.
February 5, 2013 7:55:41 PM

Quote:
I'm sorry, I forgot that you were using HxD, not DMDE


No problem, I find HxD simpler to use. I want to unplug my other 2TB drive before I go ahead and do this to remove any doubt that I am playing with the correct drive. I will do this tomorrow evening.

Quote:
If you would like to continue with our investigation, then the next step would be to examine sector 264192.


Hell yeah, we seem to be getting somewhere and I'd really like this hard drive back.

Sector 264192...




Thanks again for taking the time to help me.



a c 289 G Storage
February 5, 2013 8:26:17 PM

That's looking better. It's actually an NTFS boot sector. It confirms that the volume begins at sector 0x40800 and is reporting a size of 0xE8DC7FFF.

The end of the volume is ...

0x40800 + 0xE8DC7FFF = 0xE8E087FF

... which matches the data in sector 2.

So all this tends to confirm that the "DE" stuff is not needed.

BTW, if you don't care about your data and just want your drive back, then you could just delete the stuff in the partition table and rebuild your drive using Disk Management. But that's no fun. :-)
February 6, 2013 6:07:29 PM

I can't quite believe it. My hard drive is now working. It's showing up in windows explorer, accessible and seems to be all fine.

I have one final question...

What do you recommend I do with this drive now i.e format / wipe are there anymore checks I need to carry out to make sure it is functioning correctly?
a c 289 G Storage
February 6, 2013 6:57:48 PM

Use a tool such as HD Sentinel to examine the raw SMART data. Look for reallocated, pending, or uncorrectable sectors.

You could run a full surface scan with Data LifeGuard (but you have already done that). A complete zero-fill would force any "pending" sectors to be reallocated.

Run CHKDSK in readonly mode to verify that the file system has no errors.

Previously you stated that "it seems a few of the [recovered] files are corrupt", so I would re-examine those files. If they turn out to be OK, then this would beg the question, why was TestDisk not able to recover these files in an intact state?

Assuming everything is OK, that would still leave us with a few puzzling questions.

Where did the "DE" stuff come from?

Why did Disc Management use the bogus data in sector 0 to determine the drive's physical capacity instead of asking the drive itself? The ATA standard provides an Identify Device command for this purpose. The drive responds with a 512-byte block of data which includes its model number, serial number, firmware version, capacity in sectors, and its feature set.

BTW, thanks for your patience and excellent feedback. This was the first time I had examined a GPT drive, so it was a very useful learning experience for me. That said, I was careful not to put your data at risk -- we always had a foolproof undo strategy.
February 7, 2013 4:57:48 PM

My message from last night wasn't very clear so I wanted to post exactly what I've done (taking advice from fzabkar) to make my hard drive visible on windows explorer and (so far) work normally ...

Using HxD disc editor (in hexidecimal mode) in sector 0 I zeroed out the 0xDE partition bytes. That is, replaced the first 14 bytes at offset 0x1F0 with 00 leaving the 55 AA bytes at the end.
February 7, 2013 6:21:39 PM

Quote:
Use a tool such as HD Sentinel to examine the raw SMART data. Look for reallocated, pending, or uncorrectable sectors.


I've run HD Sentinel (nice software) and I believe that everything is okay - see image



Quote:
Run CHKDSK in readonly mode to verify that the file system has no errors.


I'm not sure how to do this.

I am using Tune-Up Disc Doctor to scan the drive (this will take a few hours) I'll post the results later.

Quote:
Previously you stated that "it seems a few of the [recovered] files are corrupt", so I would re-examine those files. If they turn out to be OK, then this would beg the question, why was TestDisk not able to recover these files in an intact state?


All the files seem to be okay. They were mainly videos and they work fine.

Quote:
Where did the "DE" stuff come from?


No idea. A few months have passed since this all started but as far as I can remember the drive just wasn't visible straight away after reinstalling windows 7.

Quote:
Why did Disc Management use the bogus data in sector 0 to determine the drive's physical capacity instead of asking the drive itself? The ATA standard provides an Identify Device command for this purpose. The drive responds with a 512-byte block of data which includes its model number, serial number, firmware version, capacity in sectors, and its feature set.


Again, no idea. I'll be happy as long as the drive continues to work and just hope this issue doesn't happen again.

Quote:
BTW, thanks for your patience and excellent feedback. This was the first time I had examined a GPT drive, so it was a very useful learning experience for me. That said, I was careful not to put your data at risk -- we always had a foolproof undo strategy.


It's me who should be thanking you. I am glad you have also got something out of helping me.




a c 289 G Storage
February 7, 2013 7:18:38 PM

HD Sentinel's report looks OK to me, too.

AIUI CHKDSK defaults to readonly mode as long as you don't specify the /r or /f options.

http://www.microsoft.com/resources/documentation/window...

"Chkdsk corrects disk errors only if you specify the /f command-line option."

If you find errors, you will have to use your discretion whether you will allow Microsoft to repair the file system. CHKDSK tends to make a big mess if there are numerous bad sectors.

As for the "DE" stuff, I notice that the two partition entries (EE and DE) look very similar. I'm wondering if the DE stuff could be Dell's proprietary version of a protective GPT MBR.
February 10, 2013 1:29:15 PM

Tune-Up Disc Doctor showed no faults with drive.

I have now deleted everything on the drive.

CHKDSK screenshot below:



Seems okay.
!