Hard Drive Recovery (Partition size shown, but not there)

[YoshiMagick]

Ok, I have a 3TB WD MyBook External Hard Drive that stopped working. I had a bunch of stuff on there, nearing 90% of the drive filled.

I do have a back up of this drive, but that was a while ago. Its not a total loss, but a significant loss. I had the drive divided into two partitions, a 2TB part, and a 746.45 GB partition.

I have used the following tools (demos) already:
EaseUs data wizard and the other tools by EaseUs
SpinRite
Pandora Recovery
R-Studio
RecoveryFix
Find and Mount
FileRestore Pro
Recuva
Partition Guru
Minitool Power Recovery
File Scavenger
Data Rescue 3
Convar (some russian program)

Partition magic has not been tried because it doesn't work for my OS

Now, all these can find the first partition, but it sees it as blank. It can't find the second partition, but it can tell me its size... (This is before I scan, it says by default that my 2.7TB drive is a 746.45GB drive, so its not just telling me the empty space after my 2TB partition)

Oh and it sees a small 100MB partition that is on all windows drives.

Is there anything more that I can do? The thing that gives me a bit of hope is that it recognizes the size of my former second partition.

Oh this drive used to be NTFS.

I have recovered a few GZ files, all about 2GB large. I can't open them with gzip or 7z.

I have opened up my WD MyBook to extract the WD Green Caviar to use as an Internal drive (This made me a bit mad, since I didn't know that WD uses the Green Caviar's for their external drives)

 

[fzabkar]

I'm a little confused. Did you run all your programs and tests while the drive was in the external enclosure, or did you do all this while it was connected internally to your computer's motherboard?

Which OS are you using?

 

[YoshiMagick]

Connected internally.

The drive only functioned intermittently when in the enclosure. Like it read a bit, then disconnected the drive. So I took it out.

I use Windows 7 64 bit Pro.

 

[fzabkar]

IIUC, you originally repartitioned and reformatted your drive whilst it was in the enclosure using Windows 7. You then had problems with it and removed it. After installing it inside your PC, you are now seeing all the partition information but you don't have access to your data.

If this is correct, then this is exactly what you would expect even if the drive had no problems. This is because the bridge firmware in WD's 3TB My Books is configured with 4KB LBAs. When you remove the drive and attach it directly to your computer motherboard's SATA port, you are exposing the drive's native 512-byte LBAs. This means that you will still be able to see the partition table in sector 0, but the actual partition data will be in the wrong place.

In short, you need to reinstall the drive in the enclosure. BTW, your model appears to be an Elements. If it had been an Essentials, then the data would have been encrypted and you would have seen gibberish.

If you can show us the contents of sector 0 using a disc editor, then we will be able to confirm what is happening.

Here are 3 freeware tools:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector%20Editor

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

 

[YoshiMagick]

This is what the tool shows me for my drive:

http://imgur.com/uZ1cN

(When it was in the enclosure it stopped working and would just connect and disconnect. The partitions were already gone)

(It wouldn't let me copy and paste the info)

 

[fzabkar]

The repeating pattern of 16 bytes (16 DE A8 ... A4) is indicative of 128-bit AES hardware encryption.

I don't understand why DMDE only finds sectors 1 - 2047. Moreover, the partition information lives in LBA 0, not LBA 1. Could we see LBA 0?

 

[YoshiMagick]

How do I get to LBA 0?

 

[YoshiMagick]

Nvm, I just went and screen shotted quickly before it disappeared

http://i.imgur.com/qdX7W.png

 

[fzabkar]

@YoshiMagick, in the light of your sector dumps, it would appear that your drive is actually an Essentials, not an Elements as your initial information suggested. Is it?

Your screenshot of LBA 0 is non-encrypted. This is suggesting that you took the drive out of its enclosure and installed it inside your PC. Windows would have seen encrypted gibberish and advised you that the drive was uninitialised. You would then have been invited to initialise your drive. Unfortunately you appear to have accepted this invitation and subsequently trashed the information in sector 0.

The partition table in sector 0 is showing two partitions.

The first partition begins at sector 2048 and has a size of 0x03200 sectors, ie 100MB:
http://www.google.com.au/search?q=0x032000+x+512+bytes+in+megabytes

The second partition follows the first and has a size of 2047.9 GB:
http://www.google.com.au/search?q=0xFFFCD800+x+512+bytes+in+gigabytes

Therefore you have reduced the usable space on your 3TB drive to 2TiB.

If you want to recover your data, you will need to reinstall the drive inside its enclosure and rebuild sector 0. I can help you can do this by hand. Whatever you do, don't let Windows initialise the drive.

BTW, I'm assuming that you have not done any more damage to the drive. For example, I'm hoping that you did not format it, or allow some tool to "repair" the boot sector(s). Did you?

Could we see sector 2048?

 

[YoshiMagick]

http://i.imgur.com/ojdcb.png

I have already formatted the first partition (2TB), not the second. It was already showing up as blank both in the enclosure and out of it?


Also, what is drive initialising?
Also, how can you tell by looking at the numbers?

And yes it is an essentials. I will assemble my Hard drive back into its enclosure, but is there any other sectors you want looking at first? It might not read it correctly again in the enclosure..

Also, how do I use this program? I go to this sector by scrolling down to it since I couldn't find the move to sector function.

This is about the 8th day in my problem.

9 Days ago, the drive was working fine. 8 days ago, it stopped working. In those 8 days I have used various programs. And bad sectors were found.

 

[fzabkar]

Your latest sector dump shows that the 100MB Windows 7 system partition was formatted. However, the boot sector (2048) is all zeros, which would suggest that it was subsequently erased. I don't understand why or how this happened. Suffice to say that the data that originally occupied this partition has probably been overwritten.

You now say that the 2TB partition was also formatted, which would then beg the question, was this a full format or a quick format? A full format would have filled the entire data area with zeros. The boot sector for this second partition would be sector 0x032800, ie sector 206848 (decimal). If you examine it with DMDE you should see an NTFS signature.

To answer your questions, the "initialisation" process erases the existing partition table. The "allocation" process then creates new partitions. As for how to make sense of the numbers, see the following thread:

http://forum.hddguru.com/book-recovery-t24419.html

The OP in that thread initialised sector 0 but did no other damage. In his/her case the data are completely recoverable.

 

[YoshiMagick]

quick format, i know that a full format would make the data unrecoverable. My drive may or may not have been hit by unknown malware, because my OS acted funny at the same time too. (I just re-imaged my OS to fix that)

http://i.imgur.com/18x56.png

 

[fzabkar]

Sector 206848 is the NTFS boot sector for your 2TB partition. This indicates that it has indeed been formatted.

Sector 206847 is the backup boot sector for the 100MB partition. That's the data that was missing from sector 2048.

You didn't say whether DMDE had any trouble reading these sectors, so I assume that none of these sectors are physically bad. If they were unreadable, then perhaps that might explain the zeros.

Anyway, good luck with the enclosure. BTW, if the drive has bad sectors, then the best approach would be to clone it, sector by sector, and then work on the clone.

 

[YoshiMagick]

Ok. I have put it back in it enclosure. What do I do now?

DMDE hanged for like 10 minutes before it started to work on this drive.

R-Studio and other programs all just hanged and didn't really stop hanging. Except find and mount. That is scanning for partitions right now.

I have no drive big enough to clone it

 

[fzabkar]

ISTM that there may be something wrong with the enclosure or the power adapter. Can DMDE read sector 0 now? Does the drive actually spin up?

 

[YoshiMagick]

The drive spins up, but DMDE is hanging again. :/ You can give me a list of sectors to read again so I can find them when it starts working again. Would they be any different with the enclosure adapter?

Here is LBA 0:
http://i.imgur.com/WhQj9.png

LBA 1:
http://i.imgur.com/r1xXd.png (the second partition, archives should be larger than that, should be around 746GB)

Every now and again the DMDE just goes to 'Please Wait, Completing current operation'

Edit: Should I update the WD's Firmware in hopes of fixing whatever might be wrong with it?

 

[fzabkar]

ISTM that your drive probably has weak heads. That's why it is taking so long to read. :-(

Anyway now you can see the reason why your data was gibberish when the drive was inside the PC. LBA 0 is now encrypted, and the total number of LBAs is now 732558336.

732558336 LBAs x 4096 bytes per LBA = 3 000 558 944 256 bytes

I would try to clone your drive with ddrescue. Failing that, use DMDE to Search For Special Sectors (Tools menu). Look for an NTFS Boot Sector. There should be a backup boot sector near the end of the drive. The one at the beginning will probably have been overwritten by the new 100MB partition.

To avoid thrashing your drive, I would start searching near the end of the drive rather than from the beginning. For example, select Editor -> Goto Object Offset and select LBA 732558300, say.

That said, I really do think you should find some way to clone your drive before it fails completely.

 

[YoshiMagick]

This is the boot sector. It has found my first partition's file structure ^_^
http://i.imgur.com/iADx5.png

But what do I do with it?

 

[fzabkar]

Your hex dump shows the backup NTFS boot sector at the end of the drive. It is telling us that the size of the NTFS volume is 0x2BA9F2FF LBAs, and each LBA has a size of 0x1000 (= 4096) bytes.

Therefore, the capacity of your NTFS partition is ...

(0x2BA9F2FF + 1) x 4096 = 3 000 557 895 680 bytes

There are 63 sectors per track, and 255 heads.

The partition begins at sector 0x0100 (= 256).

I would now use DMDE to examine sector 256. I'm expecting that you will find gibberish, but you could be lucky.

For your reference ...

An Examination of the NTFS Volume Boot Record of MS Win2K & Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

 

[YoshiMagick]

http://i.imgur.com/ooCou.png - 256

It sees the file structure of my first partition, now where should I look for the second?

 

[fzabkar]

Byte offsets 0x100000 - 0x1001FF are the contents of sector 2048 when the drive is outside its enclosure. Offsets 0x100200 - 0x1003FF are the contents of sector 2049.

http://i.imgur.com/ojdcb.png (LBA 2048, outside enclosure)

The same offsets inside the enclosure represent LBA 256 (2048 = 256 x 8). That is, we are seeing the same data, but one is encrypted while the other is decrypted.

http://i.imgur.com/ooCou.png (LBA 256, inside enclosure)

Notice that offsets 0x100220 - 0x10024F are zeros in the first case, but "A3 08 8F ... 5D" in the second case. The latter sequence of 16 bytes is what you get when you encrypt 16 zeros. This same sequence is repeated for LBA 255 (sector 2047) at the top of the screen.

Now the fact that sector 2048 is all zeros but its LBA 256 counterpart does not consist of 32 repetitions of the abovementioned 16-byte sequence would suggest that DMDE was unable to read sector 2048 in the first case but was successful in the second case. This means that your drive is very sick. So not only does the drive have the original physical problem, it now has a corrupt filesystem.

As for your question regarding your second partition, the backup boot sector is indicating that there was only one original 3TB partition. This would have been how the drive was originally shipped. If you had repartitioned and reformatted the drive inside the enclosure when you first got it, as you have suggsted, then we would expect to see remnants of the 2TiB and 745GiB boot sectors.

 

[YoshiMagick]

Ok, I found my second partition.

And my drive is not hanging anymore, not since I updated my drive's firmware.

And I bought a copy of DMDE

And I have also ordered a new drive so I can start recovering my files.

Thanks so much for helping me with all of this You are awesome

Is there anyway I can restore the file system and partitions on this drive? or do I just recover the files off of it? If the latter, how could I repartition this drive with new drives?

 

[fzabkar]

A firmware update would most probably have updated the firmware on the USB-SATA bridge board, not on the drive itself. Therefore I can't see how this would have affected your outcome.

If your HDD problem is an intermittent one, you might like to remove the PCB from the HDD and use a soft white pencil eraser to gently remove any oxidisation from the preamp contacts. This is a common problem with recent post-RoHS WD drives.

Here is a sample WD PCB:
http://farm8.staticflickr.com/7162/6653607779_7bd78c478e_z.jpg

The 20-pin preamp contacts (J1) are at the bottom left of the above photo. This area of the PCB connects to the head preamplifier and voice coil inside the drive.

I've never used DMDE other than as a disc editor, so I don't know how it fares as a recovery tool. DMDE has a menu function (Insert Partition - Undelete) that enables you to select a boot sector and restore its parameters into the partition table in sector 0. I would prefer to do it by hand, but I would need to see your two boot sectors.

As for the clone, I would think that the destination drive would also need to be configured with 4096-byte sectors. Alternatively, you could connect both drives to your motherboard's SATA ports, clone them with ddrescue, and then install the clone inside the My Book enclosure.

A bootable live Ubuntu Rescue Remix CD might be advisable for such a job.

 

[YoshiMagick]

Well, when I had my drive in the computer, it didn't hang, only when I used the USB-SATA bridge.

Where did you learn how to do all of this? (And can you point me toward a resource where I may learn more?)

What are the boot sector's numbers?

 

[YoshiMagick]

Best answer selected by YoshiMagick.