RAW Harddisk (tried a lot without succes)

[jvandeleur]

Hello community,

First of all, I know this is a common thread on a lot of forums, but I've tried a lot and don't get my files back.
I'm having an older Maxtor 320 GB sata harddrive that went into an RAW format a few years back. Back then there weren't any programs that could really recover the files on it without having to format the drive (which is something I don't want to do unless there isn't any other option left).

I know that in many cases even though the harddrive has been formatted, the data can be recovered if it hasn't been rewritten after that.

With todays programs I tried some of them to read and extract the data from this drive to another. Programs I've used so far are:

Drive Rescue (which gives an error: "bad parameter in boot sector: Bytes Per Sector (0) = 0"),
EaseUS Data Recovery Wizard Professional (which can find the files and extract them to another drive, but the files can't be opened and are all named: FILE001, 002 etc..),
Testdisk (which reads the cillinder fully, but doesn't find any partitions) and
Recuva (which can't open the harddisk at all: "The path does not exist").

The one I had the most luck with was EaseUS, which could find and extract 193 GB (something more than 76000 files) off of the harddrive, only problem is that it doesn't open any of them (it says they are either damaged or the filetypes aren't supported). It found a lot of different filetypes: Adobe Photoshop files, ANI, ASF, AVI, GIF, JPEG, DOC, MP3 and RAR are most of them.

The weird thing about the drive is that it hasn't been used for running an OS during my use (though I just heard it is a revised drive), but it had been working for a few years and was only used for storing data (music, photo's, pdf's etc..). Nothing has happened to it after it went RAW, I just kept it, hoping someday I could maybe open it, it isn't necessary for me to get the drive itself working again, just to get the data off of it. It has a lot of photo's an music and because of that, a lot of memories.

Of course I know I should've made a backup of it, but it was at least 5 years ago I think and didn't had the knowledge back then that I have now.

If someone has an idea on what I could do, I would be more than happy to try it and very grateful .

Thank you very much in advance.

Jeffrey

P.S.

As of now I am running EaseUS again, but instead of doing the full recovery, I'm now running the Partition Recovery, which found 85000 (total) files by now and is still running.

 

[jvandeleur]

Hello community,

First of all, I know this is a common thread on a lot of forums, but I've tried a lot and don't get my files back.
I'm having an older Maxtor 320 GB sata harddrive that went into an RAW format a few years back. Back then there weren't any programs that could really recover the files on it without having to format the drive (which is something I don't want to do unless there isn't any other option left).

I know that in many cases even though the harddrive has been formatted, the data can be recovered if it hasn't been rewritten after that.

With todays programs I tried some of them to read and extract the data from this drive to another. Programs I've used so far are:

Drive Rescue (which gives an error: "bad parameter in boot sector: Bytes Per Sector (0) = 0"),
EaseUS Data Recovery Wizard Professional (which can find the files and extract them to another drive, but the files can't be opened and are all named: FILE001, 002 etc..),
Testdisk (which reads the cillinder fully, but doesn't find any partitions) and
Recuva (which can't open the harddisk at all: "The path does not exist").

The one I had the most luck with was EaseUS, which could find and extract 193 GB (something more than 76000 files) off of the harddrive, only problem is that it doesn't open any of them (it says they are either damaged or the filetypes aren't supported). It found a lot of different filetypes: Adobe Photoshop files, ANI, ASF, AVI, GIF, JPEG, DOC, MP3 and RAR are most of them.

The weird thing about the drive is that it hasn't been used for running an OS during my use (though I just heard it is a revised drive), but it had been working for a few years and was only used for storing data (music, photo's, pdf's etc..). Nothing has happened to it after it went RAW, I just kept it, hoping someday I could maybe open it, it isn't necessary for me to get the drive itself working again, just to get the data off of it. It has a lot of photo's an music and because of that, a lot of memories.

Of course I know I should've made a backup of it, but it was at least 5 years ago I think and didn't had the knowledge back then that I have now.

If someone has an idea on what I could do, I would be more than happy to try it and very grateful .

Thank you very much in advance.

Jeffrey

P.S.

As of now I am running EaseUS again, but instead of doing the full recovery, I'm now running the Partition Recovery, which found 85000 (total) files by now and is still running.

UPDATE:

The recovery is finally finished and now it found more than 100.000 files worth something less than 310 GiGs and it's now actually showing the correct filenames and paths!

When extracting of the data goes well, I will close this thread and for people with the same problem, I think that the Partition Recovery feature of EaseUS does the job instead of the Complete Recovery, which seemingly only searches for RAW files. No format needed (in my case).

 

[fzabkar]

Thanks for the feedback.

Assuming that you are able to recover your data, would you be interested in examining your drive with a disc editor? The fact that EaseUS was able to recover the directory tree suggests that the damage could not have been excessive. I would be interested in helping you with this.

For example, the "bad parameter in boot sector: Bytes Per Sector (0) = 0" error suggests that the boot sector may have been zeroed, in which case there is sometimes a backup boot sector that could be used to reconstruct it.

BTW, formatting is data destructive. You should NEVER do this, despite what Internet folklore may tell you.

 

[jvandeleur]

Thanks for the feedback.

Assuming that you are able to recover your data, would you be interested in examining your drive with a disc editor? The fact that EaseUS was able to recover the directory tree suggests that the damage could not have been excessive. I would be interested in helping you with this.

For example, the "bad parameter in boot sector: Bytes Per Sector (0) = 0" error suggests that the boot sector may have been zeroed, in which case there is sometimes a backup boot sector that could be used to reconstruct it.

BTW, formatting is data destructive. You should NEVER do this, despite what Internet folklore may tell you.

You're welcome, the data is still being copied over as we speak and I'm confident that it's working.
I don't know if there even is any damage to the drive to be honest, it just went RAW suddenly and it was only used to store data. It isn't something mechanical, I'm pretty sure, because EaseUS can still read the drive and get the data off of it.

I don't think there is going to be a backup boot sector on the drive, since it has only been used for data during my use, never installed an OS onto it, though EaseUS did find some FAT folders, as well as FAT boot files and NTSF boot files, strangely. And on the other hand, EaseUS found 106 partitions, indicating that it has been used before I used it back then, because I never formatted the drive or partitioned it. It was always one big partition of 320 GB (or 296 GiGs).

I'm surely interested in finding out why the drive suddenly went RAW or to find out what damage it has gone through, and if a Disc editor can help me with that (with the help of you along the way) that would be great for me .

I did indeed read about the boot sector being zeroed, though it still is weird for me. I've spent a lot of time dealing with all kinds of problems with pc's, but never had this before. The drive seems to be okay and everything is still on there, it just somehow decided to go RAW, which made it unreadable for Windows.

As of now, it is still copying over the data, but when that is done, I can try and find out what's wrong with it.

BTW, if it is of any importance, this drive used to work on an XP machine back then and on there it changed suddenly.

And yes, formatting is bad, that's why I've kept it for over 5 years, hoping someday a program would be there that could get the data off of it, without having to format the drive first.

I appreciate your help and want to thank you in advance, I would really want to learn what caused this weird phenomenen

 

[fzabkar]

AIUI, when a drive becomes "RAW", it's because some critical part of the file system has become damaged. That could be due to bad sectors, or it could occur if a drive goes offline while data are being written, or if it is disconnected before data have been flushed from cache. The OS then treats the resulting unrecognisable file system as just a bunch of bits.

FAT32 volumes keep an automatic backup of the boot sector (logical sector 0) at logical sector 6. NTFS volumes maintain a backup at the very end of the volume.

As for "ghost" partitions and FAT/NTFS boot sectors, could it be that EaseUS has found these structures inside regular Microsoft OS files? For example, DiskPart, Fixmbr, Fixboot are several utilities which would need to incorporate MBR and boot sector templates.

Here are several disc editors. They all default to readonly mode, so you should be safe. I prefer DMDE, but its UI isn't very intuitive.

The first thing you would do would be to examine sector 0 (in hexadecimal mode). That's where the MBR code and partition table are located. The partition table then tells us where to find the boot sector, usually at sector 63 for an XP system. Also the partition style for XP would be MBR rather than GPT.

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector%20Editor

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

Here are some useful references:

An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

An Examination of the Windows 2000/XP MBR:
http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

 

[jvandeleur]

AIUI, when a drive becomes "RAW", it's because some critical part of the file system has become damaged. That could be due to bad sectors, or it could occur if a drive goes offline while data are being written, or if it is disconnected before data have been flushed from cache. The OS then treats the resulting unrecognisable file system as just a bunch of bits.

FAT32 volumes keep an automatic backup of the boot sector (logical sector 0) at logical sector 6. NTFS volumes maintain a backup at the very end of the volume.

As for "ghost" partitions and FAT/NTFS boot sectors, could it be that EaseUS has found these structures inside regular Microsoft OS files? For example, DiskPart, Fixmbr, Fixboot are several utilities which would need to incorporate MBR and boot sector templates.

Here are several disc editors. They all default to readonly mode, so you should be safe. I prefer DMDE, but its UI isn't very intuitive.

The first thing you would do would be to examine sector 0 (in hexadecimal mode). That's where the MBR code and partition table are located. The partition table then tells us where to find the boot sector, usually at sector 63 for an XP system. Also the partition style for XP would be MBR rather than GPT.

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector%20Editor

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

Here are some useful references:

An Examination of the NTFS Volume Boot Record of Win2K and Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

An Examination of the Windows 2000/XP MBR:
http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

Thank you for your reply.

I will look into this now and see what info it gives me.
The extracting was completed yesterday, so whatever happens to the drive, it doesn't really matter anymore, the data is safe and backuped, and I'm not expecting to get the drive running again, but I will check the sectors to see what caused this, would be a good learning process for me for when this happens again in the future.

I will try DMDE first, since you prefer it and know how to use it, in case I can't figure it out.
I will post my findings here, since I think I am probably not going to fully understand them.

Thanks again for your help and explanation, I appreciate it! I will post my findings asap.

 

[jvandeleur]

Okay, I've searched the bootsector via the Editor tab and it started at the beginning (LBA: 0 Block: 0) and it's all zeroed (in Hexadecimal mode).

I then searched for the bootsector via the Tools tab and then it displays this:

LBA: 4087020 Block: 4 078 020
OEM identifier | +%j&WIHC
Bytes per Sector | 512
Sectors per Cluster | 1
Reserved Sectors | 1
Number of FATs | 2
Root Dir Entries | 224
Total Sectors | 2280
Media Descriptor | F0h
Sectors per FAT | 9
Sectors per Track | 18
Number of Heads | 2
Hidden Sectors | 0
Total Sectors | 0
Drive Number | 0h
Reserved | 0h
Ext. Boot Sign. (0x29) | 29h
Serial Number | 2ECC62C1h
Volume Name
File System Type | FAT12
Boot Signature (0xAA55) | AA55h

Then when I search for the Boot Signature via the same tab, it gives me
LBA: 4094267 Block: 4 094 267
and it's all zeroed, exept for the last line, which only displays 55 AA (at the very end).

Though it seems that I have more Boot Signatures, because when I put it back to the beginning, it found one earlier on (LBA: 82977 Block: 82 977), which had a lot of letters and digits and seems okay, I think, though I don't have any knowledge when it comes to this. It doesn't have lines full of zeroes in any case and it also ends with 55 AA.

Do I need to keep searching for more Boot Signatures and/or Sectors?

I also searched for the Partition Table Sector, under Tools, and the first one that came up contained the following information:

LBA: 4226044 Block: 4 226 044

System ID____Boot Flag|First____|Last__________|Relative Sector |Number of Sectors
____________________Cyl/Head/Sec|Cyl/Head/Sec
Disc identifier (Windows): B7E61057h
07h NTFS/exFAT 00h |0 1 1 |1023 254 63 |63 |79875117 40.9 GB
07h NTFS/exFAT 00h |1023 0 1|1023 254 63 |79875180 |80196480 41.1 GB
00h 00h |0 0 0 | 0 0 0 |0 |0
00h 00h |0 0 0 | 0 0 0 |0 |0
MBR signature (0xAA55): AA55h

Okay, this isn't displaying as I want to, will make a printscreen and post it.

 

[jvandeleur]

Bootsector (LBA:0 Block:0) http://vvcap.net/db/YuePEP1VQC8b3TYOLFaU.htp
First Bootsignature (LBA: 82977 Block: 82 977): http://vvcap.net/db/lqVtwJjMmq3zYUnbRedc.htp
Boot Partition Table (LBA: 4226044 Block: 4 226 044): http://vvcap.net/db/FUECIXPQZsnqNUl4WOoZ.htp
Boot Partition Table, Hexadecimal (same LBA and Block as above): http://vvcap.net/db/QPcSIchCPwLvz_fJoecc.htp

In the last screenshot it tells me that it couldn't load an operating system and that there is an invalid partition table, though there wasn't an OS on it when I used it.

Hope you can make some sense out of it, because for me this is very difficult to understand.

 

[fzabkar]

The boot sector that you found looks like the kind of FAT12 template that you would find embedded within a file such as FIXBOOT.EXE. It is in fact the boot sector of a floppy diskette (2 heads, 18 sectors per track).

A Boot Signature is a hexadecimal byte pair, 55 AA (or 0xAA55 in little endian format). These bytes are used to validate MBRs and boot sectors. The signature is placed at the end of the sector.

In binary it looks like this ...

01010101 10101010

As for your searches, you don't need to perform a full surface scan. Unlike data recovery software which is unable to make assumptions regarding your partitioning, you know how your drive was configured. Therefore you can restrict your searches to the most likely areas.

First Bootsignature (LBA: 82977) is not a boot sector.

Boot Partition Table (LBA: 4226044) is a real partition table, but it doesn't appear to be relevant.

BTW, ISTM that you may be searching a logical drive rather than the physical disk. When DMDE launches, select your physical disk and ESCape out of the partitions menu. That should place you at sector 0 of the physical drive. Hopefully you will see MBR code plus a partition table at the end.

There should be a backup NTFS boot sector at the end of the drive. One way you could search for it would be to position your cursor at the end of the drive (Ctrl-End). Then select Tools -> Search String in Object, type "NTFS" into the ASCII box, select Case Sensitive, Backward, From Cursor, and click OK.