Sign in with
Sign up | Sign in
Your question

All Data Suddenly Gone

Last response: in Storage
Share
February 16, 2013 3:52:25 PM

Hello Guys

I just installed 3TB Drives

I have Rampage IV Extreme Board

I wass copying data and I copied about 2TB DATA into a drive it was really important
And the windows ggave me a message "please restart to complete disk check", I cancelled copy reset and suddenly the drive became unaccessible
And in DEVICE MANAGER it showed the as a HEALTHY PARTITION with 100% free space

WTF?

I reinstated the device by giving permission of accessibility to "everyone" and it started opening with only boot.sm something and nothing else, everything GONE!!

I had all files over 5 - 6 GB
Why did this happen and can I recover data?

I really need that data back?

More about : data suddenly

a c 311 G Storage
February 16, 2013 7:33:10 PM

Your problem sounds strangely similar to a problem at another storage forum. In that case a 3TB drive became inaccessible after the user wrote data beyond the 2TB point. In his case the drive was configured as an 800GB pjhysical drive with a 3TB NTFS partition. I'm wondering whether Windows has made a mess of yours, too?

If you can be patient and resist the temptation to throw all sorts of data recovery software at the problem, we can examine the critical sectors and try to understand what happened. You say you "installed 3TB drives". I assume this means that you have a second working 3TB drive that we could use for comparison purposes.

If you wish to proceed, then please show us the contents of sectors 0, 1 and 2 of the physical drive. If you could show us the same information for both of your 3TB drives, then this would be even better.

Here are two free disc editors:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd
m
0
l
February 17, 2013 3:03:46 AM

Yes I have a total of 4 3TB Drives.
Two crashed, and I lost 4TB of data
In one drive weirdly many of my videos stopped working giving error "Cannot Render file" in in MPC-HC and uunable to play or the playback was less than a second in VLC.

Let me know what to do
m
0
l
Related resources
February 17, 2013 3:07:23 AM

Yes I have a total of 4 3TB Drives.
Two crashed, and I lost 4TB of data
In one drive I was copying data, weridly PC got reset and I lost the entire drive, it said RAW FILE SYSTEM and had to format, I read it was a BOOT SECTOR ISSUE, was unable to recover that.
Please I am losing data I gathered over years in less than a dayy lol
In one drive weirdly many of my videos stopped working giving error "Cannot Render file" in in MPC-HC and uunable to play or the playback was less than a second in VLC.

I am not sure if this matters, but on my RAMPAGE BOARD the drives are treated as RAID as I have RAID enabled on two of my SSDs 240GB
There are other drives connected on it too which are not on RAID, I am not sure if that matters or not

Also please let me know how to tell you the contents of sector 0,1,2

Let me know what to do
m
0
l
a c 129 G Storage
February 17, 2013 4:19:55 AM

are you running the Rampage IV Extreme BIOS 3404 bios to make sure the mb can under efi bios mode see drives and write to them??
m
0
l
a c 311 G Storage
February 17, 2013 5:45:21 AM

Your symptom is exactly the same as in that other thread. It's almost as if you are the same person !?

Anyway, to save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 3

In the Destination pane, select File.

You will be offered a filename of lba_0_3.bin

Click Save, OK, etc.

Now upload the BIN file to a filesharing service or your own web site.

If you could repeat this procedure for one of your good drives, then that would be even better.
m
0
l
February 17, 2013 11:21:48 AM

Yes I am running latest BIOS supporting Windows 8 UEFI

I just rAN EASEUS its showing drive as capacity 768 :(  WTF?

I even have 2 3TB drives filled to 95% I wonder whats wrong

I have attached bin file sfor 1 2TB drive, and both 3TB FILES

bin 01 is 2TB drive
bin 02 is 3TB correct drive (its showing 740 something data)
bin 03 is 3TB drive which crashed

http://rapidshare.com/files/1328723048/Desktop.rar
m
0
l
a c 311 G Storage
February 17, 2013 1:49:43 PM

"Download not available
Download permission denied by uploader. (0b67c2f5)"

m
0
l
a c 311 G Storage
February 17, 2013 6:46:11 PM

You have shown us the first three sectors of each LOGICAL drive. We need to see the PHYSICAL drives. Perhaps you need to give yourself administrator privileges?

Anyway, #1 and #3 are showing a Windows 7 NTFS boot sector.

#2 is also an NTFS boot sector, but it appears to have been created by a different version of Windows.

#1 is telling us that the partition begins at sector 2048 (= 0x800) and has a size of 2TB:

(0xE8E077FF + 1) sectors x 512 bytes per sector = 2 000 396 746 752 bytes

http://www.google.com/search?q=0xE8E07800+x+512+in+deci...

#2 and #3 both begin at sector 264192 (= 0x40800) and have a size of 3TB.

(0x015D4C97FF + 1) x 512 = 3 000 457 232 384

In short, all three NTFS boot sectors appear to be intact. HDD #1 was partitioned in MBR mode, while HDD #2 and #3 were partitioned in GPT mode.

An Examination of the Windows 7 Volume Boot Record:
http://thestarman.pcministry.com/asm/mbr/W7VBR.htm#CHS

Our next step will be to examine sectors 0,1, and 2 of each physical drive to check for consistency with the boot sectors.

Sector #1 should look something like Figures 3 and 4:
http://thestarman.pcministry.com/asm/mbr/GPT.htm

The tail end of sector #0 should look like Figure 1.

Sector #2 should have references to a reserved partition and a basic data partition.

m
0
l
February 17, 2013 7:11:26 PM

You are correct one drive I have since I used Windows 7, and these ones I initialized on Windows 8 (the 3TB ones)

http://ul.to/gp35sip5
(when I did on physical drives it showed AVAILBLE 800GB, not 3TB :S
WTF is going on please help

#1 is 2TB drive, #2 is 3TB drive working correctly for now, #3 is 3TB Drive which suuddenly lost all data.

PLease help out
m
0
l
a c 311 G Storage
February 17, 2013 10:09:14 PM

1.BIN is showing a drive with a 2TB MBR partition of type 07 (NTFS). The size (0xE8E07800) and start sector (0x800) matches the information in the NTFS boot sector of your 2TB drive, so everything appears to be OK.

2.BIN and 3.BIN are showing drives with GPT partition systems. Sector 2 of each drive shows a 3TB partition beginning at sector 0x40800 and ending at sector 0x15D509FFF. This equates to a size of ...

0x15D509FFF - 0x40800 = 0x15D4C97FF

... which matches the boot sector information.

However, there is a problem in sector 1 of each of the 3TB drives. Sector 1 is the "EFI PART" sector. In both cases the numbers are telling us that the usable area begins at sector 34 (= 0x22) and ends at sector 0x5D50A38E.

The size of the usable area is therefore ...

(0x5D50A38E - 0x22 + 1) sectors x 512 bytes per sector = 801 569 692 160 bytes

This means that sector #1 is reporting a physical capacity of 800GB, but sector #2 is reporting a partition size of 3TB. It appears that this could be the root cause of your data corruption.

Sector #2 is reporting that the full size of the drive is 0x5D50A3B0 (= 0x5D50A3AF + 1) sectors. The actual size of WD's and Seagate's 3TB SATA drives is 5860533168 sectors.

In hexadecimal this number is 0x15D50A3B0:

http://www.google.com/search?q=5860533168+in+hex

Therefore you can see that the two numbers differ in the most significant bit, 0x15D50A3B0 versus 0x5D50A3B0. The leading "1" is the 33rd bit, so it appears that the drive was initialised when a 32-bit LBA limit (2TiB) was active, and then subsequently partitioned and formatted when the full 48-bit LBA range became available. At least that's one explanation. The 32-bit LBA limit could have been a driver problem which was subsequently corrected, or it could have been a BIOS issue which was later fixed by a BIOS update. Alternatively, if you switched between AHCI and RAID modes, or IDE modes, in your BIOS setup, then this may have invoked different Windows drivers, one of which may have the 32-bit limit while the other may not. Again that's just speculation.

Whatever the reason, there is a problem in sector #2 which will undoubtedly result in further data corruption. I suggest you backup your data ASAP, using data recovery software where necessary, and refrain from writing to the drives.

As for how the corruption occurred, imagine that the OS attempts to write to a sector beyond the 2TiB limit. Instead of writing to sector 0x1nnnnnnnn, the leading "1" is dropped and data is instead written to 0x0nnnnnnnn. In other words, data written to the end of the drive (sector 2TiB + X) wraps around to the beginning (sector X), resulting in critical file system areas being overwritten. The file system then becomes corrupted. Windows then sees the file system as RAW and treats it as just a bunch of bytes.
m
0
l
a c 311 G Storage
February 18, 2013 1:17:49 AM

@khizaraq, if you are prepared to indulge me, I would like to try to repair sector 1 for you. I don't know if this will give us access to your data, but it may correct the misreporting of your drive's capacity by EaseUS. If we don't succeed, it will be very easy to undo the changes.

BTW, what range of sectors do you see at the top of DMDE's screen when viewing the physical disk?

Is it 0 - 5860533167 ?

Or is it 0 - 1565300735 ?
m
0
l
February 18, 2013 8:14:29 AM

If you want to recover that then try a data recovery software.
m
0
l
a c 311 G Storage
February 18, 2013 8:25:04 PM

By all means try data recovery software, but don't allow it to write on your drive.

Whatever the outcome with your data, we need to determine why a 3TB physical drive was initialised as an 800GB physical drive, and why this 800GB physical drive has a 3TB partition. If you rebuild your drives in exactly the same way as previously, then you will be creating two more time bombs.
m
0
l
February 19, 2013 10:40:31 AM

fzabkar said:
@khizaraq, if you are prepared to indulge me, I would like to try to repair sector 1 for you. I don't know if this will give us access to your data, but it may correct the misreporting of your drive's capacity by EaseUS. If we don't succeed, it will be very easy to undo the changes.

BTW, what range of sectors do you see at the top of DMDE's screen when viewing the physical disk?

Is it 0 - 5860533167 ?

Or is it 0 - 1565300735 ?


You are free to fix it, if I don't lose data on those drives.

Also you are absolutely correct, I turned my mode from AHCI to RAID ffrom my BIOS, and some of the drives are attached to that controller as well.

I need RAID for my SSDs, maybe that is why this happened?

What can I do to fix it?

I think I get the problem, with sectors but I got no clue how to fix it, Right now I have HUGE amounts of data on the drives, its there, its stored I am afraid if I move it might even lose that lol.

Hellp me out guys, if anyone wants to TeamViewer and fix it by all means
m
0
l
a c 311 G Storage
February 19, 2013 7:44:56 PM

I would advise you to proceed cautiously. You really should try to backup and recover whatever data you can, even from your "good" 3TB drive. At the very least I would disconnect any unnecessary drives until you can determine whether they are safe. In fact your "good" 3TB drive appears to be a time bomb.

That said, you need to be certain that your backup drive won't be at risk, so I would use a 2TB drive for this purpose since these will not be affected by a 32-bit LBA limit.

The next thing I would do is to examine your two 3TB drives a little further.

Firstly I would try to read the very first sector after the 2TiB point, ie sector 4 294 967 296 (= 0x100000000). If this sector contains the same data as sector 0, then we will have a 32-bit wraparound problem.

Using DMDE ...

Tools -> Copy Sectors
Start Sector -> 4294967296
Number of Sectors -> 1

Secondly, we need to locate the mirror copies of sectors 1 and 2. These should be located at the very end of the physical drive, in reverse order. The question is, are these copies at the end of the 3TB physical drive, or at the end of the 800GB physical drive? If they are at the 800GB point, then they will fall within the 3TB data area and will eventually be overwritten with user data. AISI, this will have undefined consequences.

Using DMDE ...

Tools -> Copy Sectors
Start Sector -> 5860533166
Number of Sectors -> 2

... and ...

Tools -> Copy Sectors
Start Sector -> 1565565870
Number of Sectors -> 2

BTW, none of the above is putting your data at risk. DMDE will be in readonly mode.
m
0
l
February 20, 2013 9:30:58 AM

Issue 1:
I tried entering this value it said its out of bounds so its not reading the drive entirely as a 3TB Drive?

I get INVALID INPUT error in DMDE when I try to do the first command
m
0
l
a c 311 G Storage
February 20, 2013 10:48:57 AM

Try reading sector 4294967295. That's just below the 2TiB boundary.

Also try the last set of inputs (1565565870, etc). That's the 800GB point.
m
0
l
a c 311 G Storage
February 20, 2013 7:48:09 PM

DMDE appears to be telling us that your current setup is affected by a 32-bit limit. If you discard the 33rd bit, you are left with a capacity of 800GB (= 746GiB).

As for your latest sector dumps, your file names are confusing. When DMDE offers to create a file, it calls it LBA_X_Y.bin, where X is the starting sector and Y is the total number of sectors. You appear to be using Y as the disc number.

lba_1565565870_2.bin is showing the last two sectors of the 800GB area of drive #2. These appear to match the data at the beginning of the drive, but in reverse order. To be certain, we would need to see the last 33 sectors, ie the entire partition array.

However, lba_1565565870_1.bin is showing a single sector (1565565870) rather than 2, and it contains data rather than partition information. Is this your 2TB drive (drive #1), or is it your "bad" 3TB drive?

In short, your "good" 3TB drive needs to be backed up ASAP. You also need to determine what is responsible for your 32-bit limit.

I notice that your motherboard has two SATA controllers, Intel and ASMedia:
http://www.asus.com/ROG/RAMPAGE_IV_EXTREME/
http://www.asus.com/websites/global/products/r7FZemJak3...

Intel X79 chipset :

2 x SATA 6Gb/s port(s), red
4 x SATA 3Gb/s port(s), black
Support RAID 0, 1, 5, 10

ASMedia PCIe SATA controller :

2 x eSATA 6Gb/s port(s), red
2 x SATA 6Gb/s port(s), red

If you have a spare, blank 3TB drive, I would attach it to each of the different SATA ports, and switch between AHCI and RAID modes in the BIOS. Then use DMDE to determine whether you can see the full 3TB capacity in each of the different configurations.
m
0
l
February 20, 2013 11:07:32 PM

I actually can't do that, if I switch to AHCI from RAID, I would, I think, lose my OS which is on RAID 0 SSD.

2 of my 3TB are connected via ASMedia and 2 are connected on x79 Chipset, both show 800GB
As Media doesn't have Switching capability it just shows "non-raid", x79 can shift between RAID and AHCI
m
0
l
a c 311 G Storage
February 21, 2013 3:34:05 AM

ISTM that all 4 of your 3TB drives are at risk. I confess that I'm baffled as to how you were able to create a 3TB NTFS partition on each of four 800GB drives, and on two different SATA controllers. That's just crazy. Which tools did you use?

BTW, can you confirm whether lba_1565565870_1.bin is from your "bad" 3TB drive or from your 2TB drive?

If you r-click your drive or SATA controller in Device Manager, can you see the name of the driver file? Are both controllers using the same driver? Are they Microsoft drivers, or Intel or ASMedia?
m
0
l
!