Find the answer to your Linux question:
Results 1 to 8 of 8
OK. Quick briefing. A friend of mine lent me an HDD to "play with", which has apparently suffered from an electrical/heavy storm and maybe a discharge. Her husband claims it ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Newbie
    Join Date
    Jan 2013
    Location
    Argentina
    Posts
    120

    "Stormy" HDD drive with NTFS + FAT16 + LBA - Not working


    OK. Quick briefing. A friend of mine lent me an HDD to "play with", which has apparently suffered from an electrical/heavy storm and maybe a discharge. Her husband claims it has 3 partitions but I see only 2 with testdisk (BTW, I am using su privilege). Apparently there are some damaged sectors.

    Below you can find information about HDD's damaged boot record. At least it is being recognised, but I've tried mounting it and it ain't working either.

    Code:
    TestDisk 6.13, Data Recovery Utility, November 2011
    
    Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
         Partition                  Start        End    Size in sectors
     1 P HPFS - NTFS              0   1  1 30399 254 63  488375937
    
    filesystem size           488375937 1
    sectors_per_cluster       8 0
    mft_lcn                   786432 0
    mftmirr_lcn               4923918 0
    clusters_per_mft_record   -10 0
    clusters_per_index_record 1 0
    Extrapolated boot sector and current boot sector are different.
    I'm afraid to overwrite some data on HDD if I create a new MBR or to make it worse. Also, how many sectors does an 250 GB WD Caviar HDD has? I'm not sure if it is listing partition. Apparently it is as it shows partition number 1 Primary and filesystem to be HPFS OR NTFS. I've never used this tool before and I would like to give at least some positive answer to my friend.

    Thank you in advanced.

    PS: I do not have an equal or higher storage capability HDD to try to "clone" its content. Is there any workaround?

    PS2: Is this MBR empty?

    Code:
    Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
     1 P HPFS - NTFS              0   1  1 30399 254 63  488375937
    Boot sector                        Backup boot sector
    00C0 00000000 00000000   ........  00000000 00000000   ........
    00C8 00000000 00000000   ........  00000000 00000000   ........
    00D0 00000000 00000000   ........  00000000 00000000   ........
    00D8 00000000 00000000   ........  00000000 00000000   ........
    00E0 00000000 00000000   ........  00000000 00000000   ........
    00E8 00000000 00000000   ........  00000000 00000000   ........
    00F0 00000000 00000000   ........  00000000 00000000   ........
    00F8 00000000 00000000   ........  00000000 00000000   ........
    0100 00000000 00000000   ........  00000000 00000000   ........
    0108 00000000 00000000   ........  00000000 00000000   ........
    0110 00000000 00000000   ........  00000000 00000000   ........
    0118 00000000 00000000   ........  00000000 00000000   ........
    0120 00000000 00000000   ........  00000000 00000000   ........
    0128 00000000 00000000   ........  00000000 00000000   ........
    0130 00000000 00000000   ........  00000000 00000000   ........
    0138 00000000 00000000   ........  00000000 00000000   ........
    0140 00000000 00000000   ........  00000000 00000000   ........
    0148 00000000 00000000   ........  00000000 00000000   ........
    0150 00000000 00000000   ........  00000000 00000000   ........
    0158 00000000 00000000   ........  00000000 00000000   ........
    0160 00000000 00000000   ........  00000000 00000000   ........
    0168 00000000 00000000   ........  00000000 00000000   ........
    0170 00000000 00000000   ........  00000000 00000000   ........
    0178 00000000 00000000   ........  00000000 00000000   ........
    0180 00000000 00000000   ........  00000000 00000000   ........
    0188 00000000 00000000   ........  00000000 00000000   ........
    0190 00000000 00000000   ........  00000000 00000000   ........
    0198 00000000 00000000   ........  00000000 00000000   ........

    Code:
    MFT and MFT mirror are bad. Failed to repair them.

    EDIT: I was able to mount 178ish GiB Win Partition, but only folders I see are "System Volume Information" and "Recycle Bin".
    Last edited by ivotkl; 02-05-2013 at 12:40 AM.

  2. #2
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Posts
    11,539
    I doubt that you will be able to pull much data off of this disc without resorting to professional data recovery services. If your friend is ok with losing all the data, you may be able to do a low-level format of the disc ( dd if=/dev/zero of=/dev/sdb bs=1M ). Also, what does the S.M.A.R.T. utility tell you? If you install the disk utility package on your system (gnome-disk-utility for Red Hat & Fedora distributions), you should be able to see what the drive can tell you as to its condition. You can look in the Applications->System Tools menu to see if it is already installed (it's call Disk Utility).
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

  3. #3
    Linux Newbie
    Join Date
    Jan 2013
    Location
    Argentina
    Posts
    120
    Rubberman: Thank you for your reply.

    Well, according to testdisk's report, MBR is messed and by repairing it I was able to see an almost blank Win XP partition. I could also see the 3 partitions listed I was told about.Also, MFT and its backup are unfixable. Also, there are 2 sectors with bad blocks.

    Code:
    As per information on Wikipedia:
    "Master File Table
    In NTFS, all file, directory and metafile data —file name, creation date, access permissions (by the use of access control lists), and size— are stored as metadata in the Master File Table. This abstract approach allowed easy addition of file system features during Windows NT's development—an interesting example is the addition of fields for indexing used by the Active Directory software. This also enables software like Everything or Ultrasearch[55] to perform instantaneous real-time searches for file and folder names, without relying on an indexing service.
    The MFT structure supports algorithms which minimize disk fragmentation.[56] A directory entry consists of a filename and a "file ID", which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of Files-11, other NTFS structures radically differ."
    I know basically (almost literally) nothing about this subject, but I believe that if MFT table gets broken, then sayonara to the files. As its metadata is there. Hence, metadata broken = cannot find files?

    I have mentioned her indeed about going to PROs, but it costs way to much for her budget (she's building her home with her own hands and it's taking her money and a lot of time).

  4. #4
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Posts
    11,539
    It is not uncommon for drives to have a couple of bad blocks. The SMART controller will remap those as necessary. If may be too late, but if she hasn't used encrypted folders, then you might be able to use the ntfsck tool (mapped to fsck.ntfs) assuming you have installed the ntfs-3g and ntfsprogs packages. Use the kernel packages, not the fuse versions.
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

  5. #5
    Linux Newbie
    Join Date
    Jan 2013
    Location
    Argentina
    Posts
    120
    Thank you. What about MFT?

  6. #6
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Posts
    11,539
    Quote Originally Posted by ivotkl View Post
    Thank you. What about MFT?
    Sorry, but I've never used it, so I can't reasonably comment about it. Thanks for the info though. I'll check it out when I have a chance.
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

  7. #7
    Linux Newbie
    Join Date
    Jan 2013
    Location
    Argentina
    Posts
    120
    No problem. I've been told by Mark Phelps in ubuntuforums to use a windows program to get windows-like files. I hate to admit it, but it works better than test disk if you don't have a spare drive to clone the damaged one.

  8. #8
    Linux Newbie
    Join Date
    Jan 2013
    Location
    Argentina
    Posts
    120
    Marking it as solved.

    Solution: Used a combination of testdisk under Linux to fix some sectors and MBR + partition table of it, then file recovery software under windows to retrieve some files. Not all files are recoverable in my case.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •