"Stormy" HDD drive with NTFS + FAT16 + LBA - Not working

Printable View

02-04-2013
ivotkl

"Stormy" HDD drive with NTFS + FAT16 + LBA - Not working

OK. Quick briefing. A friend of mine lent me an HDD to "play with", which has apparently suffered from an electrical/heavy storm and maybe a discharge. Her husband claims it has 3 partitions but I see only 2 with testdisk (BTW, I am using su privilege). Apparently there are some damaged sectors.

Below you can find information about HDD's damaged boot record. At least it is being recognised, but I've tried mounting it and it ain't working either.

Code:

TestDisk 6.13, Data Recovery Utility, November 2011 Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63 Partition Start End Size in sectors 1 P HPFS - NTFS 0 1 1 30399 254 63 488375937 filesystem size 488375937 1 sectors_per_cluster 8 0 mft_lcn 786432 0 mftmirr_lcn 4923918 0 clusters_per_mft_record -10 0 clusters_per_index_record 1 0 Extrapolated boot sector and current boot sector are different.

I'm afraid to overwrite some data on HDD if I create a new MBR or to make it worse. Also, how many sectors does an 250 GB WD Caviar HDD has? I'm not sure if it is listing partition. Apparently it is as it shows partition number 1 Primary and filesystem to be HPFS OR NTFS. I've never used this tool before and I would like to give at least some positive answer to my friend.

Thank you in advanced.

PS: I do not have an equal or higher storage capability HDD to try to "clone" its content. Is there any workaround?

PS2: Is this MBR empty?

Code:

Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63 1 P HPFS - NTFS 0 1 1 30399 254 63 488375937 Boot sector Backup boot sector 00C0 00000000 00000000 ........ 00000000 00000000 ........ 00C8 00000000 00000000 ........ 00000000 00000000 ........ 00D0 00000000 00000000 ........ 00000000 00000000 ........ 00D8 00000000 00000000 ........ 00000000 00000000 ........ 00E0 00000000 00000000 ........ 00000000 00000000 ........ 00E8 00000000 00000000 ........ 00000000 00000000 ........ 00F0 00000000 00000000 ........ 00000000 00000000 ........ 00F8 00000000 00000000 ........ 00000000 00000000 ........ 0100 00000000 00000000 ........ 00000000 00000000 ........ 0108 00000000 00000000 ........ 00000000 00000000 ........ 0110 00000000 00000000 ........ 00000000 00000000 ........ 0118 00000000 00000000 ........ 00000000 00000000 ........ 0120 00000000 00000000 ........ 00000000 00000000 ........ 0128 00000000 00000000 ........ 00000000 00000000 ........ 0130 00000000 00000000 ........ 00000000 00000000 ........ 0138 00000000 00000000 ........ 00000000 00000000 ........ 0140 00000000 00000000 ........ 00000000 00000000 ........ 0148 00000000 00000000 ........ 00000000 00000000 ........ 0150 00000000 00000000 ........ 00000000 00000000 ........ 0158 00000000 00000000 ........ 00000000 00000000 ........ 0160 00000000 00000000 ........ 00000000 00000000 ........ 0168 00000000 00000000 ........ 00000000 00000000 ........ 0170 00000000 00000000 ........ 00000000 00000000 ........ 0178 00000000 00000000 ........ 00000000 00000000 ........ 0180 00000000 00000000 ........ 00000000 00000000 ........ 0188 00000000 00000000 ........ 00000000 00000000 ........ 0190 00000000 00000000 ........ 00000000 00000000 ........ 0198 00000000 00000000 ........ 00000000 00000000 ........

Code:

MFT and MFT mirror are bad. Failed to repair them.

EDIT: I was able to mount 178ish GiB Win Partition, but only folders I see are "System Volume Information" and "Recycle Bin".
02-05-2013
Rubberman

I doubt that you will be able to pull much data off of this disc without resorting to professional data recovery services. If your friend is ok with losing all the data, you may be able to do a low-level format of the disc ( dd if=/dev/zero of=/dev/sdb bs=1M ). Also, what does the S.M.A.R.T. utility tell you? If you install the disk utility package on your system (gnome-disk-utility for Red Hat & Fedora distributions), you should be able to see what the drive can tell you as to its condition. You can look in the Applications->System Tools menu to see if it is already installed (it's call Disk Utility).
02-05-2013
ivotkl

Rubberman: Thank you for your reply.

Well, according to testdisk's report, MBR is messed and by repairing it I was able to see an almost blank Win XP partition. I could also see the 3 partitions listed I was told about.Also, MFT and its backup are unfixable. Also, there are 2 sectors with bad blocks.

Code:

As per information on Wikipedia: "Master File Table In NTFS, all file, directory and metafile data —file name, creation date, access permissions (by the use of access control lists), and size— are stored as metadata in the Master File Table. This abstract approach allowed easy addition of file system features during Windows NT's development—an interesting example is the addition of fields for indexing used by the Active Directory software. This also enables software like Everything or Ultrasearch[55] to perform instantaneous real-time searches for file and folder names, without relying on an indexing service. The MFT structure supports algorithms which minimize disk fragmentation.[56] A directory entry consists of a filename and a "file ID", which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of Files-11, other NTFS structures radically differ."

I know basically (almost literally) nothing about this subject, but I believe that if MFT table gets broken, then sayonara to the files. As its metadata is there. Hence, metadata broken = cannot find files?

I have mentioned her indeed about going to PROs, but it costs way to much for her budget (she's building her home with her own hands and it's taking her money and a lot of time).
02-05-2013
Rubberman

It is not uncommon for drives to have a couple of bad blocks. The SMART controller will remap those as necessary. If may be too late, but if she hasn't used encrypted folders, then you might be able to use the ntfsck tool (mapped to fsck.ntfs) assuming you have installed the ntfs-3g and ntfsprogs packages. Use the kernel packages, not the fuse versions.
02-06-2013
ivotkl

Thank you. What about MFT?
02-06-2013
Rubberman

Quote:

Originally Posted by ivotkl

Thank you. What about MFT?

Sorry, but I've never used it, so I can't reasonably comment about it. Thanks for the info though. I'll check it out when I have a chance.
02-06-2013
ivotkl

No problem. I've been told by Mark Phelps in ubuntuforums to use a windows program to get windows-like files. I hate to admit it, but it works better than test disk if you don't have a spare drive to clone the damaged one.
02-08-2013
ivotkl

Marking it as solved.

Solution: Used a combination of testdisk under Linux to fix some sectors and MBR + partition table of it, then file recovery software under windows to retrieve some files. Not all files are recoverable in my case.