volcanoj

I recently had a problem with a friend's computer that I was working on. I was forced to replace the motherboard, CPU and RAM and while trying to get the old installation of windows to work with the new hardware, I ran into some issues. It all started with the computer restarting itself when it was loading windows, so I tried to reinstall windows. Somehow, instead of reintalling windows, it installed a second copy of windows on the hard drive. I tried again using a different XP CD and now the HD shows has having a partition, but it not being formatted.

I've moved the HD to another computer and tried the steps in the sticky thread to recover a lost partition. Unfortunately, it doesn't seem to be working like it should.

First a note. My computer does see that there is a drive there, but it doesn't recognize the partition. My drive manager shows the drive as being "RAW." Also interesting is that the drive only shows as 128GB instead of the 160GB that it is. I know that there is a difference between GB and GiB but I don't think that is is almost 30Gigs. The original computer also only saw 128GB so I suspect that the person who last worked on the computer did it this way for some reason.

Here is a snapshot of what my computer shows:
windows view of drive.jpg

During the process of following the sticky's procedure, things start going different rather quickly at step E. There it says "invalid FAT Boot sector"

testdisk1.jpg

I continue with the scan anyway, but after scanning, it says that It cannot find any partitions.

First it shows me:
testdisk2.jpg

after pressing ENTER I see:
testdisk3.jpg

I run the deeper scan which it asks for, but I still get no results.

I really need to recover the data from this drive since this is my friends computer and not my own.

I would greately appreciate any help you can give me. Also, once I recover the data, do you think that is is safe to continue to reformat the HD and continue to use it, or is the drive physically shot and needs replaced. I'm hoping for the former because neither my friend nor I have the money to purchase a replacement HD at this time.

volcanoj

Oh, I forgot to mention, that the Hard Drive is a SATA Segate Barracuda 7200.7 160GB.

Deleted090308

Hi

The 128GB issue is probably caused by installing XP without service packs (support for drives larger than 137GB was introduced with SP1).

I don't think this is "fixable" with TestDisk.

Try using some data recovery programs to recover important data.
GetDataBack ($79)
Recuva (free)
Roadkil's Unstoppable Copier (free)

Then run Seatools for DOS to check the drive for errors.
If the HDD is OK - wipe it with DBAN, then reinstall Windows.

wiseleo

Hmm... let's try this:

Enable 48bit LBA in registry. Search the forum for details on that.
Reboot.
Rerun a scan with testdisk.

You should have different results.

I think your data is still there and you can recover it this way. It may simply show up, but if not testdisk should dig it up.

If you want to be certain, run testdisk from a bootable sysrescuecd (see my signature for details) on the old system. It would be independent of Windows and not subject to Windows limitations. That way you would know with certainty whether this is a fault with Windows not seeing 48-bit LBA (which, by the way, it is), or if it's a fault with BIOS that may need flashing, or if the drive's 48-bit mode got deactivated.

If it works on the old system get your data off of it immediately. Then try the same experiment on the new system. If it doesn't work, probably BIOS is at fault.

Since you moved the disk between systems, I am suspecting BIOS issues in addition to lack of 48-bit LBA support on Windows.

If it's the drive's 48-bit mode that got deactivated, which is a form of logical failure that we see at times, you'd have limited options.

1. Manufacturer's utility to manipulate the 48-bit setting, if available
2. Not much else except professional tools.

If the data is important, image the drive (see my signature for steps), and work on the image using software tools. I personally use Active@ Undelete for easy stuff like this. It will open the raw drive image in read-only mode and let you work with it safely. I haven't evaluated freeware tools for this yet, but that's on my to-do list.

Remember that Windows interferes too much with data recovery tools like testdisk, so they may misreport things if Windows is not seeing the drive properly, such as in your case.

Here is the Seagate link about your issue: http://www.seagate.com/ww/v/index.js...00dd04090aRCRD

Deleted090308

TestDisk usually gets the HDD info from BIOS.
48-bit LBA is enabled by default in XP SP1 and later + Vista. You only have to enable it in Windows 2000.

wiseleo

Testdisk under windows runs under cygwin. Thus, it is subject to all Cygwin1.dll limitations. More details: http://www.cgsecurity.org/wiki/TestDisk_Compilation

It is an awesome tool. :)

Cygwin then uses kernel calls to operate on pipes such as \\.\PhysicalDrive0 or \\.\Device\HardDisk0\Partition1 (drive C: in this case) to access the devices. Therefore, I am not sure that is correct. Now, I can look up how that is handled in Win32 API, but I am pretty sure that goes through the device driver. Given that we have a malfunction in logical drive manager, it would be logical to conclude that we may be working with faulty data.

I can tell you that I've been able to read disks far more reliably outside Windows using Testdisk on the same system. I don't even bother reading disks likely to be bad under Windows anymore. As always, I assume that this is the last time we can get the drive to read again, so why waste that precious powerdown cycle on a Windows test that is likely to be inconsistent. There is always that fact that we can control the aggressiveness of a disk driver under Linux much better and we have the raw ATA console output on Ctrl-F12 terminal.

I would be curious about the actual results of this experiment. :)

volcanoj

I'm pretty sure that the 48-bit LBA isn't an issue with my computer. I'm running Vista and have a 500GB HD that Windows sees fine.

wiseleo

That does change things a bit.

Did you try accessing the disk outside windows? I am really curious what "cat /dev/sda" would show. That command would be correct if this were the only SATA device in the box. It would be helpful to not have Vista or XP interfering at this stage.

I saw "I used an XP CD, then I used another XP CD" and now you are talking about Vista. That is just a tiny bit confusing. :)

Have you tried reading this disk in another system?

What you'll probably wind up doing is recreating the partition table and rebuilding the MFT if the original partition was NTFS. If it were FAT32, there is more guesswork ahead. And you should be doing that only on an image, possibly inside Vmware as this stuff is pretty destructive if a mistake is made.

You ran testdisk as admin under vista, right? It has been updated to 6.10.

Let me know when you grabbed the image of this drive.

volcanoj

I apologize for the confusion about the CDs. The original computer that I was working on had XP on it. I tried to reinstall at two different times using different CDs. When the HD problem manifested itself. I moved the problem drive to my personal computer for trouble shooting purposes. My personal computer is running vista.

I used the systemrescucecd you reccomended to try running testdisk outside of a windows enviornment and it worked beautifully. I was able to rewrite the partition table using testdisk (I think that is the correct term for what ever I did) and it started working.

I immediately imaged the disk to an external HD.

I ran the seatools for dos and all scans came up clean.

I've looked at the image using active@ undelete and it looks like everything is there.

wiseleo

Volcanoj - I am happy that my procedure worked for you. :)

Tell your friend to buy an external drive for backup purposes. They are quite cheap.

volcanoj

I just feel the need to thank everyone for their help. The computer has been reloaded and her data restored. You guys are awesome.