external Raw usb drive, clean command and restoring data

Page 1 of 3 123 LastLast

  1. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
       #1

    external Raw usb drive, clean command and restoring data


    Hello everybody!
    My "story" is a long one.. and I don't want to make you tired if it is not necessary. So I'll start from the end.
    I'm speaking for an external drive connected with usb. Before it was a system drive with W7. (still there is the OS but not using it)
    4 partitions oem, recovery, OS and Data. Suddenly became Raw and I cleaned also partitions by accident.. (diskpart- clean) (clever me!..)
    I am only interesting for the last Data partition which was the bigest (500GB) with all my files.
    Now I am at the moment DMDE shows the image you see and in the left pane I can see all the structure of data I had.
    I don't know how to continue. Is it possible to get my files back without fixing everything well (the rest 3 partitions, mbr, mft etc because I don't need them
    and thats why i did the mistake with clean command not remembering that it will clean the whole drive)
    So any suggestion? Can I restore them? rebuild only Data partition?
    If more information need it I'm happy to give them
    Thanks a lot.
    Attached Thumbnails Attached Thumbnails external Raw usb drive, clean command and restoring data-dmde-3.0.6..png  
      My Computer


  2. Posts : 7,055
    Windows 7 Home Premium 32 bit
       #2

    Launch PartitionWizard, on the left Pane click on Partition Recovery Wizard > Next > Select your external drive >Next > Full Disk > Next > QuickScan > Next. Allow the quickscan to complete. At the end of the quickscan you will get a window showing all the found partitions. Post a screenshot of it. After you have taken t e screenshot click on Cancel button on that Window and close PW. You can run it again after getting further instructions from me.
      My Computer


  3. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
    Thread Starter
       #3

    Thanks for reply.
    So I closed DMDE and I launch Mini Tool PW. Hoping that I understand you well.
    I'm already running QuickScan. It looks it will need maybe 1-2 days to finish.
    It is at 604.000 sector from 1.465.149.168 sectors. (750Gb disk)
    Few times "not responding", but just for a second and continue scanning (sorry for my poor english)

    The disk possible has some physical damage too. That's why I got it out and put a new one in the laptop.
    I couldn't run chkdsk because of Raw fs but it looks it comminicate well and I don't hear something strange.
    Unfortunatelly is the only place where now are all my Data.
    All my backups got infected by the ransonware cerberus out of this disk.
    I thought I'm very near to recover with DMDE.... I'll wait finish scanning and upload screenshot.
    At the moment it found 2 small partitions 3Mb each. Label "boot".
    Thanks for your help.
      My Computer


  4. Posts : 7,055
    Windows 7 Home Premium 32 bit
       #4

    I don't know much about DMDE and how to use it for data recovery and so I shall stick with the known devil PW. If you had done only diskpart Clean, which only writes zeros to the first 2047 sectors, then I expect Partition Recovery Wizard should easily find the partitions.

    Since you are saying that PW is stumbling in Quick Scan, then as you say there may be some damage to the HDD - may be bad sectors. In such a case I shall keep my fingers crossed on the outcome. Anyway let Quick Scan complete.
      My Computer


  5. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
    Thread Starter
       #5

    Hi jumanji.

    Like I said my last (wrong) action it was the clean command in an already Raw drive.
    Data for sure there are because I have see them in tact with two different apps.
    Bad sectors sure there are but I believe not in the last DATA partition, which is the one I want back.
    I cannot run chkdsk and I don't know other way to check the bad sectors which I believe are in the first sectors
    that's maybe why drive went Raw...
    Before I was reading other threads with the same problem and I found very interesting the actions you do with BOOTICE.
    Also in my new drive inside of the laptop I have restore an image from Macrium which was exactly what is in the problematic drive that we try to fix.
    So near and same that when I connect first time the Raw drive they had signature collison.
    I thought that if the two drives are so much the same maybe you could help me to do restoring first sectors with Bootice.
    Of course I need help to do this. eg how you back up sectors and restore and some other questions I have.
    I try already and download Bootice but I found it in a Japanish site. Is that right? Will it be in English?
    Also in some sites I read that there are virus in this app. Have you see anything strange? Still I haven't install it.
    Of course I'm going to follow your suggestions. I am newbie in this area.

    PW is still in 2.000.000 (about) sector. So is going to take a long long time..... if with the same rythm I count it needs 5 months.....:)
      My Computer


  6. Posts : 7,055
    Windows 7 Home Premium 32 bit
       #6

    Hmmmm... I thought its going to be a child's play since I assumed that it was a good drive which became RAW after a diskpart clean. In that scenario, it would have indeed been a child's play since PW would have found the Partitions in a jiffy.

    Now that the full picture has emerged that the drive was RAW even before and on that you ran clean and PW is limping, its going to be a onerous task.

    Sector 0 consists of the MBR code and the partition table.The MBR code can be written at anytime. When you initialise the drive in Windows Disk Management and just stop with initialisation not proceeding further, the MBR code will be written to sector 0. You can use PW to to rebuild MBR. You can see it on the left pane under Operations. You can also write the MBR with bootice. But what is of importance is that we should find the start sector of the fourth partition and write the partition table for that into sector 0. Only then you will be able to see the partition and access it. That is why we are scanning with PW.

    If it is not successful, then we shall try TestDisk next.

    Now I have a question. You tried DMDE. Does it show the fourth partition start sector No.? We can then ask PW to scan only a specific range around that sector that will take much less time.

    Even otherwise follow this dictum. Your 750GB drive will have approximately 1465149167 sectors. Assuming that your fourth partition is 500GB, the start sector should be at one third of that total number of sectors. approximately sector Number 488383055.So cancel the present scan and ask PRW to scan sectors from 488000000 to 48900000 or even 488300000 to 488400000. Leave it to scan this range overnight and let us see whether it can see the partition start point.

    As for Bootice, what you see may be in Chinese but the program you download will be in English. There is no need to run bootice now. We know what will be in Sector 0 after the diskpart clean - only all zeros in it.

    I am off to bed now - under the new split Inverter aircon that was installed just hours ago. It is still under test run to see whether it reaches the minimum set temp of 17 degree Celsius.
    Last edited by jumanji; 18 Apr 2016 at 12:46.
      My Computer


  7. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
    Thread Starter
       #7

    Hi!
    Yes in my first post the screenshot shows exactly where DATA partition starts and where ends.
    I don't know what "Indicator xCF" means.
    I believe DMDE reads only the NTFS partition table because was somehow quick.
    The structure in left pane of the "tree" from DATA partition (folders, files etc) looks completely right!
    .
    So I'm going to follow your advice. Scanning that area only.
    Wish to you good luck with your test and
    Sweet dreams if finaly you go to sleep.
    Tomorrow you might explain to me where and what I have to write in the first sectors .

    Cheers
      My Computer


  8. Posts : 7,055
    Windows 7 Home Premium 32 bit
       #8

    Yep, I see DMDE shows the start sector of fourth partition as 416 571 392. So your Partition Recovery Wizard scan range you may set as 416 500 000 to 416 600 000. If partition Wizard does find the start sector correctly it should be able to write the partition table correctly into sector 0. ( The range given by me is way off from this figure. But then this is the first time we are doing a selected range scan. Next time I should widen the range )

    Post the screenshot of partitions found Window.
      My Computer


  9. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
    Thread Starter
       #9

    Hi!
    I started already yesterday but I set starting point exactly 416.571.392 as shown.
    Until 2.000.000 sector it found nothing.
    Then I read your last post so I stop it and gave a starting point before that like you suggest.
    I'm just waiting to finish.
    Yesterday I read about the architectonic of mbr, mft etc and there are few different forms eg where is the copy, relation with vbr, ebr etc. God is very complicate....
    I lost again my hopes...
    I'll post result.
      My Computer


  10. Posts : 141
    Windows 7 Home Premium x64, *W7 Prem. x64
    Thread Starter
       #10

    No result. It finds nothing.
    [When I open Wind.Disk Manag. ask me to initialize the disk before I can use it .
    Do you know if I've to do it? of course it shows as unallocate drive but maybe I must initialize first for connected it?]

    So what's now?
      My Computer


 
Page 1 of 3 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 08:24.
Find Us