Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?

08 Apr 2019   #31
goopy

Windows 7 Ultimate x86
 
 

Greetings Jumanji. Hope you've had a good rest.
1. The two volumes shown belong to the unformatted 500G ssd. Systems disk is 250G.
2. The screenshot posted shows the top volume. It correctly identifies the DISM++ and Macriumbackup folders that reside on the SSD that's supposed to have a single NTFS partition. The contents of these two folders, however, are shown in the the subfolders of [Lost & Found].
3. The lower volume also shows some of the files that reside in Macriumbackup. Not sure if these were deleted files.
4. Am I correct to understand that Bootice detected a single valid NTFS volume at sector 2048, while both Minitool and Getback found two at sectors 2048 and 2050?

5. Is the OS's failure to identify the disk due to corrupted sector 2048? Is sectors 0 and 2050 also corrupted?

6. Wile Minitool took more than an hour to scan the disk, Getback was able to obtain the file list instantaneously. Does that mean Getback knows where to get the info on the disk?
7. Will give Active @ File recovery a try.


Many thanks and best regards.


7. What's your normal procedure for repair? Patching sector 2048 with correct data? Sector 0 as well?


My System SpecsSystem Spec
.
09 Apr 2019   #32
goopy

Windows 7 Ultimate x86
 
 

More screenshots:

1. It seems Getback identifies both ntfs volumes at 2048(bottom) and 2050(top).
2. Sector 2048 (bottom) seems to be a partial duplicate of sector 2050. It lists a single subfolder [00002B], but contains only 5 of the 8 files shown in the same subfolder in sector 2050. Sectors count is 2 less.
3. How to get Active recovery to scan the disk and display the contents?

Many thanks and best regards,


Attached Thumbnails
Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-get_s500.jpg   Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-get2048.jpg  
My System SpecsSystem Spec
09 Apr 2019   #33
jumanji

Windows 7 Home Premium 32 bit
 
 

"4. Am I correct to understand that Bootice detected a single valid NTFS volume at sector 2048, while both Minitool and Getback found two at sectors 2048 and 2050? "

bootice reads sector 0, sees the partition table for the volume starting at 2048 and shows it in Partitions . Sector 2048 may still be not a valid VBR. You can go to sector 2048 and see. If it is a valid VBR it would start with EB 52 90 4E 54 46 53 in the sector map which on the right ASCII panel shows as .R.NTFS .

It does not see a partition table for the partition starting at 2050 in sector 0 and so does not list it. But if you check sector 2050 you will see the above string in it.

MiniTool PW saw the partition table for 2048 at Sector 0 and listed it as existing. It also during the scan read sector 2050 where it found the NTFS string. Since it did not see a corresponding partition table in sector 0 it marked that as lost. ( bootice does not scan. you have to manually go to any sector to find what is in it)

"5. Is the OS's failure to identify the disk due to corrupted sector 2048? Is sectors 0 and 2050 also corrupted?"

You see, some program capable of modifying the partition structure for its operations and has modified it ,overrides the OS and takes control to show only the partition it had created. To do that it should always be running in the background right from the start, suppressing the OS. If you take away that program that was running in the background ( either deliberately or that program getting corrupted failing to run in the background) , the OS now gaining control sees a corrupted partition structure.

Without knowing how the partition structure got corrupted in a very unusual way - as I have been saying I haven't seen one like this before - I did not want to make any changes and that is why I abandoned bootice and went over to Getdataback. When it showed all images and images and images and nothing but images I have to infer as mentioned above ( right or wrong)

Getdataback and Active @ File Recovery has been recommended by us and used by many users successfully when no freeware could recover the data.

As for using Active @ File Recovery the download page also has a link to the users guide.

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-09-04-2019-13-54-45.jpg

I have not used any of these anytime. I am not a data recovery professional .


My System SpecsSystem Spec
.

09 Apr 2019   #34
jumanji

Windows 7 Home Premium 32 bit
 
 

A Samsung SSD860EVO 500GB Model Code: MZ76E500BW was just delivered to me. It came as "Unknown, Not initialised, Unallocated ". I put it inside an ORICO external case (delivered yesterday), initialised it as MBR. created a simple volume encompassing the full disk and did a quick format all in Windows Disk Management.

This should be the original condition.

The screenshots:

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-109-04-2019-18-18-04.jpg

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-209-04-2019-18-14-30.jpg
The highlighted 16byte string is the partition table for the first single partition starting at sector 2048.

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-309-04-2019-18-20-10.jpg

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-409-04-2019-18-21-02.jpg
This is how sector 2050 will look like in a normal SSD

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-09-04-2019-18-26-25.jpg

I haven't put any data into the SSD. So PW does not show any data. If there was data it will show in it.

If after running GetDataBack and /or Active @ File Recovery you see all your data and that is what you want to recover ( you are the person to decide on it and not me. For me that data is all Greek and Latin ) then buy a license and copy the data to another disk. ( As per info provided by GetDataBack the VBR at sector 2050 was created on 09/22/2018 5:04:35 P.M. What did you do on that day? VBR at 2048 was created on ??- you have to roll down and see. That should be the date it was first initialised and commissioned. I am learning more and more as I indulge in these projects.)

This is all what a professional data recovery can also and will also do and charge you a fat nothing less than $500.

After recovering the data,you can give clean wipe your SSD, initialise it as MBR and format it. Your SSD itself is still good. ( And yes it would have perhaps selfdestroyed itself if it had developed an electronic fault as Lady Fitzgerald opined earlier)


My System SpecsSystem Spec
09 Apr 2019   #35
goopy

Windows 7 Ultimate x86
 
 

Greetings Jumanji.
1. Getadata doesn't seem to show the creation date of Vol2048.
2. The disk is used almost exclusively for storing OS images created by Macrium. The earliest date shown by Getdata is 09/26. Earlier images may have bee deleted. If this mess is caused by a misbehaving application software, I'd say Macrium is the prime suspect.
3. The disk was last on 03/31 by Macrium to create a new OS image. It became unformatted the following day.
4. It would seem Getdata is able to get the lost data by accessing Sector 2050. If the problem is a matter of displaced location, would the disk be made readable if the MBR at Sector 0 is modified to point to Sector 2050 instead of Sector 2048?

5. Alternatively, it seems the original sectors 2048-2056 have been shifted by 2 to position 2050-2058. The current 2048-2049 is just a duplicate of the original 2052-2053. So if the current 2050-2058 is moved back to its original position beginning at 2048, and 2057-2058 zerorised, the disk might be made readable again.

What do you think?


Attached Thumbnails
Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-get-20502048.jpg  
My System SpecsSystem Spec
10 Apr 2019   #36
jumanji

Windows 7 Home Premium 32 bit
 
 

No lateral shifting is possible. The volume boot sector is just one component of the file system. There are other components that are written into the disk for bookkeeping. It should be evident if you had run checkdisk from the command prompt anytime. ( Verifying files, Verifying indexes,Verifying Security descriptors etc.,)

To make it more visible the following PerfectDisk screenshot will show what those are. ( During defragmenting process these metadata files are not touched. This screenshot is that of the 500GB SSD just formatted. There is nothing else on it. Only a valid NTFS file system)

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-10-04-2019-18-32-20.jpg

In the final analysis, there is no other option except trying to recover whatever could be recovered using Active @ File Recovery or GetDataBack the two we normally recommend in this forum.

( Once Partition Recovery Wizard did not show the files when you double clicked on the partition starting @ sector 2050, I gave up the idea of asking it to write the partition Table for that in sector 0 replacing the existing partition table for 2048. Doing that also would not have shown your files. For the same reason I had written off TestDisk also. TestDisk will not find the files. And that is the most potent truly free freeware)


My System SpecsSystem Spec
10 Apr 2019   #37
goopy

Windows 7 Ultimate x86
 
 

Thanks Jumanji.
On a completely new subject, is there a way to recover form a deleted GPT formatted dynamic disk NTFS volume? It 's now shown as unallocated space.
Many thanks and best regards,


Attached Thumbnails
Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-boot-tigo-dynamic.jpg  
My System SpecsSystem Spec
10 Apr 2019   #38
jumanji

Windows 7 Home Premium 32 bit
 
 

Quote   Quote: Originally Posted by goopy View Post
.......On a completely new subject, is there a way to recover form a deleted GPT formatted dynamic disk NTFS volume? It 's now shown as unallocated space.......
Please start a new thread explaining your problem in detail abinitio with a screenshot of Windows Disk Management showing your dynamic disk. A screenshot of how that disk looks like in PW is also necessary. There may be other experts like SIW2, dsperber, samuria, Megahertz07 ( to mention a few) who may be able to help. For me busy days ahead.. Good luck.
My System SpecsSystem Spec
Reply

 Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?




Thread Tools




Similar help and support threads
Thread Forum
Minitool Power Data Recovery or Runtime Get Data Back, which
Minitool Power Data Recovery or Runtime Get Data Back, which one would you choose or which one did you choose? I want to purchase a serious data recovery program for personal business use.
Backup and Restore
Samsung Recovery Solution 5 - Recovery Not Working - Remove?
I have a Samsung RV510 laptop that came installed with Samsung Recovery Solution 5. I had installed Ubuntu, didn't like it on this laptop, uninstalled it, fix mbr and boot, and I am back on to just Windows 7 Home Edition x64. I am having a problem where Samsung Recovery Solution 5 (SRS5), is simply...
Installation & Setup
My Notebook Shut Down When Running easeus data recovery wizard
- Windows 7 x64 bit; - the original installed OS on the system: windows 7 professional 64 bit; - full retail version; - the age of system (hardware) one year; - the age of OS installation: seven months after last installation. Hello, every time I run easeus data recovery wizard...
BSOD Help and Support
EASEUS Data Recovery Wizard - 3 Day Giveaway
|MG| EASEUS Data Recovery Wizard - 3 Day Giveaway Download
Software
Easeus Data Recovery Free ( normally $70)
EASEUS Data Recovery Wizard Giveaway: Get the Data Recovery Software Full Version for FREE. I have the Pro version of this software - it works very well. The Giveaway is for a limited time - tho. once you have it - it runs forever.
Software


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 08:12.
Twitter Facebook