Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?

jumanji · 06 Apr 2019

goopy said:

Greetings Jumanji.

1. .......I'd like to try this on a duplicate of of the samsung. Is there a way to make a sector-by-sector duplicate?
2. What did the screenshots tell you about the status of the samsung?
3. Tried a direct sata connection. But no resurrection this time.

Many thanks and best regards,

1. I hadn't cloned a drive anytime. So not a or the best person to give any recommendation

. But people here in Seven Forums have been recommending Macrium Reflect

"The best program I have found for imaging and cloning is Macrium Reflect. Cloning is as simple as it it gets on Macrium Reflect. Just click on the dive and partitions you want to clone, click on Clone this Disk, select the drive you want to clone to, and go from there. The prompts are simple to follow." -Lady Fitzgerald in Use Macrium Reflect (free) or other to clone a Win7 hard disk

Also a youtube video

You may also google "hdd cloning software" and take your pick.

You are on your own

.

2. I had already told about what Partition Wizard>Partition Recovery Wizard found. VBR @ sector 2048 the first partition start sector -Partition existing but corrupt. Reason why the File System shows as " other" and not NTFS. Don't know why it finds a VBR at sector 2050 - Lost/deleted and how it came about. I haven't seen one like that

3. I don't understand a bit of what you are saying and meaning. "But no resurrection this time" What exactly do you mean by that? What did you try after a direct connection and what did you find? Please elaborate.

goopy · 07 Apr 2019

jumanji said:

...
Open the bootice folder and check those have been saved. The size of each file will be 512 bytes.Close bootice. Post the screenshots
.....

Not sure if I understand this. Nothing in the folder.
Screenshots attached.

jumanji · 07 Apr 2019

jumanji said:

3. I don't understand a bit of what you are saying and meaning. "But no resurrection this time" What exactly do you mean by that? What did you try after a direct connection and what did you find? Please elaborate.

Answer.

If you skip reading and answering my posts/queries, I will also skip reading and answering your queries

.

One more question: If you are using a third party enclosure or dock for placing your Samsung 500GB SSD, please provide the manufacturer's name, and model number/name so that I can check their specifications. If you can post a link where the product and specifications can be seen it will be much better. (Incompatible old enclosures/docks can corrupt the storage device placed into it under certain conditions.)

How to save specific sectors is well explained in my post #7 here.

Lost partitions!

( I already mentioned it in my post #16. Did you read it?)

Please read it and save sectors 0 , 2048 and 2050 only. Once stored, open the BOOTICE_2016.06.17_v1.3.4.0 folder and show me the contents of the folder - screenshot

A sample screenshot from my PC:

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-07-04-2019-16-52-57.jpg

On the screenshots you posted last:

Sector 0 shows the presence of only one partition table. The first partition

Sector 2048 does not show a valid VBR , A valid VBR should be the one like in the screenshot of sector 2050

When one initialises a Disk as MBR, the MBR code is written into sector 0. Nothing more.

When one creates a single partition, the partition table for that partition is written into sector 0. Sector 0 is complete. ( Sector 0 can accomodate four partition tables meaning you can create four partitions in a MBR drive)

When one formats the partition a Volume Boot Record is written at the start sector and space is reserved for the Master File Table.In other words the NTFS File system is written into that partition .The first partition always starts at sector 2048. So one will always find the VBR at sector 2048.

VBR at sector 2050 stumps me. I haven't seen one like that before.What happened? How it could happen? *scratches his head*

If a valid VBR has somehow been written into sector 2050, it would also mean that a new NTFS with a new Master file Table space has been written/allocated and the original Master File Table for VBR at 2048 would have been lost.

Given this situation, we will only be forced to shoot in the dark trying various tools in the hope we can somehow hit the target. So nothing is guaranteed.

But as I said we can restore the drive as it is now since we are dealing only with specific sectors. Saving those sectors is therefore essential and should be done correctly.

goopy · 07 Apr 2019

Greetings Jumanji.
Appreciate your spending your sunday looking at partition table.
1. The enclosure is a $10 chinese made product picked up on sale. There's a sticker "Blueendless" at the back, but I doubt it'd be of any help to you. I tried connecting the ssd directly to the sata port, hoping it would be detected as formatted, but that did not work.
2. Should I use Backup to File or Save Changes to save a sector? Does Save Changes write to the disk?
Many thanks and best regards,

jumanji · 07 Apr 2019

For saving the sector you will go that sector and click on "Backup to file" button in the Menu Bar and in the ensuing dialog box give it a name say LBA0 ( if you are saving sector 0) and click on the Backup button in that Window. Likewise for sector 2048 and 2050.

( "Save changes" will write whatever is on the screenshot to the disk. Do not write unless I ask you to write)

"The enclosure is a $10 chinese made product picked up on sale."

You will buy a costly Samsung SSD and put it in a cheap " no-name" chinese enclosure!!!

Anyway let me believe that it hadn't done any harm to your SSD.

Now post one more screenshot. Click on the "Partitions" button and post a screenshot.
It may look like the screenshot below. It will show your existing partition structure.

Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?-07-04-2019-19-45-06.jpg

For the day this will be my last post though I may be watching Seven Forums on my mobile without logging in and barge in if necessary and I haven't gone to sleep.

goopy · 07 Apr 2019

Thanks Jumanji.

jumanji · 07 Apr 2019

OK, bootice seems to see a valid NTFS at sector 2048.

For the timebeing we shall shift course and check whether GetDatback can see your data.Download, install and run Getdataback Simple from Data Recovery Software Products - Runtime Software Products
(Please read the how to guides and other documents linked in that page.)

It will show your drives. Click on the 500GB SSD and it will scan the drive and show the folders and files. Does it?

If it shows, you can open the files and check the integrity.

With the demo version you cannot copy the files. We are using this only to check whether your files can be seen.

Since it only scans and does not write anything to the drive you can afford to make any number of mistakes in trying to familiarise with it.

jumanji · 07 Apr 2019

OK, bootice seems to see a valid NTFS at sector 2048.

For the timebeing we shall shift course and check whether GetDatback can see your data.Download, install and run Getdataback Simple from Data Recovery Software Products - Runtime Software Products
(Please read the how to guides and other documents linked in that page.)

It will show your drives. Click on the 500GB SSD and it will scan the drive and show the partitions .Click on the partition to show your folders and files in it. Does it?

If it shows, you can open the files and check the integrity.

With the demo version you cannot copy the files. We are using this only to check whether your files can be seen.

Since it only scans and does not write anything to the drive you can afford to make any number of mistakes in trying to familiarise with it.

goopy · 08 Apr 2019

Greetings Jumanji.
1. As I indicated earlier, finding the files wasn't a problem. But GetDataBack is lightning fast, and more intelligent than the OS, it would seem, knowing where to locate the files without having to do any scan.
2. Some files are located in the lower partition. Not sure if these were the deleted ones.
3. Was able to open one txt file that looks OK , but cannot be 100% certain without any hash to compare.
Many thanks and best regards,

jumanji · 08 Apr 2019

Morning I had to visit my bank to get a financial statement of my accounts with them to sponsor my granddaughter for her higher studies in USA and when I returned after obtaining the statement that I am enough rich and could afford to pay for her escapade in USA, I was so tired that I was in no mood to write a post. Anyway that job is over.

Referring to your Getdataback screenshot , I believe that you were shown two disks, one your 500GB system disk and two your 500GB Samsung disk.Clicking on the 500GB Samsung SSD you were shown two volumes and perhaps both the volumes showed your files.And almost all of them were/are system images.

I do not know what all imaging software you have used - but those seem to have changed the partition structure of your disk.Now a conflict has arisen which in my opinion is irreversible. ( Long long ago I was using Acronis True Image and was updating to each new version. When I came to know that it makes irreversible changes to MBR, I jettisoned it.)

Recalling your question in the first post "A simple disk scan using free data recovery tools made by both Minitool and EaseUS suggested complete recovery of lost data could still be possible. Which of the two is the forum's favourite to perform the actual data recovery task?"

Neither the MiniTool Power Data Recovery nor the EaseUs Data Recovery is really free. With the free version you can recover only 2GB or so data. For more you have to get a licensed version.
EaseUS(R) Data Recovery Wizard - Best Data Recovery Software to Recover All Lost Data.
MiniTool Power Data Recovery Comparison

With the assimilated information thus far I have come to the conclusion that you have to use the commercial software to recover any data from both the volumes - coexisting one on one - shown now. Even with this, I do not rule out that some data could already have been overwritten and you have to be happy with whatever intact data you get. ( Had it not been image files it would have been easy to check the integrity of the files with the demo versions before buying a licence)

You can now try Active @ File recovery which works the sameway as Getdataback . Some users have said it is much better than Getdataback. After ascertaining that it also shows all your data, you can buy a licence for either of the two . Active @ File recovery will cost USD30. and Getdataback $70. Take your pick.That is the only choice you have. No freeware and even TestDisk will be able to recover the data from both volumes on the disk.

Active@ File Recovery: download evaluation version for free