Samsung SSD gone rogue(raw) - Minitool or EaseUS for data recovery?

More screenshots:

1. It seems Getback identifies both ntfs volumes at 2048(bottom) and 2050(top).
2. Sector 2048 (bottom) seems to be a partial duplicate of sector 2050. It lists a single subfolder [00002B], but contains only 5 of the 8 files shown in the same subfolder in sector 2050. Sectors count is 2 less.
3. How to get Active recovery to scan the disk and display the contents?

Many thanks and best regards,

"4. Am I correct to understand that Bootice detected a single valid NTFS volume at sector 2048, while both Minitool and Getback found two at sectors 2048 and 2050? "

bootice reads sector 0, sees the partition table for the volume starting at 2048 and shows it in Partitions . Sector 2048 may still be not a valid VBR. You can go to sector 2048 and see. If it is a valid VBR it would start with EB 52 90 4E 54 46 53 in the sector map which on the right ASCII panel shows as .R.NTFS .

It does not see a partition table for the partition starting at 2050 in sector 0 and so does not list it. But if you check sector 2050 you will see the above string in it.

MiniTool PW saw the partition table for 2048 at Sector 0 and listed it as existing. It also during the scan read sector 2050 where it found the NTFS string. Since it did not see a corresponding partition table in sector 0 it marked that as lost. ( bootice does not scan. you have to manually go to any sector to find what is in it)

"5. Is the OS's failure to identify the disk due to corrupted sector 2048? Is sectors 0 and 2050 also corrupted?"

You see, some program capable of modifying the partition structure for its operations and has modified it ,overrides the OS and takes control to show only the partition it had created. To do that it should always be running in the background right from the start, suppressing the OS. If you take away that program that was running in the background ( either deliberately or that program getting corrupted failing to run in the background) , the OS now gaining control sees a corrupted partition structure.

Without knowing how the partition structure got corrupted in a very unusual way - as I have been saying I haven't seen one like this before - I did not want to make any changes and that is why I abandoned bootice and went over to Getdataback. When it showed all images and images and images and nothing but images I have to infer as mentioned above ( right or wrong)

Getdataback and Active @ File Recovery has been recommended by us and used by many users successfully when no freeware could recover the data.

As for using Active @ File Recovery the download page also has a link to the users guide.



I have not used any of these anytime. I am not a data recovery professional .

A Samsung SSD860EVO 500GB Model Code: MZ76E500BW was just delivered to me. It came as "Unknown, Not initialised, Unallocated ". I put it inside an ORICO external case (delivered yesterday), initialised it as MBR. created a simple volume encompassing the full disk and did a quick format all in Windows Disk Management.

This should be the original condition.

The screenshots:




The highlighted 16byte string is the partition table for the first single partition starting at sector 2048.




This is how sector 2050 will look like in a normal SSD



I haven't put any data into the SSD. So PW does not show any data. If there was data it will show in it.

If after running GetDataBack and /or Active @ File Recovery you see all your data and that is what you want to recover ( you are the person to decide on it and not me. For me that data is all Greek and Latin ) then buy a license and copy the data to another disk. ( As per info provided by GetDataBack the VBR at sector 2050 was created on 09/22/2018 5:04:35 P.M. What did you do on that day? VBR at 2048 was created on ??- you have to roll down and see. That should be the date it was first initialised and commissioned. I am learning more and more as I indulge in these projects.)

This is all what a professional data recovery can also and will also do and charge you a fat nothing less than $500.

After recovering the data,you can give clean wipe your SSD, initialise it as MBR and format it. Your SSD itself is still good. ( And yes it would have perhaps selfdestroyed itself if it had developed an electronic fault as Lady Fitzgerald opined earlier)

Greetings Jumanji.
1. Getadata doesn't seem to show the creation date of Vol2048.
2. The disk is used almost exclusively for storing OS images created by Macrium. The earliest date shown by Getdata is 09/26. Earlier images may have bee deleted. If this mess is caused by a misbehaving application software, I'd say Macrium is the prime suspect.
3. The disk was last on 03/31 by Macrium to create a new OS image. It became unformatted the following day.
4. It would seem Getdata is able to get the lost data by accessing Sector 2050. If the problem is a matter of displaced location, would the disk be made readable if the MBR at Sector 0 is modified to point to Sector 2050 instead of Sector 2048?

5. Alternatively, it seems the original sectors 2048-2056 have been shifted by 2 to position 2050-2058. The current 2048-2049 is just a duplicate of the original 2052-2053. So if the current 2050-2058 is moved back to its original position beginning at 2048, and 2057-2058 zerorised, the disk might be made readable again.

What do you think?

No lateral shifting is possible. The volume boot sector is just one component of the file system. There are other components that are written into the disk for bookkeeping. It should be evident if you had run checkdisk from the command prompt anytime. ( Verifying files, Verifying indexes,Verifying Security descriptors etc.,)

To make it more visible the following PerfectDisk screenshot will show what those are. ( During defragmenting process these metadata files are not touched. This screenshot is that of the 500GB SSD just formatted. There is nothing else on it. Only a valid NTFS file system)



In the final analysis, there is no other option except trying to recover whatever could be recovered using Active @ File Recovery or GetDataBack the two we normally recommend in this forum.

( Once Partition Recovery Wizard did not show the files when you double clicked on the partition starting @ sector 2050, I gave up the idea of asking it to write the partition Table for that in sector 0 replacing the existing partition table for 2048. Doing that also would not have shown your files. For the same reason I had written off TestDisk also. TestDisk will not find the files. And that is the most potent truly free freeware)

goopy said:

.......On a completely new subject, is there a way to recover form a deleted GPT formatted dynamic disk NTFS volume? It 's now shown as unallocated space.......

Please start a new thread explaining your problem in detail abinitio with a screenshot of Windows Disk Management showing your dynamic disk. A screenshot of how that disk looks like in PW is also necessary. There may be other experts like SIW2, dsperber, samuria, Megahertz07 ( to mention a few) who may be able to help. For me busy days ahead.. Good luck.