Laptop Toshiba 500GB crashed NTSF patitions became RAW

[jumanji]

Good. I shall write the next episode after another 17 hours that is tomorrow afternoon.. ( I am going out now and then it is night time) I hope you have saved Sector 2048 also which I mentioned last in my last post.

 

[jumanji]

The next episode .

As already told you will now zero all the wrongly written GPT structure data in sector 0, 1, 2, n, and n-32.

Here is how.

Using bootice go to sector 0 on your faulty drive. CAUTION: Make doubly sure you have selected the correct faulty 500GB drive. If you wrongly do this zeroing on your system drive your PC will become unbootable. ( By default bootice will show the USB drive but that is no reason to throw caution to the winds. During these procedures also make sure that you have no other USB storage device plugged in to avoid accidental zeroing on those)

On sector 0 drag your mouse pointer from top left corner to the bottom left corner to select all fields. All filds shoud turn blue.



Click on the Fill selected block icon and in the ensuing Fill Char Window, make sure 0x00 is selected and click on OK.



All fields will turn into 00. Click on the Save changes icon to write it to the HDD. Done. You have effectively overwritten the Protective MBR with 00s making it ready to receive the real MBR code and the partition table.



Now repeat this zeroing on sector 1, 2 , n ( in your case the last sector 976773167) and n-32 ( in your case sector 976773135). Make sure you click on Save changes button to write 00s to each of these sectors..

Close bootice completely and then rerun it again afresh, select your faulty drive and check that sector 0, 1, 2, n and n-32 are all zeros.

NOTE: Do not zero sector 2048. That is the original Partition Boot Record and we want to retain it.

Close bootice, safely remove your 500 GB external drive.

If you haven't already installed, download and install MiniTool Partition Wizard Free edition 9.1 https://www.partitionwizard.com/free-partition-manager.html

Confirm that you have completed all this and then we shall proceed to the next and perhaps final episode of restoring your HDD. ( As with all Partition Recovery/Data Recovery efforts, I am keeping my fingers croseed as between the cup and the lip there can be many a slip )

 

[GeekEco]

OK I have done this! waiting for next step

 

[jumanji]

I am still doing my homework for the next crucial post . You may expect it my tomorrow morning. It is going to be a win-win or no-win situation. Mostly win-win as per my present perception. Let us see.

 

[GeekEco]

Thanks for working on it! What are the odds of it not working? If it is no-win situation will I be able to revert back to where I was before we started so I can recover all the raw files on my HDD?

 

[jumanji]

Continuing,

Now plug in only your faulty 500GB external drive. Go to Windows Disk Management. Since we had already zeroed sector 0, you will be asked to initialise your 500GB drive. Go ahead and initialise it as an MBR drive.This will write the MBR code into Sector 0. Stop with initialisation.( Do not go further. Do not create a new volume. Do not format.)

Post a screenshot of Windows Disk Management adhering to the guideliines here http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

Close Windows Disk Management.

If you now examine the drive with bootice, you will find that the MBR code has been written to sector 0, but the four 16 byte slots ( highlighted in the screenshot in different colours) where the 16 byte partition table/s should exist, will all be zeroes.



We shall now check whether Partition Wizard can locate the partition start point/s and write the partition table/s.

Run Partition Wizard.

Post a screenshot of how your 500GB external drive appears in it ( the very first screen when you launch PW).

On the left pane click on Partition Recovery Wizard > Next > select your faulty 500GB external drive > Next > Full Disk > Next > Quick Scan > Next

Let the Quick scan run and complete the run. It may be a short run or a long run. Wait till it completes. At the end you will get a window showing the found partitions like the one below.



Take a screenshot of that Window and post.

Click on the Cancel button, and then close Partition Wizard. (You can run Quick Scan again - if conditions are favourable - after getting my instructions.)

If all the partitions are found correctly, then we can recover the partitions and restore the drive. If not we shall shift from Partition Recovery to Data Recovery)

Post the screenshots and wait for further instructions..

 

[GeekEco]

Well right not looking so good. The progam is currently not responding locked up. Could be bad sectors on it. Can't kill the program in process explorer, can't eject drive. I have to reboot.

 

[GeekEco]

Actually. I was able to unattach the hdd and close the application after waiting a bit. I have a lot of medical research on this drive. Would a data recovery center have more sophisticated tools to recover the with their file names. EasUS said they could recovery most of the files in raw file format but I don't know if they are the best out there for something like this if there are bad sectors on the hard drive. Thx for your help!

 

[jumanji]

After passing the System Reserved Partition ending at LBA206846, PW is having problems reading the next volume boot sector. That volume boot sector is most probably corrupted.

We haven't yet completed our data recovery process.If all our efforts fail using all possible means, then you can consider entrusting your work to Data Recovery Professinal. We haven't reached that stage yet. Of course it is a slow process.

1. In your post #17, you showed me the first partition boot sector 2048. Now with bootice examine sectors 206847, 206848( The most probable second partition boot sector) and 206849.Does one of them show more or less the same picture as in 2048? You should be able to read the word NTFS on the ASCII panel in the first row.

2. If bootice can read the sectors, then I wouldn't call those bad sectors but corrupted sectors which can be rewritten. We may have to use TestDisk to find the backup bootsector and write it.

3. In Partition Recovery Wizard, instead of Full Scan select a specified range now 207000 to 976773167 and let it scan. If it finds a large partition then it was your C drive and we can recover the partition.

As long as PW does not show it as a bad drive ( I wanted the screenshot only to check on it), we have many options to try and recover the partitions/ recover the data

 

[GeekEco]

Ok, that's good to know My HDD had a recovery partition, c:\ primary system partition 25-30GB? and my D:\ drive was were I kept all my data. FYI When I ran eause free recovery program, I wanted to see if it could even read the drive which it did. I could see all the files in raw file format. I don't know if it created mini partition.

On this latest adventure, I put in the boot sectors and as you stated ascii and ntsf showed up with slight change in data but on 206849 it said bootmgr...screen shots enclosed. I ran Partition Recovery Wizard and it hung or I think it hung as the scan sectors numbers stopped and the cursor said program not responding at 1498496. I couldn't eject the drive and had a difficult time killing the process. There was no activity in process explorer that it was accessing the drive. However, the drive light was flashing as well has the light on my hard drive. I realized that my anti-virus and anti-malware as well as windows indexing were accessing the drive as indicated by process explorer. So I don't know if that was causing the hang. So, I disabled indexing and the anti-virus/anti-malware on one but could not turn off the anti-virus unless I uninstall the program. So, I ran Partition Recovery Wizard again and it went a bit further to 1499008 so maybe its algorithym is sitting there trying to crunch through the corrupted stuff. But at that rate, it would have be days if at all to scan the disk. I didn't want to stress out HDD as I don't know how much damage there is to HDD and how much longer it will last. Appreciate your help.

 

[jumanji]

OK, good that you posted the screenshots of sector 206847,.....48 and ......49. We have a small clue here. There are two partition boot sectors one at 206847 and one at 206848. This can't be like that. There should only be one partition boot sector. This also may be the reason why PW got confused and stalled.It may be the same case with your C and D partitions. I shall reserve my comments on this to my last post in this thread - whenever it happens .

Now look at the second PRW screenshot in my post #26. The next partition always starts in the previous ending LBA +2. So do this now: Save LBA 206847 with that sector Number and then zero it. Quit bootice, safely remove your drive and then plug it in again. Run bootice and check it has been really zeroed. Quit bootice after this check.

Reboot your PC, plug in your drive and now run Partition Recovery Wizard Quick Scan. Does it now find the second partition easily? It may stall again after finding the second partition but from the ending LBA showed you can repeat the same process to get the third and fourth partition start point. ( Always remember to save the sector by that sector number before you zero it - just in case we need to restore it)

Let me know first whether the second partition was found before repeating the process to find the third and fourth partitions.

As always, I am keeping my fingers crossed. This job is like that .

 

[GeekEco]

You want me to save 206847 as 2 and then zero out 2. I cannot save 206847 as 2 as there are no Save AS function. I can only zero out 206847 but I do not see a menu action to save as sector to 2???

WHEN I Try to SAVE IT as 2 I enter 2 in save it box It then loads 2 again and I lose 206847. I WANT TO SAVE IT as 2 but when I ENTER 2 it BRINGs UP 2 AGAIN on screen/ Bottom line can zero it out but do not see a menu action to save it as 2? I'M CONFUSED.

 

[jumanji]

You are confused. Yes . Go to Sector Number 206847. Click on "Save to file". Give the name sector206847 and back it up.( The same way you backed up the sectors before). It will be backed up as sector206847.bin in the bootice folder.,

After backing it up, zero that sector in the same way you zeroed the GPT sectors before, killing the duplicate bootsector 206847..

Regarding my statement on the screenshot at post # 26;

First sector Starting LBA 2048. Ending LBA 366416443. Second partition starting LBA 366416445, that is the previous partition ending LBA 366416443+2.

So in your case I believe the (first partition ending LBA 206846+2) = 206848 is the real and correct second partition starting LBA.

So we are retaining 206848. We are killing the duplicate bootsector 206847 by zeroing it.( after saving it, just like you saved the GPT sectors 0,1,2,n and n-32 and then zeroed it)

So save sector 206487 - as a precautionary measure with the name sector206847 - and then zero it to kill that duplicate.Remember to click Save changes icon on the menu bar to write zeros into the HDD.

After that run Partition Wizard Quickscan. Report if it lists the second partition with starting LBA at 206848. Post a screenshot. ( Partition Wizard will again stall after finding the second partition. The best and proper method for terminating a not-responding program is press CTRL+ALT+DELETE to invoke Task Manager, select the not responding program in the Task Manager list and end it. Don't simply pull out the drive.)

 

[GeekEco]

Yes I was confused/ I will be traveling over the next couple of days attending meetings so I don't know how much time I will have but will take my HDD with me in case I have time.

I never remove the drive by pulling it out. My description above was trying to eject it but my anti malware was accessing the drive. In Process Explorer with admin rights, I saw Partition Recovery Wizard not using any memory jsut sitting there. I tried to kill the program by repeatedly ending the process through closing Partition Recovery Wizard and also through Process Explorer. It was not using any memory in the threads. My anti malware was going crazy with high CPU usage and the flashes on both HHD indicator light. So I believe it was trying to analysis the drive for malware. I killed all programs accessing the drive and then after that Partition Recovery Wizard closed. I never thought about task manager maybe it is more effective than Process Explorer in closng programs with admin rights. At no time did I pull out the drive without ejecting. My last though was just shutdown windows if I couldn't close the program

Thanks for the information and help! Stressful time as there is a lot of research material on the D Drive.

 

[GeekEco]

I did a quick full scan as mentioned and it hung as you mentioned 206846 not a large partition size

 

[jumanji]

Please post a screenshot of sector 206847 and sector 206848 taken with bootice as it exists now.I want to confirm that 206847 has been zeroed and 206848 remains as it was before.

 

[GeekEco]

OK, I had some problems. I connected HHD back into my laptop usb port heard the sound that I normally get but no eject button showed in my taskbar. My computer did not show the drive. It did not show up in devices and printers panel. I ran bootice and click on UAC window for admin rights but nothing happened. bootice did not appear on my screen. So I clicked it again and then click on uac button nothing, no window. so i did it a third time and still no window but all three programs were running in different processes in taskmanager. Weird. So I killed all instances of the same program and the same thing happend again. So I shut down the computer. unplugged the HDD and restarted the computer. So I plugged the usb HDD back in same thing occured. I heard the normal connection sound but no eject in task bar, nothing under devices, nothing in MY computer, I opened admin tools and storage-drive component and it saw C and D drive and an unknown blank drive where toshiba drive is normally listed. I thought I lost the drive. So Imoved the drive without disconnecting it and sound the sound of connection came on and everthing showed up nomraly in taskbar, devices and admin storage panel. Bootice then worked normally so I retook the screen shots but afraid it might be on its last legs.

I included 0 sector as well in case something is wrong there from the original thx

 

[jumanji]

Whenever you encounter problems like this, shut down your PC, remove the drive. Shutting down will close everything. Re boot and then plug in your drive.

If you run drive seeking programs one after another, your drive may get locked by a program and not get released for another program to see it.

Since you brought this problem do it now.

Shut down your PC. Remove the 500GB external drive(if you hadn't removed it earlier). Reboot and then plug in your drive. Now invoke Windows Disk Management. Post a picture of Windows Disk Management. Close Windows Disk Management.

Safely remove your drive. Plug it in again. Now run bootice. Does bootice see the drive?

I just want to make sure everything is fine before proceeding further.

( If I ask you to run bootice, do not open Windows Disk Management (WDM), PW or any other program to see the drive and then run bootice. Run bootice only without opening any other program prior to it. If I ask you to run PW straight away run it without opening WDM or bootice before it.Before changing over from one program to another, close the running program, safely remove and then plug in your drive before running the other program.Never run these drive seeking programs simultaneously. It may lead to a panic situation like the one you faced.)

 

[GeekEco]

Yes bootice sees the drive everything is now working for now. OK THX for info

 

[jumanji]

OK, your drive appears fine. You have also correctly zeroed 206847 retaining 206848. But that hasn't helped matters. Quick scan still stalls at 2048. Instead of a Full Scan do a range scan with the range 206000 to 207000 and check whether it finds the second partition at 206848.

Sample screenshot selecting the range:



Whether Quick Scan stalls or finds the partition at 206848, post a screenshot.

( If it stalls, shut down the computer or do the Ctrl+Alt+Delete and kill the program in the Task Manager.)