Serious hard drive problem

[Cybermancer]

Since I've never cloned anything before, I was under the impression that a clone is basically the same as an image... The fact that it'll reformat and overwrite everything seem's like something that should be emphasized and re-emphasized with bold capital letters in your guides. DDrescue didn't even give any warning either. Usually software let's you know if it deletes or overwrites personal files.

I partially cloned the 500gb hard drive to a 2TB external hard drive, with about 600 gig's free. So where the hell did all that other space go? Did it just evaporate? I didn't even know it was possible for free space to be deleted.

Schofield's Second Law of Computing states that data doesn't really exist unless you have at least two copies of it. Kinda goes along with Murphy's Law if anything can go wrong, it will.
What a pickle.

I've always been a firm believer in Murphy's law. Now more than ever. Especially the quantized revision "Everything goes wrong all at once". Just this past month alone I've had the worst luck of my entire life... my smartphone got hardcore bricked, my debit card/checking info got leaked from Amazon by hackers, car's breaks failed while I was going down a hill straight into a busy intersection (nearly got me killed), 7.1 surround gaming headset got completely destroyed, lost my 64GB flash drives, and now all this. Either this is the work of a skilled thief/saboteur, or the machines are revolting against me. It almost seems supernatural. Maybe I'm being punished by Santa Clause or Jesus for being naughty or not believing in them. I've actually promised my higher self I'd quit smoking if he threw a miracle my way. That will be my new years resolution... I'm hoping for a fresh start and change of luck this new year, and praying the worst is over.

So yea, this is all going to set me back a pretty penny. I just purchased a new 5TB external hard drive for 138$, but this is just the beggining of my financial setbacks.

Just for the record please post a screenshot of how your external drive looks like in Windows Disk Management.

Your statement also made me think that perhaps you should try GetDataback Simple straightaway. If the MFT (Master File Table) has not been overwritten, it may perhaps find most of the files if any left. Also the author of TestDisk says when PhotoRec fails try GetDataback or Zero Assumption Recovery.

So do this first. Download the trial version of GetDataback Simple and scan your external drive. GetDataback Simple does not write anything to the drive and so it is absolutely safe like PhotoRec. If Getdataback Simple shows the files which you can preview also and assess the integrity, well and good.

With the Trial version you can't copy the files. You have to buy the license for it.

If it is successful in atleast showing most or some of the files with intact integrity, then try PhotoRec which is free. You can consider buying GetDataback after that.

Getdataback Simple: https://www.runtime.org/data-recovery-software.htm

I've acquired a laptop with working windows, as well as a new external hard drive. I'll get to work as soon as I get back home, and post the screenshots you've requested.

I've downloaded several different data recovery software including data recovery wizard. However I'm thinking of trying Seagate recovery first, since it's a Seagate external drive. I've also got Recuva, Data rescue, Stellar Phoenix, Ontrack, and Aid file recovery - which I've heard is best for recovering overwritten files. Not sure if that's true.

Aside from the text and image files, I'd honestly be satisfied if I could just recover fragment's of the media files I've lost, so I know what I'm missing.

 

[ThrashZone]

The bigger the hard drive the bigger the potential losses are with data
Personally I like to keep them down to 1tb to 775gbs. and use western digital blacks

I don't see how one can restore a clone but do know how to restore a system image with a recovery cd

 

[Baddog22556]

You can clone a hard drive using the imaging process. This is where the confusion may set in and the question arises about whether to clone or image. I use Acronis True Image but it can also clone.
Also @Cybermancer: if you're superstitious there are a million things to do or not do.
I just believe when it rains it pours sometimes. If it wasn't for bad luck you wouldn't have luck at all.
Florida made it against the law for bumper stickers like '**IT HAPPENS'. IT HAPPENS is OK.
New year coming up with mega-changes. (hopefully good ones.)

 

[Cybermancer]

No luck with Recuva or Getbackdata. They're only finding the clone data. Currently trying Seagate data recovery, Aid file recovery, and Phoenix stellar. They're taking a lot longer, so I'm guessing it's finding more stuff than the other software. Aid is finding a lot of media files judging by the extensions, which I think is a good sign, although they're all showing up as string of numbers in the search.

I found this on a forum

"Recovering data itself might be possible in very rare conditions, if by some miracle you stopped the clone before it reached into a second partition. If this is the case, you'd just have to rebuild the partition tables in their exact position. Unfortunately, this is harder than it looks and is usually impossible."

Can anyone tell from what I posted earlier whether ddrescue reached into a second partition? How can I rebuild partition tables?

I'm still not convinced all the files I had on there were overwritten. If I cloned a 500GB hard drive onto a 2TB external which had 1.4TB of data on it, then how could the hard drive clone overwrite more data than it has? This doesn't make sense to me. At least some of the external's data must be somewhere, perhaps on a hidden partition. I'm messing with partition recovery software, hopefully that'll give me a clue.

 

[jumanji]

The statement there applies if and only if you had more than one partition on your 2TB external drive.How many partitions did you have on the 2TB external drive and what is their extent?

 

[Baddog22556]

The destination disk will be deleted (all data and partitions) and the source disk will be cloned (copied) to the destination disk. The first thing done is erasing the MBR. You clone a 100MB drive to a 6TB drive
and the destination drive will be erased/formatted. You just have to hit start/proceed and turn your computer off immediately it is already too late.
Using disk partition software will allow one to create partitions on destination drive and then use the
cloning or imaging program to select source partitions and path to destination drive. No data or
formatting will be done outside the partitions selected.
Probably too late but for next time. Always, Always create a system image of your drive so you can
restore if Murphy's Law kicks in: "Matter will be damaged in direct proportion to its value."

 

[jumanji]

^ What you have stated is not correct. Sector to sector copying does not happen in a millisecond and it is definitely going to take a finite time. It neither erases the full length of the HDD nor formats it before it starts sector by sector copying. These again are time consuming processes which can't happen in a blink. As far as I have experienced ddrescue starts copying the moment you type the command and press enter.. It just copies sector by sector. When the new sector data is copied the original data on that sector is overwritten and therefore lost.

Here is my 750GB external drive with three partitions one 500GB +100GB +100GB



Sector 0 contains the MBR code and the Partition Table (in this example the start/end points of the three partitions).

The first volume boot record will always be at Sector 2048.

The screenshot shows the volume boot record sectors of the second and third partitions.

When sector 0 of the source disk is copied on to sector 0 of the destination external drive sure the original MBR code and partition Table of the external drive is lost and what one has now is the MBR Code and partition table of the source drive on the external drive.

Now assuming that that all sectors of the 500GB source drive had been copied to the external drive, I will still have the original volume boot record of my second partition and third partition and if so I should be able to recover all the data in the second partition and third partition.

That is why I asked him whether he had any partitions in his external drive and the extent of such partitions, but the OP has not answered.

I have now read the statement OP has quoted in his post #24 from the original thread. ( even though he did not give the link )

partitioning - Is it possible to UNDO a (failed) partition cloning made with the dd command to an external hardrive? - Ask Ubuntu

Even assuming that the OP had no partitions, he may try PhotoRec and see whether it can reconstruct the data in the sectors beyond the 500GB or beyond the point where copying was interrupted..

This is also suggested in the above link.

"Recovering data itself might be possible in very rare conditions, if by some miracle you stopped the clone before it reached into a second partition. If this is the case, you'd just have to rebuild the partition tables in their exact position. Unfortunately, this is harder than it looks and is usually impossible. Finally, there have been some reports of photorec working, but that isn't the norm. YMMV."

If the OP had only a single volume on his external drive , then PhotoRec is the only option to try. But he seems to have his own plans - some Forensic and things like that..

 

[Baddog22556]

The master boot record is always located at cylinder 0, head 0, and sector 1, the first sector on the disk.
If you grab the wrong drive, with critical data on it, and use it for your destination drive, any attempt to
clone or recover an image to that drive will will render it unusable if you suddenly remembered and tried
to stop the process immediately after starting it. And of course cloning or imaging takes a very long time
with huge disks with 500GB, 1,2 or 6 TB drives.
Something will, or should, happen to speed this process up with new higher and higher capacity drives.
I would never put all my eggs in one basket and NEVER, NEVER use your only hard drive to backup on
or save an image on it. If it crashes and burns then your backup never was or will be again.

 

[jumanji]

In HDD parlance, Cylinder 0, head 0, sector 1(as we count), is designated as sector 0 .( Count starts from 0. The first sector of the HDD is sector 0)

If I accidentally clone my 500GB source drive to my 750GB external drive, even assuming ddrescue completed cloning the full 500GB, my data beyond 500GB on the external drive, will still remain and I can recover it. I will use the Partition Recovery Wizard in Partition Wizard which during the Quick scan will find the volume boot records of the second and third partition and rewrite the partition table strings to sector 0.This will immediately make my drive accessible. The first partition will contain the data from the cloned source drive ( Original data overwritten) and the second and third partition the data that originally existed.

There is only one small uncertainty here on the second partition. Suppose my 500 GB source disk had more than 1049008128 sectors, (this can be a few tens of sectors more or less and never precise) then I would have lost the volume boot record at sector 1049008128 on the external drive. So Partition Wizard cannot find the second partition beginning and therefore cannot write the partition table string for this partition in sector 0.In this case I shall use PhotoRec to reconstruct the files that were in the second partition.

In the case where one has only one single volume starting at sector 2048, one has to necessarily try PhotoRec and check whether it can carve out the files beyond 500GB or the point where copying was interrupted. No partition recovery is possible since there is no second ,third ...........partition.

 

[Cybermancer]

So after Seagate and Phoenix Stellar turned out to be failure's just like the others, I had almost given up hope... I was a bit skeptical about aidsfile due to it's choppy english interface, but I was wrong about it. Either I was right that the files were still hiding somewhere on the drive, or this software really does recover overwritten files like it claims. It had actually managed to locate and recover every single file I had on there before the clone catastrophe, and then some... I'm seeing files I didn't even know I had or forgotten. It's a bona fide miracle. I guess now I have to make good on that resolution to my higher self haha... However, some of the files are corrupt/fragmented and I'm not seeing my odt files, so I guess I only need to cut down rather than quit entirely. Also it only recovered the individual files without their respective folders, so it's a total mess... I'll have to do a lot of reorganizing. Anyway's I was so ecstatic, I almost called Drivesavers just to tell them HA! AND YOU SAID IT COULDN'T BE DONE! Maybe they'd offer me a job, which I could really use right now.

Now I must continue what I originally set out to do... recovering that corrupt hard drive. I'll probably just try photorec again, and transfer the files directly to my new external hard drive. No more damned cloning.

 

[jumanji]

That's some real good news . What is that aidsfile? Can you please post the link to download?

 

[jumanji]

OK, I got it. Shall look into it when time permits.

File recovery - Aid file recovery software

 

[Cybermancer]

I used the professional edition

 

[jumanji]

On closer scrutiny, it seems to have done what PhotoRec would have done exactly. I don't see anything special or different to call it a super software that has escaped our attention so far.

In any case I shall overwrite data deliberately, and run it to determine whether it really brings out any overwritten data in due course and post the results.. The experiment is simple but I have to find sometime to sit tight on it and do.

Which of the four options did you choose? Format Recovery, Delete Recovery, Partition Recovery,Full Recovery ?

 

[jumanji]

I used the professional edition

Did you purchase it? I don't want to use pirated software just to experiment..

 

[jumanji]

OK, it says free edition can recover 1GB. So I shall go ahead with my experiment sometime.

 

[Cybermancer]

I will also experiment and try to replicate this successful recovery with photorec. Perhap's it'll do it faster, and yield more complete files. With aidfile I think I chose the full scan option followed by recover iirc

 

[jumanji]

Yep. You are in a better position to try it .

Off now and we have been without power since morning and I have been running on the inverter . Time now to save the remaining inverter power for any exigency tonight.

 

[Baddog22556]

Destroying information on a hard drive isn't easy. Hit it with a hammer or disk wipe programs
are not good enough. The FBI and NSA, and others, use forensics that would bedazzle you.
The three best ways to destroy a hard drive are with a drill, where the disc is physically not
capable of being read anymore, microwave oven, or my favorite — thermite. Chemicals are also
a possibility but not really practical. Any given file occupies less than .0015 square inches,
so even small fragments can be read with advanced equipment.

 

[Cybermancer]

Photorec seems to be recovering a wider range of file formats, including a lot of useless ones like dll's and other crap that just takes up time/space... it's just haphazardly dumping them all into folders, without any neat categorization like aidfile did. But it's also recovering a lot of files I needed that aidfile couldn't recover, like the aforementioned odt files. However, it freezes when it gets to a certain sector. Others get this problem too, but they say they had better luck with qphotorec, so I'll give that a shot next.

Also, I want to create an image of the failed hard drive, before I attempt repairs. Should I use testdisk, or is there something better? I want to be sure I'm creating an image, and not a clone. Some people have referred to the testdisk imaging as cloning, so I'm not so sure. I have Paragon disk manager, would it be better suited for this purpose?