Damaged hard drive

Y

yaro137

My disk that was keeping the system partiton started failing on me to
the point that now I can't even get whole the way to Windows. It
starts loading but then it bluescreens with some error. Same with Safe
mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
installation but it wouldn't run on that drive. Possibly too many bad
blocks.
When I then connected the disk to another PC it the system recognizes
it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
but it doesn't work. Any idea what else can I try to get some data of
that drive?
yaro
 
C

Craig Coope

My disk that was keeping the system partiton started failing on me to
the point that now I can't even get whole the way to Windows. It
starts loading but then it bluescreens with some error. Same with Safe
mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
installation but it wouldn't run on that drive. Possibly too many bad
blocks.
When I then connected the disk to another PC it the system recognizes
it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
but it doesn't work. Any idea what else can I try to get some data of
that drive?
yaro

Why you plug it into another PC can you boot from that PCs OS and then
"explore" your busted drive whilst in Windows?
 
R

R. McCarty

You actions may have actually reduced any chance of recovery.

When a drive is failing ( did you actually check the SMART table ? )
you need to make one, concerted effort at recovery. Depending on
the level of errors you have to choose perhaps one of two methods:
1.) Boot to a Linux distro and copy critical data only. (Docs, Mail).
2.) Use a Boot Media disk of Acronis True Image and attempt a
image using an optional setting to ignore disk errors. This has
maybe a 35-50% chance of successfully completing. The key
here is to get a image ( or a large portion ) and then attempt
to get critical files from it and not the source drive.

If the second PC only detects a 31-Gig partition then I'd say your
chances of recovery are pretty low.
 
Y

yaro137

No, I couldn't see the contents when connecting it to another PC.
Actually when I tried accessing it the system asked me if I want to
format it.
Thought Ghost will ignore any bad sectors but as you suggest I'll try
getting to it from sime Linux Live CD
or through that Acronics product. For the moment the disk seems to be
stable. Just can't get to the data.
I checked that error and one off the possibilities points to a boot
sector virus. However if it was so wouldn't
the fix* commands fix it?
yaro
 
J

Jim

My disk that was keeping the system partiton started failing on me to
the point that now I can't even get whole the way to Windows. It
starts loading but then it bluescreens with some error. Same with Safe
mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
installation but it wouldn't run on that drive. Possibly too many bad
blocks.
When I then connected the disk to another PC it the system recognizes
it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
but it doesn't work. Any idea what else can I try to get some data of
that drive?
yaro

And the error says .................?
 
B

Bennett Marco

yaro137 said:
My disk that was keeping the system partiton started failing on me to
the point that now I can't even get whole the way to Windows. It
starts loading but then it bluescreens with some error. Same with Safe
mode. Tried fixboot and fixmbt but it didn't do anything. Tried repair
installation but it wouldn't run on that drive. Possibly too many bad
blocks.
When I then connected the disk to another PC it the system recognizes
it as a 31GB drive although it's 250GB. I tried cloning it with Ghost
but it doesn't work. Any idea what else can I try to get some data of
that drive?
yaro

You waited too long after you realized you had disk problems.

Next time you'll know better.
 
Y

yaro137

The error is 0x00...7B(0xF8981524, 0xC00...34,000...,000...)
Also in safe mode it hangs on something called JGOGO.sys
yaro
 
P

Paul

yaro137 said:
The error is 0x00...7B(0xF8981524, 0xC00...34,000...,000...)
Also in safe mode it hangs on something called JGOGO.sys
yaro

JGOGO.sys is a JMicron JMB363 driver file. Perhaps the disk is
connected to the JMicron port ?

This is the approach I'd use.

First, have *two* spare disks at your disposal.

1) Copy the entire disk (all 250GB) sector by sector, to a spare disk.
That is as insurance, that you won't lose any data while working on the drive.
You can use "dd" disk dump, either in a Linux LiveCD environment,
or you can use a Windows port of "dd" ( http://www.chrysocome.net/dd )

2) Once the data is secure, you have two options for recovery.

2a) Repair the structures on the broken disk.

2b) Use a file scavenger to extract files and copy them to a spare disk.

*******

To repair structures on the disk, give TestDisk a try. If the drive
had a single partition of size 250GB, and you're absolutely sure of
that, then TestDisk can scan the disk, and see that file system,
and TestDisk will be able to write a correct partition table.
If that part worked, perhaps chkdsk could repair any other damage.
If the repair fails at any point, you have your "dd" backup copy to
use, to restore things again. If TestDisk wrote a wrong partition
table, and you ran chkdsk, it could make an awful mess. Whicn is why
you made a backup copy first.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

*******

These are some file scavengers. These will attempt to locate files on the
broken drive, and copy them to a spare drive. Use this, if TestDisk is
not working properly or you suspect things are really messed up.
Make sure the spare disk has enough room to hold the scavenged files.

http://www.cgsecurity.org/wiki/PhotoRec

http://www.pricelesswarehome.org/WoundedMoon/win32/driverescue19d.html

*******

The 31GB number, could be indicating you've placed a jumper on the IDE
drive in an incorrect location. That jumper location is called
"clip", since it clips capacity to around 33GB or so. So perhaps
the number you're seeing, when connected to the second computer,
is because you put the jumper on the wrong pins ? Go to the web
site for the disk drive, and get the jumper block diagram.

You should also enter the BIOS and see if the identity of
the 250GB broken drive is correct or not. In some failure cases,
the drive will report a new smaller capacity, which is a sign of
serious trouble. Disk drives rely on storage of size and identity
information, at location "sector -1". If the drive controller is
not able to read that information, default information from the
disk controller firmware is used instead. I've seen this on a
40GB drive, that suddenly started saying it was a 10G drive and
its name was "Falcon" instead of Maxtor model xxxx. The ratio
of those two numbers, is the number of surfaces on all the platters.

Disk drive manufacturers provide diagnostic programs, and you
can run a program like that, to see how healthy the drive is.
You need to know what brand the drive is, to get a utility
which will do a good job of testing.

The first priority, is to back up the broken drive. You can
use "dd" for that, because it doesn't care about the state
of the partition table. It will just copy everything. If
the drive has bad sectors, there is another program called
"dd_rescue" which ignores bad sectors, and can speed up the
copy process, if "dd" is having problems.

Once you have your backup made, you can test with the
diagnostic program, repair the partition table,
scavenge files or whatever you want. If you screw up
the original broken 250GB drive, you can use "dd" to copy
the entire 250GB back to it later. Take note of the size
information from the drive, so that you can use block count and
size parameters properly when copying with "dd".

Example - copying 80GB drive to 300GB drive. 80GB drive is "broken".
Harddisk0 is the source. Harddisk1 is the destination.
The destination drive is bigger, so there is enough room to
hold the backup.

dd if=\\?\Device\Harddisk0\Partition0 of=\\?\Device\Harddisk1\Partition0

Record the exact amount of data copied. It is possible to control
exactly how much data is transferred, using block size and count
parameters. The product of bs*count should be equal to your disk
total size. The disk total size should be factorable, so two
exact numbers can be used that when multiplied together, equal
the total disk capacity of the target. Here, I'm copying back
the data, and defining exactly how much data I want copied.
Hopefully 1M * 80000 = 80GB. You can also use numbers like
bs=1048576 if you want more precision in what you're doing.
The disk size quantity should be factorable into two smaller
numbers. ("dd" commands tend to run a bit faster, if you use
block size and count parameters.)

dd if=\\?\Device\Harddisk1\Partition0 of=\\?\Device\Harddisk0\Partition0 bs=1M count=80000

Those are examples of doing it in Windows, on a second computer. In
Linux, it would look like this. The disk names are a bit different.
HDB would be the spare drive, to hold the backup copy. HDA would be
the broken drive. HDB should be bigger than HDA, so there is plenty
of room.

dd if=/dev/hda of=/dev/hdb

Anyway, that is the basic idea.

HTH,
Paul
 
Y

yaro137

Thanks Paul. Great stuff. Hope it works. I've got a spare drive
kicking around and just downloaded Damnsmalllinux. Lets put it to
tests.
yaro
 
Y

yaro137

Oh and I'm pretty sure there were 2 partitions. One for the system and
the other for data.
yaro
 
Y

yaro137

Linux was unable to see the contents of that drive so I quit on that
one.
elemfm was showing hda1 in /mnt folder but it was empty even after
enabling Show Hidden files. Well unless it was only that empty spare
drive which would indicate that it wasnt detecting the other one at
all.
Bios can see the disk identifier just fine and it detects it as
33822MB
drive so roughly 264GB which is bit strange for a 250GB disk.
yaro
 
Y

yaro137

Ok, before I mess something up I thought it would be a good idea to
show the result of running dd --info
Here is what comes:
Win32 Available Volume Information
\\.\Volume{d9b48260-7874-11de-b539-00142a0f8ad6}\
link to \\?\Device\HarddiskVolume1
fixed media
Mounted on \\.\f:

\\.\Volume{6f31b204-9f8b-11dd-acf1-806d6172696f}\
link to \\?\Device\HarddiskVolume2
fixed media
Mounted on \\.\c:

\\.\Volume{64d45d1c-7872-11de-8c2e-806d6172696f}\
link to \\?\Device\HarddiskVolume3
fixed media
Mounted on \\.\e:


NT Block Device Objects
\\?\Device\Floppy0
\\?\Device\Harddisk0\Partition0
link to \\?\Device\Harddisk0\DR0
Fixed hard disk media. Block size = 512
size is 320072933376 bytes
\\?\Device\Harddisk0\Partition1
link to \\?\Device\HarddiskVolume1
Fixed hard disk media. Block size = 512
size is 320070288384 bytes
\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR1
Fixed hard disk media. Block size = 512
size is 79998918144 bytes
\\?\Device\Harddisk1\Partition1
link to \\?\Device\HarddiskVolume2
\\?\Device\Harddisk2\Partition0
link to \\?\Device\Harddisk2\DR2
Fixed hard disk media. Block size = 512
size is 33820286976 bytes
\\?\Device\Harddisk2\Partition1
link to \\?\Device\HarddiskVolume3
Fixed hard disk media. Block size = 512
size is 33820286976 bytes

Virtual input devices
/dev/zero (null data)
/dev/random (pseudo-random data)
- (standard input)

Virtual output devices
- (standard output)


OK so my broken drive is Volume3. Yhe spare one is Volume 1 and the
one that's running the system now is Volume2.
Problem is the tools shows disk0 part 0 and 1 for the spare one where
I'm sure there is only one partition. Also it shows
disk 2 partition 0 and 1. In both cases the partitions are of very
similar size but not exactly the same. What does this mean?
Which of them do I need to dd?
yaro
 
D

db

well, 32 gigs can get
pretty small real quick.

perhaps, only 32 gigs
of the drive was formatted,

leaving the rest as
unallocated space.

if you look at the
drive via computer
management under
admin tools,

you should gain some
info on that drive.

if there is unallocated
space on the disk,

then either you can
format that space

or increase the size
of the 32 gig partition
so that it can acquisition
the rest of the disk,

or both of the above.

just let us know what
you see in computer
management.


--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen
 
Y

yaro137

Unfortunatelly only a healthy 31.5GB basic partition.
However just noticed another strange thing. In My Computer
next to the drive letters I can see their sizes except for that
one drive. It's the Disk Management snap-in that tells me 31.5
Thanks again
yaro
 
P

Paul

yaro137 said:
Ok, before I mess something up I thought it would be a good idea to
show the result of running dd --info
Here is what comes:
Win32 Available Volume Information
\\.\Volume{d9b48260-7874-11de-b539-00142a0f8ad6}\
link to \\?\Device\HarddiskVolume1
fixed media
Mounted on \\.\f:

\\.\Volume{6f31b204-9f8b-11dd-acf1-806d6172696f}\
link to \\?\Device\HarddiskVolume2
fixed media
Mounted on \\.\c:

\\.\Volume{64d45d1c-7872-11de-8c2e-806d6172696f}\
link to \\?\Device\HarddiskVolume3
fixed media
Mounted on \\.\e:


NT Block Device Objects
\\?\Device\Floppy0
\\?\Device\Harddisk0\Partition0
link to \\?\Device\Harddisk0\DR0
Fixed hard disk media. Block size = 512
size is 320072933376 bytes
\\?\Device\Harddisk0\Partition1
link to \\?\Device\HarddiskVolume1
Fixed hard disk media. Block size = 512
size is 320070288384 bytes
\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR1
Fixed hard disk media. Block size = 512
size is 79998918144 bytes
\\?\Device\Harddisk1\Partition1
link to \\?\Device\HarddiskVolume2
\\?\Device\Harddisk2\Partition0
link to \\?\Device\Harddisk2\DR2
Fixed hard disk media. Block size = 512
size is 33820286976 bytes
\\?\Device\Harddisk2\Partition1
link to \\?\Device\HarddiskVolume3
Fixed hard disk media. Block size = 512
size is 33820286976 bytes

Virtual input devices
/dev/zero (null data)
/dev/random (pseudo-random data)
- (standard input)

Virtual output devices
- (standard output)


OK so my broken drive is Volume3. Yhe spare one is Volume 1 and the
one that's running the system now is Volume2.
Problem is the tools shows disk0 part 0 and 1 for the spare one where
I'm sure there is only one partition. Also it shows
disk 2 partition 0 and 1. In both cases the partitions are of very
similar size but not exactly the same. What does this mean?
Which of them do I need to dd?
yaro

http://www.chrysocome.net/dd

"Partition0 is the entire disk."

"Partition 0" refers to the entire disk. "Partition 1..N" are
the separate partitions. To back up the entire disk, you
use Partition 0 entry. \\?\Device\Harddisk2\Partition0

Based on the output you've posted above.

\\?\Device\Harddisk0 has one partition using the entire disk (minus enough
for the partition table, and perhaps rounded to the
nearest cylinder). Size = 320,072,933,376 (320GB)

\\?\Device\Harddisk1 has one partition. The size is missing for some reason.
79,998,918,144 is shown for the disk. (80GB)

\\?\Device\Harddisk2 has one partition. Now you claim there are two partitions
on there. Run TestDisk and check. Let it scan the entire
disk looking for partitions. You'll also notice the
entire disk size 33,820,286,976 and the first partition
are exactly the same. If this is an IDE ribbon cable drive,
did you check the jumpers yet ??? I suspect you have a
jumper in the "clip" position. "Clip" jumper is not shown
on the hard drive label. "Clip" jumper location may be
shown using web site information. The size shown cannot
possibly be right.

Please give the exact make and model number of the broken drive.
So I can look it up.

Paul
 
P

Paul

Please give the exact make and model number of the broken drive.
So I can look it up.

Paul

Don't run TestDisk, until you get the jumpering straightened out.
TestDisk will not be able to scan the entire disk, if the "clip"
jumper is what is setting the size to 33,820,286,976. And then it
will not be able to find all partitions and prepare a correct
partition table.

If you're in the middle of TestDisk (windows version) and don't
like the fact there is no "quit" item to exit the program,
you can use <ctrl>-c to quit the program. The program should
be sitting in one of its menus, when you use Control C.

This is how I know your drive is clipped. Download this document.
Look for "66055248 sectors" in the document. That is caused by
the geometry that "clip" caused. 66055248 * 512bytes/sector ==>
33,820,286,976. Your drive is "clipped" right now. Fix it.
Change the jumpers.

http://ibiblio.org/pub/Linux/docs/HOWTO/other-formats/pdf/Large-Disk-HOWTO.pdf

Paul
 
Y

yaro137

Luckily I haven't had the chane to run TestDisk yet as I left the
drive at my friend's.
I'll be getting there soon and check the jumper first thing. Thanks a
lot.
yaro
 
Y

yaro137

Paul you were absolutely right as to the pins.
I remember setting it to a slave drive before connecting
it to my friend's PC but did not realize it limits the drive
to 32GB. I changed it back to master. Now I can see it in
Disk Management as a Foreign disk but I can't import it.
I'll try DSL again. Maybe it can see my drive this time.
yaro
 
Y

yaro137

Well, no luck with DSL again which is strange as I can see hba1 and
hda2
but couldn't find my test.txt file which I created under Windows on my
spare drive
on any of them. Back to dd then :)
yaro
 
Y

yaro137

dd did not work for me. When I run the command it just shows the
banner and stops on that. Doesn't do anything from that point.
I tried recovery console to see if I can fix the mbt again but as only
the recovery console loads the computer reboots. So next step was to
try Windows repair. After pressing F8 to accept the licence it showed
me 2 partitions!!! ... and then rebooted before I managed to do
anything. Isn't that odd? So maybe a virus after all?
yaro
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top