Virus? USB 500GB external hard disk is now "raw format"

R

ralphemers

My Western Digital external USB 500GB disk has been working for months
on a variety of Windows XP Home & Professional machines but all of a
sudden, it is found in Windows but Windows says it's a RAW disk with
no data.

Can a virus convert a perfectly good disk into a "raw" disk (whatever
that is)?
How would I recover the data (some of which is not backed up).

Please help ...

The particulars are ...

My Computer:
- Name: Local Disk (X:)
- Type: Local Disk
- Total Size: <blank>
- Free Space <blank>
- Comments <blank>

Right-click on the disk and select "Properties":
- General tab
-- Tyype: Local Disk
-- File system: RAW
-- Used space: 0 bytes 0 bytes
-- Free space: 0 bytes 0 bytes
-- Capacity: 0 bytes 0 bytes

Double-click on the disk and up pops a form saying:
Disk is not formated
The disk in drive X: is not formatted.
Do you want to format it now?

Right-click on "My Computer" and select "Manage":
- Disk Management
-- Layout = Partition
-- Type = Basic
-- File System = blank
-- Status = healthy
-- Capacity = 465.75 GB
-- Free Space = 565.75 GB
-- %Free = 100%
-- Fault Tolerance = 0
-- Overhead = 0%
 
P

Paul

My Western Digital external USB 500GB disk has been working for months
on a variety of Windows XP Home & Professional machines but all of a
sudden, it is found in Windows but Windows says it's a RAW disk with
no data.

Can a virus convert a perfectly good disk into a "raw" disk (whatever
that is)?
How would I recover the data (some of which is not backed up).

Please help ...

The particulars are ...

My Computer:
- Name: Local Disk (X:)
- Type: Local Disk
- Total Size: <blank>
- Free Space <blank>
- Comments <blank>

Right-click on the disk and select "Properties":
- General tab
-- Tyype: Local Disk
-- File system: RAW
-- Used space: 0 bytes 0 bytes
-- Free space: 0 bytes 0 bytes
-- Capacity: 0 bytes 0 bytes

Double-click on the disk and up pops a form saying:
Disk is not formated
The disk in drive X: is not formatted.
Do you want to format it now?

Right-click on "My Computer" and select "Manage":
- Disk Management
-- Layout = Partition
-- Type = Basic
-- File System = blank
-- Status = healthy
-- Capacity = 465.75 GB
-- Free Space = 565.75 GB
-- %Free = 100%
-- Fault Tolerance = 0
-- Overhead = 0%

You could try "Testdisk" on it.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Note that Testdisk is a "repair-in-place" utility, and that
makes it dangerous. It can do more damage to the disk, if
something goes wrong. Before using a utility like that,
it is preferable to do a sector-by-sector copy of the
disk, to another disk. If the repair attempt screws up,
then you haven't lost everything. The files are still
there (somewhere).

I've used "dd" in Linux, to copy one drive to another.
The beauty of that technique, is the copy program doesn't
have to know anything about the file system types. It
just copies all the sectors. With that approach, the
destination disk should be the same size or larger than,
the source disk.

Since there is no guarantee that "dd" handles bad
sectors properly, you can also try scanning the disk
first, for bad blocks, to get some idea what you're
up against. I don't know what the best utility is for
that, but I have tried HDTune from HDTune.com on one occasion.
They have a free version for download. Scanning for bad
blocks, is one of its options. If the "bad" disk scans
clean, that means you can safely use "dd" to make an
exact copy.

The reason I am so cautious, is because of an experience
I had years ago. I had a disk, and a utility that was
supposed to copy a duplicate file structure, when the
primary file structure was damaged. To my shock, when
I ran the utility, it copied the bad structure, over
the good one, dooming all my data. (That was a non-Windows
system.) Now, I'm more careful to try to copy the disk first,
because there is really no way to know whether every
corner case has been considered by the repair utility
writer.

Paul
 
R

ralphemers

First...try it on another machine...
if the problem remains...
Remove the drive and install it internally

I did try it. On three machines. Same thing. It shows up as a "RAW"
unformatted disk.
I'll try other suggestions (if they come in) before I'll actually take
the compartment apart.

I guess your point is that the disk itself might not be bad but that
the "electronics" surrounding the disk might be?
What that the reason for the suggestion to "install it
internally" (I'm sure it won't fit my laptop no matter what I do)?
 
R

ralphemers

Your URL of http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step seems
very useful.
It says, for example two things might happen:
I certainly have the first:
1. Windows Explorer or Disk Manager displays the first primary
partition as raw (unformatted) and Windows prompts: The drive is not
formatted, do you want to format it now?
[You should never do so without knowing why!]

But, do I really have the second?
2. A logical partition is missing. In Windows Explorer, that
logical drive is no longer available. The Windows Disk Management
Console now displays only "unallocated space" where this logical
partition had been located.
 
R

ralphemers

Since there is no guarantee that "dd" handles bad
sectors properly, you can also try scanning the disk
first, for bad blocks, to get some idea what you're
up against. I don't know what the best utility is for
that, but I have tried HDTune from HDTune.com on one occasion.
They have a free version for download.

I tried the Microsoft Checkdisk program but it reports an error.

C:\>G:
The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded
and that the volume is not corrupted.

http://support.microsoft.com/kb/315265

I'll try your suggested free program to check an external 500GB hard
disk that shows up as a drive letter but as "RAW" format.
 
P

Paul

Your URL of http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step seems
very useful.
It says, for example two things might happen:
I certainly have the first:
1. Windows Explorer or Disk Manager displays the first primary
partition as raw (unformatted) and Windows prompts: The drive is not
formatted, do you want to format it now?
[You should never do so without knowing why!]

But, do I really have the second?
2. A logical partition is missing. In Windows Explorer, that
logical drive is no longer available. The Windows Disk Management
Console now displays only "unallocated space" where this logical
partition had been located.

The web page I posted, is intended to illustrate the flexibility
of the program. If your problem is less complex than that one,
then it will be simpler to fix (fewer steps, a subset of the
example).

There are undoubtedly other utilities, with nice GUIs on them,
that could also do this repair. What you're trading, by using
a program like Testdisk, is it is free. Due to the nature
of the interface, Testdisk isn't everyone's cup of tea.

Paul
 
D

David W. Hodgins

C:\>G:
The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded
and that the volume is not corrupted.

Be extremely careful. When m$ software doesn't recognize a valid partition
table on a storage device, simply connecting it, will cause a new partition
table to be written. I found that out the hard way, with a usb memory stick
where the entire device was formatted as a linux filesystem, without a mbr.

Forgot to remove it before booting into windows. Windows overwrote the
first sector with an empty partition table, without any warnings. Didn't
realize what had happened till I tried to read the device in linux, and
viewing it with a hex editor showed an empty partition table.

Regards, Dave Hodgins
 
J

Johnw

It happens that (e-mail address removed) formulated :
I did try it. On three machines. Same thing. It shows up as a "RAW"
unformatted disk.
I'll try other suggestions (if they come in) before I'll actually take
the compartment apart.

I guess your point is that the disk itself might not be bad but that
the "electronics" surrounding the disk might be?
What that the reason for the suggestion to "install it
internally" (I'm sure it won't fit my laptop no matter what I do)?

These may help.

Disk Investigator
http://www.softpedia.com/get/System/Back-Up-and-Recovery/Disk-Investigator.shtml
http://www.theabsolute.net/sware/dskinv.html

ADRC Data Recovery Software Tools
http://tinyurl.com/47vgvx
http://www.adrc.com/software/data_recovery_tools/
http://www.downloads-portal.com/system-utilities/file-and-disk-management/data-recovery-using-adrc-
 
R

Russg

Maybe try to do a sector copy first, your data will
be in there someplace. But, I don't know about
XP/Vista but used to be the MS partition program,
FDISK, would sometimes recover a lost FAT
with the command, from a DOS prompt,
fdisk /mbr
You might try that, after the sector copy.
The sector copy, like a Ghost backup, should
be able to restore to the way it was if need be.
 
R

Russg

http://support.microsoft.com/?kbid=314058

You can't do a fdisk /mbr in XP/Vista.
Above is a URL for running 'FIXMBR' from
a XP boot install/recovery CD. It might work,
hard disks, probably including NTFS volumes,
have a backup Master Boot Record, or whatever
NTFS has.
Making a sector copy first would still be to do.
Norton Ghost or Nero Backitup are two programs
to make sector copy.
500 GB on a USB drive will take hours.
There are also hard disk utilities on the 'Ultimate
Boot CD' or UBCD, something there might work.
(Google UBCD).
 
D

Dustin Cook

(e-mail address removed) wrote in @f40g2000pri.googlegroups.com:
My Western Digital external USB 500GB disk has been working for months
on a variety of Windows XP Home & Professional machines but all of a
sudden, it is found in Windows but Windows says it's a RAW disk with
no data.


Most likely, the cheap controller board inside the case has gone bye bye.
The drive itself and your data is probably all okay. I'd suggest you
crack the case open, pull the drive and install it in your computer. It
may be a SATA based drive, so if you don't have SATA ports but you do
have a free PCI slot, you can get a SATA controller card.

It's not strickly a western digital issue, I've seen it happen on cheaper
brands as well. The USB to drive converter board is just.. poor quality
and dies easily.
Can a virus convert a perfectly good disk into a "raw" disk (whatever
that is)?

Sure, but that's probably not your problem.
How would I recover the data (some of which is not backed up).

Try what I said above, and if that doesn't do it, post back and we'll go
from there.
 
M

Mike Ray

Dustin said:
(e-mail address removed) wrote in @f40g2000pri.googlegroups.com:



Most likely, the cheap controller board inside the case has gone bye bye.
The drive itself and your data is probably all okay. I'd suggest you
crack the case open, pull the drive and install it in your computer. It
may be a SATA based drive, so if you don't have SATA ports but you do
have a free PCI slot, you can get a SATA controller card.

It's not strickly a western digital issue, I've seen it happen on cheaper
brands as well. The USB to drive converter board is just.. poor quality
and dies easily.


Sure, but that's probably not your problem.


Try what I said above, and if that doesn't do it, post back and we'll go
from there.

Or it maybe easier to just get another external HD case with a USB
output. They can be as cheap as $20. No need to mess with your tower
then and if it works your all set.
 
B

BTB

David H. Lipman said:
From: <[email protected]>

Please remove; alt.comp.freeware
It is Off Topic subject matter.
Unless there are freeware applications that could recover his hard disk. So
after that idea should it still be removed from alt.comp.freeware?
 
R

ralphemers

Or it maybe easier to just get another external HD case with a USB
output. They can be as cheap as $20. No need to mess with your tower
then and if it works your all set.

Doesn't this indicate a 'good' controller?
Windows XP Explorer sees the bad drive as 0 bytes but the "My Computer
Manage > Disk Management" sees it as a "healthy" 500GB

Seems to me the data is bad (lost table somewhere) and not the
controller. No bad sounds. All lights light up. Disk is recognized.
Just no data.

Even so, I went to Costco yesterday and brought the original Western
Digital 500 GB drive with me. Unfortunately they idn't have the same
one, but they had something similar that was a Terabyte drive so I
bought that.

Do you think if I open both boxes up, and move the disk itself from
the 500GB case to the 1TB case, that it will then be recognized on
Windows XP with data?

..
 
R

ralphemers

Unless there arefreewareapplications that could recover his harddisk. So
after that idea should it still be removed from alt.comp.freeware?

Freeware is good but I do wish to post to the correct group but I just
don't know which that would be.

What group is best for software to debug a WinXP external Western
Digital USB hard disk mounted as RAW problem (ie recover lost data)?

alt.comp.hardware ?
microsoft.public.windowsxp.general ?
 
F

Franklin

<@o4g2000pra.googlegroups.com>
Freeware is good but I do wish to post to the correct group but I
just don't know which that would be.

What group is best for software to debug a WinXP external Western
Digital USB hard disk mounted as RAW problem (ie recover lost data)?

alt.comp.hardware ?
microsoft.public.windowsxp.general ?


Try comp.sys.ibm.pc.hardware.storage. Seems it's an active group.
There's also microsoft.public.windowsxp.hardware.

Your boot sector may be corrupt. (That's where the info is stored
defining the file system type.)

"Find And Mount" scans to find the start and end of your partition
without using boot sector info. http://findandmount.com/

Of course your drive's corruption may be more widespread than the boot
sector, so first check in that other group.

There's also:
 
R

ralphemers

Most likely, the cheap controller board inside the case has gone bye bye.
The drive itself and your data is probably all okay. I'd suggest you
crack the case open, pull the drive and install it in your computer. It
may be a SATA based drive, so if you don't have SATA ports but you do
have a free PCI slot, you can get a SATA controller card.

Since the drive is "recognized" by Windows Explorer (it gives it a
drive letter but 0 bytes) and by Windows "Computer Management > Disk
Management" (it says it's "healthy" and gives the right size), I
wonder if it's the controller or the data.

Still, changing the controller can't hurt (right?). I first tried to
buy the same 500GB Western Digital disk at Costco but ended up with a
1TB Western Digital drive (that's all they had that was Western
Digital).

I will go to Fry's today and pick up the $25 SATA-to-USB adapter. Then
I will remove the disk from the WD enclosure and see if it spins up on
that SATA/IDE-to-USB adapter. If it shows the same problem, then I'll
know the electronics aren't to blame and I can concentrate on the
recovery.

BTW, what group are you coming in on because I want to just limit this
to the proper group.
 
R

ralphemers

These may help.
Disk Investigator http://www.theabsolute.net/sware/dskinv.html
ADRC DataRecoverySoftware Toolshttp://tinyurl.com/47vgvx

Reference Post - Freeware for Failing Disk Recovery
http://groups.google.com/group/alt.comp.freeware/msg/a542816dab134fb9?dmode=source

Running a Fast Format Recover
http://www.recovermyfiles.com/fast-format-recovery.pdf

Failing Disk Recovery Freeware
http://groups.google.com/group/datarecoveryfreeware/msg/b3763830e51d277e?dmode=source
This gave me a good googling head start where I found this post below
on this newsgroup which lists a lot of free programs to recover from a
RAW disk.



Note - If this series is considered by some to be spamming I will stop
or remove the messages as Google allows. Let's take a vote. It's from
my new Google group Data Recovery Freeware which receives 4 visits
an hour, but since this is a much more active and referenced group I
thought it appropriate. Perhaps I'm just showing off since I'm active
in this group. This content also
repeat what is on my site at www.s2services.com except is more
complete, my site has only about half the links and needs updating. I
have posted some of these series but I thought I would formerly label
them in a regular way.

++Failing Disk and File Cloners++

* http://www.diydatarecovery.nl/HD_Workbench.htm - Allows you to
monitor your disk health, scan it for bad sectors, replace bad sectors
and image a failing disk.

* http://www.pcinspector.de/clone-maxx/uk/welcome.htm - "PC INSPECTOR
clone maxx is the new professional hard drive copying program from
CONVAR. Using the new direct DMA support, data can be copied from hard
drives in high speed mode with speeds up to 3.3 GB per minute."

* http://www.runtime.org/dixml.htm - "DriveImage XML is an easy to use
and reliable program for imaging and backing up partitions and logical
drives.=E2=80=9D

* http://www.partition-saving.com/ - "Partition Saving is a DOS
program
that is used to save, restore and copy hard-drive, partitions, floppy
disk and DOS devices.=E2=80=9D

* http://www.roadkil.net/RawCopy.html - "This program copies a disk as
a raw image from one drive directly to another. This utility is
designed for people who have faulty drive and want to transfer the
data
directly to another drive without doing a file by file copy. This
saves
the need for operating system re-installs and allows drives with an
unknown file system to be copied (including from console game
machines,
data recorders, Mac etc). The program has a built in data recovery
function which will attempt to recover data from bad sectors to ensure
all the available data is restored from the drive.=E2=80=9D

* http://www.roadkil.net/DiskImg.html - "Creates and writes disk
images
files to hard and floppy disks. Great for writing boot disk images
download from the internet or creating a perfect copy of a disk to
email to someone else."

* http://home.tiscali.de/zdata/hdcopy_e.htm - "With HDCopy you can
make
an identical copy of a hard drive onto another hard drive. If you buy
a
new hard drive and don't wish to change your Windows configuration in
any way, you can use HDCopy to copy your old hard drive completely to
the new one (hidden files as well."

* http://www.restorer2000.com/ - "Restorer2000 Free DEMO 2.0 allows
you
to evaluate Restorer2000 products and displays your hard drive
structure with deleted files and folders. Also, with Restorer2000 Free
DEMO 2.0 you can create an Image file for an entire disk, partition or
its part. Then the Image file can be used like regular disk." Comment
- Interestingly the Demo's disk imaging feature works in unlimited for
free but the undelete only shows you what can be undeleted. Thus free
disk imaging. :)

* http://www.diskman.co.uk/default.aspx - "Diskman is free for
noncommercial use. Diskman products may be licensed for commercial use
and may be fully customized to suit particular application
requirements. The core Diskman library supports a variety of file
system and disk manipulation commands which can be used to extract and
modify information not normally available from the OS. Diskman is
currently supported by MS-DOS (and its clones) and Microsoft Windows
NT/2000/XP . A Linux version of Diskman may be developed in the
future.
Diskman 4 is the latest MS-DOS compatible release:=E2=80=9D

* http://www.vanheusden.com/recoverdm/ - "This program will help you
recover disks with bad sectors. You can recover files as well complete
devices. In case if finds sectors which simply cannot be recovered,
it
writes an empty sector to the outputfile and continues. If you're
recovering a CD or a DVD and the program cannot read the sector in
"normal mode", then the program will try to read the sector in "RAW
mode" (without error-checking etc.). This toolkit also has a utility
called 'mergebad': mergebad merges multiple images into one. This can
be useful when you have, for example, multiple CD's with the same data
which are all damaged. In such case, you can then first use recoverdm
to retrieve the data from the damaged CD's into image-files and then
combine them into one image with mergebad."

*
http://members.ozemail.com.au/[email protected]/freezip/freeware/#=
dsfok
=E2=80=93 backup partitions, entire disks including CDs and floppies
and ma=
ny
other features.

* http://memberwebs.com/nielsen/software/scrounge/ - =E2=80=9C{Data
recovery
program for NTFS file systems. Reads each block of the hard disk to
and
retrieves rebuilds file system tree on another partition. I wrote this
program when one of my friends lost valuable data on an NTFS drive. It
been used since then in several cases, but not thoroughly tested,
especially not WRT the fact that it's a data recovery program. You
should have your partition information stored away in advance. This
allows reliable retrieval of file info.=E2=80=9D

http://www.copyhandler.com/en/manual/introduction-to-copy-handler.html
- "# copying data at rates up to 6-7 times faster than standard MS
Windows copying (when copying data from one partiton to another on the
same physical hard disk); # allow full-control over the copying/moving
process by pause, resume, restart and cancel features;fully
customizable - over 60 detailed options - from setting language
(multiple languages) through auto-resume on error, shutting down
system
after copying finished to very detailed and technical (customizing
copy/move thread - buffer sizes, thread priority, ...) ending on
sounds
on specific events;"

++Failing File System Readers++

* http://memberwebs.com/nielsen/software/scrounge/ - Data recovery
program for NTFS file systems. Reads each block of the hard disk to
and
retrieves rebuilds file system tree on another partition.

* http://www.diskinternals.com/products/ntfs-reader/ - DiskInternals
NTFS Reader is a freeware tool that provides a read access to NTFS
disks from Windows 95, 98 and Me.

* http://www.ekremdeniz.com/pub/tdisk.zip - - "Recovers files from
disks with physical damage. Allows you to copy files from disks with
problems such as bad sectors, scratches or that just give errors when
reading data. The program will attempt to recover every readable piece
of a file and put the pieces together. Using this method most types of
files can be made useable even if some parts were not recoverable in
the end."

* http://www.diskinternals.com/linux-reader/ - This easy-to-use tool
runs under Windows and allows you to browse Ext2/Ext3 Linux file
systems and extract files from there.

* http://www.vcsoftwares.com/cc.html - Copy Cat 2.0 actually skip the
bytes which are not readable from file and copy all other bytes
therefore it extracts max data which is normally not done by windows
copy operation.

* http://www.deaddiskdoctor.com/ - Dead Disk Doctor - allows copying
files from scratched or damaged CD, DVD disks, unreadable Floppy and
Hard Drives or other media.

* http://www.diydatarecovery.nl/irecover.htm - "iRecover is a Windows
based, read-only data recovery utility. iRecover offers FAT, FAT32 and
NTFS file system support, and supports all current Microsoft Windows
versions (including 2000 and XP, server and workstation). iRecover
allows you to recover data from deleted, corrupt, reformatted and
intact (for recovering deleted files) volumes by copying this data to
any destination Windows assigns a drive letter such as additional hard
disks, partitions, ZIP disks and mapped network shares.=E2=80=9D Demo
allows
recovery of a directory, otherwise, not free.

* http://www.linux-ntfs.org/ - =E2=80=9CThe goals of the Linux-NTFS
project
are to develop reliable and full feature access to NTFS by the Linux
kernel driver, and by a user space filesystem (ntfsmount), and to
provide a wide collection of NTFS utilities (ntfsprogs) and a
developer's library (libntfs) for other GPLed programs. We have
achieved already a lot, with high quality results.=E2=80=9D

* http://www.ntfs.com/products.htm - "NTFS Reader DOS Boot Disk
provides read access to NTFS drives from the MS DOS environment. It
supports long filenames as well as compressed and fragmented files.
NTFS Reader for DOS allows you to preview the files on NTFS and copy
them from NTFS to FAT volumes or network drives. In order to use the
software you need to copy the readntfs.exe file to a bootable floppy
disk and boot from it. NTFS Reader for DOS is a FREEWARE"

* http://www.nu2.nu/pebuilder/ - "Bart's PE Builder helps you build a
"BartPE" (Bart Preinstalled Environment) bootable Windows CD-Rom or
DVD
from the original Windows XP or Windows Server 2003 installation/setup
CD, very suitable for PC maintenance tasks. It will give you a
complete Win32 environment with network support, a graphical user
interface (800x600) and FAT/NTFS/CDFS filesystem support. Very handy
for burn-in testing systems with no OS, rescuing files to a network
share, virus scan and so on. This will replace any Dos bootdisk in no
time!

* http://www.simtel.net/product.php[url_fb_product_page]44201 -
"Data Recovery Software: Reads BAD disks"

* http://www.roadkil.net/Sectedit.html - "Allows displaying, editing,
printing and searching of disks by individual sectors. The information
can be displayed and edited in both ASCII or hexadecimal. Sectors can
be copied and exported to files."

* http://www.roadkil.net/unstopcp.html - "Recovers files from disks
with physical damage. Allows you to copy files from disks with
problems
such as bad sectors, scratches or that just give errors when reading
data. The program will attempt to recover every readable piece of a
file and put the pieces together. Using this method most types of
files
can be made useable even if some parts were not recoverable in the
end."

*
http://members.ozemail.com.au/[email protected]/freezip/freeware/#=
dsfok
=E2=80=93 backup partitions, entire disks including CDs and floppies
and ma=
ny
other features.

* http://www.digitalsystem.co.yu/download.html - "Info: A program for
copying corrupted files which can't be copied the standard way because
of some error on media the file is stored on."

* http://pjwalczak.com/scaven/index.php - "SCAVEN is a micro-tool for
data recovery. It was designed to perform unattended multi-string
searches through large hard drives. It records position of matches
found to the output text file in a sector:blush:ffset:match format (fixed
size column). SCAVEN is an effective tool and time saver in the
recovering data from: * files permanently deleted, * files lost
through
overwrite, * accidentally formatted drives, * drives with damaged
MBR /
lost partitions, * drives with corrupted FATs, * drives which
developed
bad sectors, SCAVEN will not help if:* drive developed mechanical
problems (strange metallic sounds), * motor is dead (not spinning at
all), * controller failed (drive not detected by BIOS)"

* http://www.salvagentfs.com/6.0.html - "SalvageNTFS is capable of
scanning a partition, or even a whole disk drive, for anything that
looks like valid NTFS data. Normally, the location of this information
is stored on the volume itself; however, if this becomes damaged, the
volume can become unusable. SalvageNTFS continues to function and can
(after an exhaustive search) furnish a complete list of data that can
be recovered. Additionally, most file system drivers fail
less-than-gracefully when unexpected data is encountered. SalvageNTFS
is able to identify damaged records, extract whatever information it
can, and continue using the other portions of the volume with ease."

* http://www.mitec.cz/systools.htm - Powerful multiple files
hexadecimal editor with following features: Data Inspector,
Calculator,
File Compare, Memory Dumper, Disk Dumper (NT only).

* http://www.gnu.org/software/ddrescue/ddrescue.html - =E2=80=9CGNU
ddrescue
is a data recovery tool. It copies data from one file or block device
(hard disc, cdrom, etc) to another, trying hard to rescue data in case
of read errors. Ddrescue does not truncate the output file if not
asked
to. So, every time you run it on the same output file, it tries to
fill
in the gaps. The basic operation of ddrescue is fully automatic. That
is, you don't have to wait for an error, stop the program, read the
log, run it in reverse mode, etc.=E2=80=9D

* http://memberwebs.com/nielsen/software/scrounge/ - =E2=80=9CData
recovery
program for NTFS file systems. Reads each block of the hard disk to
and
retrieves rebuilds file system tree on another partition. I wrote this
program when one of my friends lost valuable data on an NTFS drive. It
been used since then in several cases, but not thoroughly tested,
especially not WRT the fact that it's a data recovery program. You
should have your partition information stored away in advance. This
allows reliable retrieval of file info.=E2=80=9D

* http://www.inner-smile.com/dl_piece.htm - =E2=80=9CPieceCopy is a
tiny to=
ol
which will extract a portion of a specific file. You can use it to
extract data of files, to cut file headers, to retrieve binary data of
a specific position, to rescue parts of damaged files/disks or
whatever.=E2=80=9D
++ Lost Partition Rescue++
* http://www.cgsecurity.org/index.html?testdisk.html - "Tool to check
and undelete partition. Works with the following partitions: - BeFS (
BeOS ). - BSD disklabel ( FreeBSD/ OpenBSD/NetBSD ). - CramFS
(Compressed File System). - DOS/ Windows FAT12, FAT16 and FAT32. -
HFS,
Hierarchical File System. - JFS, IBM's Journaled File System. - Linux
Ext2 and Ext3. - Linux Raid. - Linux Swap (versions 1 and 2). - LVM
and
LVM2, Linux Logical Volume Manager. - Netware NSS. - NTFS ( Windows
NT/2K/XP/2003 ). - ReiserFS 3.5 and 3.6. - UFS (Sun/BSD/...). - XFS,
SGI's Journaled File System."

* http://www.roadkil.net/bootbuild.html - "Boot builder allows you to
create your own custom boot sector from scratch. This utility allows
you to recreate or restore boot sectors lost due to virus or other
damage to a drive. Boot sectors can be imported/exported to a disk or
created from a template. This program supports FAT and NTFS boot
sector
types."

* http://paradiseprogramming.tripod.com/prescue.html - "Partition
Rescue backs up your disk's partition system to //partition rescue
floppy disk//. If your disk's partition system gets damaged you can
restore it by booting your system using this rescue disk. It can
recover your disk from damaged partition table, missing partitions,
virus attack etc."

* http://hp.vector.co.jp/authors/VA003009/mbrscane.html - "MBRSCAN is
a PC-DOS program which dumps MBR (Master Boot Record) and boot record
of each partition and analyzes partition table entries. I wrote this
program to dump the MBR when I encountered MBR corruption at OS
installation. At first, I used a debug command to look at the MBR.
Then
I wrote the MBRSCAN for asking other person to display the MBR much
easier. After that, I added partition table analyzer to the MBRSCAN.
If you have some knowledge about hard disk, you can figure out
partition and boot problems using this tool. The MBRSCAN is also good
for understand partition table structure."

* http://www.diskman.co.uk/default.aspx - The core Diskman library
supports a variety of file system and disk manipulation commands which
can be used to extract and modify information not normally available
from the OS. Diskman is currently supported by MS-DOS (and its clones)
and Microsoft Windows NT/2000/XP . A Linux version of Diskman may be
developed in the future. Diskman 4 is the latest MS-DOS compatible
release: Backup and restore VFAT (Windows 9X/nt/2000). Long File Names
(LFN). Archive compatible with DOSLFNBK, the leading LFN backup
utility. Support for disk image files up to 2GB (4GB coming soon).
Support for spanned image files up to 2TB. Mount and manipulate disk
images (such as those created for Rawrite). Export volumes or entire
physical drives for later restore. Quickly copy every file into image
files for easy backup and later restore. Directly edit disks at the
sector level. Support for all BIOS supported disks, DOS supported
drives and Image files. Help repair disks after a virus attack or
rescue critical data."

* http://pjwalczak.com/scaven/index.php - "SCAVEN is a micro-tool for
data recovery. It was designed to perform unattended multi-string
searches through large hard drives. It records position of matches
found to the output text file in a sector:blush:ffset:match format (fixed
size column). SCAVEN is an effective tool and time saver in the
recovering data from: * files permanently deleted, * files lost
through
overwrite, * accidentally formatted drives, * drives with damaged
MBR /
lost partitions, * drives with corrupted FATs, * drives which
developed
bad sectors, SCAVEN will not help if:* drive developed mechanical
problems (strange metallic sounds), * motor is dead (not spinning at
all), * controller failed (drive not detected by BIOS)"

* http://www.salvagentfs.com/6.0.html - "SalvageNTFS is capable of
scanning a partition, or even a whole disk drive, for anything that
looks like valid NTFS data. Normally, the location of this information
is stored on the volume itself; however, if this becomes damaged, the
volume can become unusable. SalvageNTFS continues to function and can
(after an exhaustive search) furnish a complete list of data that can
be recovered. Additionally, most file system drivers fail
less-than-gracefully when unexpected data is encountered. SalvageNTFS
is able to identify damaged records, extract whatever information it
can, and continue using the other portions of the volume with ease."

++Failing CD and Floppy Readers and Repair++

* http://www.deaddiskdoctor.com/ - Dead Disk Doctor - allows copying
files from scratched or damaged CD, DVD disks, unreadable Floppy and
Hard Drives or other media.

* http://www.denispetrov.com/?page_id=3D3 - force formats most
floppies
even if initially unreadable, unlike Windows.

* http://www.vcsoftwares.com/cc.html - Copy Cat 2.0 actually skip the
bytes which are not readable from file and copy all other bytes
therefore it extracts max data which is normally not done by windows
copy operation.

* http://www.geocities.com/cdmage/frames.html - repair corrupted CD
image files?

* http://www.roadkil.net/unstopcp.html - "Recovers files from disks
with physical damage. Allows you to copy files from disks with
problems
such as bad sectors, scratches or that just give errors when reading
data. The program will attempt to recover every readable piece of a
file and put the pieces together. Using this method most types of
files
can be made useable even if some parts were not recoverable in the
end."

* http://www.isobuster.com/ - "Rescue lost files from a bad or trashed
CD or DVD ! Save important documents, precious pictures or video from
the family, your only system backup, ...IsoBuster can do it all !
=E2=80=9D

* http://www.elpros.si/CDCheck/ - "CDCheck is a utility for the
prevention, detection and recovery of damaged files on CD-ROMs with an
emphasis on error detection. With CDCheck you can check your CDs and
discover which files are corrupted. By using the program proactively,
you can insure that your data on CD-ROMs are safe - - before it's too
late! CDCheck provides the following features: readability
verification, binary compare, CRC file creation (and verification) and
file recovery. For more information see Info."

* http://www.ice-graphics.com/ICEECC/IndexE.html - Developer Provided
Description - "ICE ECC is a file verification and repair tool. ICE ECC
allows you to protect your important files and sensitive data against
digital corruption using Reed-Solomon codes. Did you know that a
typical CD-R/DVD-R disk can hold its data intact for only a few years?
ICE ECC is the perfect solution to this problem - before you store
your
data, protect it against corruption with ICE ECC." Comment -
Apparently
you can recover from corruption if the software is previously
installed
and run but not after the fact installation.

* http://www.ekremdeniz.com/pub/tdisk.zip - - "Recovers files from
disks with physical damage. Allows you to copy files from disks with
problems such as bad sectors, scratches or that just give errors when
reading data. The program will attempt to recover every readable piece
of a file and put the pieces together. Using this method most types of
files can be made useable even if some parts were not recoverable in
the end."

++Virus Recovery++

* http://housecall.trendmicro.com/ - "Ease your mind and scan your PC
for viruses." Comment - If a virus has knocked out your antivirus,
just
go online. Trend Micro is often the highest rated antivirus software.

*
http://www.pandasoftware.com/products/activescan/com/activescan_princ...
- "Scans, disinfects and eliminates over 90,000 viruses, worms and
Trojans from all system devices, hard disks, compressed file and all
your email. Detects spyware. 84 percent of malware installed on
computers worldwide is spyware. Do you know if your PC is spyware
free?
NEW! Detects the following types of malware: Dialers. Hacking tools.
Jokes. Security risks. Hoaxes." Comment - Panda is a highly rated
antivirus software. This is also a free online scanner.

* http://us.mcafee.com/root/mfs/default.asp - "McAfee FreeScan helps
you detect thousands of viruses on your computer. Based on the
award-winning McAfee VirusScan engine, FreeScan searches for viruses,
including the latest known "in the wild" viruses, and displays a
detailed list of any infected files. Should viruses be found, FreeScan
even provides links to more information about the viruses and what you
can do to clean your system."

* http://www.bitdefender.com/scan8/ie.html - "BitDefender Online
Scanner is a fully functional antivirus product. It features all
required elements for thorough antivirus scanning and effective
cleaning: it scans your system's memory, all files, folders and
drives'
boot sectors, providing you with the option to automatically clean the
infected files."

* http://support.f-secure.com/ols/start.html - "F-Secure Online Virus
Scanner is a free service. Use it to find out if your computer is
infected with a virus and disinfect your computer if needed."

* http://www.symantec.com/cgi-bin/securitycheck.cgi - "Symantec
Security Check tests your exposure to a wide range of online threats.
It's free and efficient, and it helps you determine your Internet
security needs."

* http://www.bitdefender.com/site/Download/browseFreeRemovalTool/ -
List of 101 free specific virus removal tools. If you know what the
virus is, you can remove it with these. Other antivirus companies
have
similar tools.

* http://www.avdisk.org/pages/en/about.html - =E2=80=9CAVDisk is a
program
which automates the task of getting your anti-virus software on to
floppy disks which you can use to start, scan and disinfect your
computer.=E2=80=9D

* http://grc.com/cih.htm - "The CIH virus attempts to ERASE the
writable FLASH BIOS of infected PC's, and also overwrites the first
2,048 sectors (1,048,576 bytes) of all of the system's available
non-removable writable disk drives! While this behavior places the CIH
virus among the nastiest of all viruses, the damage is more
recoverable
than at first appears..."

* http://www.nu2.nu/pebuilder/ - Allows you to use anti-virus programs
in the Windows =E2=80=9Cpre-installed=E2=80=9D environment, which is
kind o=
f midway
between DOS and Windows. Weird but, after a Windows 2000 and XP disks
are mounted, they start up a non-gui version of Windows that this
environment takes advantage. You can load all sorts of data recovery
apps in this environment. You should have a license for the Windows
pre-install environment you are using.

* http://www.s2services.com/hosted-freeware/csfd.zip - "Clean Start
was
designed with two applications in mind. First, it has proven very
effective in controlling inadvertent infection of customers' systems
by
technicians, software trainers, consultants, and others who carry
disks
to customer sites. Such infections normally occur when systems are
booted with floppy disks left in the floppy disk drives. An infected
Clean Start diskette will provide a clear indication (a yellow on red
splash) that both the diskette and the customer's hard drive are
infected. Remedial action can be taken right then and there, so that
the agent does not walk away, leaving the infection in place."

* http://invircible.com/iv_tools.php#FreeDOS - "Certain viruses like
INT_CE and W95.Spaces, take advantage of a vulnerability in MS-DOS
based operating systems, starting from MS-DOS 5. The exploit is known
as the circular partition trick. This is an extremely frustrating
condition, as the computer with a tricked drive will not boot anymore,
not even from floppy. Even experts are misled when faced with a
circular partition and will replace the hard drive, believing that the
hardware is at fault. The only way to revert a circular partition is
to
boot with other than MS-DOS, like PC-DOS, or FreeDOS, and fix it with
a
disk recovery tool such as the NetZ ResQ utilities.=E2=80=9D

* http://www.s2services.com/hosted-freeware/zefrjpg.zip - "Demand
continues for this widely used tool, which recovers JPG images after
they have been lost to a LoveLetter worm attack (or any other reason).
Archive now includes an NTFS version along with the FAT version.
Millions (by now perhaps billions) of files have been successfully
recovered by ZefrJPG over the years."

++Master Boot Record (MBR) Tools++

*http://www.sysint.no/nedlasting/mbrfix.htm - "Perform several Master
Boot Record (MBR) tasks, like backing up, restoring, fixing the boot
code in the MBR, etc. The utility should not be used for GUID
Partition
Table (GPT) disks. The utility now, by popular demand, also come in a
x64-version running unde x64-editions of Windows and PE."

* http://www.diydatarecovery.nl/mbrtool.htm - MBRtool=E2=84=A2 is a
DOS
program designed to manipulate your hard disk Master Boot Record
(MBR).
MBR editor, MBR backup & restore, partition table editor and more.

http://mbrwizard.tripod.com/ - "MBRWiz is a command line tool designed
to directly modify the MBR, with the capability to set partitions
active for booting, delete or hide partitions, back up and restore
copies of the MBR, as well as sort the partition entries."

++Hard Disk Testing and Repair++

* http://www.e-systems.ro/diskcheck.htm - "Emsa Disk Check is a
dual-purpose utility, for disk checking (prescan and full disk
reading)
and also benchmarking. What it does, is scanning/reading the entire
contents of a disk (CD, DVD or hard drive; or even floppy) and show
any
read errors that may appear, but also show drive speed information,
progress statistics etc. It was designed with simplicity in mind, but
usefulness for the user."

* http://www.hdtune.com/ - This can check the health of your drive.
Important step if the drive is suspected of imminently failing.

* http://www.diydatarecovery.nl/HD_Workbench.htm - Allows you to
monitor your disk health, scan it for bad sectors, replace bad sectors
and image a failing disk.

* http://www.vanheusden.com/recoverdm/ - "This program will help you
recover disks with bad sectors. You can recover files as well complete
devices. In case if finds sectors which simply cannot be recovered,
it
writes an empty sector to the outputfile and continues. If you're
recovering a CD or a DVD and the program cannot read the sector in
"normal mode", then the program will try to read the sector in "RAW
mode" (without error-checking etc.). This toolkit also has a utility
called 'mergebad': mergebad merges multiple images into one. This can
be useful when you have, for example, multiple CD's with the same data
which are all damaged. In such case, you can then first use recoverdm
to retrieve the data from the damaged CD's into image-files and then
combine them into one image with mergebad."

* http://www.s2services.com/product.php?id=3D55929 - "Recovery is a
utility program providing a convenient and prompt method for restoring
Registry and System files. Something, that can be very useful, should
your computer fail to function properly due to faults in these files.
The program has options for saving multiple copies (Images) of the
Registry and System files. So snapshots can be saved of your computer
set-up as it may change over time with new programs added and others
deleted. Saved snapshots can be copied back to system restoring
computer to a previously saved set-up. To be fully effective Recovery
relies upon there being sound and reasonably up-to-date copies of the
Registry and System files saved on disk. Version 4.0 is a major update
and is free to private users. Business users please refer to License
information." Really a registry backup disaster readiness program, not
unplanned emergency recovery.

* http://www.roadkil.net/bootbuild.html - =E2=80=9CBoot builder allows
you =
to
create your own custom boot sector from scratch. This utility allows
you to recreate or restore boot sectors lost due to virus or other
damage to a drive. Boot sectors can be imported/exported to a disk or
created from a template. This program supports FAT and NTFS boot
sector
types.=E2=80=9D

* http://www.ontrack.com/dataadvisor/ - =E2=80=9CData Advisor=C2=AE is
a si=
mple,
yet powerful computer diagnostic tool for assessing the condition of
your computer system. Data Advisor quickly assesses the health of your
hard disk drive, file structures, and computer memory by identifying
problems that could cause data loss. Don't worry if you can't boot
your
system to Windows; DataAdvisor is self-booting, so it runs even when
your system won't. This comprehensive computer diagnostic tool can be
used to both diagnose current problems and/or as part of a regular
maintenance program to identify potential problems that could lead to
data loss. If potential problems are identified, you will have time to
backup your valuable information and make corrections to avoid future
loss.=E2=80=9D

* http://www.salvationdata.com/download.htm - Many utilities are
present like HDD Repairer Seagate Demo 5.0, HDD Firmware Repairer
Demo2.0 (Floppy disk version), etc. Some of the demos never expire,
although not strictly freeware.

++Guides for Dealing with Failing Disks++

* http://camtech2000.net/Pages/WinErrs.html - "Did you ever get an
'Illegal Operation' or 'Page Fault' error message and wonder what it
meant? WinErrs is a database of 1.554 Windows error codes and their
definitions. These codes are extracted directly from Microsoft Windows
and are their descriptions. With over 1,500 error codes they certainly
seemed prepared for the worst."

* http://www.tech-pro.net/links_dr.html - "This page contains details
of sites that have information related to data recovery. It is not
exhaustive: some categories only contain sites or products that we
happened to come across and liked."

* http://www.computerhope.com/index.htm - =E2=80=9CComputer Hope is a
collection of free services that allows any user to access its
database
of extensive free computer related information. With these resources
available, Computer Hope has become a popular destination for end-
users
as well as computer support facilities for answering computer related
questions. Some of the services that Computer Hope is able to offer
include free technical support, computer product information, free
online forum, computer product buying tips, third-party computer
company information, computer dictionary, weekly computer newsletter,
daily computer news, and much more. Each of these services help make
Computer Hope the number one free computer services on the Internet.

* http://www.chiff.com/computer/data-recovery.htm - failing hard disk
recovery guides.

* http://www.pchell.com/ - Everyone has been to PC Hell at one time or
another. It=E2=80=99s that place you visit when your personal computer
is
driving you insane with problems, glitches, and so on. To try to
soothe
the frustration, we=E2=80=99ll provide some tips, hints, and
troubleshooting
remedies to help you get out of PC Hell. Be warned however, sometimes
there is no exit=E2=80=A6.

++Misc. Failed Disk Recovery++

* http://fire.dmzs.com/?section=3Dtools - a Linux Boot Disk with data
forensic apps.

* http://www.adrc.net/data_recovery_software/index.html - multiple
undelete and failing disk recovery suite.

* http://www.delback.co.uk/wavrep/ - Wave Repair Program (possible use
- cleans up noise from vinyl records).

* http://www.grc.com/tip/clickdeath.htm - "Iomega ZIP and JAZ drives
suffer from a head positioning problem (servo stiction) that can
actively and permanently damage perfectly good ZIP and JAZ drive
media.
TIP (Trouble In Paradise) provides an early warning system when a
user's drives are beginning to damage its media."

* http://www.othersystem.net/korben/rockxp-4.html - "RockXP allows you
to retrieve and change your XP product key that you used when you
installed Windows XP. This can come very handy if you need to
reinstall
but have misplaced or lost the CD cover with the serial sticker. In
addition, the program also lets you save the product activation to a
file, enables you to recover usernames and passwords contained in the
Windows Secure Storage, recover your Microsoft Windows Products keys
and have password generator."

* http://www.magicaljellybean.com/keyfinder.html - "The Magical Jelly
Bean Keyfinder is a freeware utility that retrieves your Product Key
(cd key) used to install Windows from your registry. It has the
options
to copy the key to clipboard, save it to a text file, or print it for
safekeeping. It works on Windows 95/98/ME/NT/2000/XP /Server 2003,
Office 97, and Office XP. This version is a quick update to make it
work with Windows Server 2003."

* http://members.fortunecity.com/bigg5/frw/diagn.htm - "Special
requirements: DriveSpace 3 - Manually recover corrupted DriveSpace 3
drives. The "DriveSpace 3 Disaster Recovery Kit" is a toolkit for
salvaging files and data from DriveSpace 3 CVFs (those .000 or .001
files) that have been corrupted beyond the ability of ScanDisk to
repair. It is meant to assist someone who already has a good
understanding of how data is stored on (ordinary, uncompressed) hard
drives in manually recovering otherwise inaccessible compressed
cluster
data from within damaged CVFs, and then in piecing the recovered
clusters back together into files..."

* http://www.simtel.net/product.php[url_fb_product_page]44347 -
Tiramisu is a famous early disk recovery program for DOS, Win FAT16,
and Win nt. Those versions are now shareware. This early Novell
version is free.

* http://www.s2services.com/product.php?id=3D55929 - "Recovery is a
utility program providing a convenient and prompt method for restoring
Registry and System files. Something, that can be very useful, should
your computer fail to function properly due to faults in these files.
The program has options for saving multiple copies (Images) of the
Registry and System files. So snapshots can be saved of your computer
set-up as it may change over time with new programs added and others
deleted. Saved snapshots can be copied back to system restoring
computer to a previously saved set-up. To be fully effective Recovery
relies upon there being sound and reasonably up-to-date copies of the
Registry and System files saved on disk. Version 4.0 is a major update
and is free to private users. Business users please refer to License
information." Really a registry backup disaster readiness program, not
unplanned emergency recovery.

* http://www.roadkil.net/unstopcp.html - "Recovers files from disks
with physical damage. Allows you to copy files from disks with
problems
such as bad sectors, scratches or that just give errors when reading
data. The program will attempt to recover every readable piece of a
file and put the pieces together. Using this method most types of
files
can be made usable even if some parts were not recoverable in the
end."


http://www.ubcd4win.com/contents.htm - "UBCD4Win is a bootable CD
which
contains software that allows you to repair, restore, or diagnose
almost any computer problem. Our goal is to be the ultimate free
hardware and software diagnostic tool. All software included in
UBCD4Win are freeware utilities for Windows=C2=AE. UBCD4Win is based
on
Bart's PE=C2=A9. Bart's PE=C2=A9 builds a Windows=C2=AE "pre-install"
envir=
onment
CD, basically Windows=C2=AE booted from CD. We include many free
hardware
and software diagnostic tools that allow you to fix almost any problem
you will face with your computer. With network support, the ability to
modify NTFS volumes, recover deleted files, create new NTFS volumes,
scan hard drives for viruses, etc. this project includes almost
everything you need to repair your system problems. This project has
been put together to be the ultimate recovery cd and not a replacement
OS (Operating System). Please visit the "List of Tools" page for a
complete list of what is included in the latest version of the
project."

http://www.passmark.com/products/diskcheckup.htm - "PassMark
DiskCheckup=E2=84=A2 allows the user to monitor the SMART attributes
of a
particular hard disk drive. SMART ( Self Monitoring Analysis &
Reporting Technology ) is an interface between a computer's BIOS
(basic
input/output system) and the computer hard disk. It is a feature of
the
Enhanced Integrated Drive Electronics (EIDE) technology that controls
access to the hard drive. If S.M.A.R.T is enabled when a computer is
set up, the BIOS can receive analytical information from the hard
drive
and determine whether to send the user a warning message about
possible
future failure of the hard drive."
 
D

Dustin Cook

(e-mail address removed) wrote in
Since the drive is "recognized" by Windows Explorer (it gives it a
drive letter but 0 bytes) and by Windows "Computer Management > Disk
Management" (it says it's "healthy" and gives the right size), I
wonder if it's the controller or the data.

Still, changing the controller can't hurt (right?). I first tried to
buy the same 500GB Western Digital disk at Costco but ended up with a
1TB Western Digital drive (that's all they had that was Western
Digital).

I will go to Fry's today and pick up the $25 SATA-to-USB adapter. Then
I will remove the disk from the WD enclosure and see if it spins up on
that SATA/IDE-to-USB adapter. If it shows the same problem, then I'll
know the electronics aren't to blame and I can concentrate on the
recovery.

BTW, what group are you coming in on because I want to just limit this
to the proper group.

I'm picking you up from alt.comp.virus...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top