Virus? USB 500GB external hard disk is now "raw format"

[Dustin Cook]

Or it maybe easier to just get another external HD case with a USB
output. They can be as cheap as $20. No need to mess with your tower
then and if it works your all set.

That's another way to do it, I suppose.

 

[CBFalconer]

From: <[email protected]>

Please remove; alt.comp.freeware. It is Off Topic subject matter.

If you want to do that it is simple. Set follow-ups yourself. If
you want to complain the only viable complaint is that the
originator didn't set follow-ups.

 

[gsaogwash]

I did try it. On three machines. Same thing. It shows up as a "RAW"
unformatted disk.

Do this for your Windows system.

Download the ISO image and burn to a cd SystemRescueCd freeware
http://www.sysresccd.org/Main_Page

SystemRescueCD is a light-weight bootable Linux system specifically built
for repairing and recovering your disk data.

With a cold PC, plug in the old 500MB USB hard drive and plug in your new
1TB USB hard drive and then boot your PC to the SystemRescueCD Linux (F12).

At the SystemRescueCD Linux command line, run "tail /var/log/messages |
grep sd" and you should see something like sdb and sdb1 as partitions for
the first disk, and sdc and sdc1 as partitions for the second disk.

Copy the first disk to the second disk
dd -if=/dev/sdb of=/dev/sdc bs=4096k

When done (this may take days for a USB disk) work with the copy. Your 1TB
disk will now look like your 500MB disk. At this point, you can run Norton
Utils or SystemRestoreCD utilities to repair the disk.

I'm not sure what utilities will repair the disk but that's what the other
people are here for on this newsgroup.

 

[ralph]

Disk Investigator
http://www.theabsolute.net/sware/dskinv.html

ADRC Data Recovery Software Tools
http://www.adrc.com/software/data_recovery_tools

Here is where I am.

The controller is good and the disk itself has not crashed.
So I created a systemrecoverycd boot cd which can freely recover all
photographs regardless of the fat32 tables.

The dd took 7 hours but now I have a duplicate disk to work with (keeping
the original pristine).

I'm looking up the photo-recovery feature of the latest systemrecoverycd.

 

[Johnw]

ralph was thinking very hard :

Here is where I am.
The controller is good and the disk itself has not crashed.
So I created a systemrecoverycd boot cd which can freely recover all
photographs regardless of the fat32 tables.
The dd took 7 hours but now I have a duplicate disk to work with (keeping
the original pristine).
I'm looking up the photo-recovery feature of the latest systemrecoverycd.

Thanks Ralph, good luck.

 

[ralph]

Thanks Ralph, good luck.

Thanks for the encouragement. It's not done yet but I haven't given up
either. The new PhotoRec freeware seems perfect for recovering lost
photographs and MP3 files (of which I had many on that lost disk).
http://www.cgsecurity.org/wiki/PhotoRec

The dd command after booting to the systemrecoverycd I used was:

% tail /var/log/messages (which told me sdb was the 500MB & sdc was 1TB)
% date
% dd if=/dev/sdb of=/dev/sdc bs=4096k; date

The result, 7 hours later, was a copy of the original disk sdb
119235 records in
119235 records out
500107862016 bytes (500 GB) copied, 25203.6s, 19 MB/s

I am not sure what to do with the systemrecoverycd but I noticed it still
thinks the sdc is 1 terabyte (which surprised me as everyone said it would
"look" like 500 megabytes at this time).

If all my attempts to salvage the file allocation tables fail (I'm really
not sure how to proceed at this point as I do not know Linux), I can at
least run the new photo recovery cd program which saves lost photos and MP3
files (and many other formats) even from a dead disk
http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

So the summary is that I have a copy of my original disk but don't know
what to do next. Am looking.

 

[Johnw]

ralph presented the following explanation :

I just can't seem to find a tutorial for recovering photographs using the
free Photo Rescue CD http://www.cgsecurity.org/wiki/PhotoRec

This page tells me I have a common problem which hits people who store
photographs on an external drive. It says most likely the virus or Windows
corrupted something called the Master Boot Record (MBR).
http://linux.goeszen.com/second-hard-drive-appears-as-raw-after-fresh-xp-install.html

Assuming the Master Boot Record (MBR) is corrupted on the external Western
Digital 500 GB USB photograph storage drive, I've booted the Windows PC to
the free Linux SystemRescueCD and tried to recover all JPEG photographs
from the RAW disk.

But I'm stuck at this point not knowing how to proceed to save my lost
photographs due to Windows not recognizing the drive (calling it RAW).

Try this search criteia in google. If you get any other error messages,
google.

recover images raw drive

http://www.google.com.au/search?hl=en&q=recover+images+raw+drive&btnG=Google+Search&meta=

http://preview.tinyurl.com/6y8wvd

 

[Johnw]

I just can't seem to find a tutorial for recovering photographs using the
free Photo Rescue CD http://www.cgsecurity.org/wiki/PhotoRec

Have a look at these.

tutorial PhotoRec
http://www.google.com.au/search?hl=en&q=tutorial+PhotoRec&btnG=Search&meta=

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

http://preview.tinyurl.com/ytbkba

 

[ralph]

tutorial PhotoRec
http://www.google.com.au/search?hl=en&q=tutorial+PhotoRec&btnG=Search&meta=
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
http://preview.tinyurl.com/ytbkba

Excellent! Will try. I thought this was going to be easy to rescue the RAW
disk thousands of photos but it has turned out to not be intuitive. It's
like working with unexploded ordnance ... even simple things become
difficult without precise instructions as hit or miss doesn't work with
photo rescue efforts.

 

[Guest]

| On Thu, 27 Nov 2008 06:06:20 +0900, Johnw wrote:
|
|> tutorial PhotoRec
|> http://www.google.com.au/search?hl=en&q=tutorial+PhotoRec&btnG=Search&meta=
|> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
|> http://preview.tinyurl.com/ytbkba
|
| Excellent! Will try. I thought this was going to be easy to rescue the RAW
| disk thousands of photos but it has turned out to not be intuitive. It's
| like working with unexploded ordnance ... even simple things become
| difficult without precise instructions as hit or miss doesn't work with
| photo rescue efforts.

Precise instructions to recover depend on first knowing precisely what is wrong.
Neither of us know what that is.

This is more of a forensics situation. If my goal is just to recover, then I
work to find out what is there so I can figure out what to do to recover. If
the drive is physically readable, then the next think I look at is of the MBR
is consistent. If so, then I check to see if the partitions are what I think
they should be. If so, then I see if I can mount them in READ ONLY mode.

One problem with all this is that there are few filesystem types that Windows
knows how to read. So if I have a situation like this with an external drive
on Windows, that drive gets moved to another computer running Linux, and the
two computers get networked together (but not to the internet). Then I can do
a file share to let Windows get the files back and store them on a new empty
drive.

 

[Guest]

| I am not sure what to do with the systemrecoverycd but I noticed it still
| thinks the sdc is 1 terabyte (which surprised me as everyone said it would
| "look" like 500 megabytes at this time).

Can you get a web page that gives specifications for the EXACT model of drive
you actually have? I'm wondering if maybe its one of those boxes that has 2
drives of 500 GB, and arranges them in a RAID configuration, and the RAID
configuration somehow got changed from level 1 (mirrored presenting a single
500GB space) to level 0 (concatenated presenting all the space as 1 TB).

It may be that the RAID is done in Windows driver software, and then Linux
will NOT see that configuration. Maybe Windows doesn't see it now, either.

 

[Franklin]

| I am not sure what to do with the systemrecoverycd but I noticed it
| still thinks the sdc is 1 terabyte (which surprised me as everyone
| said it would "look" like 500 megabytes at this time).

Can you get a web page that gives specifications for the EXACT model
of drive you actually have? I'm wondering if maybe its one of those
boxes that has 2 drives of 500 GB, and arranges them in a RAID
configuration, and the RAID configuration somehow got changed from
level 1 (mirrored presenting a single 500GB space) to level 0
(concatenated presenting all the space as 1 TB).

It may be that the RAID is done in Windows driver software, and then
Linux will NOT see that configuration. Maybe Windows doesn't see it
now, either.

Hi Phil, this situation seems to be getting more and more involved!

Surely the FIRST thing to do is post (crosspost if appropriate) to the
IBM storage group. This will be to the chagrin of some regular posters
in ACF.

Next is NOT to blindly run a defrag, scandisk or fdisk in hope that one
of them might do something useful because they can each cause damage in
this situation.

Then, as you say, restore the MBR. Apart from the Microsoft partition ID
sig, all the MBR can probably be recovered if there are still partitions
on the drive at all. The Storage group can advise what automated
software they will talk him thru. Svend provides Findpart (which is
freeware) but his tools often need reasonable user expertise.

http://www.partitionsupport.com/utilities.htm

I'll assume the PBS is ok although it seems this drive has had a failure
in both system areas and file areas. Next is a choice between (a)
checking which of the two FATs is in the best condition and ISTR Findpart
may also do this or (b) seeing what damaged sectors there are.

There are lots of architectural limits occurring here. I forget all the
details: XP will access the hard drive itself even beyond the 137 GB
limit but ISTR version 6.22 of MS's Fdisk/format wont create or format a
partition bigger than 32GB but version 7 will. Either could be on a W98
system. MS's Scandisk & defrag are limited to 127 GB. The W98 system
may not be able to see beyond 137 GB of the drive (48 bit LBA arrived
with ATA-6). So who knows what happened as part of this HDD's setup or
how it managed to work in practise. The lost clusters now being picked
up by scandisk are not a good sign because they might have been needed in
a repair.

To have a guess *maybe* this drive has been moved between systems with
different HDD addressing conventions or there has been some unwelcome
changes made in the motherboard settings. Or maybe surface damage
instead that didn't automatically get mapped out for some reason.

The Storage group might talk the OP thru this. I've seen Svend walk a
user thru recovery but that was some years ago and he may not be able to
now.