DIY DataRecovery.nl Support forum

Support => DiskPatch => Topic started by: j700_be on May 09, 2017, 10:37:23 AM



Title: Partition table not OK---overlapped partitions
Post by: j700_be on May 09, 2017, 10:37:23 AM
Hello

--> following the cannot find MBR topic. Here it continues with report files of the disk, (129) it will be in attachment.
The partition table is no OK anymore, however the data is still on the disk. It is not possible at the moment to rebuilt a folder tree in this situation.
Before all data was on a 1TB disk, stating that the total amount of volumes was...2TB  ???
Therefor all was cloned to a physical 2TB disk were you can find the report.
The only thing that "wrong" happened with the Original disk is that the MBR has been overwritten.
All other data remains in the same state.
I do not take risky steps now in this situation. I think the MBR/partition table needs to be rebuilt.

Regards


Title: Re: Partition table not OK---overlapped partitions
Post by: Tom on May 09, 2017, 12:59:39 PM
The log is confusing, I see a few things that don't make sense and to be honest I'm not sure where to start on trying to make this work. My advice for now would be to try iRecover and analyze the disk, see if anything comes up.


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 09, 2017, 04:51:26 PM
iRecover cannot give out more details.
It finds 4 partitions, and this is indeed weird. Data cannot be properly recovered this way. Just some files. But no directory structure as it should be.

I need to delete one partition (or all?) and set new parameters for the partition table, as I think these have been shifted. That's why I first need to have the structure right. I know there is data on it.
The MFT file is still there? Can it be recognised? I think this would be a good startingpoint.

Regards


Title: Re: Partition table not OK---overlapped partitions
Post by: Tom on May 10, 2017, 11:35:06 AM
The log shows DiskPatch finds nothing at all, but this may be because of incorrect disk size values.
Try this:
- Start DiskPatch
- Select the correct disk
- Go to Options
- Set the disk geometry to 255 heads and 63 sectors
- Create a fresh support analysis log from the Support menu
Then post the log as you did before.


Title: Re: Partition table not OK---overlapped partitions
Post by: Joep on May 10, 2017, 12:08:56 PM
Hi,

An MFT can be a starting point, you'd have to make assumptions about the cluster size and decode the MFT entry for the MFT itself.

But even with an intact MFT, rewriting a partition table isn't something that will change the amount of data picked up by iRecover. Even with an intact partition table, this is completely ignored when doing file system reconstruction.

How do you use iRecover? Do you use the option to scan for lost partitions? Can I see a screenshot for the dir/file list?



Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 17, 2017, 11:45:21 AM
Hello

This reply was not immediatly possible due to the necessary steps and took some time.
Included are screenshots of iRecover, and also the English version of ZAR.
The comment: adapt the disk geometry is I think the way to go as it is indeed different to to other disk.
Thanks for understanding. For now I haven't done this yet, because I first wanted to reply on the iRecover feedback, which is also interesting.

It's strange that a full run of the scan doesn't work anymore as the program stops at a certain point.
It finds:
217 701 files
903 466 folders  (it's not logic to me, but can be explained by the false geometry??)
It starts to reassemble and finds a ext2/ext3 filestructure.
Before it was possible to see a result: a lot of numbered folders and also files, but no treestructure.
Running ZAR gives the same thing, but now give a message when stopping.
"Tread folder monitorThread"
Screenshots in attachment.

Thanks


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 17, 2017, 11:51:32 AM
extra comment
ZAR finds (as seen also on the last screenshot)
4 294 273 768 files
903 466 folders
ext2/3/4
Because of the numberous amount, the program goes out of memory?

Regards


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 17, 2017, 11:56:43 AM
another comment.
The amount of folders is the same I see now. 903 466
Later more files are found with the other version --> the not logic thing from me can be cancelled then... ;)


Title: Re: Partition table not OK---overlapped partitions
Post by: Joep on May 17, 2017, 05:52:05 PM
Hello,

What was actually on the disk, I mean what was the file system? Becoming hard to follow, this.

So, the iRecover/ZAR screenshots are from the 2TB disk, first half containing the cloned 1 TB?

What happened again to it?


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 17, 2017, 10:45:22 PM
Hello

Only in the begining long ago I was once able to see 2 partitions with files and folders on a Windows XP machine.
One was around 250GB, the other around 400GB.
This was on the original bad 1TB disk.
So there must be some FAT/NTFS  story.
I've also noticed through several tools a partition of 195 GB in ext format at the start of the disk.
MBR is been overwritten because the disk acted strange and was slow on response. Afterthoughts maybe this was not a good idea as also earlier stated. (--> therefor I'm looking into the Diskpatch solution.)
Later I noticed that the disk got physically more worse and therefor I made a clone to continue.

Now what you see in the pics is the cloned 2TB disk where the first half is been used by filestructure, indeed.
Later I've placed the cloned disk to another computer for Diskpatch, but no changes were done then.
That is the only thing done after, and some power off's.
I try to let run a full scan again, but it takes some time. About 28+ hours.
Thanks for all your support, even if it's hard to follow.  8)

Regards



Title: Re: Partition table not OK---overlapped partitions
Post by: Joep on May 18, 2017, 01:37:10 PM
Hi,

All looks really weird and wrong. Almost all FS structures and only tiny bit of data fragments, so fragments recognized as files. When that map fills iRecover does 2 things basically: scan for filesystem structures and scan for sectors that look they belong to a file. For example, this looks like the contents of a JPG file, or a ZIP file. And that's kept in an array. Later on it combines all that to determine the file system and file system parameters such as the start of the file system, it's size and the cluster size. Normally the amount of file system stuff is a fraction of what we find, and data fragments we find all over the place.

This is true whether we have a partition table or not. A partition table is not going to change what we find when scanning the disk. I can' explain what happened here because I wasn't there, but it looks wrong.

Do we still have the original drive? Can we scan that for a while? See if the picture the diskmap gives us is different? Or, if you're afraid the original disk may die on you, can we image it using iRecover instead? Note that iRecover does not do disk to disk, it does disk to file. So to store the file you need a NTFS formatted volume > 1 TB.

Can you also, with the original disk do: in disk/partition window, select the physical disk > More Options > S.M.A.R.T. > save as text file and paste that text file here?

And is it perhaps possible to do it on an entirely different system to rule out cabling and memory errors? How are disks connected anyway, SATA or USB? If USB can we try a different enclosure? Just asking, don't know your options ..

Was the bad disk, the 1 TB one, an internal disk, or external? If external, what brand? It's not one of those WD Passport things is it?


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 19, 2017, 02:52:34 PM
Hello

1. I still have the original bad 1TB disk, and a report and smart file is in attachement.
2. It is not possible to do an analysis because of the physical state of the disk. It stops at some point.
3. I'm trying to make an image by iRecover but the disk is now for more then one hour idle.
    No action is happening. Also the physical cause.
In the report it's the second disk/129. I know it's connected by USB otherwise I don't have access to it by Diskpatch. (other computer is used as recommended)
Now it's possible to see 4 sections and in iRecover I've seen a 500GB Linux partition appearing.
(on a SATA connected PC)
Disk is a Maxtor Diamondmax 22 STM31000340A5 Manufactured by Seagate/Korat-Thailand.

Reading your former comments, that the cloned disk has shattered data, makes me think that the cloning was of bad quality.
I've tried mulitple cloning solutions, and almoast all got stuck. Then one possibility did do the job piece by piece but took 6 months+ non-stop  :o to make the clone. --> makes me think that the recompile of the data on the target disk are all little pieces, and can not be fully trusted. And that this is what you are seeing on the cloned 2TB.

Following this I'm concluding now:
1. Other cloning suggestions that can handle bad readable/half dead disks. The disk is still spinning. Any ideas?
2. Can I replace the platters myself to another working mechanic diskassembly without getting damage?
    I do not have a cleanroom myself. So little homedust is possible...
3. Physical solution. Do I really need to bring it in to some IT-company with cleanroom?

Regards
   


Title: Re: Partition table not OK---overlapped partitions
Post by: Joep on May 19, 2017, 07:10:12 PM
Hi,

iRecover didn't show the SMART status? I'd stop cloning for now, may make matters worse. Try getting SMART using this:
http://www.disktuna.com/hd-sentinel-hdd-and-ssd-disk-health-monitor/

Yes, well replacing the platters, what do you mean? It is unlikely a recovery lab would be doing that. Labs have specialized hardware/software with which the can control behavior of a disk. Tell it when to give, power down/up again etc.. So much more control than DiskPatch or iRecover. So, that's probably what they'd try first. The disk may never see a cleanroom at all if you let them handle it.

I don't know your location, but there are reputable companies, that if they can clone the disk, will charge a couple of hundred of dollar. You always see the 1000's of Dollars stories, but that's nonsense. many recoveries can be done for much less. Example: https://www.recoveryforce.com/

You need to decide if it's worth the money. Swapping platters when for example there's 100's of bad sectors makes no sense at all.



Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 20, 2017, 07:42:33 PM
Hello

S.M.A.R.T is not lightened up in iRecover.
HDD Sentinel: it was possible to make a report. I will add it in a new post.
I'm from Belgium, and lately also contacted Attingo in the Netherlands, but was out of range.




Title: Re: Partition table not OK---overlapped partitions
Post by: Joep on May 22, 2017, 02:57:19 PM
out of range to drop off you mean?


Title: Re: Partition table not OK---overlapped partitions
Post by: j700_be on May 22, 2017, 11:31:31 PM
Costs indeed. For now I'm still not out of all my options.
So in the worst case I still have a contact for a advanced/hardware-solution.
This topic may be closed now.