max300 support log

[jwixson]

here are the results of my running DiskPatch support logging on a hard disk i call Max300.
after the support log ran, i got the message "unrecoverable error: operations halted: error message 208, address 264508: unforeseen runtime error."  DiskPatch also wrote two files, which i enclose in zipped format: the file DP, which is empty, and the other file, dpstate.131.  i do not know what is in it, since it has a format which no application i know can open.

i hope to learn what this means, and perhaps some article which can explain more to me.
i hope also that i can fix whatever prevented me from producing a support log, so that i can make and send one to you.  thank you!
jw

[Tom]

How did you create the logs? Did you use the bootable diskette, CD or USB key?

Please try this and post the result:
http://www.diydatarecovery.nl/dp_manual/guide_smartcheck.htm

[jwixson]

Tom,
i used a USB key.
jw

[jwixson]

Tom,
can i run the SMART report on a drive that i am not booting?
jw

[Joep]

Hello,

Yes, it will try to detect all disks and report on them.

[jwixson]

here is the SMART  report - it does not appear to see disk MAX300, tho it sees the other two drives.
As i have written earlier: when i start DiskPatch, i get a "disk overlay" warning.  It complains that "Startup Check requires attention," blinks an exclamation point in the entry called Disk Overlay, and (three) lines of format "Disk1 (physical) [number of sectors on drive] [size in GB] 255 63 (BIOS)" are displayed in blinking red.  I have no idea what this means, so do not know what i can or ought to do about it.

It is disk 3 - Max300 - which i am most concerned about - this is the disk which lost my data.  i cannot tell much about it, except that DiskPatch can see it.  I have not tried any operations on it (yet), and am waiting for instructions on how to proceed.
It bothers me that SMART cannot see it.  But i hope that DiskPatch can read it and retrieve some files.
What can you tell about this drive?

And what does the "disk overlay" warning mean?
I run Windows7, and had used this drive for some time until, one day, it no longer showed up - the BIOS could not see it.
One possible factor:  i had been using Terabyte Unlimited's BootIt Multiboot utility on it - installed in a small, special partition.
"Overlay" could possibly refer to this software, which alters the master boot record.
thank you
jw
 

[Tom]

here is the SMART report

Where is it?

And what does the "disk overlay" warning mean?

That was explained in the other thread. You have to keep an eye on the things you post, we answer every question but you have to read the answer, obviously.
http://www.diydatarecovery.nl/forum/index.php/topic,1299.0.html

Ignore the disk overlay thing.

Try connecting the disk to another PC, that may help us find out where things go wrong. Try to create a SMART log and a support analysis log on the other PC.

Can the disk be seen in the hardware list in Windows? If so, you could do a SMART test from within Windows by installing iRecover and checking the disk's health with that.

[Tom]

There was no need for a new thread. In fact, more threads is more potential confusion.

Try the DiskPatch support log and SMART log.
http://www.diydatarecovery.nl/dp_manual/guide_smartcheck.htm
http://www.diydatarecovery.nl/dp_manual/guide_supportanalysis.htm

If that doesn't work out install iRecover and check the SMART status: Click the "datarecovery for windows and linux" button, then right-click the disk in the list and select SMART info. Save to a file and post it here.

[jwixson]

Tom,
this time i think i have it!  I enclose a support log and a SMART report, both of which can see my Max300 drive (Maxtor 6V300F0).  I hope these are useful to you.

At one time i had about 300GB of data on this drive, including a great many Office data files (documents, spreadsheets etc) and some pretty large Outlook (PST) files, which i would dearly love to see again.
And i would especially like to know how you read these, as well as what you can find.

I have run File Scavenger on this disk and it comes up with a huge number of mostly unidentified files, which does not do me much good.  This company's philosophy is that everything about FS is a state secret (as if there were any)!  So i could not get much help from them (they want me to send them the drive, of course).
I greatly prefer your approach of letting us learn and discover.

If my data files are no longer in retrievable form on this drive, i have two more chances, in diminishing order of hope - i did a backup of the data on Max300 some time ago, but playing with Terabyte's utilities has pretty much scrambled these drives, too.  Still...

I have a clue about "overlays:" it seems that Terabyte's BootIt utility (for multiple booting) is a candidate, and i suspect that this is what DiskPatch was muttering about.

i anxiously await your comments, but hesitate to perform any DP actions until i hear.  I am wondering if i should not first of all clone Max300 (if i can get a big enough drive), and operate on the image instead?  Or maybe there are some non-invasive explorations i can do from DP first?
Also: would the results of (recovery) operations on the image be the same as if performed on the subject drive itself?
(I can guess many of the answers, but have become very shy of experimenting.)
in hope...
jw

[Joep]

Hello,

Ok, and to complete the picture: What does windows show when you access the disk? so, for example: entire drive is gone/does not show up, no drive letter etc. /or/ you see disk but it's empty /or/ windows shows message /etc ...

From the logfile:

- Indeed the MBR is not standard but that figures as you mentioned bootit or similar software. That should not prevent you from accessing the disk/drive.

- Two NTFS partition we see right now +, and that's odd, a type DF partition near the end of the disk which http://www.win.tue.nl/~aeb/partitions/partition_types-1.html indeed lists as a bootit partition.

- The boot sectors for the NTFS partitions look valid. By displaying the volume label, DiskPatch indicates that the boot sectors also point to a valid MFT structure.

The NTFS partitions are Megabyte aligned. Older operating systems (XP) create cylinder aligned partitions. We also find traces of cylinder aligned partitions.

Sumarizing, there are 2 valid partitions. So nothing DiskPatch can repair there. It's normal we also detect traces of previous partitions if a disk has been repartitioned in the past.

If results using FileScavenger are not satisfactory you may want to try iRecover. In one situation one solution may render more usable data than the other and vice versa.

[jwixson]

Joep,
when i look at the Max300 drive under Windows, i see four partitions:
1.) 100MB system reserved, as usual
2.) 29GB Windows7, which looks normat (but has none of my data in it)
3.) 250GB "unallocated," which is (i hope) where any of my data might be
4.) 8MB, reserved for BootIt, the multi-boot utility which is probably the "overlay" which DiskPatch finds to be present.

it is in this third, unallocated partition that i have hopes of finding (at least some of) my data.

you mention iRecover, and i plan to try it, hoping that it can indeed recover data.  I believe that i must buy it first, before it will function, no?

But above all, i do not want to make an already bad situation worse.  That is why i asked you if i should operate directly on this drive, or whether i should first attempt to copy the third, unallocated partition to another drive, then operate on that image (presumably with iRecover).  What do you say?

If i send you the result of running File Scavenger, would that be of any help to you?  (Do you know how to read it?)

in hope, jw

[Tom]

iRecover has a trial version that allows analysis of the disk, so you can see if data can be recovered.

iRecover is read-only so it's safe to use on any disk, unless that disk has mechanical problems (which does not appear to be the case here).

If you want to play it safe you can create an image of the entire drive and work on that image. This can be done with iRecover (also with the trial version). Obviously you would need a disk that can hold such a large file.

[Joep]

And also: We didnt receive a file scavenger file but there's not a lot we can do with it anyway.

With regards to using iRecover: Use the data recovery for Linux and Windows option. Since you want to scan an unallocated area you best should define an area manually (in disk selection screen, right click). Add sizes in Mb from previous partitions and use that for start value, and enter the approximate size for the partition that was lost in Mb. An unknown partition appears in the list, select that and scan it. In the right side of the screen, the source for the partition will indicate 'user input'.

Then, keep your fingers crossed. If you do get you data back, verify it, and then you can use the unallocated space to recreate a new partition.