Dynamic Disk Data Recovery - HELP PLEASE

[cr8apic]

Recently my old Windows XP Motherboard crashed and I decided to update the PC and get Vista.  I had 2 drives mirrored using Raid 1 on a Siicon Image SATA PCI Raid Card.  I installed the card in the new PC's and quickly discovered that the disks were not readable.  After some research I realised that the XP disks were dynamic disks and Vista could not read them.  More research and I discovered a way to convert a dynamic disk to a basic disk without data loss using a hex editor.  I proceeded to use the process on both disks and one worked OK and is installed but the second drive has caused a few problems.

I downloaded a demo copy of DiskPatch and had hoped that it would recover the data.  Before purchasing I sent a support request  and support analysis log file to DiskPatch but did not get a reply.  I decided to jump in and purchase a copy a couple of weeks ago.  Despite my best efforts I have not bee able to recover the data.  Can you help?

I have a  suuport analysis log file for both drives. I have tried to do any editing on the mirrored drive and kept the original drive with as little editing and program manipulation as possible.  Both files are available plus any other information you need..

I hope you can assist as I do not want to go down the refund path and just want the data recovered.

[Joep]

Hello,

I proceeded to use the process on both disks and one worked OK and is installed but the second drive has caused a few problems.

Please describe those problems.

Despite my best efforts I have not bee able to recover the data.

Maybe you can elaborate on what was tried sofar.

I have a  suuport analysis log file for both drives.

Can we see please ...

And, if the 2 disks were mirrors, and the original is fine (it is isn't it), then why not just reformat the mirror?

[cr8apic]

Originally I had 2 disks with each disk mirrored - a total of 4 disks.  The process I used was from http://www.wilderssecurity.com/showthread.php?t=191006 .  This worked fine on one set of mirrored disks but did not work on the second problem disk.

Windows shows no data on the problems disk or the mirrored copy.  I have used demo versions of Zero Assumption Recovery, Partition Recovery, NTFS Data recovery, File Recovery, Gat Data Back NTFS, Disk Explorer and Raid Recovery.  Before posting I ran DiskPatch and had a look at all options.  I got a message "run a repair session to rclaim individual partitions" but have not beenable to find out how to complete this?

Thank for your help and I will send the support anaysis files separately.

[Joep]

Hello,

I got a message "run a repair session to reclaim individual partitions" but have not beenable to find out how to complete this?

In DiskPatch?

Thank for your help and I will send the support anaysis files separately.

Ok, did you sent that already? If so, then please sent again because we didn't receive those files.

[cr8apic]

Yes in DiskPatch - after running the MBR Repair from memory?

What address do I send the support files to?  I have sent them to support@diydatarecovery.nl twice now.  I used the link from this page http://www.diydatarecovery.nl/FAQ_diskpatch.htm under how to initiate a support request.

[Joep]

Hello,

Why don't you paste it here so we keep everything in one spot? Because I don't see them in our inbox.

[cr8apic]

Is this the info you are after?

Drive 1
"3.4.100   255       63        625142448 7CD9BB85F4B4865A    9         2         0         "
"129","63","NTFS","BS","63","625137282","PRI","I"
"129","625137344","NTFS","BBS","63","625137282","PRI","I"
"129","0","DYN","PTE1","63","625137282","PRI","I"
"129","6","DYN","LDM","63","4294967233","PRI","I"
"129","8","NTFS","PTE1","71","625137282","LOG","I"
"129","63","NTFS","BS","63","625137282","PRI","I"
"129","380885124","GOBACK","PTE1","4096513992","1157562368","LOG","I"
"129","625137344","NTFS","BBS","63","625137282","PRI","I"
"129","625142447","DYN","LDM","63","625137282","PRI","I"
"NTFS","","1","2","---","1","1","1","2","A","","",""
"GOBACK","7","---","---","---","7","7","7","1","-","","",""

Drive 2
"3.4.100   255       63        625142448 9AA6F39791517E0B    8         1         0         "
"130","63","NTFS","BS","63","625137282","PRI","I"
"130","625137344","NTFS","BBS","63","625137282","PRI","I"
"130","0","DYN","PTE1","63","625137282","PRI","I"
"130","6","DYN","LDM","63","4294967233","PRI","I"
"130","8","NTFS","PTE1","71","625137282","LOG","I"
"130","63","NTFS","BS","63","625137282","PRI","I"
"130","625137344","NTFS","BBS","63","625137282","PRI","I"
"130","625142447","DYN","LDM","63","625137282","PRI","I"
"NTFS","","1","2","---","1","1","1","2","A","","",""

[Joep]

http://www.diydatarecovery.nl/dp_manual/guide_supportanalysis.htm

[cr8apic]

That is the process I used, file completed, opened in Notepad, copied into previous forum post.  I will run again and attach below.

Must have opened the wrong file as I have been watching rugby league on TV betwen posts - this should be it:

Code:

.../000:02/LOG> ### LOG START ###
.../000:02/LOG> DISKPATCH 3.4.100
.../000:02/LOG> (C) 2000-2008 DIY DataRecovery
.../000:02/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:02/LOG> MemFree: 76Kb
.../000:02/LOG> CommandLineParms: /sup
.../000:02/LOG> LogDate: 06-15-2008
.../000:02/CFG> FilePath="1/.\DPFILES\"
.../000:02/CFG> LogFilename="DP.LOG"
.../000:02/CFG> ReadRetries="32"
.../000:02/CFG> WriteRetries="32"
.../000:02/CFG> MaxReadErrors="32"
.../000:02/CFG> MaxWriteErrors="1"
.../000:02/CFG> ReadDelay="0"
.../000:02/CFG> VfyFixedBadSect="1"
.../000:02/CFG> CleanAfterDOD="1"
.../000:02/CFG> DiskReset="1"
.../000:02/CFG> SectorSkip="1024"
.../000:02/CFG> AutoSaveState="1"
.../000:02/CFG> DumpFoundSectors="0"
.../000:02/CFG> FixFats="1"
.../000:02/CFG> MaxFatScan="51200"
.../000:02/CFG> MaxDataColEntries="256"
.../000:02/CFG> IgnoreF8FF="0"
.../000:02/CFG> DownSizeExt="1"
.../000:02/CFG> ScanSignature="55AA"
.../000:02/CFG> Rebuild="00"
.../000:02/13H> Ext13H installed test requested
.../000:02/13H> Disk found at 128
.../000:02/13H> Ext13H version: EDD-3.0
.../000:02/13H> Ext13H Support: Extended disk access functions
.../000:02/13H> Ext13H Support: Enhanced disk drive functions
.../000:02/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:02/13H> Drive Interface Info :
.../000:02/13H> Disk 128 X13H data : 16383/16/63 156312576/512
.../000:02/13H> Disk found at 129
.../000:02/13H> Ext13H version: EDD-3.0
.../000:02/13H> Ext13H Support: Extended disk access functions
.../000:02/13H> Ext13H Support: Enhanced disk drive functions
.../000:02/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:02/13H> Drive Interface Info :
.../000:02/13H> Disk 129 X13H data : 16383/16/63 625142448/512
.../000:02/13H> Disk found at 130
.../000:02/13H> Ext13H version: EDD-3.0
.../000:02/13H> Ext13H Support: Extended disk access functions
.../000:02/13H> Ext13H Support: Enhanced disk drive functions
.../000:02/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:02/13H> Drive Interface Info :
.../000:02/13H> Disk 130 X13H data : 16383/16/63 625142448/512
.../000:02/13H> Ext13H tested ok
.../000:02/FDL> DiskList requested
.../000:02/FDL> Disk found at 128
.../000:02/FDL> Disk found at 129
.../000:02/FDL> Disk found at 130
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .156312576 | 255 | 63 | .74
129 | .625142448 | 255 | 63 | 298
130 | .625142448 | 255 | 63 | 298
..0 | .........0 | ..0 | .0 | ..0
.../000:02/IAS> AdmiSector found on disk 0 (128)
.../000:02/IAS> AdmiSector found on disk 1 (129)
.../000:02/IAS> AdmiSector found on disk 2 (130)
.../000:03/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:03/EXE> Read/Write pattern test for disk 1 (129) successful
.../000:04/EXE> Read/Write pattern test for disk 2 (130) successful
.../000:04/WAS> AdmiSectors in use : 0+ 1+ 2+
.../000:04/KEY> DEMO/1
.../000:04/PFC> UDMA driver not loaded
.../000:04/PFC> PQstuff signature detected on disk 0 (128)
.../000:04/PFC> PQstuff signature not detected on disk 1 (129)
.../000:04/PFC> PQstuff signature not detected on disk 2 (130)
.../000:05/PFC> Partition State backup not found on disk 0 (128)
.../000:05/PFC> Partition State backup not found on disk 1 (129)
.../000:05/PFC> Partition State backup not found on disk 2 (130)
.../000:05/PFC> No Repair date found on disk 0 (128)
.../000:05/PFC> No Repair date found on disk 1 (129)
.../000:05/PFC> No Repair date found on disk 2 (130)
.../000:22/CSD> Start CheckDisk for disk 1 (129)
.../000:22/CSD> CheckDisk complete, ReadErrors 0
.../000:22/USD> Disk 1 (129) selected
.../000:22/GSC> First DP run, geo info for disk 1 (129) not yet recorded
.../000:22/WAS> AdmiSectors in use : 0+ 1+ 2+
.../000:22/GSC> Geo for disk 1 (129) saved as 0625142448255063
129/000:22/USD> MBR for disk 1 (129)
129/000:22/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 FA 8E D0 BC 00 7C FB 8E D8 8B F4 8B F8 B9  |  3ÀúŽÐ¼.|ûŽØ‹ô‹ø¹
016   E0 07 8E C1 51 B8 20 00 50 B9 00 02 FC F3 A4 CB  |  à.ŽÁQ¸ .P¹..üó¤Ë
032   0E 1F BE AF 01 83 C6 0F AC 3C 80 74 18 81 FE EF  |  ..¾¯.ƒÆ.¬<€t.þï
048   01 75 F2 BE B2 00 E8 5D 00 BE 1B 01 E8 57 00 33  |  .uò¾².è].¾..èW.3
064   C0 CD 16 CD 19 B4 41 BB AA 55 CD 13 72 1B 81 FB  |  ÀÍ.Í.´A»ªUÍ.r.û
080   55 AA 75 15 83 C6 07 1E 07 BF AA 00 A5 A5 BE A2  |  Uªu.ƒÆ...¿ª.¥¥¾¢
096   00 B8 00 42 CD 13 EB 13 90 AC 8A F0 AD 8B C8 33  |  .¸.BÍ.ë.¬Šð­‹È3
112   C0 8E C0 BB 00 7C B8 01 02 CD 13 BE D2 00 72 B6  |  ÀŽÀ».|¸..Í.¾Ò.r¶
128   33 C0 8E C0 BE EF 00 26 81 3E FE 7D 55 AA 75 A6  |  3ÀŽÀ¾ï.&>þ}Uªu¦
144   50 B8 00 7C 50 CB B4 0E AC 3C 00 74 04 CD 10 EB  |  P¸.|PË´.¬<.t.Í.ë
160   F7 C3 10 00 01 00 00 7C 00 00 00 00 00 00 00 00  |  ÷Ã.....|........
176   00 00 0D 0A 41 63 74 69 76 65 20 70 61 72 74 69  |  ....Active parti
192   74 69 6F 6E 20 6E 6F 74 20 64 65 66 69 6E 65 64  |  tion not defined
208   21 00 0D 0A 45 72 72 6F 72 20 72 65 61 64 69 6E  |  !...Error readin
224   67 20 62 6F 6F 74 20 73 65 63 74 6F 72 21 00 0D  |  g boot sector!..
240   0A 45 72 72 6F 72 20 62 6F 6F 74 20 73 69 67 6E  |  .Error boot sign
256   61 74 75 72 65 20 6F 6E 20 61 63 74 69 76 65 20  |  ature on active
272   70 61 72 74 69 74 69 6F 6E 21 00 0D 0A 50 72 65  |  partition!...Pre
288   73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72 65  |  ss any key to re
304   62 6F 6F 74 20 2E 2E 2E 0D 0A 00 00 00 00 00 00  |  boot ...........
320   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
336   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 D8 69 8F 50 00 00 00 01  |  ........ØiP....
448   01 00 42 FE FF FF 3F 00 00 00 82 D6 42 25 00 00  |  ..Bþ..?...‚ÖB%..
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............Uª
###
129/000:23/VEC> Start Verify EPBR Chain for disk 1 (129)
129/000:23/VEC> Listing current partitions on disk:
129/000:23/VEC>      DYN (P)   New Volume          63   625137282     (298 Gb)
129/000:23/VEC> Partition Table info for sector 0 (0 0 1)
129/000:23/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..42 | ....0...1...1 | .1023.254..63 | ........63 | .625137282
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/000:23/VEC> 55AA sig Ok
129/000:23/VEC> Verify EPBR Chain completed
129/000:24/USD> Select disk completed
129/000:30/SCN> DiskScan requested, ScanType is 3
129/000:30/SCN> from 0 (0 0 1) to 625142447 (38913 80 63), 625142448 sectors
129/000:30/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
129/000:30/SCN> Next QuickScan location at 625137345 (38913 0 1)
129/000:30/SCN> Next QuickScan location at 0 (0 0 1)
129/000:31/SCN> QuickScan finished
129/000:31/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
129/018:44/SCN> SmartScan finished
129/018:45/SCN> DiskScan completed
129/018:45/SCN> ReadErrors for disk 1 (129): 0
129/037:23/LOG> DataCollection items found: 9 / 4
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 129 | ........63 | ...NTFS | ..BS | ........63 | .625137282 | PRI | .
002 | 129 | .625137344 | ...NTFS | .BBS | ........63 | .625137282 | PRI | .
003 | 129 | .........0 | ....DYN | PTE1 | ........63 | .625137282 | PRI | .
004 | 129 | .........6 | ....DYN | .LDM | ........63 | 4294967233 | PRI | I
005 | 129 | .........8 | ...NTFS | PTE1 | ........71 | .625137282 | LOG | I
006 | 129 | ........63 | ...NTFS | ..BS | ........63 | .625137282 | PRI | I
007 | 129 | .380885124 | .GOBACK | PTE1 | 4096513992 | 1157562368 | LOG | .
008 | 129 | .625137344 | ...NTFS | .BBS | ........63 | .625137282 | PRI | I
009 | 129 | .625142447 | ....DYN | .LDM | ........63 | .625137282 | PRI | .
129/037:24/LOG> DataCollection items found: 9 / 4
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 129 | ........63 | ...NTFS | ..BS | ........63 | .625137282 | PRI
002 | 129 | .625137344 | ...NTFS | .BBS | ........63 | .625137282 | PRI
003 | 129 | .........0 | ....DYN | PTE1 | ........63 | .625137282 | PRI
007 | 129 | .380885124 | .GOBACK | PTE1 | 4096513992 | 1157562368 | LOG
009 | 129 | .625142447 | ....DYN | .LDM | ........63 | .625137282 | PRI
129/037:24/C4L> PTE found for DYN partition at LBA 0 / DC 3
129/037:24/C4L> LDM found for DYN partition at 625142447 (38913 80 63) / DC 9
129/037:24/C4L> PTE and LDM found, DYN appears complete
129/037:24/LOG> PartList items created: 2
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ... | ..1 | ..2 | --- | ..1 | ..1 | ..1 | 2 | ..A
002 | .GOBACK | ..7 | --- | --- | --- | ..7 | ..7 | ..7 | 1 | ..-
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R
001 | ...NTFS | ........63 | .625137282 | .625137344 | PRI | ..A
002 | .GOBACK | 4096513992 | 1157562368 | .959109063 | LOG | ..-
129/037:24/SST> SaveState requested for disk 1 (129)
129/037:42/WAS> AdmiSectors in use : 0+ 1+ 2+
129/037:43/SST> SaveState completed for disk 1 (129)
129/037:43/EXE> Analysis complete
129/037:54/LOG> RunTime: 037:54
129/037:54/LOG> ### CLOSE LOG ###

The above is for Drive 1 - currently running log file for Drive 2 - Drive 0 is working fine (this is another system as the MB of my old system crashed).

[Joep]

Hello,

And there was one volume on that disk? But you have not edited this one, did you? As it's still a type 42 (dymanic) partition.

[cr8apic]

Yes - tried to convert to basic but did not work - data was not found like the previous drive where all data was found in the correct folders.  Reverted back to dynamic?

Currently running on Disk 2 and will post when completed.

[Joep]

no, it is still dynamic. so whatever you did, you did something wrong and you shoud try again.

[cr8apic]

The process I used was from http://www.wilderssecurity.com/showthread.php?t=191006 and I ran this in late May or early June.  When I ran this and the data did not show in Windows Explorer so I reversed the process.

Are you indicating that DiskPatch cannot recover the data?  Cannot locate the sector to change from "42" to "7" to run the process again.

[Tom]

Forget wilderssecurity. Reversing that process is not how this works, obviously.

Are you indicating that DiskPatch cannot recover the data?

Where did we say that? We think you probably did something wrong, that's something a bit different.

Cannot locate the sector to change from "42" to "7" to run the process again.

What does this mean?

What you have to do is simple: run a partition rebuild operation. That will add the partition to the (old school) partition table again, making the disk basic. If THAT doesn't work then we have other problems, but try that first.
http://www.diydatarecovery.nl/dp_manual/guide_ptrepair.htm

[Joep]

Are you indicating that DiskPatch cannot recover the data?  Cannot locate the sector to change from "42" to "7" to run the process again.

No, all I am saying is that the 42 you were supposed to change to 07 hasn't changed and is still 42. Plus I asked you somthing, 'was there only one volume on the disk' ...