Welcome, Guest. Please login or register.
Did you miss your activation email?
June 19, 2019, 01:21:41 PM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  DiskPatch (Moderators: Tom, Joep)
| | |-+  Possible 128Gb barrier problem
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] 2 Go Down Print
Author Topic: Possible 128Gb barrier problem  (Read 28702 times)
bharnish
member

Posts: 19


« on: August 07, 2008, 01:00:13 PM »

Hi.  I installed a 160 GB drive in two Dell Latitude D800 notebook computers, formatted and set them up successfully.  I also installed PointSec data encryption.  Several months later they both crashed with a "blinking cursor".  I decrypted the drives but I still can't see the data, either as a master or a slave.

I ran the DiskPatch demo on one and I noticed a line in the log file that says: "Possible 128Gb barrier problem ... ".

I have called Dell and they say there is no limitation to the size of the drive that can be used in these systems.

Do you think the full version of DiskPatch can recover these drives?  A log file is shown below.

Thanks.


Code:
.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 3.4.100
.../000:01/LOG> (C) 2000-2008 DIY DataRecovery
.../000:01/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 74Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 08-06-2008
.../000:01/CFG> FilePath="1/.\DPFILES\"
.../000:01/CFG> LogFilename="DP.LOG"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:01/13H> Drive Interface Info :
.../000:01/13H> Disk 128 X13H data : 16383/16/63 268435455/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .268435455 | 255 | 63 | 127
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
.../000:01/IAS> AdmiSector found on disk 0 (128)
.../000:01/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:01/WAS> AdmiSectors in use : 0+
.../000:01/KEY> DEMO/1
.../000:01/PFC> UDMA driver not loaded
.../000:01/PFC> PQstuff signature detected on disk 0 (128)
.../000:01/PFC> !- Possible 128Gb barrier problem detected for disk 0 (128)
.../000:01/RDS> Read past EOD intercept for disk 128 at 268435456 (16709 85 17)
.../000:01/PFC> Sector test is negative
.../000:02/PFC> Partition State backup not found on disk 0 (128)
.../000:02/PFC> No Repair date found on disk 0 (128)
.../000:38/CSD> Start CheckDisk for disk 0 (128)
.../000:38/CSD> CheckDisk complete, ReadErrors 0
.../000:38/USD> Disk 0 (128) selected
.../000:38/GSC> No geo change detected for disk 0 (128)
.../000:38/WAS> AdmiSectors in use : 0+
.../000:38/GSC> Geo for disk 0 (128) saved as 0268435455255063
128/000:38/USD> MBR for disk 0 (128)
128/000:38/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3???.|?P.P.??.|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04  |  ?..PW??.????.?.
032   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5  |  8n.|.u.??.???.??
048   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B  |  ??.It.8,t? ?.?.?
064   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88  |  ??<.t??..?.?.???
080   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B  |  N.?F.s*?F.?~..t.
096   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83  |  ?~..t. ?.u?F..?
112   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB  |  F..?V..?!.s. ?.?
128   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0  |  ??>?}U?t.?~..t? 
144   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56  |  ?.??.W???..?V
160   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC  |  .?.?.r#??$?????
176   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56  |  C?????.??B??9V
192   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C  |  .w#r.9F.s.?..?.|
208   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A  |  ?N.?V.?.sQOtN2??
224   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD  |  V.?.???V.`??U?A?
240   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60  |  .r6??U?u0??.t+a`
256   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A  |  j.j..v..v.j.h.|j
272   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B  |  .j.?B???.aas.Ot.
288   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61  |  2??V.?.??a??Inva
304   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  |  lid partition ta
320   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E  |  ble.Error loadin
336   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 2C 44 63 D4 30 CE 48 00 00 00 01  |  .....,Dc?0?H....
448   01 00 DE FE 3F 2F 3F 00 00 00 F1 C3 0B 00 80 00  |  ..???/?...??..?.
464   01 30 07 FE FF FF 30 C4 0B 00 91 C6 95 12 00 00  |  .0.?..0?..??...
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U?
###
128/000:38/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:38/VEC> Listing current partitions on disk:
128/000:38/VEC>  UNKNOWN (P)        (Err)          63      771057       (0 Gb)
128/000:38/VEC>     NTFS (P)                   771120   311805585     (149 Gb)
128/000:38/VEC> Partition Table info for sector 0 (0 0 1)
128/000:38/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..DE | ....0...1...1 | ...47.254..63 | ........63 | ....771057
..2 .128 | ..07 | ...48...0...1 | .1023.254..63 | ....771120 | .311805585
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:38/VEC> 55AA sig Ok
128/000:38/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): F9309E
............OEM Name (txt): ?2??\c0?
....Bytes per Sector (dec): 2554
.Sectors per Cluster (dec): 244
....Reserved Sectors (dec): 16405
...........FAT count (dec): 153
....Root Entry Count (dec): 11813
..Total Sectors (16) (dec): 4294954780
....Media Descriptor (hex): 9E
.......FAT Size (16) (dec): 4294935063
...Sectors per Track (dec): 27015
.....Heads per Track (dec): 1372
......Hidden Sectors (dec): 1279753431
..Total Sectors (32) (dec): 1061930207
........Drive Number (hex): 86
............Reserved (hex): D0
......Boot Signature (hex): 1C
...........Volume ID (hex): EF85DB93
........Volume Label (txt): &3???xD?RLT
..Filesystem Type ID (txt): ?16 ?f??
....Sector Signature (hex): 8D6E
1st FAT not found at      : 16468 (1 6 26)
128/000:38/RDS> Read past EOD intercept for disk 128 at 4294951531 (267348 93 53)
2nd FAT not found at      : 4294951531 (267348 93 53)
128/000:38/CF8> FAT sectors are not equal
128/000:38/LOG> RootSector number not valid, no dump
128/000:38/LOG> Boot sector dump requested at 771120 (48 0 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): E9ED00
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 127
....Reserved Sectors (dec): 0
..............Unused (hex): 0000002000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 771120
..............Unused (hex): 00000000
.............Unknown (hex): 00000000
.......Total Sectors (dec): 311805584
........MFT Location (dec): 761618
.MFT Mirror Location (dec): 16
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): ECBC88B8BC887EB8
........Volume Label (txt):
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
128/000:39/RDS> Read past EOD intercept for disk 128 at 312576704 (19456 254 63)
128/000:39/VEC> BS and BBS not equal, dump follows;
128/000:39/LOG> Boot sector dump requested at 312576704 (19456 254 63)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 000000
............OEM Name (txt): ........
....Bytes per Sector (dec): 0
.Sectors per Cluster (dec): 0
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): 00
..............Unused (hex): 0000
...Sectors per Track (dec): 0
.....Heads per Track (dec): 0
......Hidden Sectors (dec): 0
..............Unused (hex): 00000000
.............Unknown (hex): 00000000
.......Total Sectors (dec): 0
........MFT Location (dec): 0
.MFT Mirror Location (dec): 0
....Clusters per FRS (dec): 0
.Clusters/Indx Block (dec): 0
...........Volume ID (hex): 0000000000000000
........Volume Label (txt): (Err)
............Checksum (hex): 00000000
....Sector Signature (hex): 0000
128/000:39/VEC> Verify EPBR Chain completed
128/000:39/USD> Select disk completed
128/000:49/SCN> DiskScan requested, ScanType is 3
128/000:49/SCN> from 0 (0 0 1) to 268435454 (16709 85 15), 268435455 sectors
128/000:49/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/000:49/CDC> No DataCollection entries, CleanDatacollection aborted
128/000:49/MPL> No DataCollection entries, MakePartList aborted
128/000:49/SCN> Next QuickScan location at 0 (0 0 1)
128/000:50/SCN> QuickScan finished
128/000:50/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/008:09/SCN> SmartScan finished
128/008:09/SCN> DiskScan completed
128/008:09/SCN> ReadErrors for disk 0 (128): 0
128/008:16/LOG> DataCollection items found: 1 / 0
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | .........0 | ...NTFS | PTE2 | ....771120 | .311805585 | PRI | .
128/008:16/LOG> DataCollection items found: 1 / 0
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | .........0 | ...NTFS | PTE2 | ....771120 | .311805585 | PRI
128/008:16/LOG> PartList items created: 1
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ..1 | ... | ... | --- | ..1 | ..1 | ..1 | 1 | ...
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R
001 | ...NTFS | ....771120 | .311805585 | .312576704 | PRI | ...
128/008:16/SST> SaveState requested for disk 0 (128)
128/008:17/WAS> AdmiSectors in use : 0+
128/008:17/SST> SaveState completed for disk 0 (128)
128/008:17/EXE> Analysis complete
128/008:20/LOG> RunTime: 008:20
128/008:20/LOG> ### CLOSE LOG ###
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1476


WWW
« Reply #1 on: August 07, 2008, 02:56:50 PM »

As you may have noticed DiskPatch detects the disk as being 128Gb, and you say it's 160. So that's not good. DiskPatch relies on the BIOS to access the disk so it could be that the BIOS is not seeing the disk correctly. Check that. Also, what's the disk type? IDE or SATA? Make sure that if it's SATA the BIOS is set up to allow legacy access to the disk (basically treat it as IDE), DiskPatch might need that.

Apart from that there's not much found by DiskPatch on the disk, but that's no a bad thing. It appears there's only one big NTFS partition and a DELL resq partition, which can be ignored in a recovery scenario (it can always be installed again later, if needed). The stuff that is found looks okay, even though not all components are found (but that has to do with the fact that DiskPatch assumes the disk to be 128Gb, not 160, so stuff that's near the end is not found).

So, make sure the disk is recognized correctly and then scan it again.
Or, you could connect the disk(s) to another computer and see if windows can read them. Don't start any PC from these disks, that will create a big mess, just connect them as secondary disks and see if they can be accessed. Do not run any disk repair tools like chkdsk.
Logged

bharnish
member

Posts: 19


« Reply #2 on: August 07, 2008, 08:13:28 PM »

Thanks for your reply.
The drive is IDE and made by Hitachi.
I have installed it in a new Dell Latitude D630 and rerun the scan.
Here is the latest log file.
Thanks.

Code:
.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 3.4.100
.../000:01/LOG> (C) 2000-2008 DIY DataRecovery
.../000:01/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 74Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 08-06-2008
.../000:01/CFG> FilePath="1/.\DPFILES\"
.../000:01/CFG> LogFilename="DP.LOG"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:01/13H> Drive Interface Info :
.../000:01/13H> Disk 128 X13H data : 16383/16/63 312581808/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .312581808 | 255 | 63 | 149
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
.../000:01/IAS> AdmiSector found on disk 0 (128)
.../000:02/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:02/WAS> AdmiSectors in use : 0+
.../000:02/KEY> DEMO/1
.../000:02/PFC> UDMA driver not loaded
.../000:02/PFC> PQstuff signature not detected on disk 0 (128)
.../000:02/PFC> Partition State backup not found on disk 0 (128)
.../000:03/PFC> No Repair date found on disk 0 (128)
.../002:09/CSD> Start CheckDisk for disk 0 (128)
.../002:10/CSD> CheckDisk complete, ReadErrors 0
.../002:10/USD> Disk 0 (128) selected
.../002:10/GSC> No geo change detected for disk 0 (128)
.../002:10/WAS> AdmiSectors in use : 0+
.../002:10/GSC> Geo for disk 0 (128) saved as 0312581808255063
128/002:10/USD> MBR for disk 0 (128)
128/002:10/LOG> SectorDump requested at 0 (0 0 1)
###
000   FA EB 09 53 59 4D 43 20 76 32 2E 30 33 C0 8E D8  |  ??.SYMC v2.03???
016   8E C0 8E D0 BC 00 7C FB BE 00 7C BF 00 06 B9 00  |  ????.|??.|?..?.
032   01 F3 A5 50 BF 29 06 57 CB 33 C0 CD 13 80 3E AF  |  .??P?).W?3??.?>?
048   07 01 75 2D A1 B0 07 8B 0E B2 07 8B 1E B4 07 8B  |  ..u-??.?.?.?.?.?
064   16 B6 07 BF 00 7C E8 8C 00 72 31 BF 00 7C 81 BD  |  .?.?.|??.r1?.|??
080   FE 01 55 AA 75 26 BB 00 7C E8 04 01 72 1E 06 53  |  ?.U?u&?.|?..r..S
096   CB 83 3E B4 07 00 75 09 83 3E B6 07 00 75 02 EB  |  ?>?..u.?>?..u.?
112   0B C6 06 AF 07 01 BB 00 06 E8 E4 00 BE BE 07 B3  |  .?.?..?..??.??.?
128   04 80 3C 80 74 09 83 C6 10 FE CB 75 F4 EB 2C 8A  |  .?<?t.??.??u??,?
144   64 01 8A 44 02 8A 4C 03 B5 80 8B 5C 08 8B 54 0A  |  d.?D.?L.???\.?T.
160   BF 00 7C E8 2F 00 72 1B BF 00 7C 81 BD FE 01 55  |  ?.|?/.r.?.|???.U
176   AA 75 10 B8 50 00 8B EE 06 57 CB BE 6C 07 E8 07  |  ?u.?P.??.W?l.?.
192   00 EB FE BE 86 07 EB F6 B4 0E BB 07 00 AC CD 10  |  .????.???.?..??.
208   38 3C 75 F9 C3 53 BE 00 80 EB 05 00 00 00 00 00  |  8<u??S?.??......
224   88 64 10 88 44 11 88 4C 12 88 6C 13 33 C0 C7 04  |  ?d.?D.?L.?l.3??.
240   10 00 C7 44 02 01 00 89 7C 04 8C 44 06 89 5C 08  |  ..?D...?|.?D.?\.
256   89 54 0A 89 44 0C 89 44 0E B4 41 BB AA 55 8A 54  |  ?T.?D.?D.?A??U?T
272   13 CD 13 72 26 81 FB 55 AA 75 20 1E 06 60 8A 54  |  .?.r&??U?u ..`?T
288   13 BF 05 00 B8 00 42 CD 13 73 07 33 C0 CD 13 4F  |  .?..?.B?.s.3??.O
304   75 F2 8E C0 61 8C C0 07 1F EB 23 BF 05 00 B8 01  |  u???a??..?#?..?.
320   02 8A 6C 12 8A 4C 11 8A 74 10 8A 54 13 8B 5C 04  |  .?l.?L.?t.?T.?\.
336   8E 44 06 CD 13 73 07 33 C0 CD 13 4F 75 E0 5B C3  |  ?D.?.s.3??.Ou?[?
352   B8 01 03 B9 01 00 BA 80 00 CD 13 C3 0A 0D 49 6E  |  ?..?..??.?.?..In
368   76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20  |  valid partition
384   74 61 62 6C 65 00 0A 0D 45 72 72 6F 72 20 6C 6F  |  table...Error lo
400   61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20  |  ading operating
416   73 79 73 74 65 6D 00 00 00 00 00 00 00 56 50 01  |  system.......VP.
432   09 0A D0 80 4E 37 ED 0D 7C AB 7C AB 00 00 80 FE  |  ..?N7?.|?|?..??
448   FF FF 07 FE FF FF A0 8F E8 0D 01 40 06 00 00 00  |  ...?.. ??..@....
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U?
###
128/002:10/VEC> Start Verify EPBR Chain for disk 0 (128)
128/002:10/VEC> Listing current partitions on disk:
128/002:10/VEC>     NTFS (P)        (Err)   233344928      409601       (0 Gb)
128/002:10/VEC> Partition Table info for sector 0 (0 0 1)
128/002:10/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..07 | .1023.254..63 | .1023.254..63 | .233344928 | ....409601
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/002:10/VEC> 55AA sig Ok
128/002:10/LOG> Boot sector dump requested at 233344928 (14525 12 48)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): 5EEEFE
............OEM Name (txt): s??=>J?
....Bytes per Sector (dec): 4294938665
.Sectors per Cluster (dec): 42
....Reserved Sectors (dec): 4294958405
..............Unused (hex): F6BBEF4F26
....Media Descriptor (hex): AC
..............Unused (hex): 6BAF
...Sectors per Track (dec): 4294948006
.....Heads per Track (dec): 4294949946
......Hidden Sectors (dec): 2900117117
..............Unused (hex): 1628CCBB
.............Unknown (hex): FBE8E49E
.......Total Sectors (dec): 3318770723
........MFT Location (dec): 994138091
.MFT Mirror Location (dec): 1167957300
....Clusters per FRS (dec): 484683272
.Clusters/Indx Block (dec): 381601018
...........Volume ID (hex): DA477255308468EC
........Volume Label (txt): (Err)
............Checksum (hex): 481BB4D2
....Sector Signature (hex): 7015
128/002:10/VEC> BS and BBS not equal, dump follows;
128/002:10/LOG> Boot sector dump requested at 233754528 (14550 139 22)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 50941D
............OEM Name (txt): ???[?.(?
....Bytes per Sector (dec): 20137
.Sectors per Cluster (dec): 99
....Reserved Sectors (dec): 4294938632
..............Unused (hex): B9CEECDF04
....Media Descriptor (hex): E5
..............Unused (hex): 873F
...Sectors per Track (dec): 4294966897
.....Heads per Track (dec): 17546
......Hidden Sectors (dec): 276571774
..............Unused (hex): D787625F
.............Unknown (hex): 27D3B80C
.......Total Sectors (dec): 3352787683
........MFT Location (dec): 2743423123
.MFT Mirror Location (dec): 4040143520
....Clusters per FRS (dec): 2639722656
.Clusters/Indx Block (dec): 3825327851
...........Volume ID (hex): BE0831204BA88031
........Volume Label (txt): (Err)
............Checksum (hex): 5EF737CE
....Sector Signature (hex): A868
128/002:10/VEC> Verify EPBR Chain completed
128/002:11/USD> Select disk completed
128/002:13/SCN> DiskScan requested, ScanType is 3
128/002:13/SCN> from 0 (0 0 1) to 312581807 (19457 80 63), 312581808 sectors
128/002:13/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/002:13/SCN> Next QuickScan location at 240975 (15 0 1)
128/002:14/SCN> Next QuickScan location at 312576705 (19457 0 1)
128/002:15/SCN> Next QuickScan location at 0 (0 0 1)
128/002:15/SCN> QuickScan finished
128/002:15/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/014:24/SCN> SmartScan finished
128/014:24/SCN> DiskScan completed
128/014:24/SCN> ReadErrors for disk 0 (128): 0
128/018:34/LOG> DataCollection items found: 7 / 3
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | ........63 | ..FAT16 | ..BS | ........63 | ....240912 | PRI | .
002 | 128 | ........64 | ..FAT16 | F8FF | ........63 | .......... | PRI | .
003 | 128 | ....240975 | ...NTFS | ..BS | ....240975 | .312335730 | PRI | .
004 | 128 | .........0 | ...NTFS | PTE1 | .233344928 | ....409601 | PRI | .
005 | 128 | ........63 | ..FAT16 | ..BS | ........63 | ....240912 | PRI | I
006 | 128 | ........64 | ..FAT16 | F8FF | ........63 | .......... | PRI | I
007 | 128 | ....240975 | ...NTFS | ..BS | ....240975 | .312335730 | PRI | I
128/018:34/LOG> DataCollection items found: 7 / 3
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | ........63 | ..FAT16 | ..BS | ........63 | ....240912 | PRI
002 | 128 | ........64 | ..FAT16 | F8FF | ........63 | .......... | PRI
003 | 128 | ....240975 | ...NTFS | ..BS | ....240975 | .312335730 | PRI
004 | 128 | .........0 | ...NTFS | PTE1 | .233344928 | ....409601 | PRI
128/018:34/LOG> PartList items created: 3
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ..FAT16 | ... | ..1 | --- | ..6 | ..1 | ..1 | ..1 | 3 | ..A
002 | ...NTFS | ... | ..3 | ... | --- | ..3 | ..3 | ..3 | 1 | ..B
003 | ...NTFS | ..4 | ... | ... | --- | ..4 | ..4 | ..4 | 1 | ...
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R
001 | ..FAT16 | ........63 | ....240912 | ....240974 | PRI | ..A
002 | ...NTFS | ....240975 | .312335730 | .312576704 | PRI | ..B
003 | ...NTFS | .233344928 | ....409601 | .233754528 | PRI | ...
128/018:34/SST> SaveState requested for disk 0 (128)
128/018:35/WAS> AdmiSectors in use : 0+
128/018:36/SST> SaveState completed for disk 0 (128)
128/018:36/EXE> Analysis complete
128/018:56/LOG> RunTime: 018:56
128/018:56/LOG> ### CLOSE LOG ###
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #3 on: August 07, 2008, 10:00:12 PM »

Hello,

Isn't that the exact same disk as in this thread?: http://www.diydatarecovery.nl/forum/index.php?topic=80.0 ?

Looks like it ... We now see 150 or so Gb (like in the thread i referred to), and answer is the same. Based on the logfile it appears the FAT partition (probably a Dell utility partition) and the NTFS partition can be restored. Pick entry 001 and 003, you will need the registered version for that.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
bharnish
member

Posts: 19


« Reply #4 on: August 08, 2008, 01:59:03 PM »

Sorry ... I may have gotten my log files mixed up.  I deleted them all and reran the scan.
Here is the latest.
Thanks.

Code:
.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 3.4.100
.../000:01/LOG> (C) 2000-2008 DIY DataRecovery
.../000:01/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 73Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 08-08-2008
.../000:01/CFG> FilePath="1/.\DPFILES\"
.../000:01/CFG> LogFilename="DP.LOG"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:01/13H> Drive Interface Info :
.../000:01/13H> Disk 128 X13H data : 16383/16/63 312581808/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .312581808 | 255 | 63 | 149
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
.../000:01/IAS> AdmiSector found on disk 0 (128)
.../000:01/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:01/WAS> AdmiSectors in use : 0+
.../000:01/KEY> DEMO/1
.../000:01/PFC> UDMA driver active
.../000:01/PFC> PQstuff signature detected on disk 0 (128)
.../000:02/PFC> Partition State backup not found on disk 0 (128)
.../000:02/PFC> No Repair date found on disk 0 (128)
.../000:09/CSD> Start CheckDisk for disk 0 (128)
.../000:10/CSD> CheckDisk complete, ReadErrors 0
.../000:10/USD> Disk 0 (128) selected
.../000:10/GSC> No geo change detected for disk 0 (128)
.../000:10/WAS> AdmiSectors in use : 0+
.../000:10/GSC> Geo for disk 0 (128) saved as 0312581808255063
128/000:10/USD> MBR for disk 0 (128)
128/000:10/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3???.|?P.P.??.|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04  |  ?..PW??.????.?.
032   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5  |  8n.|.u.??.???.??
048   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B  |  ??.It.8,t? ?.?.?
064   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88  |  ??<.t??..?.?.???
080   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B  |  N.?F.s*?F.?~..t.
096   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83  |  ?~..t. ?.u?F..?
112   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB  |  F..?V..?!.s. ?.?
128   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0  |  ??>?}U?t.?~..t? 
144   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56  |  ?.??.W???..?V
160   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC  |  .?.?.r#??$?????
176   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56  |  C?????.??B??9V
192   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C  |  .w#r.9F.s.?..?.|
208   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A  |  ?N.?V.?.sQOtN2??
224   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD  |  V.?.???V.`??U?A?
240   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60  |  .r6??U?u0??.t+a`
256   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A  |  j.j..v..v.j.h.|j
272   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B  |  .j.?B???.aas.Ot.
288   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61  |  2??V.?.??a??Inva
304   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  |  lid partition ta
320   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E  |  ble.Error loadin
336   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 2C 44 63 D4 30 CE 48 00 00 00 01  |  .....,Dc?0?H....
448   01 00 DE FE 3F 2F 3F 00 00 00 F1 C3 0B 00 80 00  |  ..???/?...??..?.
464   01 30 07 FE FF FF 30 C4 0B 00 91 C6 95 12 00 00  |  .0.?..0?..??...
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U?
###
128/000:10/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:10/VEC> Listing current partitions on disk:
128/000:10/VEC>  UNKNOWN (P)        (Err)          63      771057       (0 Gb)
128/000:11/RDS> ReadError for disk 128 at 771120 (48 0 1), C:1, T:80h
128/000:11/RDS> ReadSector success (after error) at 771120 (48 0 1), tries 1
128/000:11/VEC>     NTFS (P)                   771120   311805585     (149 Gb)
128/000:11/VEC> Partition Table info for sector 0 (0 0 1)
128/000:11/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..DE | ....0...1...1 | ...47.254..63 | ........63 | ....771057
..2 .128 | ..07 | ...48...0...1 | .1023.254..63 | ....771120 | .311805585
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:11/VEC> 55AA sig Ok
128/000:11/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): F9309E
............OEM Name (txt): ?2??\c0?
....Bytes per Sector (dec): 2554
.Sectors per Cluster (dec): 244
....Reserved Sectors (dec): 16405
...........FAT count (dec): 153
....Root Entry Count (dec): 11813
..Total Sectors (16) (dec): 4294954780
....Media Descriptor (hex): 9E
.......FAT Size (16) (dec): 4294935063
...Sectors per Track (dec): 27015
.....Heads per Track (dec): 1372
......Hidden Sectors (dec): 1279753431
..Total Sectors (32) (dec): 1061930207
........Drive Number (hex): 86
............Reserved (hex): D0
......Boot Signature (hex): 1C
...........Volume ID (hex): EF85DB93
........Volume Label (txt): &3???xD?RLT
..Filesystem Type ID (txt): ?16 ?f??
....Sector Signature (hex): 8D6E
1st FAT not found at      : 16468 (1 6 26)
128/000:11/RDS> Read past EOD intercept for disk 128 at 4294951531 (267348 93 53)
2nd FAT not found at      : 4294951531 (267348 93 53)
128/000:11/CF8> FAT sectors are not equal
128/000:11/LOG> RootSector number not valid, no dump
128/000:11/LOG> Boot sector dump requested at 771120 (48 0 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): E9ED00
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 127
....Reserved Sectors (dec): 0
..............Unused (hex): 0000002000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 771120
..............Unused (hex): 00000000
.............Unknown (hex): 00000000
.......Total Sectors (dec): 311805584
........MFT Location (dec): 761618
.MFT Mirror Location (dec): 16
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): ECBC88B8BC887EB8
........Volume Label (txt):
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
128/000:11/VEC> BS and BBS not equal, dump follows;
128/000:11/LOG> Boot sector dump requested at 312576704 (19456 254 63)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 31BCE0
............OEM Name (txt): .Ll#?n??
....Bytes per Sector (dec): 4294957193
.Sectors per Cluster (dec): 65
....Reserved Sectors (dec): 4294957522
..............Unused (hex): 9BE670224D
....Media Descriptor (hex): A6
..............Unused (hex): 85BA
...Sectors per Track (dec): 4294957458
.....Heads per Track (dec): 4294953379
......Hidden Sectors (dec): 1236060563
..............Unused (hex): 8566AB47
.............Unknown (hex): BC6DD6A3
.......Total Sectors (dec): 1731150395
........MFT Location (dec): 3610427237
.MFT Mirror Location (dec): 2195940122
....Clusters per FRS (dec): 1035808791
.Clusters/Indx Block (dec): 1040875146
...........Volume ID (hex): 6C2A97C08104E085
........Volume Label (txt): (Err)
............Checksum (hex): 86D0DB01
....Sector Signature (hex): EB9A
128/000:11/VEC> Verify EPBR Chain completed
128/000:11/USD> Select disk completed
128/000:11/SCN> DiskScan requested, ScanType is 3
128/000:11/SCN> from 0 (0 0 1) to 312581807 (19457 80 63), 312581808 sectors
128/000:11/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/000:11/CDC> No DataCollection entries, CleanDatacollection aborted
128/000:11/MPL> No DataCollection entries, MakePartList aborted
128/000:11/SCN> Next QuickScan location at 0 (0 0 1)
128/000:12/SCN> QuickScan finished
128/000:12/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/009:22/SCN> SmartScan finished
128/009:22/SCN> DiskScan completed
128/009:22/SCN> ReadErrors for disk 0 (128): 0
128/031:38/LOG> DataCollection items found: 2 / 0
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | .........0 | ...NTFS | PTE2 | ....771120 | .311805585 | PRI | .
002 | 128 | ....771120 | ...NTFS | ..BS | ....771120 | .311805585 | PRI | .
128/031:38/LOG> DataCollection items found: 2 / 0
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | .........0 | ...NTFS | PTE2 | ....771120 | .311805585 | PRI
002 | 128 | ....771120 | ...NTFS | ..BS | ....771120 | .311805585 | PRI
128/031:38/LOG> PartList items created: 1
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ..1 | ..2 | ... | --- | ..1 | ..1 | ..1 | 2 | ..B
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R
001 | ...NTFS | ....771120 | .311805585 | .312576704 | PRI | ..B
128/031:38/SST> SaveState requested for disk 0 (128)
128/031:39/WAS> AdmiSectors in use : 0+
128/031:39/SST> SaveState completed for disk 0 (128)
128/031:40/EXE> Analysis complete
128/031:42/LOG> RunTime: 031:42
128/031:42/LOG> ### CLOSE LOG ###
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #5 on: August 08, 2008, 02:23:40 PM »

Hello,

The small Dell (FAT) partition boot sector is corrupt. The NTFS partition appears intact from a partition table and boot sector perspective, so there's nothing DiskPatch can fix for you there.

So, even when the disk is connected to another PC Windows refuses to see data on the NTFS partition? Let's hope that the data is still intact. I recommend you try scanning the disk with iUndelete or iRecover and see if they detect file system structures.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
bharnish
member

Posts: 19


« Reply #6 on: August 11, 2008, 02:06:44 PM »

Hi.  Thanks again for your help.
I have purchased DiskPatch, iUndelete and iRecover.  I've just run iRecover on this drive (took a long time).
It says: "Validation found 8257 (17%) valid and 39060 damaged files of 176796 checked."
This doesn't sound good.  There are many folders entitled "LostFilesxxxx".  What should I do next?
Thanks.
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #7 on: August 11, 2008, 02:22:46 PM »

Hello,

Well, iRecover PLUS iUndelete is a bit redundant anyway ...

Well, under normal conditions you will see close to 100% valid data. Also when a disk was reformatted you'd expect 100% valid data or a value very close to that.

- With this disk we do not exactly know what happened, it just refused to boot, and then the data was decrypted, correct? So it is hard to tell what to expect with regards to intact-not intact data.

- I am also not too familiar with the PointSec software. When you decrypted, what do you descrypt? The entire physical disk, or individual volumes? If iRecover detects file system structures, then that was never encrypted or decrypted ok (meaning the file system structures like the MFT etc.). Data within files can only be validated if it is not encrypted, iRecover looks for things like 'magic bytes', bytes that are the same for each JPG file for example. If data within the JPG file would be encrypted validation would state the file is not intact.

- If iRecover does not determine correct volume parameters, validation will also show low score for 'intact'. But in that case, 17% intact is rather high (you'd expect it to be lower if it really missed the volume parameters).

I am not sure what to do next. Have you spoken to checkpoint already?
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
bharnish
member

Posts: 19


« Reply #8 on: August 14, 2008, 05:32:58 PM »

>With this disk we do not exactly know what happened, it just refused to boot, and then the data was decrypted, correct?

Correct.  The first thing PointSec says to do when a drive has a problem is to decrypt it.

>When you decrypted, what do you descrypt? The entire physical disk, or individual volumes?

Entire disk.

>Have you spoken to checkpoint already?

Yes.  They don't have anything else to do once the drive has been decrypted.

Should I run DiskPatch?

Thanks.
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #9 on: August 14, 2008, 08:59:45 PM »

Quote
Should I run DiskPatch?

As I mentioned I see the same invalid clustersize in these logs. You can try the NTFS boot sector repair as suggested in the other thread. Maybe we have more luck here.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
bharnish
member

Posts: 19


« Reply #10 on: August 14, 2008, 09:04:00 PM »

Thanks.  I'm doing that now.  I noticed in the Rebuild Boot Sectors log that the cluster size was set to 127 and in red.  Does this mean that if I select 128 it may work?
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #11 on: August 15, 2008, 08:17:52 AM »

Hello,

128 is a valid value and it might work. All values next to the bars in DiskPatch are valid values. Still, DiskPatch not being able to detect a correct value may indicate a more serious problem with the file system.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
bharnish
member

Posts: 19


« Reply #12 on: August 15, 2008, 02:08:09 PM »

Hi.  I attempted the boot sector repair and let DiskPatch attempt to get the cluster size (it failed).  Here is the log:

Thanks.

Code:
.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 3.4.100
.../000:01/LOG> (C) 2000-2008 DIY DataRecovery
.../000:01/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 73Kb
.../000:01/LOG> CommandLineParms: /for
.../000:01/LOG> LogDate: 08-14-2008
.../000:01/CFG> FilePath="1/.\DPFILES\"
.../000:01/CFG> LogFilename="DP.LOG"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: 2.1 / EDD-1.1
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:01/13H> Drive Interface Info :
.../000:01/13H> Disk 128 X13H data : 16383/16/63 268435455/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .268435455 | 255 | 63 | 127
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0
.../000:01/IAS> Forensic mode; no AdmiSectors used
.../000:01/WAS> AdmiSectors in use : 0-
.../000:01/KEY> 22O7O8O136/4
.../000:06/PRD> Disk 0 (128) locked
.../000:08/PFC> UDMA driver active
.../000:08/PFC> PQstuff signature detected on disk 0 (128)
.../000:08/PFC> !- Possible 128Gb barrier problem detected for disk 0 (128)
.../000:08/RDS> Read past EOD intercept for disk 128 at 268435456 (16709 85 17)
.../000:08/PFC> Sector test is negative
.../000:09/PFC> Partition State backup not found on disk 0 (128)
.../000:09/PFC> No Repair date found on disk 0 (128)
.../000:17/MNU> - Main, Select Disk
.../000:19/CSD> Start CheckDisk for disk 0 (128)
.../000:19/CSD> CheckDisk complete, ReadErrors 0
.../000:19/USD> Disk 0 (128) selected
.../000:19/GSC> AdmiSector not in use
.../000:19/GSC> AdmiSector not in use
128/000:19/USD> MBR for disk 0 (128)
128/000:19/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3???.|?P.P.??.|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04  |  ?..PW??.????.?.
032   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5  |  8n.|.u.??.???.??
048   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B  |  ??.It.8,t? ?.?.?
064   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88  |  ??<.t??..?.?.???
080   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B  |  N.?F.s*?F.?~..t.
096   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83  |  ?~..t. ?.u?F..?
112   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB  |  F..?V..?!.s. ?.?
128   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0  |  ??>?}U?t.?~..t? 
144   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56  |  ?.??.W???..?V
160   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC  |  .?.?.r#??$?????
176   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56  |  C?????.??B??9V
192   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C  |  .w#r.9F.s.?..?.|
208   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A  |  ?N.?V.?.sQOtN2??
224   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD  |  V.?.???V.`??U?A?
240   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60  |  .r6??U?u0??.t+a`
256   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A  |  j.j..v..v.j.h.|j
272   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B  |  .j.?B???.aas.Ot.
288   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61  |  2??V.?.??a??Inva
304   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  |  lid partition ta
320   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E  |  ble.Error loadin
336   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 2C 44 63 D4 30 CE 48 00 00 00 01  |  .....,Dc?0?H....
448   01 00 DE FE 3F 2F 3F 00 00 00 F1 C3 0B 00 80 00  |  ..???/?...??..?.
464   01 30 07 FE FF FF 30 C4 0B 00 91 C6 95 12 00 00  |  .0.?..0?..??...
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U?
###
128/000:20/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:20/VEC> Listing current partitions on disk:
128/000:20/VEC>  UNKNOWN (P)        (Err)          63      771057       (0 Gb)
128/000:20/VEC>     NTFS (P)                   771120   311805585     (149 Gb)
128/000:20/VEC> Partition Table info for sector 0 (0 0 1)
128/000:20/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..DE | ....0...1...1 | ...47.254..63 | ........63 | ....771057
..2 .128 | ..07 | ...48...0...1 | .1023.254..63 | ....771120 | .311805585
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:20/VEC> 55AA sig Ok
128/000:20/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): F9309E
............OEM Name (txt): ?2??\c0?
....Bytes per Sector (dec): 2554
.Sectors per Cluster (dec): 244
....Reserved Sectors (dec): 16405
...........FAT count (dec): 153
....Root Entry Count (dec): 11813
..Total Sectors (16) (dec): 4294954780
....Media Descriptor (hex): 9E
.......FAT Size (16) (dec): 4294935063
...Sectors per Track (dec): 27015
.....Heads per Track (dec): 1372
......Hidden Sectors (dec): 1279753431
..Total Sectors (32) (dec): 1061930207
........Drive Number (hex): 86
............Reserved (hex): D0
......Boot Signature (hex): 1C
...........Volume ID (hex): EF85DB93
........Volume Label (txt): &3???xD?RLT
..Filesystem Type ID (txt): ?16 ?f??
....Sector Signature (hex): 8D6E
1st FAT not found at      : 16468 (1 6 26)
128/000:20/RDS> Read past EOD intercept for disk 128 at 4294951531 (267348 93 53)
2nd FAT not found at      : 4294951531 (267348 93 53)
128/000:20/CF8> FAT sectors are not equal
128/000:20/LOG> RootSector number not valid, no dump
128/000:20/LOG> Boot sector dump requested at 771120 (48 0 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): E9ED00
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 127
....Reserved Sectors (dec): 0
..............Unused (hex): 0000002000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 771120
..............Unused (hex): 00000000
.............Unknown (hex): 00000000
.......Total Sectors (dec): 311805584
........MFT Location (dec): 761618
.MFT Mirror Location (dec): 16
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): ECBC88B8BC887EB8
........Volume Label (txt):
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
128/000:20/RDS> Read past EOD intercept for disk 128 at 312576704 (19456 254 63)
128/000:20/VEC> BS and BBS not equal, dump follows;
128/000:20/LOG> Boot sector dump requested at 312576704 (19456 254 63)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 000000
............OEM Name (txt): ........
....Bytes per Sector (dec): 0
.Sectors per Cluster (dec): 0
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): 00
..............Unused (hex): 0000
...Sectors per Track (dec): 0
.....Heads per Track (dec): 0
......Hidden Sectors (dec): 0
..............Unused (hex): 00000000
.............Unknown (hex): 00000000
.......Total Sectors (dec): 0
........MFT Location (dec): 0
.MFT Mirror Location (dec): 0
....Clusters per FRS (dec): 0
.Clusters/Indx Block (dec): 0
...........Volume ID (hex): 0000000000000000
........Volume Label (txt): (Err)
............Checksum (hex): 00000000
....Sector Signature (hex): 0000
128/000:20/VEC> Verify EPBR Chain completed
128/000:20/USD> Select disk completed
128/000:22/MNU> - Main, Repairs
128/000:25/MNU> - Repair, Rebuild Boot Sectors
128/000:26/UND> New Undo archive created for disk 0 (128)
128/000:26/LOG> Undo settings: GL(+) DE(+) FAT(+)
128/000:43/CBS> Checking validity for NTFS BS at 771120 (48 0 1)
128/000:43/CBS> E: Jumpcode : E9ED00
128/000:43/CBS> E: sectors/cluster : 127 (246/1)
128/000:43/CBS> E: Unknown : 00000000
128/000:43/CBS> E: MFT location : 761618
128/000:43/CBS> E: MFT mirror location : 16
128/000:43/CBS> E: 1st sector for MFT/MFTmirror NOT equal
128/000:43/CBS> Check completed
128/000:46/AFR> Start FindClusterSize (NTFS), from 771120 to 7062575 (6291456)
128/011:14/AFR> ClusterSize could not be determined
128/011:14/RBS> BS data could not be determined
128/931:44/RDS> ReadError for disk 128 at 0 (0 0 1), C:1, T:80h
128/931:44/RDS> ReadSector success (after error) at 0 (0 0 1), tries 1
128/931:53/UND> Undo archive discarded, no sectors saved
128/931:59/MNU> - Main, Quit
128/931:59/LOG> RunTime: 931:59
128/931:59/LOG> ### CLOSE LOG ###
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1476


WWW
« Reply #13 on: August 15, 2008, 04:56:54 PM »

Excuse me, but i'm a little lost here. Now we see the disk as 127Gb again, which is not okay. Why is that, what changed? The previous log showed the disk as 149. What happened?
And, a new problem is introduced, a read error. It shows up at address 0, which is the very first sector of the disk. I also see you've loaded the UDMA driver. These 2 things could be connected: DON'T use the udma driver.
The fact that the boot sector repair didn't finish correctly is a bad sign, but since the situation has changed again for some mystical reason (the disk size is wrong, again), i'm not too sure about this result. Either way though, it's bad, and it's unlikely that the result will be much different if the disk size WAS correct. You should still try though.
So:
- get that disk size right, as before
- try the Boot sector repair again
- DON'T load the udma driver
Post the result.

If this doesn't work and iRecover doesn't find anything, we're just about done: i can't think of anything else to try. Maybe others here have suggestions, if so they will be posted.

Well, i have at least one. Two actually... don't use encryption on hard disks (that's number one) and create backups of important data (that would be the much overlooked second).
Logged

bharnish
member

Posts: 19


« Reply #14 on: August 15, 2008, 06:13:31 PM »

Hi and thanks again.  Sorry about the confusion.
The drive originated in an old Dell D800, which shows only 127 GB.  If I put the drive in a new Dell D630, the computer recognizes the whole drive (149 GB).
This is the reason for the title of this thread: "Possible 128 Gb barrier problem".
Which computer should I use to get the correct reports?
Logged
Pages: [1] 2 Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!