Rebuilding a hard drive

Topic

New Reply

Hello!

I have a hard drive from a laptop that was damaged by water.  I thought that the drive would be Ok but it appears that the damage includes the drive as well.  I have enclosed a picture of the properties of the hard drive.  I have removed it an put it into a USB connected adapter.

As you can see, the PC can read the drive and there is one folder showing as accessible, but there should be 424mb of files which are inaccessible.

What utility do you recommend I use to rebuild the drive?  I tried SafeCP which is on the OldGeeks website, but it did not find anything nor did it have any options I could use.

Is this a partition problem?

What do you suggest?

Thanks!

 

 

Reply | Quote

Replies

Assuming this drive was connected to a different device:
What was the OS on the damaged laptop?
Was bitlocker activated or any 3rd party encryption on this drive whilst in the laptop?

Reply | Quote

You need to fire up Disk Manager (Win R, diskmgmt.msc) to see what is on the disk.
What does it show?

cheers, Paul

Reply | Quote

Probably better to get a (larger) new drive, sector to sector clone very carefully, and use data recovery on that drive as a damaged drive could just stop, anytime.

1 user thanked author for this post.

wavy

Reply | Quote

annonymous:  Hard drive was a standard Windows 10 OS drive. It was not encrypted.

Paul T:  I ran disk manager and the program was unable to initialize the drive.

The program showed a dialog saying:  You must initialize a disk before logical disk manager can access it.  Then it gave 2 options:  MBR or GPT.  Both failed.
What is interesting that I can still read and write to it without errors.

 

OldGuy:  What would be the advantage of doing a sector by sector clone?  I have already lost my data.  Once I recover it I will never use the drive again.

Thanks to all for your suggestions!

Reply | Quote

Sorry to drop it mid post – I had to deal with something elsewhere… Looking at the properties it indicates something large is hidden in the current partition. Unfortunately you don’t tell us anything about the drive (mainly, the make and model of the drive would be good so we can work out if this is likely an OS partition [most of the drive], a data partition (as Acer etc often implement [typically the same size as the potentially absent Windows partition, which could show as unallocated space]) or a large recovery partition [some are way too large.. basically enough to hold a full install image]), so that could actually be a recovery partition with a recovery image hidden away and the Windows partition has gone.

Dropping a command prompt and doing the folllowing should show several chunky files if that’s the case.. by convention the OEM folders in the recovery drive are hidden though its common to see a “windows boot” folder layout (with a sources folder) on a PE boot drive.

dir g:\*.wim /s

dir g:\*.wim /s /ah

dir g:\*.swm /s

dir g:\*.swm /s /ah

of course while you’re there you can check for hidden folders easily – maybe let us know what you see.. if you see Windows / Users / Documents and settings / Program files then its likely a Windows partition but again you have to question what’s happened.

dir g: /ah

dir g: /ah /as

Beyond that we don’t want to do too much with the original drive – DIR just reads data from the MFTs (which store file locations on the disk) – we want to avoid any data being written to the drive as that could overwrite the file information data recovery software could work with, which is why I suggested going straight for a clone, just be CERTAIN the destination drive is larger, and that’s where your copying data TO.

I’d also wonder if its some sort of crazy ransomware misfire, in which case Dr web boot  should find a cause (again, try this on a clone of the drive!) and also illuminate the paths which are there even if they’re hidden.

If you just find chunky recovery files then unfortunately I’d be down to digging out an old Hirens disk (9) to use the diskgenius on a COPY of the problem drive (I used clonedisk.exe), which should sort out the partition table. Just fire it up, right click drive and click recover lost files recovery (deleted etc doesn’t matter) and it’ll work out if the problem is in the partition table and offer to fix.. that done commit the fix and reboot… but that was  a very OLD Hirens version – I can’t vouch for the current version or either program / product at all..

Finally I see the term laptop, which makes me think of various Lenovo’s and Acers which had “one button recovery” – basically you could hold the Lenovo (latterly “novo”) button (or acer recovery key, though ALT and F10 was more common by far..) down on some and it would enter a recovery program – if your machine had that function it could be the water ingress triggered it and it crashed, damaging the drive data in which case you might as well go straight for clone and data recovery as early on the scripts removed and recreated the Windows partition (so you’ll find no folders..), set up a recovery system and rebooted to start that system loading the data from the recovery partition… the only question would be how did it get past the confirmation stages but if that’s where the drive is, that’s not a problem you can fix to get your data back..

Reply | Quote

Thanks for the suggestions.  Let me give you the whole sad story…:-)

I damaged my laptop by pouring soup on the keyboard.  I presumed that the mainboard was the problem, so I removed the SSD and tried to access my files using an adapter.  All I am seeing is one file inside one folder.  I have since been able to read that file as well as create a test file, so I know the drive is working Ok.  However, the 424mb of used space contains the files I need to extract. It is not a ransomeware problem.  The free space is real.

Running the command lines gave me this:

I will try Clonedisk.exe and see if it can do the job.

Thanks again!

 

Reply | Quote

Hello again!

I am having a hard time finding Clonedisk.  Lots of adware but no actual program files.  Where should I go to get a copy?

 

 

Reply | Quote

You only need to backup that disk, not clone it. This will collect any data that is available.
Use one of the free backup apps, Aomei, MiniTool, Paragon etc.

To see the disk partitions, try “diskpart”.
Open a Command Prompt (Win R, cmd).
Type: diskpart
Yes to run as admin.
Type: list disk
This shows you all disks. Find the troublesome one by number – I’ll assume it’s 1 for the examples.
Type: sel disk 1
Type: list par
This will show you the partitions. Post the detail here. (you can copy and paste from a Command Prompt)
Type: exit

cheers, Paul

Reply | Quote

I ran diskpart and here is what I found:

What utility should I use to restore the partition?

BTW, I did find a copy of Clone disk on the OldGeeks website.  It was in a utility CD that had tons of different utilities.  The version was comparatively old (2011) but I am thinking it will be useful.

Reply | Quote

That disk does not look good, but the final test is to view it with MiniTool Partition Wizard (free). Sometimes Windows will not identify unusual disk partitions, but MTPW gets around that.

cheers, Paul

Reply | Quote

No clue if this can work on an SSD but if the failed drive was HDD+MBR, it would very probably be of some help (I’ve used it to fully recover an ‘overwritten’ NT4 whole drive partition after it had been running Win9x for a year or so).

https://www.terabyteunlimited.com/downloads-free-software/ MBRWork 1.08

MBRWork is a utility to perform some common and uncommon tasks to the MBR/EMBR sectors of a hard drive. It should only be used by power users who understand how computers work.

It can perform the following:

1 – Backup the first track on a hard drive.
2 – Restore the backup file.
3 – Reset the EMBR area to all zeros.
4 – Reset the MBR are to all zeros.
5 – Install standard MBR Code
6 – Set a partition active (avail on the command line too)
7 – Work with multiple hard drives.
8 – Remove EZ-Drive (You must boot directly to a diskette (by passing ez-drive) for this option to show)
9 – Edit MBR partition entry values.
A – If no partitions exist in the MBR and no EMBR exists then this option will allow you to recover lost FAT, HPFS, NTFS, and Extened partitions.
C – Capture up to 64 disk sectors to a file.
R – Restore up to 64 disk sectors from a file. This feature should only be used by those who completely understand what they are doing!
T – Transfer/Copy sectors from disk to disk. This feature should only be used by those who completely understand what they are doing!
P – Compare sectors.

Reply | Quote

Paul T : I tried the free version of Partition wizard, and it could not recover anything.  However, the free version had some limitations, so if I had bought the pro version, it might have worked.

Satrow:  Using MBRwork, is a bit beyond my pay grade so I am not going to try that.

Thank you both for your suggestions.

I guess the moral of this story is back your files up regularly…:-)

 

 

Reply | Quote

PW will not recover anything, it will show you what is on the disk.
What does it show? (To post a screenshot, save the shot as PNG, then use the “select file” button to add it to your post)

cheers, Paul

Reply | Quote

Here is the results when I do a partition recovery:

I tried the Data recovery option and this is what I got:

I am not sure a single file is very useful.

Any other thoughts?  Thanks for your willingness to help, BTW…:-)

 

 

Reply | Quote

It seems that disk has gone to silicon heaven.
Without an existing backup of the data I suspect you are out of luck.

cheers, Paul

Reply | Quote

That is what I am afraid of…:-(  I will see what I have for backups.

Thanks for the advice. As always, I learn a lot from you guys!

 

 

Reply | Quote

Diskgenius is still there. I guess if all else is lost, maybe you could  disconnect the current OS drive and use the portable version if that program from USB after booting a recovery environment or such might be safe enough? (that might even all fit on one USB). A lot of the simpler “portable” apps seem to run fine from the recovery command prompt..

https://www.diskgenius.com/download.php

Just see if it’ll fix the partitions – data recovery is best done to external media, though that is simple enough to drive so if you must you could connect a second external drive maybe?

 

Reply | Quote