All Data Suddenly Gone

Toggle sidebar Toggle sidebar
K

khizaraq

Distinguished
Sep 18, 2011
26
0
18,530
Hello Guys

I just installed 3TB Drives

I have Rampage IV Extreme Board

I wass copying data and I copied about 2TB DATA into a drive it was really important
And the windows ggave me a message "please restart to complete disk check", I cancelled copy reset and suddenly the drive became unaccessible
And in DEVICE MANAGER it showed the as a HEALTHY PARTITION with 100% free space

WTF?

I reinstated the device by giving permission of accessibility to "everyone" and it started opening with only boot.sm something and nothing else, everything GONE!!

I had all files over 5 - 6 GB
Why did this happen and can I recover data?

I really need that data back?
 
Sort by date Sort by votes
Your problem sounds strangely similar to a problem at another storage forum. In that case a 3TB drive became inaccessible after the user wrote data beyond the 2TB point. In his case the drive was configured as an 800GB pjhysical drive with a 3TB NTFS partition. I'm wondering whether Windows has made a mess of yours, too?

If you can be patient and resist the temptation to throw all sorts of data recovery software at the problem, we can examine the critical sectors and try to understand what happened. You say you "installed 3TB drives". I assume this means that you have a second working 3TB drive that we could use for comparison purposes.

If you wish to proceed, then please show us the contents of sectors 0, 1 and 2 of the physical drive. If you could show us the same information for both of your 3TB drives, then this would be even better.

Here are two free disc editors:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd
 
Upvote 0 Downvote
Yes I have a total of 4 3TB Drives.
Two crashed, and I lost 4TB of data
In one drive weirdly many of my videos stopped working giving error "Cannot Render file" in in MPC-HC and uunable to play or the playback was less than a second in VLC.

Let me know what to do
 
Upvote 0 Downvote
Yes I have a total of 4 3TB Drives.
Two crashed, and I lost 4TB of data
In one drive I was copying data, weridly PC got reset and I lost the entire drive, it said RAW FILE SYSTEM and had to format, I read it was a BOOT SECTOR ISSUE, was unable to recover that.
Please I am losing data I gathered over years in less than a dayy lol
In one drive weirdly many of my videos stopped working giving error "Cannot Render file" in in MPC-HC and uunable to play or the playback was less than a second in VLC.

I am not sure if this matters, but on my RAMPAGE BOARD the drives are treated as RAID as I have RAID enabled on two of my SSDs 240GB
There are other drives connected on it too which are not on RAID, I am not sure if that matters or not

Also please let me know how to tell you the contents of sector 0,1,2

Let me know what to do
 
Upvote 0 Downvote
Your symptom is exactly the same as in that other thread. It's almost as if you are the same person !?

Anyway, to save the requested sectors, launch DMDE.

In the Select Device/Disk tab, select the Physical Drive, choose the Physical Devices radio button, uncheck the Show Partitions box, and click OK.

You should now see LBA 0 (sector 0) of your drive.

Now select Tools -> Copy Sectors

Start Sector -> 0
Number of Sectors -> 3

In the Destination pane, select File.

You will be offered a filename of lba_0_3.bin

Click Save, OK, etc.

Now upload the BIN file to a filesharing service or your own web site.

If you could repeat this procedure for one of your good drives, then that would be even better.
 
Upvote 0 Downvote
You have shown us the first three sectors of each LOGICAL drive. We need to see the PHYSICAL drives. Perhaps you need to give yourself administrator privileges?

Anyway, #1 and #3 are showing a Windows 7 NTFS boot sector.

#2 is also an NTFS boot sector, but it appears to have been created by a different version of Windows.

#1 is telling us that the partition begins at sector 2048 (= 0x800) and has a size of 2TB:

(0xE8E077FF + 1) sectors x 512 bytes per sector = 2 000 396 746 752 bytes

http://www.google.com/search?q=0xE8E07800+x+512+in+decimal

#2 and #3 both begin at sector 264192 (= 0x40800) and have a size of 3TB.

(0x015D4C97FF + 1) x 512 = 3 000 457 232 384

In short, all three NTFS boot sectors appear to be intact. HDD #1 was partitioned in MBR mode, while HDD #2 and #3 were partitioned in GPT mode.

An Examination of the Windows 7 Volume Boot Record:
http://thestarman.pcministry.com/asm/mbr/W7VBR.htm#CHS

Our next step will be to examine sectors 0,1, and 2 of each physical drive to check for consistency with the boot sectors.

Sector #1 should look something like Figures 3 and 4:
http://thestarman.pcministry.com/asm/mbr/GPT.htm

The tail end of sector #0 should look like Figure 1.

Sector #2 should have references to a reserved partition and a basic data partition.

 
Upvote 0 Downvote
You are correct one drive I have since I used Windows 7, and these ones I initialized on Windows 8 (the 3TB ones)

http://ul.to/gp35sip5
(when I did on physical drives it showed AVAILBLE 800GB, not 3TB :S
WTF is going on please help

#1 is 2TB drive, #2 is 3TB drive working correctly for now, #3 is 3TB Drive which suuddenly lost all data.

PLease help out
 
Upvote 0 Downvote
1.BIN is showing a drive with a 2TB MBR partition of type 07 (NTFS). The size (0xE8E07800) and start sector (0x800) matches the information in the NTFS boot sector of your 2TB drive, so everything appears to be OK.

2.BIN and 3.BIN are showing drives with GPT partition systems. Sector 2 of each drive shows a 3TB partition beginning at sector 0x40800 and ending at sector 0x15D509FFF. This equates to a size of ...

0x15D509FFF - 0x40800 = 0x15D4C97FF

... which matches the boot sector information.

However, there is a problem in sector 1 of each of the 3TB drives. Sector 1 is the "EFI PART" sector. In both cases the numbers are telling us that the usable area begins at sector 34 (= 0x22) and ends at sector 0x5D50A38E.

The size of the usable area is therefore ...

(0x5D50A38E - 0x22 + 1) sectors x 512 bytes per sector = 801 569 692 160 bytes

This means that sector #1 is reporting a physical capacity of 800GB, but sector #2 is reporting a partition size of 3TB. It appears that this could be the root cause of your data corruption.

Sector #2 is reporting that the full size of the drive is 0x5D50A3B0 (= 0x5D50A3AF + 1) sectors. The actual size of WD's and Seagate's 3TB SATA drives is 5860533168 sectors.

In hexadecimal this number is 0x15D50A3B0:

http://www.google.com/search?q=5860533168+in+hex

Therefore you can see that the two numbers differ in the most significant bit, 0x15D50A3B0 versus 0x5D50A3B0. The leading "1" is the 33rd bit, so it appears that the drive was initialised when a 32-bit LBA limit (2TiB) was active, and then subsequently partitioned and formatted when the full 48-bit LBA range became available. At least that's one explanation. The 32-bit LBA limit could have been a driver problem which was subsequently corrected, or it could have been a BIOS issue which was later fixed by a BIOS update. Alternatively, if you switched between AHCI and RAID modes, or IDE modes, in your BIOS setup, then this may have invoked different Windows drivers, one of which may have the 32-bit limit while the other may not. Again that's just speculation.

Whatever the reason, there is a problem in sector #2 which will undoubtedly result in further data corruption. I suggest you backup your data ASAP, using data recovery software where necessary, and refrain from writing to the drives.

As for how the corruption occurred, imagine that the OS attempts to write to a sector beyond the 2TiB limit. Instead of writing to sector 0x1nnnnnnnn, the leading "1" is dropped and data is instead written to 0x0nnnnnnnn. In other words, data written to the end of the drive (sector 2TiB + X) wraps around to the beginning (sector X), resulting in critical file system areas being overwritten. The file system then becomes corrupted. Windows then sees the file system as RAW and treats it as just a bunch of bytes.
 
Upvote 0 Downvote
@khizaraq, if you are prepared to indulge me, I would like to try to repair sector 1 for you. I don't know if this will give us access to your data, but it may correct the misreporting of your drive's capacity by EaseUS. If we don't succeed, it will be very easy to undo the changes.

BTW, what range of sectors do you see at the top of DMDE's screen when viewing the physical disk?

Is it 0 - 5860533167 ?

Or is it 0 - 1565300735 ?
 
Upvote 0 Downvote
By all means try data recovery software, but don't allow it to write on your drive.

Whatever the outcome with your data, we need to determine why a 3TB physical drive was initialised as an 800GB physical drive, and why this 800GB physical drive has a 3TB partition. If you rebuild your drives in exactly the same way as previously, then you will be creating two more time bombs.
 
Upvote 0 Downvote


You are free to fix it, if I don't lose data on those drives.

Also you are absolutely correct, I turned my mode from AHCI to RAID ffrom my BIOS, and some of the drives are attached to that controller as well.

I need RAID for my SSDs, maybe that is why this happened?

What can I do to fix it?

I think I get the problem, with sectors but I got no clue how to fix it, Right now I have HUGE amounts of data on the drives, its there, its stored I am afraid if I move it might even lose that lol.

Hellp me out guys, if anyone wants to TeamViewer and fix it by all means
 
Upvote 0 Downvote
I would advise you to proceed cautiously. You really should try to backup and recover whatever data you can, even from your "good" 3TB drive. At the very least I would disconnect any unnecessary drives until you can determine whether they are safe. In fact your "good" 3TB drive appears to be a time bomb.

That said, you need to be certain that your backup drive won't be at risk, so I would use a 2TB drive for this purpose since these will not be affected by a 32-bit LBA limit.

The next thing I would do is to examine your two 3TB drives a little further.

Firstly I would try to read the very first sector after the 2TiB point, ie sector 4 294 967 296 (= 0x100000000). If this sector contains the same data as sector 0, then we will have a 32-bit wraparound problem.

Using DMDE ...

Tools -> Copy Sectors
Start Sector -> 4294967296
Number of Sectors -> 1

Secondly, we need to locate the mirror copies of sectors 1 and 2. These should be located at the very end of the physical drive, in reverse order. The question is, are these copies at the end of the 3TB physical drive, or at the end of the 800GB physical drive? If they are at the 800GB point, then they will fall within the 3TB data area and will eventually be overwritten with user data. AISI, this will have undefined consequences.

Using DMDE ...

Tools -> Copy Sectors
Start Sector -> 5860533166
Number of Sectors -> 2

... and ...

Tools -> Copy Sectors
Start Sector -> 1565565870
Number of Sectors -> 2

BTW, none of the above is putting your data at risk. DMDE will be in readonly mode.
 
Upvote 0 Downvote
Issue 1:
I tried entering this value it said its out of bounds so its not reading the drive entirely as a 3TB Drive?

I get INVALID INPUT error in DMDE when I try to do the first command
 
Upvote 0 Downvote
DMDE appears to be telling us that your current setup is affected by a 32-bit limit. If you discard the 33rd bit, you are left with a capacity of 800GB (= 746GiB).

As for your latest sector dumps, your file names are confusing. When DMDE offers to create a file, it calls it LBA_X_Y.bin, where X is the starting sector and Y is the total number of sectors. You appear to be using Y as the disc number.

lba_1565565870_2.bin is showing the last two sectors of the 800GB area of drive #2. These appear to match the data at the beginning of the drive, but in reverse order. To be certain, we would need to see the last 33 sectors, ie the entire partition array.

However, lba_1565565870_1.bin is showing a single sector (1565565870) rather than 2, and it contains data rather than partition information. Is this your 2TB drive (drive #1), or is it your "bad" 3TB drive?

In short, your "good" 3TB drive needs to be backed up ASAP. You also need to determine what is responsible for your 32-bit limit.

I notice that your motherboard has two SATA controllers, Intel and ASMedia:
http://www.asus.com/ROG/RAMPAGE_IV_EXTREME/
http://www.asus.com/websites/global/products/r7FZemJak3vMbWHg/product_overview.jpg

Intel X79 chipset :

2 x SATA 6Gb/s port(s), red
4 x SATA 3Gb/s port(s), black
Support RAID 0, 1, 5, 10

ASMedia PCIe SATA controller :

2 x eSATA 6Gb/s port(s), red
2 x SATA 6Gb/s port(s), red

If you have a spare, blank 3TB drive, I would attach it to each of the different SATA ports, and switch between AHCI and RAID modes in the BIOS. Then use DMDE to determine whether you can see the full 3TB capacity in each of the different configurations.
 
Upvote 0 Downvote
I actually can't do that, if I switch to AHCI from RAID, I would, I think, lose my OS which is on RAID 0 SSD.

2 of my 3TB are connected via ASMedia and 2 are connected on x79 Chipset, both show 800GB
As Media doesn't have Switching capability it just shows "non-raid", x79 can shift between RAID and AHCI
 
Upvote 0 Downvote
ISTM that all 4 of your 3TB drives are at risk. I confess that I'm baffled as to how you were able to create a 3TB NTFS partition on each of four 800GB drives, and on two different SATA controllers. That's just crazy. Which tools did you use?

BTW, can you confirm whether lba_1565565870_1.bin is from your "bad" 3TB drive or from your 2TB drive?

If you r-click your drive or SATA controller in Device Manager, can you see the name of the driver file? Are both controllers using the same driver? Are they Microsoft drivers, or Intel or ASMedia?
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom