[SOLVED] HDD "corrupted" but there is no physical sign of defect at all

[howtobeironic]

So, a relative brought me a HDD, telling that it's not working. It's a thin 2.5" on an external enclosure, and it's clear that the enclosure is big for it (it was able to jiggle inside). I plugged it to the computer using my own HDD dock, and it reports "This partition is corrupt and unreadable". Even chkdsk (in my defense, it's a backup drive and the data inside wasn't REALLY important) refuses to work (Sees that it's NTFS, but "unreadable").

So, I assumed the worst (probably the shock from the jiggling one day smashed something inside, right?) and started poking around a little. Ran a ddrescue on it directly, which completed with %100 recovery rate and no bad sectors (Weird, right?) and a carve using PhotoRec was successful, and (although the names are gone) I have all the data I need inside, verified and working (only if someone could sort through 600k+ files for me...).

After getting the data out of there I started tests. For SMART, programs aren't really sure, some (CrystalDiskMark, HD Sentinel) report meaningful and all green data, some (SeaTools, AOMEI Partition Assistant I tested for some reason) tell that the drive doesn't report SMART at all. HD Sentinel reports 2813 connection faults (which didn't increase once through all testing and copying done, so I assume it's past disconnections) but nothing's even yellow. Full surface tests and SMART self checks come out all green. Read tests don't report anything out of the ordinary. The drive has a normal sound, no clicks, scratches, just a normal whirring. TestDisk (although it can't work on the drive) reports a healthy NTFS boot sector and bad MFT sector (and backup).

So, here's the question? What could have happened? Could this drive be trusted again (after a full sanitization and a few rounds of testing, obviously)? How could a perfectly working drive break itself on specific places out of thin air?

I'm open to any opinions about this one.

 

[fzabkar]

It sounds like the NTFS metadata may be corrupt, perhaps due to an unsafe disconnection??? Also, some USB-SATA bridge ICs (eg JMicron JM20337) have a known data corruption bug.

Possible flaw in popular USB-SATA adapter cables:
http://www.hddoracle.com/viewtopic.php?f=56&t=632 (this web site is currently broken due to a bad upgrade, so some things may be missing)

Try the free version of DMDE. If it detects the NTFS volume, d-click it and expand the $Root. Do you see the folder tree?

https://dmde.com/

PhotoRec is a file carver. It looks for known file headers and then assumes that the entire file is contiguous. A dumb file carver cannot handle fragmented files.

To sort through the results ...

https://www.cgsecurity.org/wiki/After_Using_PhotoRec

BTW, some enclosures (eg Seagate's) are configured with a sector size of 4KB. If you remove the drive from such an enclosure and install it in a 512B environment, the OS will still see the partition table in sector 0, but everything else will be out by a factor of 8. DMDE will report 4KB in its Partitions window. That said, it doesn't appear that this is your problem.

 

[USAFRet]

Could this drive be trusted again (after a full sanitization and a few rounds of testing, obviously)?

I don't "trust" any drive, even brand new right out of the box.

A good backup routine, and if it dies, your biggest hassle is just getting a new physical drive.

 

[howtobeironic]

It sounds like the NTFS metadata may be corrupt, perhaps due to an unsafe disconnection??? Also, some USB-SATA bridge ICs have a known data corruption bug.

Possible flaw in popular USB-SATA adapter cables:
http://www.hddoracle.com/viewtopic.php?f=56&t=632 (this web site is currently broken due to a bad upgrade, so some things may be missing)

Try the free version of DMDE. If it detects the NTFS volume, d-click it and expand the $Root. Do you see the folder tree?

https://dmde.com/

PhotoRec is a file carver. It looks for known file headers and then assumes that the entire file is contiguous. A dumb file carver cannot handle fragmented files.

To sort through the results ...

https://www.cgsecurity.org/wiki/After_Using_PhotoRec

BTW, some enclosures (eg Seagate's) are configured with a sector size of 4KB. If you remove the drive from such an enclosure and install it in a 512B environment, the OS will still see the partition table in sector 0, but everything else will be out by a factor of 8. DMDE will report 4KB in its Partitions window. That said, it doesn't appear that this is your problem.

First off thank you for that photorec hint. That's helpful now.

To the other side...

This is how the DMDE looks. The $Root only has the [..][+found] folder.
(For context, "Sistem Ayrıldı" translates to "System Reserved", so the entire partition seems to be marked as it.)

 

[howtobeironic]

I have to add, there is a "Build Virtual FS" option that when applied, adds some files and folders into the $Root. Are these put by the DMDE or...?

 

[fzabkar]

DMDE doesn't add any files of its own.

Can you show us DMDE's Partitions window, ie the first window that comes up?

 

[howtobeironic]

DMDE doesn't add any files of its own.

Can you show us DMDE's Partitions window, ie the first window that comes up?

 

[fzabkar]

Any partition that has an "F" in the Indicators column means that DMDE has found a file system, ie the metadata. These partitions provide the best chance to recover file and folder names.

It would appear that the drive had a Microsoft reserved partition between LBAs 2048 and 104447, followed by a data partition between LBAs 104448 and 975745010, and finally a reserved partition (probably for recovery) between LBAs 975745024 and 976769023. The user then appears to have reinitialised the drive by creating a single 500GB partition.

In short, DMDE has found no file system in the area occupied by the original data partition. I would perform a full scan over the range between LBAs 104448 and 975745010. You can uncheck everything except "raw" and "NTFS" (because you're not looking for FAT related structures, etc).

 

[howtobeironic]

I started a scan over those parameters you provided. By the looks of it it's taking at least half an hour to finish though. I'll send in the results once that's done, thank you for the insight.

 

[howtobeironic]

The scan has returned some results. I actually don't know what to look for here, to be honest. The first one is promising, though, because as I ask, the filled size on the drive was somewhere about 150 GB.

 

[howtobeironic]

Update: That really seems like our files there. I started catching some files.

 

[howtobeironic]

...and I found the main backup image, mostly intact, and everything working in there. Definitely beats sorting through the carver output. You sir, are a godsend.