Hey all! I've used tomshardware a lot to solve countless previous issues, but this one's over my head. Among friends I'm sort of known as the local 'fix their computer for free' guy, but this most recent problem has me stumped.
I was given a HP Pavillion laptop on Windows 7 that wouldn't boot, and the owner just wanted the files recovered from the hard drive. I've removed the hard drive and hooked it up to a working machine running Windows 7 64 bit with a SATA to USB cable that has served me well in the past.
Here's what I've tried so far:
The disk management utility recognizes the drive, and shows that it is currently in RAW format.
EASEUS Data Recovery Wizard has found many of the files, but crashes when trying to build them into a RAW file tree. Even if it succeeded, I don't think the files would be accessible.
TestDisk finds three partitions, the first being a seemingly empty bootable primary, the second being what I assume was the C:/ drive, and containing all the files wanted for recovery. The third is a seemingly empty primary.
Trying to do any type of writing with TestDisk yields an immediate error "Partition: Write Error." No more information is given on screen.
Below is a copy of the testdisk.log that was created. It's beyond my ability to try and decipher, so any and all help with this is appreciated guys. I've read a lot of different posts here about advice on recovering RAW hard drives, but I haven't seen the same types of errors I'm getting.
If you need anything else from me please let me know, otherwise for now I think I'm officially stuck.
Thanks,
Chris
I was given a HP Pavillion laptop on Windows 7 that wouldn't boot, and the owner just wanted the files recovered from the hard drive. I've removed the hard drive and hooked it up to a working machine running Windows 7 64 bit with a SATA to USB cable that has served me well in the past.
Here's what I've tried so far:
The disk management utility recognizes the drive, and shows that it is currently in RAW format.
EASEUS Data Recovery Wizard has found many of the files, but crashes when trying to build them into a RAW file tree. Even if it succeeded, I don't think the files would be accessible.
TestDisk finds three partitions, the first being a seemingly empty bootable primary, the second being what I assume was the C:/ drive, and containing all the files wanted for recovery. The third is a seemingly empty primary.
Trying to do any type of writing with TestDisk yields an immediate error "Partition: Write Error." No more information is given on screen.
Below is a copy of the testdisk.log that was created. It's beyond my ability to try and decipher, so any and all help with this is appreciated guys. I've read a lot of different posts here about advice on recovering RAW hard drives, but I haven't seen the same types of errors I'm getting.
If you need anything else from me please let me know, otherwise for now I think I'm officially stuck.
Thanks,
Chris
Wed Jul 3 20:01:01 2013
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May
2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7
(7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-06-24T18:54:26
ext2fs lib:
1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156374016
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=640135028736
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156374016
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=640135028736
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\C=148335755264
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\D
disk_get_size_win32
IOCTL_DISK_GET_LENGTH_INFO(\\.\E
filewin32_getfilesize(\\.\F
err Incorrect function.
filewin32_setfilepointer(\\.\F
Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\G
function.
filewin32_setfilepointer(\\.\G
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H
=640135028736
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector
size=512 - LITEONIT LAT-256M3S, S/N:002261017242, FW:VBA2
Disk /dev/sdb - 750 GB / 698 GiB
- CHS 91201 255 63, sector size=512 - ST750LX0 03-1AC154, S/N:2W00Q6XZ, FW:SM12
Disk
/dev/sdc - 640 GB / 596 GiB - CHS 9728 255 63, sector size=4096 - Hitachi HTS547564A9E384,
S/N:152D20337A0C
Disk \\.\PhysicalDrive2 - 640 GB / 596 GiB - CHS 9728 255 63, sector
size=4096 - Hitachi HTS547564A9E384, S/N:152D20337A0C
Drive H: - 640 GB / 596 GiB - CHS 9728
255 63, sector size=4096 - Hitachi HTS547564A9E384, S/N:152D20337A0C
Partition table type
(auto): Intel
Disk \\.\PhysicalDrive2 - 640 GB / 596 GiB - Hitachi HTS547564A9E384
Partition
table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at
3/47/45
file_win32_pread(300,4088,buffer,837640(52/35/56)) read err: read after end of file
file_win32_pread(300,1,buffer,837868(52/39/32)) read err: read after end of file
NTFS: Can't
read MFT
1 * HPFS - NTFS 3 47 45 9407 105 42 151078912
NTFS,
blocksize=4096, 618 GB / 576 GiB
ntfs_boot_sector
1 * HPFS - NTFS 3 47 45
9407 105 42 151078912
NTFS, blocksize=4096, 618 GB / 576 GiB
NTFS at 3/47/45
NTFS at
3/47/45
filesystem size 151078912
sectors_per_cluster 1
mft_lcn
786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record
1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot
sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk \\.\PhysicalDrive2 - 640 GB / 596 GiB - CHS 9728 255 63
Geometry from i386 MBR:
head=255 sector=63
NTFS at 3/47/45
file_win32_pread(300,4096,buffer,837632(52/35/48)) read
err: read after end of file
file_win32_pread(300,1,buffer,837639(52/35/55)) read err: read
after end of file
NTFS: Can't read MFT
Current partition structure:
1 * HPFS - NTFS
3 47 45 9407 105 42 151078912
search_part()
Disk \\.\PhysicalDrive2 - 640 GB / 596 GiB
- CHS 9728 255 63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) !=
4096 (HD)
filesystem size 407552
sectors_per_cluster 8
mft_lcn
16981
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_win32_pread(300,512,buffer,17237(1/18/39)) read err: read after end of file
file_win32_pread(300,1,buffer,17244(1/18/46)) read err: read after end of file
NTFS: Can't
read MFT
HPFS - NTFS 0 4 5 3 47 44 50944
NTFS,
blocksize=4096, 208 MB / 199 MiB
NTFS at 3/47/45
filesystem size 151078912
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_win32_pread
(300,4096,buffer,837632(52/35/48)) read err: read after end of file
file_win32_pread
(300,1,buffer,837639(52/35/55)) read err: read after end of file
NTFS: Can't read MFT
HPFS - NTFS 3 47 45 9407 105 42 151078912
NTFS, blocksize=4096, 618 GB
/ 576 GiB
NTFS at 9407/105/43
Warning: number of bytes per sector mismatches 512 (NTFS) !=
4096 (HD)
filesystem size 41009152
sectors_per_cluster 8
mft_lcn
786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record
1
file_win32_pread(300,512,buffer,151916544(9456/93/46)) read err: read after end of file
file_win32_pread(300,1,buffer,151916551(9456/93/53)) read err: read after end of file
NTFS:
Can't read MFT
HPFS - NTFS 9407 105 43 9726 128 2 5126144
NTFS,
blocksize=4096, 20 GB / 19 GiB
check_FAT: number of bytes per sector mismatches 512 (FAT) !=
4096 (HD)
Results
* HPFS - NTFS 0 4 5 3 47 44 50944
NTFS,
blocksize=4096, 208 MB / 199 MiB
P HPFS - NTFS 3 47 45 9407 105 42
151078912
NTFS, blocksize=4096, 618 GB / 576 GiB
P HPFS - NTFS 9407 105 43
9726 128 2 5126144
NTFS, blocksize=4096, 20 GB / 19 GiB
interface_write()
1 P HPFS -
NTFS 0 4 5 3 47 44 50944
2 * HPFS - NTFS 3 47 45
9407 105 42 151078912
3 P HPFS - NTFS 9407 105 43 9726 128 2 5126144
Facebook
Twitter
Instagram