PureBasic Forums - English

But aren't we -assuming- here that the problem is a faulty drive with a physical defect?

I've had drives lose partitions for seemingly no reason at all before, due to software mishaps or such. My brother had his whole drive wiped once just because he opened the case to do some work and barely even touched the thing.

But in those situations the drives went on to work fine for years and never had any other issues, or showed warning signs of failure, or SMART warnings, etc..


Your advice is not unwarranted, but its assuming the worst case scenario, when we weren't really given enough information to give informative replies, imho.

But either way I agree, whether the drive is physically defective or not, imaging it and then trying to recover should only be used as a last resort, and the proper way to make sure data is safe is to either Image the drive regularly, or maintain a parity based storage system via Hardware or Software RAID.

My opinon comes from years of supporting thousands of customers, since the time hard disks were invented. Edit (or least since the time they became an essential item).

its assuming the worst case scenario

It does - which is the only safe approach to a hard drive issue that could potentially lead to data loss. If you are a cop and you are called out to an armed robbery, you probably want to take your gun with you - of course the bank robbers might not use their guns but it's best to be prepared for the worst case scenario!

IdeasVacuum wrote:

But you can make an image of the drive

It is not a safe operation when the drive is damaged and could actually trigger it's fatality. Specialist recovery software constantly checks the health of the drive and takes much much longer so as not to unnecessarily stress it. There isn't really such a thing as a 'good' partition on a broken drive - there is only good luck and bad luck.

The reason the 'rescue shops' are expensive is two-fold. Firstly, they are unfortunately taking advantage of your situation to profiteer. Secondly, they actually remove the physical disc and mount it into a special drive. That requires a 'clean room' and a certain amount of skill and know-how.

IdeasVacuum wrote:My opinon comes from years of supporting thousands of customers, since the time hard disks were invented. Edit (or least since the time they became an essential item).

its assuming the worst case scenario

It does - which is the only safe approach to a hard drive issue that could potentially lead to data loss. If you are a cop and you are called out to an armed robbery, you probably want to take your gun with you - of course the bank robbers might not use their guns but it's best to be prepared for the worst case scenario!

And a very valid opinion it is indeed.

If there were indications the drive was physically damaged in some way to keep imaging or file recovery software from seeing the files I would agree with you for sending the drive out to recovery, but that does not seem to be the case here. The seagate demo software is able to recover files but the issue was that the demo software has a 64 KB limit. From what he posted he does not have a 'bad drive' just a screwed partition on that drive (partition E) and does have a good partition on the drive (partition F), so the drive isn't broken as if its not working. If it were anything other than what he posted I would agree with you. One of my first thoughts was, if its a windows Vista or Windows 7 system, that one or more of the descriptors is screwed (very common on multiple partition drives) and a "chkdsk drive: /F" might have a good chance of correcting the descriptor or move around any errors making the partition readable again.

But he doesn't have a damaged drive (at least not physically as in it just does not work). The way I understand it; He has a physical drive (HD2) with two partitions on it, partitions E and F, partition E is the problem, partition F is fine from what he posted (he posted > "So, I made a backup from the NOT demaged partition F"...). He was able to see the E partition for use with the demo seagate software and was able to use it for recovery of files, unfortunately the demo software had a 64 KB limit so he was not able to recover many files due to this limit. So the drive is readable and operating, the files are still there (from what he posted i'm assuming the files are still there). If the files are still there, and the drive is readable, if he uses the purchased Acronis to image that drive (partition E or even the whole drive with both partitions, i'd try just partition E first), the files should show up in the Acronis image. True, imaging the drive will image errors on the drive (if Acronis is not configured to skip them, Acronis can be configured to not copy any bad sectors/errors on the drive so they will not appear in the image.) but he is interested in recovery of the files (I assume from what he posted when he said > "lost partition E of my HD2 ... And lost the last 3 weeks of my program so, a lot of work is lost"). If he images the drive, he will be able to explore the image with Acronis once the image is made and then copy files from the image directly without placing the image with the errors in it (if any) back on a drive. Scan the image with anti-virus software first before trying to recover any files from it

We do this many times a day at work on single and multiple partition drives, been doing it for years, on drives we use for profiling virus, tojan, worm activity. We intentionally subject the drives to the virus, tojan, worm activity knowing it will damage partitions on the drive and then test for removal of these things after damage has occured and recovery options for the data. Of course these drives are in stand alone test systems. We also do things that intentionally damage partitions without the virus, tojan, worm activity, to simulate various sceinarios. We can have up to 100 of these systems going at any one time 24 hours a day so we can experience the non-readable/damaged partition thing literally thousands of times a year and only 15% ever need to be subjected to more drastic and expensive recovery methods. True, sometimes some files are not recoverable by the image technique, but the vast majority are.

It could also be that the partition has lost its mount point or its been disabled (lost or disabled mount points also common on multiple partition drives). If Windows Vista or Windows 7 (its present on windows XP as well but its used differently so you need to look that up if on windows XP http://www.microsoft.com/resources/docu ... x?mfr=true - with XP you will be creating a mount point and not re-enabling a mount point as there is no re-enable in the XP version if memory serves me) if the drive is NTFS (which it should be) the "Mountvol" command can be used from a command prompt. In his case, with a "MOUNTVOL E: /E" to restore the mount point, but run a "MOUNTVOL" command on the system first to show mount points and if one is disabled for the partition E then a "MOUNTVOL E: /E" might restore the mount point (if missing you need to create a mount point). For example, here is one of the test systems I mentioned above in which a drive partition has lost its mount point due to some virus activity, the "NO MOUNT POINTS" drive is drive G but that partition is not visible (the virus removed the mount point) but could be imaged and all files from the partition image were recoverable, and a "MOUNTVOL" command was also used to restore the mount point and everything was still intact:

"\\?\Volume{4922e3de-88bb-11e0-84d2-001bfcdb2b16}\
*** NO MOUNT POINTS ***

\\?\Volume{9c629fab-64b0-11e1-a4da-001b21a42b0a}\
K:\

\\?\Volume{279cfb38-7e7a-11e0-a564-001bfcdb2b16}\
J:\

\\?\Volume{279cfb33-7e7a-11e0-a564-001bfcdb2b16}\
F:\

\\?\Volume{085dc13e-7e89-11e0-938c-806e6f6e6963}\
C:\

\\?\Volume{085dc14b-7e89-11e0-938c-806e6f6e6963}\
H:\

\\?\Volume{085dc142-7e89-11e0-938c-806e6f6e6963}\
E:\"

(Lost or disabled mount points are not always due to virus, trojan, worm, malware activity. There can be odd occurances that just happen sometimes. Sometimes its software with a bug that happens under certain conditions, and its possible a user can also do it unintentionally under some circumstances. I've seen programmers do it was well unintentionally while testing their creations that access the drive. I've even seen free ware file copy software and windows explorer substitute/replacement software do it along with things that mount or create virtual drives.)

My point is, rather than immediately spending hundreds of dollars by sending the drive out to recovery specialists most times a partition can be recovered by the owner in cases such as what marc_256 has described. The point is very valid that people/places who specialize in recovery generally always have the best chance for recovering data from a drive. However, they may also be charging hundreds of dollars to do the very things I described above to recover data, and he already spent 99,99 Euro's (about $ 124.00'ish US) which has a good chance of recovering his files in this case. So if the drive is imagable i'd try the Acronis first, i'd also scan for viruses/trojans/worms/malware too.

I am wondering though why he isn't using the Acronis he purchased but is still looking around for, and trying, different other software? Then the thing about 6 hours to backup and check 250GB of programs/data with RichCopy, is also very curious considering that Acronis could have done it in less time if the drive is functioning properly mechanically and electrically. So is the RichCopy that slow really? Or is the drive actually failing mechanically or electrically? If the drive is failing mechnically or electrically or the drive data can not be imaged or bought back by one of the other things above - yes - then by all means take it out now and send it to the recovery specialists if the data on the drive is that valuable.

I would only advocate using a Recovery company as a last resort, or if the data was worth a really substantial amount of money and was so precious that any risk would be too much risk. It's not so easy for people outside the industry to choose a recovery company - there are some rogues out there.

The reason for my suggested approach was that the cause of the drive malfunction is unknown - in such circumstances, it's always best to assume nothing. I do not understand why Marc went out and bought Acronis - given that he had already found that the Seagate app would work, I'd have thought buying the full version of that might have been the obvious choice - perhaps it was too expensive or simply unavailable.

If the disk is failing with an electro-mechanical problem, imaging software like Acronis could make the drive fail completely - Acronis is not designed for damaged drive recovery but it is designed for speed, which something that faulty drives don't like.

To all,

First at all, thanks again, for all this welcome information.

'The status of the situation'

Yesterday morning I went to the computershop for needed stuff to install and finish my new LAN (local network).
All day (long day) work to intall ... not my piece of cake.
OK is almost installed and my backup server works (RAID1) 2x2TB HDD system.
And via USB 2 x cases with 1 TB HDD. oh, my bank account

So this morning I removed the broken HDD from the computer and installed it in my working (second) PC.

Found my old recovery CD (True image of Acronis-2004) and installed it.
- Recovered data via LAN to my backup unit. (6 hours) yesterday night.
- Recovered data to bin file (6 hours) this morning.

@SFSxOI
Thanks for the info, i'm little bit jealous of your knowledge about PC hardware.
Recovery HDD is not my daily job at all so ... hard work.

After recovering all the data I had less stress so,

- I did 'CHKDSK E:'
- translated answer from dutch winXP: "the type of system is NTFS
version and status of volume not accesible"

- I did a 'MOUNTVOL'
- translated answer from dutch winXP: \\?\Volume{085dc142-7e89-11e0-938c-806e6f6e6963}\
E:\" (something like this, copy of your previous example)
So I think HDD is ok.

- I did a 'MOUNTVOL E: /E'
- translated answer from dutch winXP: "the map is not empty"

- I did a 'E: [enter]'
- translated answer from dutch winXP: "file or map is demaged and unreadable"


The partition editor software answered:
"filelist demaged and unfindable"...


I hope all this information can help others also.

marc,

Marc, you may have been bitten by a very malicious virus. e.g. shamoon malware. You would have to be extremely unlucky to be hit by a virus like that, but it does happen and the really nasty ones can attack all drives.

That's another good reason to use recovery software rather than imaging software - you can pick which files you want to be recovered.

Can you tell us why you didn't go for the Seagate app even though you could see it would work?

Hi IdeasVacuum,

Marc, you may have been bitten by a very malicious virus. e.g. shamoon malware. You would have to be extremely unlucky to be hit by a virus like that, but it does happen and the really nasty ones can attack all drives.

I use NOD32 anti virus ?
Well, I was imaging the HDD, so I had some time to think wat I did before the problems occure.
I remember I just was installing/installed 'DOSBOX' to edit some very old DOS software I developed once.

That's another good reason to use recovery software rather than imaging software - you can pick which files you want to be recovered.

Yes, I found my CD with the software of Acronis and there are some other tools on the CD for recovery also.

Can you tell us why you didn't go for the Seagate app even though you could see it would work

Well, the demo works very wel till 64KB files, as I understand 'Seagate app' need at least One HDD of seagate in the PC to work.
On my other computer I only have WD HDDs.
So, low of budget now, I wanted some program who work on all my PCs.
Thats why I bought the Acronis programs.

Let know if I did it

Marc,

IdeasVacuum wrote:Marc, you may have been bitten by a very malicious virus. e.g. shamoon malware. You would have to be extremely unlucky to be hit by a virus like that, but it does happen and the really nasty ones can attack all drives.

That's another good reason to use recovery software rather than imaging software - you can pick which files you want to be recovered.

Can you tell us why you didn't go for the Seagate app even though you could see it would work?

Some type of malware/virus/trojan activity is possible but based upon his recent post I tend to think more towards an isolated corruption issue with a single partition. Most typically, virus/trojan activity which would have corrupted a file map would have affected at a minimum the boot drive first and then spread through the system.

marc_256 wrote:
I use NOD32 anti virus ?
Well, I was imaging the HDD, so I had some time to think wat I did before the problems occure.
I remember I just was installing/installed 'DOSBOX' to edit some very old DOS software I developed once.

marc, i'd dump the NOD32 and go for either Avast or the MS Security Essentials. Avast has a free version that works fine, and MS Security Essentials is free also. We test a lot of AV packages here and NOD32 never did that well overall but something is better than nothing.

I'd have to disagree with IdeasVacuum some what on the point of using recovery vs imaging in a suspected or actually infected system, in this case with a corrupted or damaged file map or corrupted partition. Never use immediate direct access recovery software to recover files from a corrupted or damaged partition in a suspected or actual infection system. Always image the partition, scan it and clean it then recover files from the image. With immediate direct access recovery software even files not accessed for recovery but which may be infected by some viruses can re-infect the system just by the direct access recovery software being aware of their existance.

With immediate direct access recovery software even files not accessed for recovery but which may be infected by some viruses can re-infect the system just by the direct access recovery software being aware of their existance.

I didn't know that was possible.

IdeasVacuum wrote:

With immediate direct access recovery software even files not accessed for recovery but which may be infected by some viruses can re-infect the system just by the direct access recovery software being aware of their existance.

I didn't know that was possible.

Yep, not for all viruses and trojans but for some especially some of the more recent newer ones and their variations in the last year or so.

I dunno, I'm pretty happy with NOD32. Been using it for ages, doesn't bog my PC down like other stuff I used to try from time to time.

But good security is just as much about good User habits, as about whatever AV software you are running.