Solved Win 8.1 x64 and raw file system on external USB drive

[speedlever]

I'm having an issue with an external Seagate 3TB USB drive that would not power up. So I took it apart, put the 3TB drive in another enclosure I have, connected it and now it wants to reformat the drive... says the file system is RAW.

For the details, check here:
cgsecurity.org

I believe the data on the drive is mostly images and some videos that my daughter would like to save.

Any suggestions?

 

[Mark Phelps]

Sorry, "RAW" is not good. I encountered just the same problem last year when a fairly new Seagate 3TB drive suddenly would not boot anymore. None of the Windows data recovery apps I ran against it could find anything. I sent if off for commercial analysis and they told me that it encountered a hardware failure and wanted $1000 USD to rebuild it -- I said NO.

The best data recovery app I've used recently is Active@File Recovery Pro. You can download and try it for free, but recovering anything but very small files requires a license. Last time I checked, it was around $30 USD for a license.

 

[jumanji]

Hi speedlever,

Your 3TB drive has a logical 512 B sector size but a physical 4096 B sector size . TestDisk reads 512 B sector size. Change it to 4096 in TestDisk and it should be able to read the drive correctly. The lost partitions should show up correctly now. Once this is achieved, use the list command to show all files and copy those to another drive. ( you should have another empty drive connected before you run TestDisk for that.) Only after copying all the files write the partition table found.

"Under Testdisk, when I was looking at "Geometry", I realised that it a default 512 byte sectors. Now I understand a little bit about sector sizes, I changed it to 4096 sectors and when Testdisk analyzed the disk, it came back "green"
So now I'm going to use the copy function and pull those files off. "

Note: I shall be out of station for the next three days and wouldn't show up here and hence I am leaving the above instructions for you to grapple with. Good Luck.

 

[speedlever]

Mark, thanks for the tip on the data recovery app. I may try that if jumanji's fix doesn't work.

jumanji, I don't see any options in TestDisk v7 that allow me to change that parameter. I'll inquire around some and see if I can find any way to do that. Meanwhile, I'll leave this thread unsolved pending your return or my successful efforts to revive this drive. If I succeed, I"ll show this as solved.

Otherwise, whichever ever one of us gets back to it first can update.

Thanks all.

 

[jumanji]

OK, I am back into my den after a overnight train journey.

I now refer to the first screenshot in the TestDisk Forum showing the Device Information on your 3TB external drive wherein it says everything is fine and " Sector Sizes 512 bytes logical, 4096 bytes physical ". I only hope that nothing has changed since then. ( Indiscriminate use of data recovery software can spoil the broth and make the situation worse.)

Try TestDisk again. But before doing that please plug out all other external drives/pendrives/ USB hubs/USB Printers/ Card Readers etc., Yes, all but your faulty external drive and another empty drive where you want to copy the recovered files. That will make identification of the drives easy in TestDisk. ( If you can you may also disconnect any other secondary drives on your machine keeping your system drive only ticking.)

I shall now lead you to the point where you can change the sector size from 512 to 4096 in TestDisk and once that change is made and accepted by TestDisk, it should be able to analyse the disk, show the correct partitions.

1. No Log - Enter

2. Select your Disk ( not Drive) -Enter . ( In the screenshot it is my 320GB external drive,)


3. Select [Intel] Intel /PC Partition - Enter


4. Go to [Geometry] Change Disk Geometry - Enter


5. Go to [Sector Size] - Enter


6. Change Sector Size to 4096 - Enter


At this stage what screen you will get, I can't say .( I don't want to change it for my sector size is correct ) But generally TestDisk will accept it and then you have to analyse and it will find the partitions rightly. Then use the LIST command to list the files and copy those to the empty drive.

If you have any doubts on any screen post the screenshot. and Quit TestDisk by pressing X in the top right title bar.

You can rerun TestDisk again after getting my instructions. ( TestDisk is safe as long as you do not give a write command without knowing what it does or writes to the disk)

 

[speedlever]

jumanji,

Thanks for the expanded info. I will test that shortly.

Thus far, I've not tried much other than creating a Puppy Linux USB thumb drive and finding that I can't read it there either. Recuva doesn't recognize it as well. So I don't think I've done anything to jeopardize the data that I think still resides there.

BTW, the problematic drive should only have a single partition.

 

[speedlever]

jumanji,

I ran TestDisk again per your excellent instructions. However, I see no change in the display info, so I quit TestDisk (X'd out) pending further review. Here's a snapshot of the results:

Any thoughts?

 

[jumanji]

You have to tell me whether the sector size was shown as 512 and you changed it to 4096 and pressed enter.

Please post the screen that appears. let me get confirmation that it is the same as shown in the last post.

You can run TestDisk again. ( The sector change you did basically holds only for that session.)

I am online. So don't close TestDisk this time. I shall follow it and send you instructions,.

 

[jumanji]

OK, I see you had gone offline.

Repeat TestDisk the same way as instructed earlier. After you change the sector size to 4096 and enter , if you get the same screen as in your post #7:

TestDisk confirms the change and shows OK highlighted. Press enter to say OK and show me the next screen.Let us see where it takes you further.

( If I am offline, you may close TestDisk and wait till I see the posted screenshot and give further instructions.)

As I mentioned earlier with the changed Sector size, you should Analyse the Disk and see whether TestDisk shows your partition and list command shows all your files.

 

[speedlever]

Ah yes. I figured I had to press enter before any thing would happen.

Sorry... just now getting back to this.

Yes, the sector size was showing as 512 and I changed it to 4096 before I X-d out of TestDisk.

Standby while I power the drive back up. Then I'll run Testdisk again and this time hit enter after changing the sector size. I'll post a screen shot of the results.

Edit:

Here's TestDisk prior to changing the sector size:

Here's TestDisk after changing the sector size to 4096 then choosing OK:

 

[jumanji]

Yes, after changing to 4096 and hitting OK, go to Analyse and let TestDisk analyse and find the partition/s. If you had closed TestDisk, you have to repeat everything again.

If you want some reading material on TestDisk, see my thread in SevenForums Regain a lost drive using Test Disk - An Illustrated Guide - Windows 7 Help Forums (Grasp/grab only what is needed here - analysing and listing.)

Copying files listed by TestDisk during Recovery: My external hard drive suddenly became unllocated: - Page 3 - Windows 7 Help Forums

In your case copying files listed by TestDisk - if as I hope it will be successful in listing - is the first priority. There is no need to write the partition table. So don't give any write command.

Your present enclosure in which you have put the HDD lacks the drive translation circuitry - which converts reads/writes from 512 b to 4096 and vice versa - and that is why we need to tell TestDisk to look for data in 4096 b sector size.

If you are able to recover data successfully, you then need to initialise the disk as GPT and reformat it to be able to use it in the present enclosure or the HDD alone as a secondary data drive in a system.

And on a positive note, if for any reason you are unable to recover data, if you buy another external drive of the same make/model/capacity (and carrying the Advanced Formatting Logo on it) and put this HDD inside that enclosure, you will see your drive as before with all data. That of course will be the final call.

 

[speedlever]

jumanji,

TestDisk is currently analyzing the drive.

stand by....

 

[jumanji]

I hope you had changed the sector size to 4096 before starting the analyse/quick search.

I am unable to make out anything out of the warning messages. I am also not sure whether it is normal since TestDisk is always tuned to 512 bytes per sector albeit changing it to 4096. The warnings could be false. So far we had only one user in Seven Forums who had changed the sector size to 4096 and successfully recovered the data on his 3TB drive. The quote in my post#3 is that of that user. I am keeping my fingers crossed.

I am retiring for the day early today and see the news from you tom.

 

[speedlever]

Yes, I changed the sector size before running analyze. Here are the Testdisk analyze results:

After reading your tutorial on the seven forums, I realized I hadn't run Testdisk as an admin. Think that might make a difference?

 

[jumanji]

It shouldn't matter if you as a user have admin privileges. To be safe we always recommend that it be run as administrator. Next time and henceforth run it as administrator.

When you reach the screen you showed in the last post where continue is highlighted, press enter to continue and check whether the next screen that comes allows you to list the files when you highlight the partition shown. ( The screen should show "P - list files" command for you to do it) Post the screenshot. If it can list the files, see whether you can see all your files listed. If yes copy those to another empty drive.

If no , then we shall take heed of the warning and make some further changes to the geometry. But first do what is stated above. We shall go step by step. Data recovery is a tedious process. We may have to change course as and when new facts emerge. So have patience. We shall try our best to get the hell out of it. As already said we still have the final call.

I need the following info.

1. Check the original enclosure from which you had taken out the HDD and see whether it has the AF logo on it. When did you buy it, just recently or quite sometime ago?


2. Your 3TB HDD was working good earlier. Is it the same PC on which you are trying it now in the new enclosure? Some PCs and some drivers cannot handle drives larger than 2TB.

3. Do you have a PC on which the 3 TB HDD can be directly connected to a SATA port as an internal drive? Can you do it? This will eliminate the current enclosure interface in the middle. Again some old enclosures and docks may not handle drives larger than 2TB.

Edit:OK, I had a relook at your thread running concurrently on the TestDisk Forum.

I got some info. 1. Earlier on in its original enclosure it was connected to your daughter's 8.1 64 bit laptop and there it developed a problem. 2. Now inside a different enclosure, it is connected to your 8.1 64bit PC and doesn't show up with the correct capacity and wants to be formatted. Since you also have another 3TB drive and it shows up correctly, your PC and drivers in it are cleared.

For the sake of completeness, please post a screenshot of Windows Disk Management showing the problem 3TB drive.Also post a screenshot of TestDisk showing the connected drives and answer question #3 above.

 

[speedlever]

Hi jumanji,

Here's a sshot of disk mgmt. Disk 4 (F:\ being the problem child).

And a sshot of TestDisk. (/dev/sde (drive F:\) being the problem disk)

And here's a shot of TestDisk after I hit enter from above. No P (list) shows.

And to question 3, yes, I have a homebrew PC (Asus P8Z68V-Pro, 16Gb ram, i5-2500k CPU, 256GB SSD for my C:\drive, assorted spinners for data, etc. running Win 8.1x64 pro). I should be able to connect the problem drive as an internal drive to this system. I may have to re-arrange some stuff, but I'm sure it's doable.

 

[jumanji]

OK, you did a good job. I presume your C, D and E drives are internal. Leave C 250GB and D 320GB undisturbed ( I see C is your boot drive and D is your system drive). You can remove Data 2 2TB E: drive and plug in your 3 TB faulty drive in its place..( Please mention the manufacturer/Model Number, Name for the record. I think it came from another Seagate Backup Plus external. Right ??)

Once done reboot your PC and post a screenshot of Windows Disk Management including the 3TB Seagate backup Plus external. That will be helpful as a reference.

Download install and run MiniTool Partition Wizard Free Edition 9.1 Best Free Partition Manager for Windows | MiniTool Partition Free. Post a screenshot of how the same set of drives look in it - the very first screen when you launch the application. Please make sure that details like the Start sector,End sector etc., are clearly visible in the Disk list by adjusting the seperators.

On the whole, we will be starting afresh with the most desirable set up.

No need to get things done in a hurry. Do it at your own pace and time. I shall come back only after another 12 hours.

 

[speedlever]

Yes, your assumptions are correct.
c:\ is a 256GB ssd for OS and programs
d:\ is a 320GB spinner for data (soon to be replaced with a 1.5TB spinner... I'll just clone the 320GB to the 1.5TB drive and extend the partition)
e:\ is a 2TB spinner for data
Z:\ is my external 3TB backup drive.

I'll post here when I get around to moving that drive to an internal connection.

This has been very informative to me. I had no idea that the enclosure (or lack thereof) would have any bearing on the data written to the drive.

Thank you for standing by with help. I remain hopeful we can save the data on the drive. If so, I'll put it back in my spare USB2 enclosure, reformat it, and copy the data back to it. (as well as copy it to the cloud for further backup).

Just for grins, here's a shot of Minitool PW before I move the external drive to an internal slot.

 

[speedlever]

jumanji,

A quick update. My original plan to replace my 320GB drive with a 1.5 TB drive (WD green drive) did not materialize. The 1.5TB drive is bad... or rather, is failing. So I have a new drive on order which should be in early next week. Once I get my PC hardware sorted, I can resume testing on the problematic external drive.

I had planned to copy the data from the problem drive to my 2TB drive, but since I will need to move it out temporarily to make room for the problem drive, I needed a larger drive to have room for the rescued data. Ergo the push to change out the 320GB drive (which has been my main data drive for years). While I still have some room on it, it is getting increasingly cramped for space and needed to be swapped out anyway.

I sorta hate to move it out. It's been extremely reliable (Samsung HD321KJ). And I leave my PC on 24/7.

BTW, I tried the problematic drive in an external HD dock (USB2). Same issue as before. So the next move will be to install the drive internal to the PC and try it again there.

 

[FreemanAA]

You can download and free trial, but to restore anything but very small files requires a license.
Samsung Galaxy S6 cover
Samsung Galaxy S6 case