No file system on USB drive.

Discussion in 'Computer Information' started by zaqxws@googlemail.com, Jun 8, 2014.

  1. Guest

    OK to cut a long story short I have been having problems with a fairly new 3 terabyte external USB 3 drive. I could not get it to work on USB so I took it out of the enclosure and tried it as a direct SATA connection. It did not wotk like that either, neither when I tried it on my old computer running XP, or Linux and just now on my new comp running win8.1.
    When I investigate it shows up as a drive, I can see the name with 3000 in it for 3 terabytes but when I look at properties it says "no file system".

    I should add I discovered this after upgrading from win 8 to win 8.1 and I initially though it was the upgrades fault, but that seems to be a red herring unless the upgrade wiped out the file system.

    So... what do I do?

    Is there something I can used to recover the data? Or at least try to?

    Nothing vitally important, I have some other backups on key documents on USB memory.

    I think also have some stuff, quite a lot on my old computer, think there are some disk utilities on there from previous problems. Oh an they may be on the USB stick too.

    I am gonna have to get a new drive or two ASAP methinks though, will just get and internal one and try it in one of my enclosures but I am bit concerned about putting a drive in the one the failed drive was in when it happened!!

    Any ideas would be appreciated!!!
    , Jun 8, 2014
    #1
    1. Advertising

  2. Paul Guest

    wrote:
    > OK to cut a long story short I have been having problems with a fairly
    > new 3 terabyte external USB 3 drive. I could not get it to work on USB
    > so I took it out of the enclosure and tried it as a direct SATA connection.
    > It did not wotk like that either, neither when I tried it on my old
    > computer running XP, or Linux and just now on my new comp running win8.1.
    >
    > When I investigate it shows up as a drive, I can see the name with 3000
    > in it for 3 terabytes but when I look at properties it says "no file system".
    >
    > I should add I discovered this after upgrading from win 8 to win 8.1 and
    > I initially though it was the upgrades fault, but that seems to be a red
    > herring unless the upgrade wiped out the file system.
    >
    > So... what do I do?
    >
    > Is there something I can used to recover the data? Or at least try to?
    >
    > Nothing vitally important, I have some other backups on key documents on USB memory.
    >
    > I think also have some stuff, quite a lot on my old computer, think there
    > are some disk utilities on there from previous problems. Oh an they may be
    > on the USB stick too.
    >
    > I am gonna have to get a new drive or two ASAP methinks though, will just
    > get and internal one and try it in one of my enclosures but I am bit concerned
    > about putting a drive in the one the failed drive was in when it happened!!
    >
    > Any ideas would be appreciated!!!


    There are two partitioning standards. The legacy MBR based
    method, and the newer GUID Partition Table or GPT.

    GPT is the standard that allows partitions larger than 2.2TB.
    To use the entire 3TB of drive capacity, requires some kind of
    trick if it is to work in WinXP as well as Windows 8.

    *******

    If we start with this article, even with GPT there is a "protective MBR".
    The MBR is loaded with a characteristic value, and that can hint at
    how the disk was prepared.

    http://en.wikipedia.org/wiki/GUID_Partition_Table

    "A single partition type of EE hex, encompassing the entire GPT drive
    (where "entire" actually means as much of the drive as can be
    represented in an MBR), is indicated and identifies it as GPT"

    So now we have a "hinting" mechanism available. If we see EE as the
    first and only partition in the MBR, then it was a GPT disk.

    This tool will display the MBR for you. PTEDIT32 used to be part of
    Partition Magic, but now that PM is no longer for sale, this particular
    tiny utility is free.

    ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    To run that in Windows 8, you want to right click it and "Run as Administrator".
    Running as administrator, is necessary to access the disk as a block device,
    and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.

    If the drive had conventional partitions, the partition type field would be 0x07
    or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker
    used by a GPT disk. So you can do a preliminary check with that.

    *******

    To scan a disk for file system headers, there is TestDisk.

    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    It basically scans at a fixed pitch, so it doesn't necessarily have
    to read every sector on the disk, but it sometimes feels like it's
    reading the entire disk. It would take a long time to scan a 3TB drive.

    The main problem with TestDisk, is the interface. It's medieval.
    This makes it hard to work with the program. If you press control-C
    (which in Linux kills programs), you can exit the program if it is
    sitting waiting for a command from you. So you can "escape" if you
    don't like what it is about to do. Some menu levels don't have a
    "QUIT" option, and control-C is your substitute for that.

    You don't accept the partition table it prepares, without using your
    previous knowledge of what was on the disk. For example, if the tool
    tells you there are four partitions, when you know there is only
    actually one, then you cannot accept and write the new MBR value.

    Now, a useful function, is if it locates a partition, it offers an
    option to "view the files on the partition". If that is working, and
    you see file names, that is reassuring, and means your data is quite
    likely to still be there.

    TestDisk is available for Windows and Linux, so can be run from
    either environment.

    There are also scavenger applications such as Photorec (same site) or
    Recuva. At this point, I don't feel there is any reason to panic.
    If you thought the TestDisk scan takes a long time, running a
    scavenger on that big of a disk, would take "infinite" time.

    *******

    One thing I discovered, while playing with my 3TB drive, is Linux
    allows loopback mounting of partitions, with an offset parameter
    applied to the mount command. The offset parameter is a 64 bit number.
    And translating that into English, it means even if the MBR or GPT
    was broken, if you can find the sector with the "NTFS" identifier in
    the header, you can mount any arbitrary bitmap area of a disk, using
    the Linux mount command. Using the offset parameter, allows the user
    to surpass the 2.2TB limitation, and mount a partition which is above
    the 2.2TB mark. So if you could find the beginning of the partition,
    in fact Linux can mount it without a (valid) MBR being present. I
    thought that was pretty neat. The number there in hexidecimal, is
    2.2TB plus 63 sectors. I just cooked up that number for illustration
    purposes, of a partition which is "up high". The /dev/sdb would be the
    3TB drive. I would use mkdir /media/mymountpoint, to make a place to
    mount the disk (temporarily).

    sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    I used dd (with its own offset capability) to snapshot small chunks
    of bitmap. And a copy of hexdump, to print the ASCII equivalent of
    what is in that chunk. That's how I was able to verify what I was about
    to mount, and that the offset value I cooked up was correct. That's why
    the mount command worked on the first try - lots of planning ahead of
    time :) By snipping out pieces of disk drive with "dd" with an offset
    applied, it was like having a disk editor available. I could verify the
    "thing" at 0x10000002F said "NTFS". Which means issuing the mount
    request is going to work for me.

    When I got my 3TB, I used the free Acronis TIH that was available to
    use on it. Inside that program is a dialog called "Capacity Manager".
    And it installs a driver into your Windows OS. The driver causes a 3TB
    disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.
    You see two disk drives in Disk Management. This is a trick to get
    around the 32 bit sector number (2.2TB capacity) limit on the older
    OSes. With the same driver present in Windows 8, I can also see that
    "two drive split" while running Windows 8. So to suit the older OS (which
    doesn't have GPT), I ended up using the Acronis driver on both OSes.
    If I was using Win8 exclusively, I'd be using GPT instead, as it's
    simpler. Getting that Acronis stuff to work, causes some hair loss.

    It was after setting that up, and placing a partition in the area above
    2.2TB, that I was testing the Linux mounting method. And I figured out
    with a hex calculator, what the offset should be for the file system
    header. I was able to mount the upper NTFS partition in Linux. The
    limitation I found with that, is the I/O speed using that method is
    only 10 to 15MB/sec, rather than the full disk speed. But if you're
    trying to retrieve files off that, that is the least of your
    concerns. Getting the data is what is important.

    So it is possible to get to your data, no matter where it is hiding
    on the disk.

    *******

    This is another option from Linux. The "disktype" program is available
    if you go to Package Manager and "turn on" all the available Repositories.
    You don't have to compile this for yourself. It's already built and on
    the distro server.

    http://disktype.sourceforge.net/

    Now, that can be pointed at say /dev/sda and asked for an
    opinion as to what is on the disk. It just takes the MBR or GPT
    info at face value.

    disktype /dev/sda

    And that should tell you how many partitions, what file system for
    each partition. in other words, if you haven't trashed the MBR,
    that program will reassure you by displaying all the particulars.
    That program can even be pointed at bitmap files (casper-rw for
    example), and tell you what file system is inside them.

    So that's a quick overview of some tools. Without attempting to
    reproduce any one of them in great detail. Just be careful with
    TestDisk, as if you write out an MBR, and the MBR is wrong, it
    could makes things a lot worse than they need to be. TestDisk
    can "show you the files" on a partition, so it does offer that
    reassurance. Most of the time, I don't accept what I get as
    a computed partition table, and use other techniques until
    I'm absolutely sure that I'm headed in the right direction.

    Any time you do repair or forensics on a disk, you need two
    spare disks. One spare disk, contains your sector by sector
    copy of the original (damaged) drive. The second drive, is
    the drive you use for the output of scavengers such as
    Photorec or Recuva. The reason for making the backup
    copy, is for situations where an in-place tool (such as CHKDSK)
    makes a horrible mess, instead of fixing something. At least
    with the scavengers, you point them to one of your spare disks,
    and the original disk is not being written upon. As long as
    you have that unblemished backup, you're safe to experiment.

    Paul
    Paul, Jun 8, 2014
    #2
    1. Advertising

  3. Guest

    On Sunday, June 8, 2014 5:20:00 AM UTC+1, wrote:
    > OK to cut a long story short I have been having problems with a fairly new 3 terabyte external USB 3 drive. I could not get it to work on USB so I took it out of the enclosure and tried it as a direct SATA connection. It did not wotk like that either, neither when I tried it on my old computer running XP, or Linux and just now on my new comp running win8.1.
    >
    > When I investigate it shows up as a drive, I can see the name with 3000 in it for 3 terabytes but when I look at properties it says "no file system"..
    >
    >
    >
    > I should add I discovered this after upgrading from win 8 to win 8.1 and I initially though it was the upgrades fault, but that seems to be a red herring unless the upgrade wiped out the file system.
    >
    >
    >
    > So... what do I do?
    >
    >
    >
    > Is there something I can used to recover the data? Or at least try to?
    >
    >
    >
    > Nothing vitally important, I have some other backups on key documents on USB memory.
    >
    >
    >
    > I think also have some stuff, quite a lot on my old computer, think thereare some disk utilities on there from previous problems. Oh an they may beon the USB stick too.
    >
    >
    >
    > I am gonna have to get a new drive or two ASAP methinks though, will justget and internal one and try it in one of my enclosures but I am bit concerned about putting a drive in the one the failed drive was in when it happened!!
    >
    >
    >
    > Any ideas would be appreciated!!!


    Thanks Paul,
    I will have a look through that in detail later, not had time yet but just wanted to report I put my 500gb drive in USB3 enclosure and it loaded onto my new machine no problem so there is no problem reading that enclose. It'sthe drive.

    However I came across a permissions problem reading it and it said something like do you want to get access to this folder (my login folder in "documents and settings" if so click continue, so now it is going ahead and changing permissions in some way but I am worried it will change them such that Ican't
    read that folder when I put in back my old machine.
    Anyway it is has just finished doing that and I can now access that drive whcih is OK as it has some disk utilities on it I go for earlier problems.

    But as I said my concern is whether my old machine will be able to read those files now the permissions have been changed.

    Anyhow I will have a read through your post now and get back,
    , Jun 8, 2014
    #3
  4. Guest

    On Sunday, June 8, 2014 6:18:13 PM UTC+1, wrote:
    > On Sunday, June 8, 2014 5:20:00 AM UTC+1, wrote:
    >
    > > OK to cut a long story short I have been having problems with a fairly new 3 terabyte external USB 3 drive. I could not get it to work on USB so Itook it out of the enclosure and tried it as a direct SATA connection. It did not wotk like that either, neither when I tried it on my old computer running XP, or Linux and just now on my new comp running win8.1.

    >
    > >

    >
    > > When I investigate it shows up as a drive, I can see the name with 3000in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >

    >
    > >

    >
    > >

    >
    > > I should add I discovered this after upgrading from win 8 to win 8.1 and I initially though it was the upgrades fault, but that seems to be a red herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > >

    >
    > >

    >
    > > So... what do I do?

    >
    > >

    >
    > >

    >
    > >

    >
    > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > >

    >
    > >

    >
    > > Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >

    >
    > >

    >
    > >

    >
    > > I think also have some stuff, quite a lot on my old computer, think there are some disk utilities on there from previous problems. Oh an they may be on the USB stick too.

    >
    > >

    >
    > >

    >
    > >

    >
    > > I am gonna have to get a new drive or two ASAP methinks though, will just get and internal one and try it in one of my enclosures but I am bit concerned about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > >

    >
    > >

    >
    > > Any ideas would be appreciated!!!

    >
    >
    >
    > Thanks Paul,
    >
    > I will have a look through that in detail later, not had time yet but just wanted to report I put my 500gb drive in USB3 enclosure and it loaded onto my new machine no problem so there is no problem reading that enclose. It's the drive.
    >
    >
    >
    > However I came across a permissions problem reading it and it said something like do you want to get access to this folder (my login folder in "documents and settings" if so click continue, so now it is going ahead and changing permissions in some way but I am worried it will change them such thatI can't
    >
    > read that folder when I put in back my old machine.
    >
    > Anyway it is has just finished doing that and I can now access that drivewhcih is OK as it has some disk utilities on it I go for earlier problems.
    >
    >
    >
    > But as I said my concern is whether my old machine will be able to read those files now the permissions have been changed.
    >
    >
    >
    > Anyhow I will have a read through your post now and get back,



    OK I had a problem when I put it back in the old machine but it is sorted now as aid in the thread on it.
    , Jun 8, 2014
    #4
  5. Guest

    On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:
    > wrote:
    >
    > > OK to cut a long story short I have been having problems with a fairly

    >
    > > new 3 terabyte external USB 3 drive. I could not get it to work on USB

    >
    > > so I took it out of the enclosure and tried it as a direct SATA connection.

    >
    > > It did not wotk like that either, neither when I tried it on my old

    >
    > > computer running XP, or Linux and just now on my new comp running win8.1.

    >
    > >

    >
    > > When I investigate it shows up as a drive, I can see the name with 3000

    >
    > > in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >

    >
    > > I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > > I initially though it was the upgrades fault, but that seems to be a red

    >
    > > herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > > So... what do I do?

    >
    > >

    >
    > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > > Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >

    >
    > > I think also have some stuff, quite a lot on my old computer, think there

    >
    > > are some disk utilities on there from previous problems. Oh an they maybe

    >
    > > on the USB stick too.

    >
    > >

    >
    > > I am gonna have to get a new drive or two ASAP methinks though, will just

    >
    > > get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > > about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > > Any ideas would be appreciated!!!

    >
    >
    >
    > There are two partitioning standards. The legacy MBR based
    >
    > method, and the newer GUID Partition Table or GPT.
    >
    >
    >
    > GPT is the standard that allows partitions larger than 2.2TB.
    >
    > To use the entire 3TB of drive capacity, requires some kind of
    >
    > trick if it is to work in WinXP as well as Windows 8.
    >
    >
    >
    > *******
    >
    >
    >
    > If we start with this article, even with GPT there is a "protective MBR".
    >
    > The MBR is loaded with a characteristic value, and that can hint at
    >
    > how the disk was prepared.
    >
    >
    >
    > http://en.wikipedia.org/wiki/GUID_Partition_Table
    >
    >
    >
    > "A single partition type of EE hex, encompassing the entire GPT drive
    >
    > (where "entire" actually means as much of the drive as can be
    >
    > represented in an MBR), is indicated and identifies it as GPT"
    >
    >
    >
    > So now we have a "hinting" mechanism available. If we see EE as the
    >
    > first and only partition in the MBR, then it was a GPT disk.
    >
    >
    >
    > This tool will display the MBR for you. PTEDIT32 used to be part of
    >
    > Partition Magic, but now that PM is no longer for sale, this particular
    >
    > tiny utility is free.
    >
    >
    >
    > ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip
    >
    >
    >
    > To run that in Windows 8, you want to right click it and "Run as Administrator".
    >
    > Running as administrator, is necessary to access the disk as a block device,
    >
    > and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.
    >
    >
    >
    > If the drive had conventional partitions, the partition type field would be 0x07
    >
    > or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker
    >
    > used by a GPT disk. So you can do a preliminary check with that.
    >
    >
    >
    > *******
    >
    >
    >
    > To scan a disk for file system headers, there is TestDisk.
    >
    >
    >
    > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
    >
    >
    >
    > It basically scans at a fixed pitch, so it doesn't necessarily have
    >
    > to read every sector on the disk, but it sometimes feels like it's
    >
    > reading the entire disk. It would take a long time to scan a 3TB drive.
    >
    >
    >
    > The main problem with TestDisk, is the interface. It's medieval.
    >
    > This makes it hard to work with the program. If you press control-C
    >
    > (which in Linux kills programs), you can exit the program if it is
    >
    > sitting waiting for a command from you. So you can "escape" if you
    >
    > don't like what it is about to do. Some menu levels don't have a
    >
    > "QUIT" option, and control-C is your substitute for that.
    >
    >
    >
    > You don't accept the partition table it prepares, without using your
    >
    > previous knowledge of what was on the disk. For example, if the tool
    >
    > tells you there are four partitions, when you know there is only
    >
    > actually one, then you cannot accept and write the new MBR value.
    >
    >
    >
    > Now, a useful function, is if it locates a partition, it offers an
    >
    > option to "view the files on the partition". If that is working, and
    >
    > you see file names, that is reassuring, and means your data is quite
    >
    > likely to still be there.
    >
    >
    >
    > TestDisk is available for Windows and Linux, so can be run from
    >
    > either environment.
    >
    >
    >
    > There are also scavenger applications such as Photorec (same site) or
    >
    > Recuva. At this point, I don't feel there is any reason to panic.
    >
    > If you thought the TestDisk scan takes a long time, running a
    >
    > scavenger on that big of a disk, would take "infinite" time.
    >
    >
    >
    > *******
    >
    >
    >
    > One thing I discovered, while playing with my 3TB drive, is Linux
    >
    > allows loopback mounting of partitions, with an offset parameter
    >
    > applied to the mount command. The offset parameter is a 64 bit number.
    >
    > And translating that into English, it means even if the MBR or GPT
    >
    > was broken, if you can find the sector with the "NTFS" identifier in
    >
    > the header, you can mount any arbitrary bitmap area of a disk, using
    >
    > the Linux mount command. Using the offset parameter, allows the user
    >
    > to surpass the 2.2TB limitation, and mount a partition which is above
    >
    > the 2.2TB mark. So if you could find the beginning of the partition,
    >
    > in fact Linux can mount it without a (valid) MBR being present. I
    >
    > thought that was pretty neat. The number there in hexidecimal, is
    >
    > 2.2TB plus 63 sectors. I just cooked up that number for illustration
    >
    > purposes, of a partition which is "up high". The /dev/sdb would be the
    >
    > 3TB drive. I would use mkdir /media/mymountpoint, to make a place to
    >
    > mount the disk (temporarily).
    >
    >
    >
    > sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint
    >
    >
    >
    > I used dd (with its own offset capability) to snapshot small chunks
    >
    > of bitmap. And a copy of hexdump, to print the ASCII equivalent of
    >
    > what is in that chunk. That's how I was able to verify what I was about
    >
    > to mount, and that the offset value I cooked up was correct. That's why
    >
    > the mount command worked on the first try - lots of planning ahead of
    >
    > time :) By snipping out pieces of disk drive with "dd" with an offset
    >
    > applied, it was like having a disk editor available. I could verify the
    >
    > "thing" at 0x10000002F said "NTFS". Which means issuing the mount
    >
    > request is going to work for me.
    >
    >
    >
    > When I got my 3TB, I used the free Acronis TIH that was available to
    >
    > use on it. Inside that program is a dialog called "Capacity Manager".
    >
    > And it installs a driver into your Windows OS. The driver causes a 3TB
    >
    > disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.
    >
    > You see two disk drives in Disk Management. This is a trick to get
    >
    > around the 32 bit sector number (2.2TB capacity) limit on the older
    >
    > OSes. With the same driver present in Windows 8, I can also see that
    >
    > "two drive split" while running Windows 8. So to suit the older OS (which
    >
    > doesn't have GPT), I ended up using the Acronis driver on both OSes.
    >
    > If I was using Win8 exclusively, I'd be using GPT instead, as it's
    >
    > simpler. Getting that Acronis stuff to work, causes some hair loss.
    >
    >
    >
    > It was after setting that up, and placing a partition in the area above
    >
    > 2.2TB, that I was testing the Linux mounting method. And I figured out
    >
    > with a hex calculator, what the offset should be for the file system
    >
    > header. I was able to mount the upper NTFS partition in Linux. The
    >
    > limitation I found with that, is the I/O speed using that method is
    >
    > only 10 to 15MB/sec, rather than the full disk speed. But if you're
    >
    > trying to retrieve files off that, that is the least of your
    >
    > concerns. Getting the data is what is important.
    >
    >
    >
    > So it is possible to get to your data, no matter where it is hiding
    >
    > on the disk.
    >
    >
    >
    > *******
    >
    >
    >
    > This is another option from Linux. The "disktype" program is available
    >
    > if you go to Package Manager and "turn on" all the available Repositories..
    >
    > You don't have to compile this for yourself. It's already built and on
    >
    > the distro server.
    >
    >
    >
    > http://disktype.sourceforge.net/
    >
    >
    >
    > Now, that can be pointed at say /dev/sda and asked for an
    >
    > opinion as to what is on the disk. It just takes the MBR or GPT
    >
    > info at face value.
    >
    >
    >
    > disktype /dev/sda
    >
    >
    >
    > And that should tell you how many partitions, what file system for
    >
    > each partition. in other words, if you haven't trashed the MBR,
    >
    > that program will reassure you by displaying all the particulars.
    >
    > That program can even be pointed at bitmap files (casper-rw for
    >
    > example), and tell you what file system is inside them.
    >
    >
    >
    > So that's a quick overview of some tools. Without attempting to
    >
    > reproduce any one of them in great detail. Just be careful with
    >
    > TestDisk, as if you write out an MBR, and the MBR is wrong, it
    >
    > could makes things a lot worse than they need to be. TestDisk
    >
    > can "show you the files" on a partition, so it does offer that
    >
    > reassurance. Most of the time, I don't accept what I get as
    >
    > a computed partition table, and use other techniques until
    >
    > I'm absolutely sure that I'm headed in the right direction.
    >
    >
    >
    > Any time you do repair or forensics on a disk, you need two
    >
    > spare disks. One spare disk, contains your sector by sector
    >
    > copy of the original (damaged) drive. The second drive, is
    >
    > the drive you use for the output of scavengers such as
    >
    > Photorec or Recuva. The reason for making the backup
    >
    > copy, is for situations where an in-place tool (such as CHKDSK)
    >
    > makes a horrible mess, instead of fixing something. At least
    >
    > with the scavengers, you point them to one of your spare disks,
    >
    > and the original disk is not being written upon. As long as
    >
    > you have that unblemished backup, you're safe to experiment.
    >
    >
    >
    > Paul


    Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did whenI put the only drive into the USB 3 enclosure.

    That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.

    Ideally I would like to work on the drive in my old machine as that has a lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a failed driveor one with errors. Plus I like to keep 'bad' stuff off my new machine.

    Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable. I will also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).

    I guess the easiest is to try the linux thing first I only need one SATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,
    , Jun 8, 2014
    #5
  6. Guest

    On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:
    > On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:
    >
    > > wrote:

    >
    > >

    >
    > > > OK to cut a long story short I have been having problems with a fairly

    >
    > >

    >
    > > > new 3 terabyte external USB 3 drive. I could not get it to work on USB

    >
    > >

    >
    > > > so I took it out of the enclosure and tried it as a direct SATA connection.

    >
    > >

    >
    > > > It did not wotk like that either, neither when I tried it on my old

    >
    > >

    >
    > > > computer running XP, or Linux and just now on my new comp running win8.1.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > When I investigate it shows up as a drive, I can see the name with 3000

    >
    > >

    >
    > > > in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > >

    >
    > > > I initially though it was the upgrades fault, but that seems to be a red

    >
    > >

    >
    > > > herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So... what do I do?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Nothing vitally important, I have some other backups on key documentson USB memory.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I think also have some stuff, quite a lot on my old computer, think there

    >
    > >

    >
    > > > are some disk utilities on there from previous problems. Oh an they may be

    >
    > >

    >
    > > > on the USB stick too.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I am gonna have to get a new drive or two ASAP methinks though, will just

    >
    > >

    >
    > > > get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > >

    >
    > > > about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Any ideas would be appreciated!!!

    >
    > >

    >
    > >

    >
    > >

    >
    > > There are two partitioning standards. The legacy MBR based

    >
    > >

    >
    > > method, and the newer GUID Partition Table or GPT.

    >
    > >

    >
    > >

    >
    > >

    >
    > > GPT is the standard that allows partitions larger than 2.2TB.

    >
    > >

    >
    > > To use the entire 3TB of drive capacity, requires some kind of

    >
    > >

    >
    > > trick if it is to work in WinXP as well as Windows 8.

    >
    > >

    >
    > >

    >
    > >

    >
    > > *******

    >
    > >

    >
    > >

    >
    > >

    >
    > > If we start with this article, even with GPT there is a "protective MBR".

    >
    > >

    >
    > > The MBR is loaded with a characteristic value, and that can hint at

    >
    > >

    >
    > > how the disk was prepared.

    >
    > >

    >
    > >

    >
    > >

    >
    > > http://en.wikipedia.org/wiki/GUID_Partition_Table

    >
    > >

    >
    > >

    >
    > >

    >
    > > "A single partition type of EE hex, encompassing the entire GPT drive

    >
    > >

    >
    > > (where "entire" actually means as much of the drive as can be

    >
    > >

    >
    > > represented in an MBR), is indicated and identifies it as GPT"

    >
    > >

    >
    > >

    >
    > >

    >
    > > So now we have a "hinting" mechanism available. If we see EE as the

    >
    > >

    >
    > > first and only partition in the MBR, then it was a GPT disk.

    >
    > >

    >
    > >

    >
    > >

    >
    > > This tool will display the MBR for you. PTEDIT32 used to be part of

    >
    > >

    >
    > > Partition Magic, but now that PM is no longer for sale, this particular

    >
    > >

    >
    > > tiny utility is free.

    >
    > >

    >
    > >

    >
    > >

    >
    > > ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    >
    > >

    >
    > >

    >
    > >

    >
    > > To run that in Windows 8, you want to right click it and "Run as Administrator".

    >
    > >

    >
    > > Running as administrator, is necessary to access the disk as a block device,

    >
    > >

    >
    > > and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.

    >
    > >

    >
    > >

    >
    > >

    >
    > > If the drive had conventional partitions, the partition type field would be 0x07

    >
    > >

    >
    > > or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker

    >
    > >

    >
    > > used by a GPT disk. So you can do a preliminary check with that.

    >
    > >

    >
    > >

    >
    > >

    >
    > > *******

    >
    > >

    >
    > >

    >
    > >

    >
    > > To scan a disk for file system headers, there is TestDisk.

    >
    > >

    >
    > >

    >
    > >

    >
    > > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    >
    > >

    >
    > >

    >
    > >

    >
    > > It basically scans at a fixed pitch, so it doesn't necessarily have

    >
    > >

    >
    > > to read every sector on the disk, but it sometimes feels like it's

    >
    > >

    >
    > > reading the entire disk. It would take a long time to scan a 3TB drive.

    >
    > >

    >
    > >

    >
    > >

    >
    > > The main problem with TestDisk, is the interface. It's medieval.

    >
    > >

    >
    > > This makes it hard to work with the program. If you press control-C

    >
    > >

    >
    > > (which in Linux kills programs), you can exit the program if it is

    >
    > >

    >
    > > sitting waiting for a command from you. So you can "escape" if you

    >
    > >

    >
    > > don't like what it is about to do. Some menu levels don't have a

    >
    > >

    >
    > > "QUIT" option, and control-C is your substitute for that.

    >
    > >

    >
    > >

    >
    > >

    >
    > > You don't accept the partition table it prepares, without using your

    >
    > >

    >
    > > previous knowledge of what was on the disk. For example, if the tool

    >
    > >

    >
    > > tells you there are four partitions, when you know there is only

    >
    > >

    >
    > > actually one, then you cannot accept and write the new MBR value.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Now, a useful function, is if it locates a partition, it offers an

    >
    > >

    >
    > > option to "view the files on the partition". If that is working, and

    >
    > >

    >
    > > you see file names, that is reassuring, and means your data is quite

    >
    > >

    >
    > > likely to still be there.

    >
    > >

    >
    > >

    >
    > >

    >
    > > TestDisk is available for Windows and Linux, so can be run from

    >
    > >

    >
    > > either environment.

    >
    > >

    >
    > >

    >
    > >

    >
    > > There are also scavenger applications such as Photorec (same site) or

    >
    > >

    >
    > > Recuva. At this point, I don't feel there is any reason to panic.

    >
    > >

    >
    > > If you thought the TestDisk scan takes a long time, running a

    >
    > >

    >
    > > scavenger on that big of a disk, would take "infinite" time.

    >
    > >

    >
    > >

    >
    > >

    >
    > > *******

    >
    > >

    >
    > >

    >
    > >

    >
    > > One thing I discovered, while playing with my 3TB drive, is Linux

    >
    > >

    >
    > > allows loopback mounting of partitions, with an offset parameter

    >
    > >

    >
    > > applied to the mount command. The offset parameter is a 64 bit number.

    >
    > >

    >
    > > And translating that into English, it means even if the MBR or GPT

    >
    > >

    >
    > > was broken, if you can find the sector with the "NTFS" identifier in

    >
    > >

    >
    > > the header, you can mount any arbitrary bitmap area of a disk, using

    >
    > >

    >
    > > the Linux mount command. Using the offset parameter, allows the user

    >
    > >

    >
    > > to surpass the 2.2TB limitation, and mount a partition which is above

    >
    > >

    >
    > > the 2.2TB mark. So if you could find the beginning of the partition,

    >
    > >

    >
    > > in fact Linux can mount it without a (valid) MBR being present. I

    >
    > >

    >
    > > thought that was pretty neat. The number there in hexidecimal, is

    >
    > >

    >
    > > 2.2TB plus 63 sectors. I just cooked up that number for illustration

    >
    > >

    >
    > > purposes, of a partition which is "up high". The /dev/sdb would be the

    >
    > >

    >
    > > 3TB drive. I would use mkdir /media/mymountpoint, to make a place to

    >
    > >

    >
    > > mount the disk (temporarily).

    >
    > >

    >
    > >

    >
    > >

    >
    > > sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    >
    > >

    >
    > >

    >
    > >

    >
    > > I used dd (with its own offset capability) to snapshot small chunks

    >
    > >

    >
    > > of bitmap. And a copy of hexdump, to print the ASCII equivalent of

    >
    > >

    >
    > > what is in that chunk. That's how I was able to verify what I was about

    >
    > >

    >
    > > to mount, and that the offset value I cooked up was correct. That's why

    >
    > >

    >
    > > the mount command worked on the first try - lots of planning ahead of

    >
    > >

    >
    > > time :) By snipping out pieces of disk drive with "dd" with an offset

    >
    > >

    >
    > > applied, it was like having a disk editor available. I could verify the

    >
    > >

    >
    > > "thing" at 0x10000002F said "NTFS". Which means issuing the mount

    >
    > >

    >
    > > request is going to work for me.

    >
    > >

    >
    > >

    >
    > >

    >
    > > When I got my 3TB, I used the free Acronis TIH that was available to

    >
    > >

    >
    > > use on it. Inside that program is a dialog called "Capacity Manager".

    >
    > >

    >
    > > And it installs a driver into your Windows OS. The driver causes a 3TB

    >
    > >

    >
    > > disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.

    >
    > >

    >
    > > You see two disk drives in Disk Management. This is a trick to get

    >
    > >

    >
    > > around the 32 bit sector number (2.2TB capacity) limit on the older

    >
    > >

    >
    > > OSes. With the same driver present in Windows 8, I can also see that

    >
    > >

    >
    > > "two drive split" while running Windows 8. So to suit the older OS (which

    >
    > >

    >
    > > doesn't have GPT), I ended up using the Acronis driver on both OSes.

    >
    > >

    >
    > > If I was using Win8 exclusively, I'd be using GPT instead, as it's

    >
    > >

    >
    > > simpler. Getting that Acronis stuff to work, causes some hair loss.

    >
    > >

    >
    > >

    >
    > >

    >
    > > It was after setting that up, and placing a partition in the area above

    >
    > >

    >
    > > 2.2TB, that I was testing the Linux mounting method. And I figured out

    >
    > >

    >
    > > with a hex calculator, what the offset should be for the file system

    >
    > >

    >
    > > header. I was able to mount the upper NTFS partition in Linux. The

    >
    > >

    >
    > > limitation I found with that, is the I/O speed using that method is

    >
    > >

    >
    > > only 10 to 15MB/sec, rather than the full disk speed. But if you're

    >
    > >

    >
    > > trying to retrieve files off that, that is the least of your

    >
    > >

    >
    > > concerns. Getting the data is what is important.

    >
    > >

    >
    > >

    >
    > >

    >
    > > So it is possible to get to your data, no matter where it is hiding

    >
    > >

    >
    > > on the disk.

    >
    > >

    >
    > >

    >
    > >

    >
    > > *******

    >
    > >

    >
    > >

    >
    > >

    >
    > > This is another option from Linux. The "disktype" program is available

    >
    > >

    >
    > > if you go to Package Manager and "turn on" all the available Repositories.

    >
    > >

    >
    > > You don't have to compile this for yourself. It's already built and on

    >
    > >

    >
    > > the distro server.

    >
    > >

    >
    > >

    >
    > >

    >
    > > http://disktype.sourceforge.net/

    >
    > >

    >
    > >

    >
    > >

    >
    > > Now, that can be pointed at say /dev/sda and asked for an

    >
    > >

    >
    > > opinion as to what is on the disk. It just takes the MBR or GPT

    >
    > >

    >
    > > info at face value.

    >
    > >

    >
    > >

    >
    > >

    >
    > > disktype /dev/sda

    >
    > >

    >
    > >

    >
    > >

    >
    > > And that should tell you how many partitions, what file system for

    >
    > >

    >
    > > each partition. in other words, if you haven't trashed the MBR,

    >
    > >

    >
    > > that program will reassure you by displaying all the particulars.

    >
    > >

    >
    > > That program can even be pointed at bitmap files (casper-rw for

    >
    > >

    >
    > > example), and tell you what file system is inside them.

    >
    > >

    >
    > >

    >
    > >

    >
    > > So that's a quick overview of some tools. Without attempting to

    >
    > >

    >
    > > reproduce any one of them in great detail. Just be careful with

    >
    > >

    >
    > > TestDisk, as if you write out an MBR, and the MBR is wrong, it

    >
    > >

    >
    > > could makes things a lot worse than they need to be. TestDisk

    >
    > >

    >
    > > can "show you the files" on a partition, so it does offer that

    >
    > >

    >
    > > reassurance. Most of the time, I don't accept what I get as

    >
    > >

    >
    > > a computed partition table, and use other techniques until

    >
    > >

    >
    > > I'm absolutely sure that I'm headed in the right direction.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Any time you do repair or forensics on a disk, you need two

    >
    > >

    >
    > > spare disks. One spare disk, contains your sector by sector

    >
    > >

    >
    > > copy of the original (damaged) drive. The second drive, is

    >
    > >

    >
    > > the drive you use for the output of scavengers such as

    >
    > >

    >
    > > Photorec or Recuva. The reason for making the backup

    >
    > >

    >
    > > copy, is for situations where an in-place tool (such as CHKDSK)

    >
    > >

    >
    > > makes a horrible mess, instead of fixing something. At least

    >
    > >

    >
    > > with the scavengers, you point them to one of your spare disks,

    >
    > >

    >
    > > and the original disk is not being written upon. As long as

    >
    > >

    >
    > > you have that unblemished backup, you're safe to experiment.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Paul

    >
    >
    >
    > Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.
    >
    >
    >
    > That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.
    >
    >
    >
    > Ideally I would like to work on the drive in my old machine as that has alot of drive utility stuff I downloaded when you helped me with a previousproblem, I can't remember exactly what it was now exactly but a failed drive or one with errors. Plus I like to keep 'bad' stuff off my new machine.
    >
    >
    >
    > Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable. I will also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).
    >
    >
    >
    > I guess the easiest is to try the linux thing first I only need one SATA cable for that however I am not used to working in Linux much. It's on a CDso I don't think I can build anything,


    Right I have booted to LINUX and the drive does not show on the desktop butI went into something called disc utility and I see it there.

    Here is what it says:

    Unknown 375GB


    Usage - (blank) device /dev/sda1


    partition type HPFS/NTFS(0x07) capacity 375GB


    Then there is also the free space 2.6TB

    Usage - unallocated space devide /dev/sda

    partition type - capacity 2.6GB


    Also Smart status - the disc has a few bad sectors.

    I'm gonna run a smart test now.
    , Jun 8, 2014
    #6
  7. Guest

    On Sunday, June 8, 2014 11:20:58 PM UTC+1, wrote:
    > On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:
    >
    > > On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:

    >
    > >

    >
    > > > wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > OK to cut a long story short I have been having problems with a fairly

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > new 3 terabyte external USB 3 drive. I could not get it to work on USB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > so I took it out of the enclosure and tried it as a direct SATA connection.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > It did not wotk like that either, neither when I tried it on my old

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > computer running XP, or Linux and just now on my new comp running win8.1.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > When I investigate it shows up as a drive, I can see the name with 3000

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I initially though it was the upgrades fault, but that seems to be a red

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > So... what do I do?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I think also have some stuff, quite a lot on my old computer, thinkthere

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > are some disk utilities on there from previous problems. Oh an theymay be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > on the USB stick too.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I am gonna have to get a new drive or two ASAP methinks though, will just

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Any ideas would be appreciated!!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > There are two partitioning standards. The legacy MBR based

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > method, and the newer GUID Partition Table or GPT.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > GPT is the standard that allows partitions larger than 2.2TB.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > To use the entire 3TB of drive capacity, requires some kind of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > trick if it is to work in WinXP as well as Windows 8.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > If we start with this article, even with GPT there is a "protective MBR".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > The MBR is loaded with a characteristic value, and that can hint at

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > how the disk was prepared.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > http://en.wikipedia.org/wiki/GUID_Partition_Table

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > "A single partition type of EE hex, encompassing the entire GPT drive

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > (where "entire" actually means as much of the drive as can be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > represented in an MBR), is indicated and identifies it as GPT"

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So now we have a "hinting" mechanism available. If we see EE as the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > first and only partition in the MBR, then it was a GPT disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > This tool will display the MBR for you. PTEDIT32 used to be part of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Partition Magic, but now that PM is no longer for sale, this particular

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > tiny utility is free.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > To run that in Windows 8, you want to right click it and "Run as Administrator".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Running as administrator, is necessary to access the disk as a block device,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > If the drive had conventional partitions, the partition type field would be 0x07

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > or 0x0C for NTFS or FAT32. In other words, values other than the 0xEEmarker

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > used by a GPT disk. So you can do a preliminary check with that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > To scan a disk for file system headers, there is TestDisk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > It basically scans at a fixed pitch, so it doesn't necessarily have

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > to read every sector on the disk, but it sometimes feels like it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > reading the entire disk. It would take a long time to scan a 3TB drive.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > The main problem with TestDisk, is the interface. It's medieval.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > This makes it hard to work with the program. If you press control-C

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > (which in Linux kills programs), you can exit the program if it is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > sitting waiting for a command from you. So you can "escape" if you

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > don't like what it is about to do. Some menu levels don't have a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > "QUIT" option, and control-C is your substitute for that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > You don't accept the partition table it prepares, without using your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > previous knowledge of what was on the disk. For example, if the tool

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > tells you there are four partitions, when you know there is only

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > actually one, then you cannot accept and write the new MBR value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Now, a useful function, is if it locates a partition, it offers an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > option to "view the files on the partition". If that is working, and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > you see file names, that is reassuring, and means your data is quite

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > likely to still be there.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > TestDisk is available for Windows and Linux, so can be run from

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > either environment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > There are also scavenger applications such as Photorec (same site) or

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Recuva. At this point, I don't feel there is any reason to panic.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > If you thought the TestDisk scan takes a long time, running a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > scavenger on that big of a disk, would take "infinite" time.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > One thing I discovered, while playing with my 3TB drive, is Linux

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > allows loopback mounting of partitions, with an offset parameter

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > applied to the mount command. The offset parameter is a 64 bit number..

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > And translating that into English, it means even if the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > was broken, if you can find the sector with the "NTFS" identifier in

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the header, you can mount any arbitrary bitmap area of a disk, using

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the Linux mount command. Using the offset parameter, allows the user

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > to surpass the 2.2TB limitation, and mount a partition which is above

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the 2.2TB mark. So if you could find the beginning of the partition,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > in fact Linux can mount it without a (valid) MBR being present. I

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > thought that was pretty neat. The number there in hexidecimal, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > 2.2TB plus 63 sectors. I just cooked up that number for illustration

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > purposes, of a partition which is "up high". The /dev/sdb would be the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > 3TB drive. I would use mkdir /media/mymountpoint, to make a place to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > mount the disk (temporarily).

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I used dd (with its own offset capability) to snapshot small chunks

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > of bitmap. And a copy of hexdump, to print the ASCII equivalent of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > what is in that chunk. That's how I was able to verify what I was about

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > to mount, and that the offset value I cooked up was correct. That's why

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the mount command worked on the first try - lots of planning ahead of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > time :) By snipping out pieces of disk drive with "dd" with an offset

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > applied, it was like having a disk editor available. I could verify the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > "thing" at 0x10000002F said "NTFS". Which means issuing the mount

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > request is going to work for me.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > When I got my 3TB, I used the free Acronis TIH that was available to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > use on it. Inside that program is a dialog called "Capacity Manager".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > And it installs a driver into your Windows OS. The driver causes a 3TB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > You see two disk drives in Disk Management. This is a trick to get

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > around the 32 bit sector number (2.2TB capacity) limit on the older

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > OSes. With the same driver present in Windows 8, I can also see that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > "two drive split" while running Windows 8. So to suit the older OS (which

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > doesn't have GPT), I ended up using the Acronis driver on both OSes.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > If I was using Win8 exclusively, I'd be using GPT instead, as it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > simpler. Getting that Acronis stuff to work, causes some hair loss.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > It was after setting that up, and placing a partition in the area above

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > 2.2TB, that I was testing the Linux mounting method. And I figured out

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > with a hex calculator, what the offset should be for the file system

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > header. I was able to mount the upper NTFS partition in Linux. The

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > limitation I found with that, is the I/O speed using that method is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > only 10 to 15MB/sec, rather than the full disk speed. But if you're

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > trying to retrieve files off that, that is the least of your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > concerns. Getting the data is what is important.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So it is possible to get to your data, no matter where it is hiding

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > on the disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > This is another option from Linux. The "disktype" program is available

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > if you go to Package Manager and "turn on" all the available Repositories.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > You don't have to compile this for yourself. It's already built and on

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the distro server.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > http://disktype.sourceforge.net/

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Now, that can be pointed at say /dev/sda and asked for an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > opinion as to what is on the disk. It just takes the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > info at face value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > disktype /dev/sda

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > And that should tell you how many partitions, what file system for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > each partition. in other words, if you haven't trashed the MBR,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > that program will reassure you by displaying all the particulars.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > That program can even be pointed at bitmap files (casper-rw for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > example), and tell you what file system is inside them.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So that's a quick overview of some tools. Without attempting to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > reproduce any one of them in great detail. Just be careful with

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > TestDisk, as if you write out an MBR, and the MBR is wrong, it

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > could makes things a lot worse than they need to be. TestDisk

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > can "show you the files" on a partition, so it does offer that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > reassurance. Most of the time, I don't accept what I get as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > a computed partition table, and use other techniques until

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I'm absolutely sure that I'm headed in the right direction.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Any time you do repair or forensics on a disk, you need two

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > spare disks. One spare disk, contains your sector by sector

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > copy of the original (damaged) drive. The second drive, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > the drive you use for the output of scavengers such as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Photorec or Recuva. The reason for making the backup

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > copy, is for situations where an in-place tool (such as CHKDSK)

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > makes a horrible mess, instead of fixing something. At least

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > with the scavengers, you point them to one of your spare disks,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > and the original disk is not being written upon. As long as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > you have that unblemished backup, you're safe to experiment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Paul

    >
    > >

    >
    > >

    >
    > >

    >
    > > Thanks Paul there is a lot of info in there a lot of which goes over myhead but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.

    >
    > >

    >
    > >

    >
    > >

    >
    > > That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Ideally I would like to work on the drive in my old machine as that hasa lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a failed drive or one with errors. Plus I like to keep 'bad' stuff off my new machine..

    >
    > >

    >
    > >

    >
    > >

    >
    > > Trouble is one of the SATA cables is really dodgy, I really should waittill tomorrow (but will be too impatient to) so I can get a new cable. I will also have to buy anther drive I think or probably two as I have nothingto back up onto now. (apart form from USB memory sticks).

    >
    > >

    >
    > >

    >
    > >

    >
    > > I guess the easiest is to try the linux thing first I only need one SATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,

    >
    >
    >
    > Right I have booted to LINUX and the drive does not show on the desktop but I went into something called disc utility and I see it there.
    >
    >
    >
    > Here is what it says:
    >
    >
    >
    > Unknown 375GB
    >
    >
    >
    >
    >
    > Usage - (blank) device /dev/sda1
    >
    >
    >
    >
    >
    > partition type HPFS/NTFS(0x07) capacity 375GB
    >
    >
    >
    >
    >
    > Then there is also the free space 2.6TB
    >
    >
    >
    > Usage - unallocated space devide /dev/sda
    >
    >
    >
    > partition type - capacity 2.6GB
    >
    >
    >
    >
    >
    > Also Smart status - the disc has a few bad sectors.
    >
    >
    >
    > I'm gonna run a smart test now.




    OK I ran something to see the smart data, two things marked out in red:-


    190 - Airflow Temperature Assessment - failed in the past.
    Value normalised 65
    Worst 39
    threshold 46
    values 35C

    Kind of hard to understand..

    Also

    197 Current Pending Sector Count

    The number of sector waiting to be remapped. If the sector waiting to be remapped is subsequently written or read successfully the value is decreased and the sector is not remapped. Read errors on the sector will not remap the sector, it will only be remapped on a failed write processed.

    Assessment Warning.

    Values

    Normalised 98
    worst 98
    threshold 0
    Value 424 sectors.

    Just tried to run a self test, short test, 10 mins but immediately it came up in red
    Self tests FAILED (read)

    So all the tests come up FAILED (read).


    So it seems it can't read the drive, so I guess the smart data is not storeon the drive itself?

    I also tried to run a read benchmark but it said an error occurred the device is busy
    , Jun 8, 2014
    #7
  8. Guest

    On Sunday, June 8, 2014 11:38:58 PM UTC+1, wrote:
    > On Sunday, June 8, 2014 11:20:58 PM UTC+1, wrote:
    >
    > > On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:

    >
    > >

    >
    > > > On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > OK to cut a long story short I have been having problems with a fairly

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > new 3 terabyte external USB 3 drive. I could not get it to work on USB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > so I took it out of the enclosure and tried it as a direct SATA connection.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > It did not wotk like that either, neither when I tried it on my old

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > computer running XP, or Linux and just now on my new comp runningwin8.1.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > When I investigate it shows up as a drive, I can see the name with 3000

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I initially though it was the upgrades fault, but that seems to be a red

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > So... what do I do?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I think also have some stuff, quite a lot on my old computer, think there

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > are some disk utilities on there from previous problems. Oh an they may be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > on the USB stick too.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I am gonna have to get a new drive or two ASAP methinks though, will just

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Any ideas would be appreciated!!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > There are two partitioning standards. The legacy MBR based

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > method, and the newer GUID Partition Table or GPT.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > GPT is the standard that allows partitions larger than 2.2TB.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > To use the entire 3TB of drive capacity, requires some kind of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > trick if it is to work in WinXP as well as Windows 8.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > If we start with this article, even with GPT there is a "protectiveMBR".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > The MBR is loaded with a characteristic value, and that can hint at

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > how the disk was prepared.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > http://en.wikipedia.org/wiki/GUID_Partition_Table

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > "A single partition type of EE hex, encompassing the entire GPTdrive

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > (where "entire" actually means as much of the drive as can be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > represented in an MBR), is indicated and identifies it as GPT"

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > So now we have a "hinting" mechanism available. If we see EE as the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > first and only partition in the MBR, then it was a GPT disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > This tool will display the MBR for you. PTEDIT32 used to be part of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Partition Magic, but now that PM is no longer for sale, this particular

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > tiny utility is free.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > To run that in Windows 8, you want to right click it and "Run as Administrator".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Running as administrator, is necessary to access the disk as a block device,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > If the drive had conventional partitions, the partition type field would be 0x07

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > used by a GPT disk. So you can do a preliminary check with that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > To scan a disk for file system headers, there is TestDisk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > It basically scans at a fixed pitch, so it doesn't necessarily have

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > to read every sector on the disk, but it sometimes feels like it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > reading the entire disk. It would take a long time to scan a 3TB drive.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > The main problem with TestDisk, is the interface. It's medieval.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > This makes it hard to work with the program. If you press control-C

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > (which in Linux kills programs), you can exit the program if it is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > sitting waiting for a command from you. So you can "escape" if you

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > don't like what it is about to do. Some menu levels don't have a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > "QUIT" option, and control-C is your substitute for that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > You don't accept the partition table it prepares, without using your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > previous knowledge of what was on the disk. For example, if the tool

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > tells you there are four partitions, when you know there is only

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > actually one, then you cannot accept and write the new MBR value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Now, a useful function, is if it locates a partition, it offers an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > option to "view the files on the partition". If that is working, and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > you see file names, that is reassuring, and means your data is quite

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > likely to still be there.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > TestDisk is available for Windows and Linux, so can be run from

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > either environment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > There are also scavenger applications such as Photorec (same site) or

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Recuva. At this point, I don't feel there is any reason to panic.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > If you thought the TestDisk scan takes a long time, running a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > scavenger on that big of a disk, would take "infinite" time.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > One thing I discovered, while playing with my 3TB drive, is Linux

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > allows loopback mounting of partitions, with an offset parameter

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > applied to the mount command. The offset parameter is a 64 bit number.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > And translating that into English, it means even if the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > was broken, if you can find the sector with the "NTFS" identifier in

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the header, you can mount any arbitrary bitmap area of a disk, using

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the Linux mount command. Using the offset parameter, allows the user

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > to surpass the 2.2TB limitation, and mount a partition which is above

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the 2.2TB mark. So if you could find the beginning of the partition,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > in fact Linux can mount it without a (valid) MBR being present. I

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > thought that was pretty neat. The number there in hexidecimal, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > 2.2TB plus 63 sectors. I just cooked up that number for illustration

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > purposes, of a partition which is "up high". The /dev/sdb would be the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > 3TB drive. I would use mkdir /media/mymountpoint, to make a place to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > mount the disk (temporarily).

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I used dd (with its own offset capability) to snapshot small chunks

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > of bitmap. And a copy of hexdump, to print the ASCII equivalent of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > what is in that chunk. That's how I was able to verify what I was about

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > to mount, and that the offset value I cooked up was correct. That'swhy

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the mount command worked on the first try - lots of planning ahead of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > time :) By snipping out pieces of disk drive with "dd" with an offset

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > applied, it was like having a disk editor available. I could verifythe

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > "thing" at 0x10000002F said "NTFS". Which means issuing the mount

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > request is going to work for me.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > When I got my 3TB, I used the free Acronis TIH that was available to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > use on it. Inside that program is a dialog called "Capacity Manager".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > And it installs a driver into your Windows OS. The driver causes a 3TB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > You see two disk drives in Disk Management. This is a trick to get

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > around the 32 bit sector number (2.2TB capacity) limit on the older

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > OSes. With the same driver present in Windows 8, I can also see that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > "two drive split" while running Windows 8. So to suit the older OS (which

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > doesn't have GPT), I ended up using the Acronis driver on both OSes..

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > If I was using Win8 exclusively, I'd be using GPT instead, as it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > simpler. Getting that Acronis stuff to work, causes some hair loss.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > It was after setting that up, and placing a partition in the area above

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > 2.2TB, that I was testing the Linux mounting method. And I figured out

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > with a hex calculator, what the offset should be for the file system

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > header. I was able to mount the upper NTFS partition in Linux. The

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > limitation I found with that, is the I/O speed using that method is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > only 10 to 15MB/sec, rather than the full disk speed. But if you're

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > trying to retrieve files off that, that is the least of your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > concerns. Getting the data is what is important.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > So it is possible to get to your data, no matter where it is hiding

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > on the disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > This is another option from Linux. The "disktype" program is available

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > if you go to Package Manager and "turn on" all the available Repositories.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > You don't have to compile this for yourself. It's already built andon

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the distro server.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > http://disktype.sourceforge.net/

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Now, that can be pointed at say /dev/sda and asked for an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > opinion as to what is on the disk. It just takes the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > info at face value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > disktype /dev/sda

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > And that should tell you how many partitions, what file system for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > each partition. in other words, if you haven't trashed the MBR,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > that program will reassure you by displaying all the particulars.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > That program can even be pointed at bitmap files (casper-rw for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > example), and tell you what file system is inside them.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > So that's a quick overview of some tools. Without attempting to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > reproduce any one of them in great detail. Just be careful with

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > TestDisk, as if you write out an MBR, and the MBR is wrong, it

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > could makes things a lot worse than they need to be. TestDisk

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > can "show you the files" on a partition, so it does offer that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > reassurance. Most of the time, I don't accept what I get as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > a computed partition table, and use other techniques until

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I'm absolutely sure that I'm headed in the right direction.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Any time you do repair or forensics on a disk, you need two

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > spare disks. One spare disk, contains your sector by sector

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > copy of the original (damaged) drive. The second drive, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > the drive you use for the output of scavengers such as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Photorec or Recuva. The reason for making the backup

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > copy, is for situations where an in-place tool (such as CHKDSK)

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > makes a horrible mess, instead of fixing something. At least

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > with the scavengers, you point them to one of your spare disks,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > and the original disk is not being written upon. As long as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > you have that unblemished backup, you're safe to experiment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Paul

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Ideally I would like to work on the drive in my old machine as that has a lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a faileddrive or one with errors. Plus I like to keep 'bad' stuff off my new machine.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable. Iwill also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I guess the easiest is to try the linux thing first I only need one SATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,

    >
    > >

    >
    > >

    >
    > >

    >
    > > Right I have booted to LINUX and the drive does not show on the desktopbut I went into something called disc utility and I see it there.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Here is what it says:

    >
    > >

    >
    > >

    >
    > >

    >
    > > Unknown 375GB

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > Usage - (blank) device /dev/sda1

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > partition type HPFS/NTFS(0x07) capacity 375GB

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > Then there is also the free space 2.6TB

    >
    > >

    >
    > >

    >
    > >

    >
    > > Usage - unallocated space devide /dev/sda

    >
    > >

    >
    > >

    >
    > >

    >
    > > partition type - capacity 2.6GB

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > Also Smart status - the disc has a few bad sectors.

    >
    > >

    >
    > >

    >
    > >

    >
    > > I'm gonna run a smart test now.

    >
    >
    >
    >
    >
    >
    >
    > OK I ran something to see the smart data, two things marked out in red:-
    >
    >
    >
    >
    >
    > 190 - Airflow Temperature Assessment - failed in the past.
    >
    > Value normalised 65
    >
    > Worst 39
    >
    > threshold 46
    >
    > values 35C
    >
    >
    >
    > Kind of hard to understand..
    >
    >
    >
    > Also
    >
    >
    >
    > 197 Current Pending Sector Count
    >
    >
    >
    > The number of sector waiting to be remapped. If the sector waiting to be remapped is subsequently written or read successfully the value is decreased and the sector is not remapped. Read errors on the sector will not remap the sector, it will only be remapped on a failed write processed.
    >
    >
    >
    > Assessment Warning.
    >
    >
    >
    > Values
    >
    >
    >
    > Normalised 98
    >
    > worst 98
    >
    > threshold 0
    >
    > Value 424 sectors.
    >
    >
    >
    > Just tried to run a self test, short test, 10 mins but immediately it came up in red
    >
    > Self tests FAILED (read)
    >
    >
    >
    > So all the tests come up FAILED (read).
    >
    >
    >
    >
    >
    > So it seems it can't read the drive, so I guess the smart data is not store on the drive itself?
    >
    >
    >
    > I also tried to run a read benchmark but it said an error occurred the device is busy



    Also tried few things I picked up the drive and turned it over and could feel it spinning, I also heard a screeching sound, this is the heads crashing I think? heard that a few times before.

    One point is it is a fast spinning drive, I guess that means hotter so fat may be bad for reliability..

    So just wondering what all that means, mechanical probs with drive?

    By the way the current pending sector count has gone up to 448 from 424, nosurprise there I guess.
    , Jun 8, 2014
    #8
  9. Guest

    On Sunday, June 8, 2014 11:59:11 PM UTC+1, wrote:
    > On Sunday, June 8, 2014 11:38:58 PM UTC+1, wrote:
    >
    > > On Sunday, June 8, 2014 11:20:58 PM UTC+1, wrote:

    >
    > >

    >
    > > > On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > OK to cut a long story short I have been having problems with afairly

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > new 3 terabyte external USB 3 drive. I could not get it to workon USB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > so I took it out of the enclosure and tried it as a direct SATAconnection.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > It did not wotk like that either, neither when I tried it on myold

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > computer running XP, or Linux and just now on my new comp running win8.1.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > When I investigate it shows up as a drive, I can see the name with 3000

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > in it for 3 terabytes but when I look at properties it says "nofile system".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > I initially though it was the upgrades fault, but that seems tobe a red

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > herring unless the upgrade wiped out the file system.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > So... what do I do?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > Is there something I can used to recover the data? Or at least try to?

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > I think also have some stuff, quite a lot on my old computer, think there

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > are some disk utilities on there from previous problems. Oh an they may be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > on the USB stick too.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > I am gonna have to get a new drive or two ASAP methinks though,will just

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > about putting a drive in the one the failed drive was in when it happened!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > > Any ideas would be appreciated!!!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > There are two partitioning standards. The legacy MBR based

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > method, and the newer GUID Partition Table or GPT.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > GPT is the standard that allows partitions larger than 2.2TB.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > To use the entire 3TB of drive capacity, requires some kind of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > trick if it is to work in WinXP as well as Windows 8.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > If we start with this article, even with GPT there is a "protective MBR".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > The MBR is loaded with a characteristic value, and that can hint at

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > how the disk was prepared.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > http://en.wikipedia.org/wiki/GUID_Partition_Table

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > "A single partition type of EE hex, encompassing the entire GPT drive

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > (where "entire" actually means as much of the drive as can be

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > represented in an MBR), is indicated and identifies it as GPT"

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > So now we have a "hinting" mechanism available. If we see EE as the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > first and only partition in the MBR, then it was a GPT disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > This tool will display the MBR for you. PTEDIT32 used to be part of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Partition Magic, but now that PM is no longer for sale, this particular

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > tiny utility is free.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > To run that in Windows 8, you want to right click it and "Run as Administrator".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Running as administrator, is necessary to access the disk as a block device,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > and read sector 0. If you're not the Admin, you get "Error 5" dueto Access Denied.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > If the drive had conventional partitions, the partition type field would be 0x07

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > used by a GPT disk. So you can do a preliminary check with that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > To scan a disk for file system headers, there is TestDisk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > It basically scans at a fixed pitch, so it doesn't necessarily have

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > to read every sector on the disk, but it sometimes feels like it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > reading the entire disk. It would take a long time to scan a 3TB drive.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > The main problem with TestDisk, is the interface. It's medieval.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > This makes it hard to work with the program. If you press control-C

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > (which in Linux kills programs), you can exit the program if it is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > sitting waiting for a command from you. So you can "escape" if you

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > don't like what it is about to do. Some menu levels don't have a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > "QUIT" option, and control-C is your substitute for that.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > You don't accept the partition table it prepares, without using your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > previous knowledge of what was on the disk. For example, if the tool

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > tells you there are four partitions, when you know there is only

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > actually one, then you cannot accept and write the new MBR value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Now, a useful function, is if it locates a partition, it offers an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > option to "view the files on the partition". If that is working, and

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > you see file names, that is reassuring, and means your data is quite

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > likely to still be there.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > TestDisk is available for Windows and Linux, so can be run from

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > either environment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > There are also scavenger applications such as Photorec (same site) or

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Recuva. At this point, I don't feel there is any reason to panic.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > If you thought the TestDisk scan takes a long time, running a

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > scavenger on that big of a disk, would take "infinite" time.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > One thing I discovered, while playing with my 3TB drive, is Linux

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > allows loopback mounting of partitions, with an offset parameter

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > applied to the mount command. The offset parameter is a 64 bit number.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > And translating that into English, it means even if the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > was broken, if you can find the sector with the "NTFS" identifierin

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the header, you can mount any arbitrary bitmap area of a disk, using

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the Linux mount command. Using the offset parameter, allows the user

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > to surpass the 2.2TB limitation, and mount a partition which is above

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the 2.2TB mark. So if you could find the beginning of the partition,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > in fact Linux can mount it without a (valid) MBR being present. I

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > thought that was pretty neat. The number there in hexidecimal, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > 2.2TB plus 63 sectors. I just cooked up that number for illustration

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > purposes, of a partition which is "up high". The /dev/sdb would be the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > 3TB drive. I would use mkdir /media/mymountpoint, to make a placeto

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > mount the disk (temporarily).

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I used dd (with its own offset capability) to snapshot small chunks

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > of bitmap. And a copy of hexdump, to print the ASCII equivalent of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > what is in that chunk. That's how I was able to verify what I wasabout

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > to mount, and that the offset value I cooked up was correct. That's why

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the mount command worked on the first try - lots of planning ahead of

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > time :) By snipping out pieces of disk drive with "dd" with an offset

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > applied, it was like having a disk editor available. I could verify the

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > "thing" at 0x10000002F said "NTFS". Which means issuing the mount

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > request is going to work for me.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > When I got my 3TB, I used the free Acronis TIH that was availableto

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > use on it. Inside that program is a dialog called "Capacity Manager".

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > And it installs a driver into your Windows OS. The driver causes a 3TB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > disk, to be split into a 2.2TB physical disk, and a 0.8TB virtualdisk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > You see two disk drives in Disk Management. This is a trick to get

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > around the 32 bit sector number (2.2TB capacity) limit on the older

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > OSes. With the same driver present in Windows 8, I can also see that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > "two drive split" while running Windows 8. So to suit the older OS (which

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > doesn't have GPT), I ended up using the Acronis driver on both OSes.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > If I was using Win8 exclusively, I'd be using GPT instead, as it's

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > simpler. Getting that Acronis stuff to work, causes some hair loss.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > It was after setting that up, and placing a partition in the areaabove

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > 2.2TB, that I was testing the Linux mounting method. And I figured out

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > with a hex calculator, what the offset should be for the file system

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > header. I was able to mount the upper NTFS partition in Linux. The

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > limitation I found with that, is the I/O speed using that method is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > only 10 to 15MB/sec, rather than the full disk speed. But if you're

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > trying to retrieve files off that, that is the least of your

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > concerns. Getting the data is what is important.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > So it is possible to get to your data, no matter where it is hiding

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > on the disk.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > *******

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > This is another option from Linux. The "disktype" program is available

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > if you go to Package Manager and "turn on" all the available Repositories.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > You don't have to compile this for yourself. It's already built and on

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the distro server.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > http://disktype.sourceforge.net/

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Now, that can be pointed at say /dev/sda and asked for an

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > opinion as to what is on the disk. It just takes the MBR or GPT

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > info at face value.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > disktype /dev/sda

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > And that should tell you how many partitions, what file system for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > each partition. in other words, if you haven't trashed the MBR,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > that program will reassure you by displaying all the particulars.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > That program can even be pointed at bitmap files (casper-rw for

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > example), and tell you what file system is inside them.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > So that's a quick overview of some tools. Without attempting to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > reproduce any one of them in great detail. Just be careful with

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > TestDisk, as if you write out an MBR, and the MBR is wrong, it

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > could makes things a lot worse than they need to be. TestDisk

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > can "show you the files" on a partition, so it does offer that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > reassurance. Most of the time, I don't accept what I get as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > a computed partition table, and use other techniques until

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > I'm absolutely sure that I'm headed in the right direction.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Any time you do repair or forensics on a disk, you need two

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > spare disks. One spare disk, contains your sector by sector

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > copy of the original (damaged) drive. The second drive, is

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > the drive you use for the output of scavengers such as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Photorec or Recuva. The reason for making the backup

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > copy, is for situations where an in-place tool (such as CHKDSK)

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > makes a horrible mess, instead of fixing something. At least

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > with the scavengers, you point them to one of your spare disks,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > and the original disk is not being written upon. As long as

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > you have that unblemished backup, you're safe to experiment.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > > Paul

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Ideally I would like to work on the drive in my old machine as thathas a lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a failed drive or one with errors. Plus I like to keep 'bad' stuff off my new machine.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable.I will also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I guess the easiest is to try the linux thing first I only need oneSATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Right I have booted to LINUX and the drive does not show on the desktop but I went into something called disc utility and I see it there.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Here is what it says:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Unknown 375GB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Usage - (blank) device /dev/sda1

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > partition type HPFS/NTFS(0x07) capacity 375GB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Then there is also the free space 2.6TB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Usage - unallocated space devide /dev/sda

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > partition type - capacity 2.6GB

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Also Smart status - the disc has a few bad sectors.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I'm gonna run a smart test now.

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > OK I ran something to see the smart data, two things marked out in red:-

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > 190 - Airflow Temperature Assessment - failed in the past.

    >
    > >

    >
    > > Value normalised 65

    >
    > >

    >
    > > Worst 39

    >
    > >

    >
    > > threshold 46

    >
    > >

    >
    > > values 35C

    >
    > >

    >
    > >

    >
    > >

    >
    > > Kind of hard to understand..

    >
    > >

    >
    > >

    >
    > >

    >
    > > Also

    >
    > >

    >
    > >

    >
    > >

    >
    > > 197 Current Pending Sector Count

    >
    > >

    >
    > >

    >
    > >

    >
    > > The number of sector waiting to be remapped. If the sector waiting to be remapped is subsequently written or read successfully the value is decreased and the sector is not remapped. Read errors on the sector will not remap the sector, it will only be remapped on a failed write processed.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Assessment Warning.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Values

    >
    > >

    >
    > >

    >
    > >

    >
    > > Normalised 98

    >
    > >

    >
    > > worst 98

    >
    > >

    >
    > > threshold 0

    >
    > >

    >
    > > Value 424 sectors.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Just tried to run a self test, short test, 10 mins but immediately it came up in red

    >
    > >

    >
    > > Self tests FAILED (read)

    >
    > >

    >
    > >

    >
    > >

    >
    > > So all the tests come up FAILED (read).

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > So it seems it can't read the drive, so I guess the smart data is not store on the drive itself?

    >
    > >

    >
    > >

    >
    > >

    >
    > > I also tried to run a read benchmark but it said an error occurred the device is busy

    >
    >
    >
    >
    >
    > Also tried few things I picked up the drive and turned it over and couldfeel it spinning, I also heard a screeching sound, this is the heads crashing I think? heard that a few times before.
    >
    >
    >
    > One point is it is a fast spinning drive, I guess that means hotter so fat may be bad for reliability..
    >
    >
    >
    > So just wondering what all that means, mechanical probs with drive?
    >
    >
    >
    > By the way the current pending sector count has gone up to 448 from 424, no surprise there I guess.


    Well I will be needing a new drive or two

    http://www.pcworld.co.uk/gbuk/compo...2_70056_xx_xx/1_20/price-asc/xx-criteria.html

    the 2 terabyte one for £60 seems best value, but I can get a 500GB one for £43, £17 less but it's 1/4 of the size.

    Also the drive is still under warrently but I don't seem to have a receipt for it, I normally put them in the box, I bet the never gave me one as theyknew the drives were dodgy? I'd be a bit worried about there being sensitive stuff on the drive, but it's mainly operating system stuff but it also has tonnes of passwords and some other person stuff on it.
    Howeverif the drive is unreadable that would not be an issue, however I expect it can be read by someone who knows what they are doing, ie take the platters out so I will give hat a miss.

    Maybe it would be more readable in a colder enviroment?
    , Jun 9, 2014
    #9
  10. Paul Guest

    wrote:
    > On Sunday, June 8, 2014 11:59:11 PM UTC+1, wrote:
    >> On Sunday, June 8, 2014 11:38:58 PM UTC+1, wrote:
    >>
    >>> On Sunday, June 8, 2014 11:20:58 PM UTC+1, wrote:
    >>>> On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:
    >>>>> On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:
    >>>>>> wrote:
    >>>>>>> OK to cut a long story short I have been having problems with a fairly
    >>>>>>> new 3 terabyte external USB 3 drive. I could not get it to work on USB
    >>>>>>> so I took it out of the enclosure and tried it as a direct SATA connection.
    >>>>>>> It did not wotk like that either, neither when I tried it on my old
    >>>>>>> computer running XP, or Linux and just now on my new comp running win8.1.
    >>>>>>> When I investigate it shows up as a drive, I can see the name with 3000
    >>>>>>> in it for 3 terabytes but when I look at properties it says "no file system".
    >>>>>>> I should add I discovered this after upgrading from win 8 to win 8.1 and
    >>>>>>> I initially though it was the upgrades fault, but that seems to be a red
    >>>>>>> herring unless the upgrade wiped out the file system.
    >>>>>>> So... what do I do?
    >>>>>>> Is there something I can used to recover the data? Or at least try to?
    >>>>>>> Nothing vitally important, I have some other backups on key documents on USB memory.
    >>>>>>> I think also have some stuff, quite a lot on my old computer, think there
    >>>>>>> are some disk utilities on there from previous problems. Oh an they may be
    >>>>>>> on the USB stick too.
    >>>>>>> I am gonna have to get a new drive or two ASAP methinks though, will just
    >>>>>>> get and internal one and try it in one of my enclosures but I am bit concerned
    >>>>>>> about putting a drive in the one the failed drive was in when it happened!!
    >>>>>>> Any ideas would be appreciated!!!
    >>>>>> There are two partitioning standards. The legacy MBR based
    >>>>>> method, and the newer GUID Partition Table or GPT.
    >>>>>> GPT is the standard that allows partitions larger than 2.2TB.
    >>>>>> To use the entire 3TB of drive capacity, requires some kind of
    >>>>>> trick if it is to work in WinXP as well as Windows 8.
    >>>>>> *******
    >>>>>> If we start with this article, even with GPT there is a "protective MBR".
    >>>>>> The MBR is loaded with a characteristic value, and that can hint at
    >>>>>> how the disk was prepared.
    >>>>>> http://en.wikipedia.org/wiki/GUID_Partition_Table
    >>>>>> "A single partition type of EE hex, encompassing the entire GPT drive
    >>>>>> (where "entire" actually means as much of the drive as can be
    >>>>>> represented in an MBR), is indicated and identifies it as GPT"
    >>>>>> So now we have a "hinting" mechanism available. If we see EE as the
    >>>>>> first and only partition in the MBR, then it was a GPT disk.
    >>>>>> This tool will display the MBR for you. PTEDIT32 used to be part of
    >>>>>> Partition Magic, but now that PM is no longer for sale, this particular
    >>>>>> tiny utility is free.
    >>>>>> ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip
    >>>>>> To run that in Windows 8, you want to right click it and "Run as Administrator".
    >>>>>> Running as administrator, is necessary to access the disk as a block device,
    >>>>>> and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.
    >>>>>> If the drive had conventional partitions, the partition type field would be 0x07
    >>>>>> or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker
    >>>>>> used by a GPT disk. So you can do a preliminary check with that.
    >>>>>> *******
    >>>>>> To scan a disk for file system headers, there is TestDisk.
    >>>>>> http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
    >>>>>> It basically scans at a fixed pitch, so it doesn't necessarily have
    >>>>>> to read every sector on the disk, but it sometimes feels like it's
    >>>>>> reading the entire disk. It would take a long time to scan a 3TB drive.
    >>>>>> The main problem with TestDisk, is the interface. It's medieval.
    >>>>>> This makes it hard to work with the program. If you press control-C
    >>>>>> (which in Linux kills programs), you can exit the program if it is
    >>>>>> sitting waiting for a command from you. So you can "escape" if you
    >>>>>> don't like what it is about to do. Some menu levels don't have a
    >>>>>> "QUIT" option, and control-C is your substitute for that.
    >>>>>> You don't accept the partition table it prepares, without using your
    >>>>>> previous knowledge of what was on the disk. For example, if the tool
    >>>>>> tells you there are four partitions, when you know there is only
    >>>>>> actually one, then you cannot accept and write the new MBR value.
    >>>>>> Now, a useful function, is if it locates a partition, it offers an
    >>>>>> option to "view the files on the partition". If that is working, and
    >>>>>> you see file names, that is reassuring, and means your data is quite
    >>>>>> likely to still be there.
    >>>>>> TestDisk is available for Windows and Linux, so can be run from
    >>>>>> either environment.
    >>>>>> There are also scavenger applications such as Photorec (same site) or
    >>>>>> Recuva. At this point, I don't feel there is any reason to panic.
    >>>>>> If you thought the TestDisk scan takes a long time, running a
    >>>>>> scavenger on that big of a disk, would take "infinite" time.
    >>>>>> *******
    >>>>>> One thing I discovered, while playing with my 3TB drive, is Linux
    >>>>>> allows loopback mounting of partitions, with an offset parameter
    >>>>>> applied to the mount command. The offset parameter is a 64 bit number.
    >>>>>> And translating that into English, it means even if the MBR or GPT
    >>>>>> was broken, if you can find the sector with the "NTFS" identifier in
    >>>>>> the header, you can mount any arbitrary bitmap area of a disk, using
    >>>>>> the Linux mount command. Using the offset parameter, allows the user
    >>>>>> to surpass the 2.2TB limitation, and mount a partition which is above
    >>>>>> the 2.2TB mark. So if you could find the beginning of the partition,
    >>>>>> in fact Linux can mount it without a (valid) MBR being present. I
    >>>>>> thought that was pretty neat. The number there in hexidecimal, is
    >>>>>> 2.2TB plus 63 sectors. I just cooked up that number for illustration
    >>>>>> purposes, of a partition which is "up high". The /dev/sdb would be the
    >>>>>> 3TB drive. I would use mkdir /media/mymountpoint, to make a place to
    >>>>>> mount the disk (temporarily).
    >>>>>> sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint
    >>>>>> I used dd (with its own offset capability) to snapshot small chunks
    >>>>>> of bitmap. And a copy of hexdump, to print the ASCII equivalent of
    >>>>>> what is in that chunk. That's how I was able to verify what I was about
    >>>>>> to mount, and that the offset value I cooked up was correct. That's why
    >>>>>> the mount command worked on the first try - lots of planning ahead of
    >>>>>> time :) By snipping out pieces of disk drive with "dd" with an offset
    >>>>>> applied, it was like having a disk editor available. I could verify the
    >>>>>> "thing" at 0x10000002F said "NTFS". Which means issuing the mount
    >>>>>> request is going to work for me.
    >>>>>> When I got my 3TB, I used the free Acronis TIH that was available to
    >>>>>> use on it. Inside that program is a dialog called "Capacity Manager".
    >>>>>> And it installs a driver into your Windows OS. The driver causes a 3TB
    >>>>>> disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.
    >>>>>> You see two disk drives in Disk Management. This is a trick to get
    >>>>>> around the 32 bit sector number (2.2TB capacity) limit on the older
    >>>>>> OSes. With the same driver present in Windows 8, I can also see that
    >>>>>> "two drive split" while running Windows 8. So to suit the older OS (which
    >>>>>> doesn't have GPT), I ended up using the Acronis driver on both OSes.
    >>>>>> If I was using Win8 exclusively, I'd be using GPT instead, as it's
    >>>>>> simpler. Getting that Acronis stuff to work, causes some hair loss.
    >>>>>> It was after setting that up, and placing a partition in the area above
    >>>>>> 2.2TB, that I was testing the Linux mounting method. And I figured out
    >>>>>> with a hex calculator, what the offset should be for the file system
    >>>>>> header. I was able to mount the upper NTFS partition in Linux. The
    >>>>>> limitation I found with that, is the I/O speed using that method is
    >>>>>> only 10 to 15MB/sec, rather than the full disk speed. But if you're
    >>>>>> trying to retrieve files off that, that is the least of your
    >>>>>> concerns. Getting the data is what is important.
    >>>>>> So it is possible to get to your data, no matter where it is hiding
    >>>>>> on the disk.
    >>>>>> *******
    >>>>>> This is another option from Linux. The "disktype" program is available
    >>>>>> if you go to Package Manager and "turn on" all the available Repositories.
    >>>>>> You don't have to compile this for yourself. It's already built and on
    >>>>>> the distro server.
    >>>>>> http://disktype.sourceforge.net/
    >>>>>> Now, that can be pointed at say /dev/sda and asked for an
    >>>>>> opinion as to what is on the disk. It just takes the MBR or GPT
    >>>>>> info at face value.
    >>>>>> disktype /dev/sda
    >>>>>> And that should tell you how many partitions, what file system for
    >>>>>> each partition. in other words, if you haven't trashed the MBR,
    >>>>>> that program will reassure you by displaying all the particulars.
    >>>>>> That program can even be pointed at bitmap files (casper-rw for
    >>>>>> example), and tell you what file system is inside them.
    >>>>>> So that's a quick overview of some tools. Without attempting to
    >>>>>> reproduce any one of them in great detail. Just be careful with
    >>>>>> TestDisk, as if you write out an MBR, and the MBR is wrong, it
    >>>>>> could makes things a lot worse than they need to be. TestDisk
    >>>>>> can "show you the files" on a partition, so it does offer that
    >>>>>> reassurance. Most of the time, I don't accept what I get as
    >>>>>> a computed partition table, and use other techniques until
    >>>>>> I'm absolutely sure that I'm headed in the right direction.
    >>>>>> Any time you do repair or forensics on a disk, you need two
    >>>>>> spare disks. One spare disk, contains your sector by sector
    >>>>>> copy of the original (damaged) drive. The second drive, is
    >>>>>> the drive you use for the output of scavengers such as
    >>>>>> Photorec or Recuva. The reason for making the backup
    >>>>>> copy, is for situations where an in-place tool (such as CHKDSK)
    >>>>>> makes a horrible mess, instead of fixing something. At least
    >>>>>> with the scavengers, you point them to one of your spare disks,
    >>>>>> and the original disk is not being written upon. As long as
    >>>>>> you have that unblemished backup, you're safe to experiment.
    >>>>>> Paul
    >>>>> Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.
    >>>>> That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.
    >>>>> Ideally I would like to work on the drive in my old machine as that has a lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a failed drive or one with errors. Plus I like to keep 'bad' stuff off my new machine.
    >>>>> Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable. I will also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).
    >>>>> I guess the easiest is to try the linux thing first I only need one SATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,
    >>>> Right I have booted to LINUX and the drive does not show on the desktop but I went into something called disc utility and I see it there.
    >>>> Here is what it says:
    >>>> Unknown 375GB
    >>>> Usage - (blank) device /dev/sda1
    >>>> partition type HPFS/NTFS(0x07) capacity 375GB
    >>>> Then there is also the free space 2.6TB
    >>>> Usage - unallocated space devide /dev/sda
    >>>> partition type - capacity 2.6GB
    >>>> Also Smart status - the disc has a few bad sectors.
    >>>> I'm gonna run a smart test now.
    >>> OK I ran something to see the smart data, two things marked out in red:-
    >>> 190 - Airflow Temperature Assessment - failed in the past.
    >>> Value normalised 65
    >>> Worst 39
    >>> threshold 46
    >>> values 35C
    >>> Kind of hard to understand..
    >>> Also
    >>> 197 Current Pending Sector Count
    >>> The number of sector waiting to be remapped. If the sector waiting to be remapped is subsequently written or read successfully the value is decreased and the sector is not remapped. Read errors on the sector will not remap the sector, it will only be remapped on a failed write processed.
    >>> Assessment Warning.
    >>> Values
    >>> Normalised 98
    >>> worst 98
    >>> threshold 0
    >>> Value 424 sectors.
    >>> Just tried to run a self test, short test, 10 mins but immediately it came up in red
    >>> Self tests FAILED (read)
    >>> So all the tests come up FAILED (read).
    >>> So it seems it can't read the drive, so I guess the smart data is not store on the drive itself?
    >>> I also tried to run a read benchmark but it said an error occurred the device is busy

    >>
    >>
    >>
    >>
    >> Also tried few things I picked up the drive and turned it over and could feel it spinning, I also heard a screeching sound, this is the heads crashing I think? heard that a few times before.
    >>
    >>
    >>
    >> One point is it is a fast spinning drive, I guess that means hotter so fat may be bad for reliability..
    >>
    >>
    >>
    >> So just wondering what all that means, mechanical probs with drive?
    >>
    >>
    >>
    >> By the way the current pending sector count has gone up to 448 from 424, no surprise there I guess.

    >
    > Well I will be needing a new drive or two
    >
    > http://www.pcworld.co.uk/gbuk/compo...2_70056_xx_xx/1_20/price-asc/xx-criteria.html
    >
    > the 2 terabyte one for £60 seems best value, but I can get a 500GB one for £43, £17 less but it's 1/4 of the size.
    >
    > Also the drive is still under warrently but I don't seem to have a receipt for it, I normally put them in the box, I bet the never gave me one as they knew the drives were dodgy? I'd be a bit worried about there being sensitive stuff on the drive, but it's mainly operating system stuff but it also has tonnes of passwords and some other person stuff on it.
    > Howeverif the drive is unreadable that would not be an issue, however I expect it can be read by someone who knows what they are doing, ie take the platters out so I will give hat a miss.
    >
    > Maybe it would be more readable in a colder enviroment?


    I'd be more interested in getting the data off the drive,
    than playing with it. The "freezer trick" is when you're
    absolutely desperate and the drive seems dead. Your
    drive is working fine right now, relatively speaking.

    The drive is allowed to run on any of six axis. That
    means all the compass points in 3D are valid operating
    positions. However, subjecting the drive to rotation
    while running, isn't the best idea. It's not a space
    ship. It's still a hard drive. The screeching has to
    come from somewhere - and both places that noise
    come from, are bad news. If the bearing makes that
    noise, the lubrication is gone, and the motor will
    seize up soon. If the heads just crashed, that screech
    could mean a gouge or ding in the finish of the platter.

    Just leave it in the normal operating position, make sure
    it receives some cooling air while operating (don't
    insulate it or anything). And get the data off it.

    I have a drive here that let out a screech (without me
    rotating it :) ), and it's in my quarantine pile now.
    I haven't started it up since, to play with it. It was
    a Seagate. I have a bunch of defective 500GB Seagates.
    I have one in the computer now, that has 14,000 hours
    on it, and it appears to be in mint condition. Go figure.
    Some of the others have relatively low service hours,
    and are "pure crap".

    Before buying a particular model, try to do some
    customer review type research, and look for reliability
    trends.

    I've given up on Seagate for the time being, and the last
    three drives were instead WD drives. That doesn't mean they're
    better, merely that now I'm testing WD for quality issues :)
    I already have my answer for the Seagate *DM* models.

    To their credit, the Seagate drives have not died outright.
    I was not left stranded, with data lost. All of the drives
    have issued various burps and farts, to say they aren't
    feeling well. So it's not like I wasn't warned. You're
    getting your warning right now, and... get your data
    off it :)

    Paul
    Paul, Jun 9, 2014
    #10
  11. Guest

    On Monday, June 9, 2014 12:57:03 AM UTC+1, Paul wrote:
    >
    >
    > > On Sunday, June 8, 2014 11:59:11 PM UTC+1, wrote:

    >
    > >> On Sunday, June 8, 2014 11:38:58 PM UTC+1, wrote:

    >
    > >>

    >
    > >>> On Sunday, June 8, 2014 11:20:58 PM UTC+1, wrote:

    >
    > >>>> On Sunday, June 8, 2014 8:34:38 PM UTC+1, wrote:

    >
    > >>>>> On Sunday, June 8, 2014 8:00:36 AM UTC+1, Paul wrote:

    >
    > >>>>>> wrote:

    >
    > >>>>>>> OK to cut a long story short I have been having problems with a fairly

    >
    > >>>>>>> new 3 terabyte external USB 3 drive. I could not get it to work on USB

    >
    > >>>>>>> so I took it out of the enclosure and tried it as a direct SATA connection.

    >
    > >>>>>>> It did not wotk like that either, neither when I tried it on my old

    >
    > >>>>>>> computer running XP, or Linux and just now on my new comp runningwin8.1.

    >
    > >>>>>>> When I investigate it shows up as a drive, I can see the name with 3000

    >
    > >>>>>>> in it for 3 terabytes but when I look at properties it says "no file system".

    >
    > >>>>>>> I should add I discovered this after upgrading from win 8 to win 8.1 and

    >
    > >>>>>>> I initially though it was the upgrades fault, but that seems to be a red

    >
    > >>>>>>> herring unless the upgrade wiped out the file system.

    >
    > >>>>>>> So... what do I do?

    >
    > >>>>>>> Is there something I can used to recover the data? Or at least try to?

    >
    > >>>>>>> Nothing vitally important, I have some other backups on key documents on USB memory.

    >
    > >>>>>>> I think also have some stuff, quite a lot on my old computer, think there

    >
    > >>>>>>> are some disk utilities on there from previous problems. Oh an they may be

    >
    > >>>>>>> on the USB stick too.

    >
    > >>>>>>> I am gonna have to get a new drive or two ASAP methinks though, will just

    >
    > >>>>>>> get and internal one and try it in one of my enclosures but I am bit concerned

    >
    > >>>>>>> about putting a drive in the one the failed drive was in when it happened!!

    >
    > >>>>>>> Any ideas would be appreciated!!!

    >
    > >>>>>> There are two partitioning standards. The legacy MBR based

    >
    > >>>>>> method, and the newer GUID Partition Table or GPT.

    >
    > >>>>>> GPT is the standard that allows partitions larger than 2.2TB.

    >
    > >>>>>> To use the entire 3TB of drive capacity, requires some kind of

    >
    > >>>>>> trick if it is to work in WinXP as well as Windows 8.

    >
    > >>>>>> *******

    >
    > >>>>>> If we start with this article, even with GPT there is a "protective MBR".

    >
    > >>>>>> The MBR is loaded with a characteristic value, and that can hint at

    >
    > >>>>>> how the disk was prepared.

    >
    > >>>>>> http://en.wikipedia.org/wiki/GUID_Partition_Table

    >
    > >>>>>> "A single partition type of EE hex, encompassing the entire GPT drive

    >
    > >>>>>> (where "entire" actually means as much of the drive as can be

    >
    > >>>>>> represented in an MBR), is indicated and identifies it as GPT"

    >
    > >>>>>> So now we have a "hinting" mechanism available. If we see EE as the

    >
    > >>>>>> first and only partition in the MBR, then it was a GPT disk.

    >
    > >>>>>> This tool will display the MBR for you. PTEDIT32 used to be part of

    >
    > >>>>>> Partition Magic, but now that PM is no longer for sale, this particular

    >
    > >>>>>> tiny utility is free.

    >
    > >>>>>> ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    >
    > >>>>>> To run that in Windows 8, you want to right click it and "Run as Administrator".

    >
    > >>>>>> Running as administrator, is necessary to access the disk as a block device,

    >
    > >>>>>> and read sector 0. If you're not the Admin, you get "Error 5" due to Access Denied.

    >
    > >>>>>> If the drive had conventional partitions, the partition type fieldwould be 0x07

    >
    > >>>>>> or 0x0C for NTFS or FAT32. In other words, values other than the 0xEE marker

    >
    > >>>>>> used by a GPT disk. So you can do a preliminary check with that.

    >
    > >>>>>> *******

    >
    > >>>>>> To scan a disk for file system headers, there is TestDisk.

    >
    > >>>>>> http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    >
    > >>>>>> It basically scans at a fixed pitch, so it doesn't necessarily have

    >
    > >>>>>> to read every sector on the disk, but it sometimes feels like it's

    >
    > >>>>>> reading the entire disk. It would take a long time to scan a 3TB drive.

    >
    > >>>>>> The main problem with TestDisk, is the interface. It's medieval.

    >
    > >>>>>> This makes it hard to work with the program. If you press control-C

    >
    > >>>>>> (which in Linux kills programs), you can exit the program if it is

    >
    > >>>>>> sitting waiting for a command from you. So you can "escape" if you

    >
    > >>>>>> don't like what it is about to do. Some menu levels don't have a

    >
    > >>>>>> "QUIT" option, and control-C is your substitute for that.

    >
    > >>>>>> You don't accept the partition table it prepares, without using your

    >
    > >>>>>> previous knowledge of what was on the disk. For example, if the tool

    >
    > >>>>>> tells you there are four partitions, when you know there is only

    >
    > >>>>>> actually one, then you cannot accept and write the new MBR value.

    >
    > >>>>>> Now, a useful function, is if it locates a partition, it offers an

    >
    > >>>>>> option to "view the files on the partition". If that is working, and

    >
    > >>>>>> you see file names, that is reassuring, and means your data is quite

    >
    > >>>>>> likely to still be there.

    >
    > >>>>>> TestDisk is available for Windows and Linux, so can be run from

    >
    > >>>>>> either environment.

    >
    > >>>>>> There are also scavenger applications such as Photorec (same site)or

    >
    > >>>>>> Recuva. At this point, I don't feel there is any reason to panic.

    >
    > >>>>>> If you thought the TestDisk scan takes a long time, running a

    >
    > >>>>>> scavenger on that big of a disk, would take "infinite" time.

    >
    > >>>>>> *******

    >
    > >>>>>> One thing I discovered, while playing with my 3TB drive, is Linux

    >
    > >>>>>> allows loopback mounting of partitions, with an offset parameter

    >
    > >>>>>> applied to the mount command. The offset parameter is a 64 bit number.

    >
    > >>>>>> And translating that into English, it means even if the MBR or GPT

    >
    > >>>>>> was broken, if you can find the sector with the "NTFS" identifier in

    >
    > >>>>>> the header, you can mount any arbitrary bitmap area of a disk, using

    >
    > >>>>>> the Linux mount command. Using the offset parameter, allows the user

    >
    > >>>>>> to surpass the 2.2TB limitation, and mount a partition which is above

    >
    > >>>>>> the 2.2TB mark. So if you could find the beginning of the partition,

    >
    > >>>>>> in fact Linux can mount it without a (valid) MBR being present. I

    >
    > >>>>>> thought that was pretty neat. The number there in hexidecimal, is

    >
    > >>>>>> 2.2TB plus 63 sectors. I just cooked up that number for illustration

    >
    > >>>>>> purposes, of a partition which is "up high". The /dev/sdb would bethe

    >
    > >>>>>> 3TB drive. I would use mkdir /media/mymountpoint, to make a place to

    >
    > >>>>>> mount the disk (temporarily).

    >
    > >>>>>> sudo mount -t ntfs -o loop,offset=0x10000002F /dev/sdb /media/mymountpoint

    >
    > >>>>>> I used dd (with its own offset capability) to snapshot small chunks

    >
    > >>>>>> of bitmap. And a copy of hexdump, to print the ASCII equivalent of

    >
    > >>>>>> what is in that chunk. That's how I was able to verify what I was about

    >
    > >>>>>> to mount, and that the offset value I cooked up was correct. That's why

    >
    > >>>>>> the mount command worked on the first try - lots of planning aheadof

    >
    > >>>>>> time :) By snipping out pieces of disk drive with "dd" with an offset

    >
    > >>>>>> applied, it was like having a disk editor available. I could verify the

    >
    > >>>>>> "thing" at 0x10000002F said "NTFS". Which means issuing the mount

    >
    > >>>>>> request is going to work for me.

    >
    > >>>>>> When I got my 3TB, I used the free Acronis TIH that was available to

    >
    > >>>>>> use on it. Inside that program is a dialog called "Capacity Manager".

    >
    > >>>>>> And it installs a driver into your Windows OS. The driver causes a3TB

    >
    > >>>>>> disk, to be split into a 2.2TB physical disk, and a 0.8TB virtual disk.

    >
    > >>>>>> You see two disk drives in Disk Management. This is a trick to get

    >
    > >>>>>> around the 32 bit sector number (2.2TB capacity) limit on the older

    >
    > >>>>>> OSes. With the same driver present in Windows 8, I can also see that

    >
    > >>>>>> "two drive split" while running Windows 8. So to suit the older OS(which

    >
    > >>>>>> doesn't have GPT), I ended up using the Acronis driver on both OSes.

    >
    > >>>>>> If I was using Win8 exclusively, I'd be using GPT instead, as it's

    >
    > >>>>>> simpler. Getting that Acronis stuff to work, causes some hair loss..

    >
    > >>>>>> It was after setting that up, and placing a partition in the area above

    >
    > >>>>>> 2.2TB, that I was testing the Linux mounting method. And I figuredout

    >
    > >>>>>> with a hex calculator, what the offset should be for the file system

    >
    > >>>>>> header. I was able to mount the upper NTFS partition in Linux. The

    >
    > >>>>>> limitation I found with that, is the I/O speed using that method is

    >
    > >>>>>> only 10 to 15MB/sec, rather than the full disk speed. But if you're

    >
    > >>>>>> trying to retrieve files off that, that is the least of your

    >
    > >>>>>> concerns. Getting the data is what is important.

    >
    > >>>>>> So it is possible to get to your data, no matter where it is hiding

    >
    > >>>>>> on the disk.

    >
    > >>>>>> *******

    >
    > >>>>>> This is another option from Linux. The "disktype" program is available

    >
    > >>>>>> if you go to Package Manager and "turn on" all the available Repositories.

    >
    > >>>>>> You don't have to compile this for yourself. It's already built and on

    >
    > >>>>>> the distro server.

    >
    > >>>>>> http://disktype.sourceforge.net/

    >
    > >>>>>> Now, that can be pointed at say /dev/sda and asked for an

    >
    > >>>>>> opinion as to what is on the disk. It just takes the MBR or GPT

    >
    > >>>>>> info at face value.

    >
    > >>>>>> disktype /dev/sda

    >
    > >>>>>> And that should tell you how many partitions, what file system for

    >
    > >>>>>> each partition. in other words, if you haven't trashed the MBR,

    >
    > >>>>>> that program will reassure you by displaying all the particulars.

    >
    > >>>>>> That program can even be pointed at bitmap files (casper-rw for

    >
    > >>>>>> example), and tell you what file system is inside them.

    >
    > >>>>>> So that's a quick overview of some tools. Without attempting to

    >
    > >>>>>> reproduce any one of them in great detail. Just be careful with

    >
    > >>>>>> TestDisk, as if you write out an MBR, and the MBR is wrong, it

    >
    > >>>>>> could makes things a lot worse than they need to be. TestDisk

    >
    > >>>>>> can "show you the files" on a partition, so it does offer that

    >
    > >>>>>> reassurance. Most of the time, I don't accept what I get as

    >
    > >>>>>> a computed partition table, and use other techniques until

    >
    > >>>>>> I'm absolutely sure that I'm headed in the right direction.

    >
    > >>>>>> Any time you do repair or forensics on a disk, you need two

    >
    > >>>>>> spare disks. One spare disk, contains your sector by sector

    >
    > >>>>>> copy of the original (damaged) drive. The second drive, is

    >
    > >>>>>> the drive you use for the output of scavengers such as

    >
    > >>>>>> Photorec or Recuva. The reason for making the backup

    >
    > >>>>>> copy, is for situations where an in-place tool (such as CHKDSK)

    >
    > >>>>>> makes a horrible mess, instead of fixing something. At least

    >
    > >>>>>> with the scavengers, you point them to one of your spare disks,

    >
    > >>>>>> and the original disk is not being written upon. As long as

    >
    > >>>>>> you have that unblemished backup, you're safe to experiment.

    >
    > >>>>>> Paul

    >
    > >>>>> Thanks Paul there is a lot of info in there a lot of which goes over my head but I will look into it, I need to decide on the best plan of action first before I jump into it and end up making things worse as I nearly did when I put the only drive into the USB 3 enclosure.

    >
    > >>>>> That leads me to a question, can I work on the drive when it is in the enclosure? Or should it be on an internal connection.

    >
    > >>>>> Ideally I would like to work on the drive in my old machine as thathas a lot of drive utility stuff I downloaded when you helped me with a previous problem, I can't remember exactly what it was now exactly but a failed drive or one with errors. Plus I like to keep 'bad' stuff off my new machine.

    >
    > >>>>> Trouble is one of the SATA cables is really dodgy, I really should wait till tomorrow (but will be too impatient to) so I can get a new cable.I will also have to buy anther drive I think or probably two as I have nothing to back up onto now. (apart form from USB memory sticks).

    >
    > >>>>> I guess the easiest is to try the linux thing first I only need oneSATA cable for that however I am not used to working in Linux much. It's on a CD so I don't think I can build anything,

    >
    > >>>> Right I have booted to LINUX and the drive does not show on the desktop but I went into something called disc utility and I see it there.

    >
    > >>>> Here is what it says:

    >
    > >>>> Unknown 375GB

    >
    > >>>> Usage - (blank) device /dev/sda1

    >
    > >>>> partition type HPFS/NTFS(0x07) capacity 375GB

    >
    > >>>> Then there is also the free space 2.6TB

    >
    > >>>> Usage - unallocated space devide /dev/sda

    >
    > >>>> partition type - capacity 2.6GB

    >
    > >>>> Also Smart status - the disc has a few bad sectors.

    >
    > >>>> I'm gonna run a smart test now.

    >
    > >>> OK I ran something to see the smart data, two things marked out in red:-

    >
    > >>> 190 - Airflow Temperature Assessment - failed in the past.

    >
    > >>> Value normalised 65

    >
    > >>> Worst 39

    >
    > >>> threshold 46

    >
    > >>> values 35C

    >
    > >>> Kind of hard to understand..

    >
    > >>> Also

    >
    > >>> 197 Current Pending Sector Count

    >
    > >>> The number of sector waiting to be remapped. If the sector waiting tobe remapped is subsequently written or read successfully the value is decreased and the sector is not remapped. Read errors on the sector will not remap the sector, it will only be remapped on a failed write processed.

    >
    > >>> Assessment Warning.

    >
    > >>> Values

    >
    > >>> Normalised 98

    >
    > >>> worst 98

    >
    > >>> threshold 0

    >
    > >>> Value 424 sectors.

    >
    > >>> Just tried to run a self test, short test, 10 mins but immediately itcame up in red

    >
    > >>> Self tests FAILED (read)

    >
    > >>> So all the tests come up FAILED (read).

    >
    > >>> So it seems it can't read the drive, so I guess the smart data is notstore on the drive itself?

    >
    > >>> I also tried to run a read benchmark but it said an error occurred the device is busy

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Also tried few things I picked up the drive and turned it over and could feel it spinning, I also heard a screeching sound, this is the heads crashing I think? heard that a few times before.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> One point is it is a fast spinning drive, I guess that means hotter sofat may be bad for reliability..

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> So just wondering what all that means, mechanical probs with drive?

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> By the way the current pending sector count has gone up to 448 from 424, no surprise there I guess.

    >
    > >

    >
    > > Well I will be needing a new drive or two

    >
    > >

    >
    > > http://www.pcworld.co.uk/gbuk/compo...2_70056_xx_xx/1_20/price-asc/xx-criteria.html

    >
    > >

    >
    > > the 2 terabyte one for �60 seems best value, but I can get a 500GB one for �43, �17 less but it's 1/4 of the size.

    >
    > >

    >
    > > Also the drive is still under warrently but I don't seem to have a receipt for it, I normally put them in the box, I bet the never gave me one as they knew the drives were dodgy? I'd be a bit worried about there being sensitive stuff on the drive, but it's mainly operating system stuff but it also has tonnes of passwords and some other person stuff on it.

    >
    > > Howeverif the drive is unreadable that would not be an issue, however Iexpect it can be read by someone who knows what they are doing, ie take the platters out so I will give hat a miss.

    >
    > >

    >
    > > Maybe it would be more readable in a colder enviroment?

    >
    >
    >
    > I'd be more interested in getting the data off the drive,
    >
    > than playing with it. The "freezer trick" is when you're
    >
    > absolutely desperate and the drive seems dead. Your
    >
    > drive is working fine right now, relatively speaking.
    >
    >
    >
    > The drive is allowed to run on any of six axis. That
    >
    > means all the compass points in 3D are valid operating
    >
    > positions. However, subjecting the drive to rotation
    >
    > while running, isn't the best idea. It's not a space
    >
    > ship. It's still a hard drive. The screeching has to
    >
    > come from somewhere - and both places that noise
    >
    > come from, are bad news. If the bearing makes that
    >
    > noise, the lubrication is gone, and the motor will
    >
    > seize up soon. If the heads just crashed, that screech
    >
    > could mean a gouge or ding in the finish of the platter.
    >
    >
    >
    > Just leave it in the normal operating position, make sure
    >
    > it receives some cooling air while operating (don't
    >
    > insulate it or anything). And get the data off it.
    >
    >
    >
    > I have a drive here that let out a screech (without me
    >
    > rotating it :) ), and it's in my quarantine pile now.
    >
    > I haven't started it up since, to play with it. It was
    >
    > a Seagate. I have a bunch of defective 500GB Seagates.
    >
    > I have one in the computer now, that has 14,000 hours
    >
    > on it, and it appears to be in mint condition. Go figure.
    >
    > Some of the others have relatively low service hours,
    >
    > and are "pure crap".
    >
    >
    >
    > Before buying a particular model, try to do some
    >
    > customer review type research, and look for reliability
    >
    > trends.
    >
    >
    >
    > I've given up on Seagate for the time being, and the last
    >
    > three drives were instead WD drives. That doesn't mean they're
    >
    > better, merely that now I'm testing WD for quality issues :)
    >
    > I already have my answer for the Seagate *DM* models.
    >
    >
    >
    > To their credit, the Seagate drives have not died outright.
    >
    > I was not left stranded, with data lost. All of the drives
    >
    > have issued various burps and farts, to say they aren't
    >
    > feeling well. So it's not like I wasn't warned. You're
    >
    > getting your warning right now, and... get your data
    >
    > off it :)
    >
    >
    >
    > Paul


    This tells a tale!!!
    http://www.pcworld.com/article/2089...eals-the-most-reliable-hard-drive-makers.html

    Is Seagate drives are crap!!!

    "The worst of the bunch, meanwhile was the 1.5 TB Seagate Barracuda Green (ST1500DL003), with an average lifespan of 0.8 years. Ouch!" <----------------

    10 months!! That is about how old mine is I think, though I can't remember for sure. I think I mentioned in previous posts when I bought it so I will see if I can find out from them.

    Anyway Hitachi seems to be the way to go but none of my local store seem tostock them.
    http://www.pcworld.co.uk/gbuk/compo...2_70056_xx_xx/1_20/price-asc/xx-criteria.html

    Unfortunately there is no info on the Toshiba drives.

    Another article here

    http://www.theregister.co.uk/2014/02/17/backblaze_how_not_to_evaluate_disk_reliability/

    Says Seagate TTB barracuda are the best now!!!

    Any just checked the drive in this machine, Western digital!! Phew!!
    One 500gb drive in my old machine is also a WD (from a USB enclosure).

    I note I also have another failed drive as 250gb one which is a Samsung, a brand I always confuse with Seagate.

    I also found out that Hitachi was bought by Western digital. So WD seems tobe the way to go.

    I think another issue is external drives tend to get handled roughly, I am always more careful with a bare drive as they look more delicate, the enclosures tend to give you the idea you can treat it more roughly.
    , Jun 9, 2014
    #11
  12. Paul Guest

    wrote:

    >
    > This tells a tale!!!
    > http://www.pcworld.com/article/2089...eals-the-most-reliable-hard-drive-makers.html
    >
    > Is Seagate drives are crap!!!
    >
    > "The worst of the bunch, meanwhile was the 1.5 TB Seagate Barracuda Green (ST1500DL003), with an average lifespan of 0.8 years. Ouch!" <----------------
    >
    > 10 months!! That is about how old mine is I think, though I can't remember for sure. I think I mentioned in previous posts when I bought it so I will see if I can find out from them.
    >
    > Anyway Hitachi seems to be the way to go but none of my local store seem to stock them.
    > http://www.pcworld.co.uk/gbuk/compo...2_70056_xx_xx/1_20/price-asc/xx-criteria.html
    >
    > Unfortunately there is no info on the Toshiba drives.
    >
    > Another article here
    >
    > http://www.theregister.co.uk/2014/02/17/backblaze_how_not_to_evaluate_disk_reliability/
    >
    > Says Seagate TTB barracuda are the best now!!!
    >
    > Any just checked the drive in this machine, Western digital!! Phew!!
    > One 500gb drive in my old machine is also a WD (from a USB enclosure).
    >
    > I note I also have another failed drive as 250gb one which is a Samsung, a brand I always confuse with Seagate.
    >
    > I also found out that Hitachi was bought by Western digital. So WD seems to be the way to go.
    >
    > I think another issue is external drives tend to get handled roughly, I am always more careful with a bare drive as they look more delicate, the enclosures tend to give you the idea you can treat it more roughly.


    One of my failing 500GB drives, it seemed to be a "wearout"
    mechanism. In that all the bad sectors were over top of
    a relatively small OS partition. Areas of the disk outside
    the OS partition, didn't have the errors. The way I detect that,
    is to run a sequential read benchmark, and watch for parts
    of the disk with lower transfer rates. On that disk, the
    SMART was still clean, meaning the total number of
    substituted sectors wasn't that large. The reason I
    replaced the drive, is it was making a difference to
    how fast things would happen on the computer. So
    it got replaced. I could have moved the OS partition to another
    area. But then, I'd never be sure it wouldn't just drop dead
    on me the next day. That's the thing about being given a
    warning, you never know how long they last after that.

    Seagate bought Maxtor some years ago, and the cynic in me
    says that's where the bad drives are coming from :) I had
    a batch of bad Maxtors too, years ago. And swore off those.
    But bad drives can happen to any company, and the problems
    can follow particular models, and that's why you can't
    get too excited about this stuff. In the case of the recent
    Seagate drives, I had to do something, because my replacement
    rate had become "once a year".

    What I can't understand, is why one of those drives has
    lasted 14,000 hours. I wonder what the difference between
    these drives is ? That drive doesn't spin down or anything.
    It's not like it is resting all the time.

    Another observation (with the usual lack of statistical
    significance), is I've noticed that room humidity plays
    a part in drive failure. I've had a couple drives fail
    during intervals where the room humidity stays at 60%
    for a month. There is a breather hole on modern drives,
    so the room humidity and HDA humidity levels should
    be the same. None of the people doing these disk studies
    will be seeing that, as they'll have better humidity
    control than I do. During the transition between hot
    and cold parts of the year, the daily humidity level in
    the house rises. And drive failures are (slightly) more
    likely then.

    Paul
    Paul, Jun 9, 2014
    #12
  13. Guest


    > the OS partition, didn't have the errors. The way I detect that,
    >
    > is to run a sequential read benchmark, and watch for parts
    >
    > of the disk with lower transfer rates. On that disk, the
    >
    > SMART was still clean, meaning the total number of
    >
    > substituted sectors wasn't that large. The reason I
    >
    > replaced the drive, is it was making a difference to
    >
    > how fast things would happen on the computer. So
    >
    > it got replaced. I could have moved the OS partition to another
    >
    > area. But then, I'd never be sure it wouldn't just drop dead
    >
    > on me the next day. That's the thing about being given a
    >
    > warning, you never know how long they last after that.
    >
    >
    >
    > Seagate bought Maxtor some years ago, and the cynic in me
    >
    > says that's where the bad drives are coming from :) I had
    >
    > a batch of bad Maxtors too, years ago. And swore off those.
    >
    > But bad drives can happen to any company, and the problems
    >
    > can follow particular models, and that's why you can't
    >
    > get too excited about this stuff. In the case of the recent
    >
    > Seagate drives, I had to do something, because my replacement
    >
    > rate had become "once a year".
    >
    >
    >
    > What I can't understand, is why one of those drives has
    >
    > lasted 14,000 hours. I wonder what the difference between
    >
    > these drives is ? That drive doesn't spin down or anything.
    >
    > It's not like it is resting all the time.
    >
    >
    >
    > Another observation (with the usual lack of statistical
    >
    > significance), is I've noticed that room humidity plays
    >
    > a part in drive failure. I've had a couple drives fail
    >
    > during intervals where the room humidity stays at 60%
    >
    > for a month. There is a breather hole on modern drives,
    >
    > so the room humidity and HDA humidity levels should
    >
    > be the same. None of the people doing these disk studies
    >
    > will be seeing that, as they'll have better humidity
    >
    > control than I do. During the transition between hot
    >
    > and cold parts of the year, the daily humidity level in
    >
    > the house rises. And drive failures are (slightly) more
    >
    > likely then.
    >
    >
    >
    > Paul


    Always seems to be humid where I am currently 85, the lowest in the next 10days is 65 and that is low, whenever I look it seems to be in the 80's however is averages about 70 this next 10 days.
    Anyhow it does seem to be the case the study was not very scieentific, ie arandom selection.
    Anyway I went out and got myself a drive, they actually had some in the store!!!
    This one, http://www.pcworld.co.uk/gbuk/compo...-5-internal-hard-drive-2-tb-21651951-pdt.html
    £80 I could have got cheaper but I am hoping this will be more reliable.
    Not too sure how I will use it, I think initially I will clone my windows 8..1 drive and see if I can boot from it and then have a go at curing the AVGproblem.

    Then if that works I will use it in an enclosure to back up stuff to.
    Not much point in having the biggest drive in the machine as you can't backit up.

    I would like to have partitioned it but seems I can only clone, however theexisting drive which is 500GB has two partition on it so that might help.
    Will have to see what happens.


    Then I will have to have a look at the failed drive and see if anything canbe done with it. If it cannot read the drive I don't think there is much Ican do?
    Will have to try some recovery stuff on it an see what happens.
    And I will need the 2 gig drive to recover too.I was going to get a 3 TB drive but I though then bigger it is the more chance of failure, also turns out XP only goes up to 2TB I think.
    , Jun 9, 2014
    #13
  14. Guest

    On Monday, June 9, 2014 7:09:21 PM UTC+1, wrote:
    > > the OS partition, didn't have the errors. The way I detect that,

    >
    > >

    >
    > > is to run a sequential read benchmark, and watch for parts

    >
    > >

    >
    > > of the disk with lower transfer rates. On that disk, the

    >
    > >

    >
    > > SMART was still clean, meaning the total number of

    >
    > >

    >
    > > substituted sectors wasn't that large. The reason I

    >
    > >

    >
    > > replaced the drive, is it was making a difference to

    >
    > >

    >
    > > how fast things would happen on the computer. So

    >
    > >

    >
    > > it got replaced. I could have moved the OS partition to another

    >
    > >

    >
    > > area. But then, I'd never be sure it wouldn't just drop dead

    >
    > >

    >
    > > on me the next day. That's the thing about being given a

    >
    > >

    >
    > > warning, you never know how long they last after that.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Seagate bought Maxtor some years ago, and the cynic in me

    >
    > >

    >
    > > says that's where the bad drives are coming from :) I had

    >
    > >

    >
    > > a batch of bad Maxtors too, years ago. And swore off those.

    >
    > >

    >
    > > But bad drives can happen to any company, and the problems

    >
    > >

    >
    > > can follow particular models, and that's why you can't

    >
    > >

    >
    > > get too excited about this stuff. In the case of the recent

    >
    > >

    >
    > > Seagate drives, I had to do something, because my replacement

    >
    > >

    >
    > > rate had become "once a year".

    >
    > >

    >
    > >

    >
    > >

    >
    > > What I can't understand, is why one of those drives has

    >
    > >

    >
    > > lasted 14,000 hours. I wonder what the difference between

    >
    > >

    >
    > > these drives is ? That drive doesn't spin down or anything.

    >
    > >

    >
    > > It's not like it is resting all the time.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Another observation (with the usual lack of statistical

    >
    > >

    >
    > > significance), is I've noticed that room humidity plays

    >
    > >

    >
    > > a part in drive failure. I've had a couple drives fail

    >
    > >

    >
    > > during intervals where the room humidity stays at 60%

    >
    > >

    >
    > > for a month. There is a breather hole on modern drives,

    >
    > >

    >
    > > so the room humidity and HDA humidity levels should

    >
    > >

    >
    > > be the same. None of the people doing these disk studies

    >
    > >

    >
    > > will be seeing that, as they'll have better humidity

    >
    > >

    >
    > > control than I do. During the transition between hot

    >
    > >

    >
    > > and cold parts of the year, the daily humidity level in

    >
    > >

    >
    > > the house rises. And drive failures are (slightly) more

    >
    > >

    >
    > > likely then.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Paul

    >
    >
    >
    > Always seems to be humid where I am currently 85, the lowest in the next 10 days is 65 and that is low, whenever I look it seems to be in the 80's however is averages about 70 this next 10 days.
    >
    > Anyhow it does seem to be the case the study was not very scieentific, iea random selection.
    >
    > Anyway I went out and got myself a drive, they actually had some in the store!!!
    >
    > This one, http://www.pcworld.co.uk/gbuk/compo...-5-internal-hard-drive-2-tb-21651951-pdt.html
    >
    > £80 I could have got cheaper but I am hoping this will be more reliable..
    >
    > Not too sure how I will use it, I think initially I will clone my windows8.1 drive and see if I can boot from it and then have a go at curing the AVG problem.
    >
    >
    >
    > Then if that works I will use it in an enclosure to back up stuff to.
    >
    > Not much point in having the biggest drive in the machine as you can't back it up.
    >
    >
    >
    > I would like to have partitioned it but seems I can only clone, however the existing drive which is 500GB has two partition on it so that might help..
    >
    > Will have to see what happens.
    >
    >
    >
    >
    >
    > Then I will have to have a look at the failed drive and see if anything can be done with it. If it cannot read the drive I don't think there is muchI can do?
    >
    > Will have to try some recovery stuff on it an see what happens.
    >
    > And I will need the 2 gig drive to recover too.I was going to get a 3 TB drive but I though then bigger it is the more chance of failure, also turnsout XP only goes up to 2TB I think.


    Oh and anther thing what are these network drives? Are they lower spec?
    They seem to be cheaper. Apart from the 3TB which is more expensive.

    On and I forgot to say I had heard the head screeching before when I was not moving the drive, ages ago. Didn't think too much of it but not a good sign
    , Jun 9, 2014
    #14
  15. Paul Guest

    wrote:
    >> the OS partition, didn't have the errors. The way I detect that,
    >>
    >> is to run a sequential read benchmark, and watch for parts
    >>
    >> of the disk with lower transfer rates. On that disk, the
    >>
    >> SMART was still clean, meaning the total number of
    >>
    >> substituted sectors wasn't that large. The reason I
    >>
    >> replaced the drive, is it was making a difference to
    >>
    >> how fast things would happen on the computer. So
    >>
    >> it got replaced. I could have moved the OS partition to another
    >>
    >> area. But then, I'd never be sure it wouldn't just drop dead
    >>
    >> on me the next day. That's the thing about being given a
    >>
    >> warning, you never know how long they last after that.
    >>
    >>
    >>
    >> Seagate bought Maxtor some years ago, and the cynic in me
    >>
    >> says that's where the bad drives are coming from :) I had
    >>
    >> a batch of bad Maxtors too, years ago. And swore off those.
    >>
    >> But bad drives can happen to any company, and the problems
    >>
    >> can follow particular models, and that's why you can't
    >>
    >> get too excited about this stuff. In the case of the recent
    >>
    >> Seagate drives, I had to do something, because my replacement
    >>
    >> rate had become "once a year".
    >>
    >>
    >>
    >> What I can't understand, is why one of those drives has
    >>
    >> lasted 14,000 hours. I wonder what the difference between
    >>
    >> these drives is ? That drive doesn't spin down or anything.
    >>
    >> It's not like it is resting all the time.
    >>
    >>
    >>
    >> Another observation (with the usual lack of statistical
    >>
    >> significance), is I've noticed that room humidity plays
    >>
    >> a part in drive failure. I've had a couple drives fail
    >>
    >> during intervals where the room humidity stays at 60%
    >>
    >> for a month. There is a breather hole on modern drives,
    >>
    >> so the room humidity and HDA humidity levels should
    >>
    >> be the same. None of the people doing these disk studies
    >>
    >> will be seeing that, as they'll have better humidity
    >>
    >> control than I do. During the transition between hot
    >>
    >> and cold parts of the year, the daily humidity level in
    >>
    >> the house rises. And drive failures are (slightly) more
    >>
    >> likely then.
    >>
    >>
    >>
    >> Paul

    >
    > Always seems to be humid where I am currently 85, the lowest in the next 10 days is 65 and that is low, whenever I look it seems to be in the 80's however is averages about 70 this next 10 days.
    > Anyhow it does seem to be the case the study was not very scieentific, ie a random selection.
    > Anyway I went out and got myself a drive, they actually had some in the store!!!
    > This one, http://www.pcworld.co.uk/gbuk/compo...-5-internal-hard-drive-2-tb-21651951-pdt.html
    > £80 I could have got cheaper but I am hoping this will be more reliable.
    > Not too sure how I will use it, I think initially I will clone my windows 8.1 drive and see if I can boot from it and then have a go at curing the AVG problem.
    >
    > Then if that works I will use it in an enclosure to back up stuff to.
    > Not much point in having the biggest drive in the machine as you can't back it up.
    >
    > I would like to have partitioned it but seems I can only clone, however the existing drive which is 500GB has two partition on it so that might help.
    > Will have to see what happens.
    >
    >
    > Then I will have to have a look at the failed drive and see if anything can be done with it. If it cannot read the drive I don't think there is much I can do?
    > Will have to try some recovery stuff on it an see what happens.
    > And I will need the 2 gig drive to recover too.I was going to get a 3 TB drive but I though then bigger it is the more chance of failure, also turns out XP only goes up to 2TB I think.


    At least the 2TB drive won't cause a problem with WinXP. You can
    still view the partitions on it, without anything special installed.

    Some levels of "Working":

    1) Name of drive doesn't show up in the BIOS, for
    a bad drive connected to a SATA or IDE port. A drive
    will not report in, if for any reason it cannot load
    the heads onto the platter, get the firmware off "track -1"
    and become fully operational. As a designer, I feel it would make
    more sense if the drive "always talked to us", but as a
    consumer I just have to put up with this behavior. So if you
    did not see it in the BIOS drive tables somewhere, "it's dead Jim".

    2) Use HDTune to check the drive. HDTune deals with the drive
    as a block level device. You can do a read benchmark, and
    look for the proper gradual transfer rate curve. Downward spikes
    indicate areas using substitute sectors. Read speed decreases when
    that is needed.

    http://www.hdtune.com/files/hdtune_255.exe

    3) You can run TestDisk on it, and scan for partitions. TestDisk looks
    for a sector with "NTFS" string at a particular offset. In other words,
    it looks for evidence that a partition used to be there. But you must use
    care with the utility, if attempting to write out a new MBR. The MBR
    contains a table of primary partitions, and those are "pointers"
    the OS uses, to find that sector with the "NTFS" in it. If your partition
    is there, TestDisk has an option to "list the files". Which proves all
    is not lost.

    An OS can find a partition (good MBR), but refuse to mount the partition
    (bad data structures in the header section). In which case, perhaps
    not even CHKDSK can help.

    There are plenty of $39.95 data recovery programs. Some of them,
    you download them for free. The program "teases" you, by listing the
    names of files it proposes to fix. You then pay the $39.95 to purchase
    a license key, and then the program will actually do the data recovery.
    So that's certainly an option, if TestDisk is not showing promise.

    I have one utility which is available for free, and the developer
    sold the code to some other company. You can use the last version
    he offered. Now it looks like the bastards have retroactively
    removed it from archive.org. So I had to find another download
    site. Check the checksum on it before using it. (Make sure you have
    your popup-blocker running - it's one of *those* kinds of sites.)

    http://download.modem-help.co.uk/non-modem/File-Rescue---Disk-Recovery/driverescue19d.zip.php

    This info is from when I downloaded it from archive.org, while
    you could still get it.

    driverescue19d.zip 1,007,764 bytes
    MD5SUM = 63b7e1e8b1701593d5f52c7927d01558
    SHA1SUM = bd2caef584d9efd2f9714d6714856784a8eb5c40

    MD5SUM is no longer trustworthy, so including it is only
    of historical interest. You should use SHA1SUM for
    verifying unadulterated downloads. It's the next best
    thing. We will soon need 256 bit hashing, but that's
    a topic for another day.

    This is where I got my sha1sum.exe on May 1, 2014.

    ftp://ftp.gnupg.org/gcrypt/binary/sha1sum.exe

    sha1sum.exe driverescue19d.zip

    When you unpack the driverescue package, this
    is what it looks like to run it. I haven't had an
    opportunity to test this on something of the
    appropriate level of "broken-ness", so can't tell
    you more than what you see in this picture. One other
    poster I talked to, used the program to recovery
    his files from an NTFS partition. So even if NTFS
    support is "preliminary", the program does work.

    http://imagizer.imageshack.us/a/img822/1299/evie.gif

    The drive I tested that on, wasn't really broken.

    Paul
    Paul, Jun 9, 2014
    #15
  16. Paul Guest

    wrote:

    > Oh and anther thing what are these network drives? Are they lower spec?
    > They seem to be cheaper. Apart from the 3TB which is more expensive.
    >
    > On and I forgot to say I had heard the head screeching before when I was not
    > moving the drive, ages ago. Didn't think too much of it but not a good sign


    The screech could be the FDB (fluid dynamic bearing) spindle
    motor running out of oil. Only a couple of drops of
    oil are inside those motors. To detect oil loss under
    laboratory conditions at the factory, they actually weight
    the motors when new, and compare to the motor weight later
    (when they've failed or otherwise). You would think it would make
    sense to have ounces of oil present, but they only provide a
    few drops. The spindle of the motor is patterned, to function
    as a pump, and "circulate" the drops of oil over the shaft
    of the motor.

    When the motor starts, it is dry for the first few rotations,
    and if the screech was extremely short, maybe that's OK. Some
    FDB motors have one support point (and rely on the fluid bearing
    once the motor is up to speed). A few motors have two support
    points, so they cannot "wobble around" at startup. FDB is a
    great concept - it is used at hydroelectric dams, to cause
    generator bearings to be frictionless and last for a
    calculated 1000 year lifetime. The FDB motor is truly
    frictionless when up to speed. But in the case of the
    hard drive spindle motor, the fluid used is of limited
    volume, and can be forced out of the motor by
    excessive heat. Given enough time, the motor can dry out.

    If there was an oil filler hole, maybe things would
    be different :)

    Paul
    Paul, Jun 9, 2014
    #16
  17. Guest

    On Monday, June 9, 2014 9:15:47 PM UTC+1, Paul wrote:
    > wrote:
    >
    >
    >
    > > Oh and anther thing what are these network drives? Are they lower spec?

    >
    > > They seem to be cheaper. Apart from the 3TB which is more expensive.

    >
    > >

    >
    > > On and I forgot to say I had heard the head screeching before when I was not

    >
    > > moving the drive, ages ago. Didn't think too much of it but not a good sign

    >
    >
    >
    > The screech could be the FDB (fluid dynamic bearing) spindle
    >
    > motor running out of oil. Only a couple of drops of
    >
    > oil are inside those motors. To detect oil loss under
    >
    > laboratory conditions at the factory, they actually weight
    >
    > the motors when new, and compare to the motor weight later
    >
    > (when they've failed or otherwise). You would think it would make
    >
    > sense to have ounces of oil present, but they only provide a
    >
    > few drops. The spindle of the motor is patterned, to function
    >
    > as a pump, and "circulate" the drops of oil over the shaft
    >
    > of the motor.
    >
    >
    >
    > When the motor starts, it is dry for the first few rotations,
    >
    > and if the screech was extremely short, maybe that's OK. Some
    >
    > FDB motors have one support point (and rely on the fluid bearing
    >
    > once the motor is up to speed). A few motors have two support
    >
    > points, so they cannot "wobble around" at startup. FDB is a
    >
    > great concept - it is used at hydroelectric dams, to cause
    >
    > generator bearings to be frictionless and last for a
    >
    > calculated 1000 year lifetime. The FDB motor is truly
    >
    > frictionless when up to speed. But in the case of the
    >
    > hard drive spindle motor, the fluid used is of limited
    >
    > volume, and can be forced out of the motor by
    >
    > excessive heat. Given enough time, the motor can dry out.
    >
    >
    >
    > If there was an oil filler hole, maybe things would
    >
    > be different :)
    >
    >
    >
    > Paul


    OK first a progress report to get things up to date.
    I have successfully cloned my 500GB drive on my new ASUS machine (i3) onto
    the new 2TB drive I got today.
    Just to avoid confusion there is also a working 500GB old machine (a HewettPackard AMD 3800 X2) not sure if I mention that but it could cause confusion.
    I probably should back up the HP 500GB drive in the near future and that was previously backed up onto the failed 3TB drive.
    SO I booted up the ASUS on the new 2TB drive OK I then put the ASUS 500GB drive
    back in. When I booted on that I got to this screen, a BIOS screen
    http://images.anandtech.com/doci/6516/ASUS P8Z77-I Deluxe BIOS 01 - EZ.png

    Not sure if I accidentally hit ESC or something or if it went in their because
    it detected a hardware profile change? Thinking about it I may have connected it to a different SATA port, I think I did because it originally have a connector with a corner (right angle) on it, I think I connected it onto the flat connector I used for the clone. Hopefully that won't be a problem, Idon't think it will. I could not seem to get out of that menu so I ended up rebooting and it booted normally.


    Now.......regarding the failed 3TB drive, that came from an USB backup drive I got, so I never made it bootable I just copied files to it. However it did come with some backup software on it, although I never used it I just made a folder and copied stuff into it.

    So I think it may be just one big partition, but I don't know, it always showed up as one drive. H: usually.
    So I don't know if it has a MBR on it or not, I am not too familiar with USB drives. All it really had was a bunch of folders I back up to.
    It may have a full backup of my 500GB HP drive, however I think it only haspartial backup on, no complete operating system.

    anyway I have booted up my old HP and I am going to try the failed 3TB drive in the USB caddy, unfortunately I left the SATA cable in my new machine.
    But I understand I should be able to just as much with it on the USB as I would be able to do it it on SATA?

    I think HDtune and some other drive testing stuff is already on the HP frompreviously trouble.

    So I will have a go and see if I can run any test on it.

    So it seem I have two more thing to do, sort out the AVG thing and investigate the failed 3TB drive.

    I will have a go at those a late I need calm down a little and get things straight in my head.

    One thing which concerned me a little was when had finished testing the cloned 2T drive I shutdown and it gave out a little shriek!! Not too loud buta noise none the less. I am probably gonna have to retest that now.
    , Jun 9, 2014
    #17
  18. Guest

    On Monday, June 9, 2014 11:41:23 PM UTC+1, wrote:
    > On Monday, June 9, 2014 9:15:47 PM UTC+1, Paul wrote:
    >
    > > wrote:

    >
    > >

    >
    > >

    >
    > >

    >
    > > > Oh and anther thing what are these network drives? Are they lower spec?

    >
    > >

    >
    > > > They seem to be cheaper. Apart from the 3TB which is more expensive.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > On and I forgot to say I had heard the head screeching before when I was not

    >
    > >

    >
    > > > moving the drive, ages ago. Didn't think too much of it but not a good sign

    >
    > >

    >
    > >

    >
    > >

    >
    > > The screech could be the FDB (fluid dynamic bearing) spindle

    >
    > >

    >
    > > motor running out of oil. Only a couple of drops of

    >
    > >

    >
    > > oil are inside those motors. To detect oil loss under

    >
    > >

    >
    > > laboratory conditions at the factory, they actually weight

    >
    > >

    >
    > > the motors when new, and compare to the motor weight later

    >
    > >

    >
    > > (when they've failed or otherwise). You would think it would make

    >
    > >

    >
    > > sense to have ounces of oil present, but they only provide a

    >
    > >

    >
    > > few drops. The spindle of the motor is patterned, to function

    >
    > >

    >
    > > as a pump, and "circulate" the drops of oil over the shaft

    >
    > >

    >
    > > of the motor.

    >
    > >

    >
    > >

    >
    > >

    >
    > > When the motor starts, it is dry for the first few rotations,

    >
    > >

    >
    > > and if the screech was extremely short, maybe that's OK. Some

    >
    > >

    >
    > > FDB motors have one support point (and rely on the fluid bearing

    >
    > >

    >
    > > once the motor is up to speed). A few motors have two support

    >
    > >

    >
    > > points, so they cannot "wobble around" at startup. FDB is a

    >
    > >

    >
    > > great concept - it is used at hydroelectric dams, to cause

    >
    > >

    >
    > > generator bearings to be frictionless and last for a

    >
    > >

    >
    > > calculated 1000 year lifetime. The FDB motor is truly

    >
    > >

    >
    > > frictionless when up to speed. But in the case of the

    >
    > >

    >
    > > hard drive spindle motor, the fluid used is of limited

    >
    > >

    >
    > > volume, and can be forced out of the motor by

    >
    > >

    >
    > > excessive heat. Given enough time, the motor can dry out.

    >
    > >

    >
    > >

    >
    > >

    >
    > > If there was an oil filler hole, maybe things would

    >
    > >

    >
    > > be different :)

    >
    > >

    >
    > >

    >
    > >

    >
    > > Paul

    >
    >
    >
    > OK first a progress report to get things up to date.
    >
    > I have successfully cloned my 500GB drive on my new ASUS machine (i3) onto
    >
    > the new 2TB drive I got today.
    >
    > Just to avoid confusion there is also a working 500GB old machine (a Hewett Packard AMD 3800 X2) not sure if I mention that but it could cause confusion.
    >
    > I probably should back up the HP 500GB drive in the near future and that was previously backed up onto the failed 3TB drive.
    >
    > SO I booted up the ASUS on the new 2TB drive OK I then put the ASUS 500GBdrive
    >
    > back in. When I booted on that I got to this screen, a BIOS screen
    >
    > http://images.anandtech.com/doci/6516/ASUS P8Z77-I Deluxe BIOS 01 - EZ.png
    >
    >
    >
    > Not sure if I accidentally hit ESC or something or if it went in their because
    >
    > it detected a hardware profile change? Thinking about it I may have connected it to a different SATA port, I think I did because it originally have a connector with a corner (right angle) on it, I think I connected it onto the flat connector I used for the clone. Hopefully that won't be a problem,I don't think it will. I could not seem to get out of that menu so I endedup rebooting and it booted normally.
    >
    >
    >
    >
    >
    > Now.......regarding the failed 3TB drive, that came from an USB backup drive I got, so I never made it bootable I just copied files to it. However it did come with some backup software on it, although I never used it I justmade a folder and copied stuff into it.
    >
    >
    >
    > So I think it may be just one big partition, but I don't know, it always showed up as one drive. H: usually.
    >
    > So I don't know if it has a MBR on it or not, I am not too familiar with USB drives. All it really had was a bunch of folders I back up to.
    >
    > It may have a full backup of my 500GB HP drive, however I think it only has partial backup on, no complete operating system.
    >
    >
    >
    > anyway I have booted up my old HP and I am going to try the failed 3TB drive in the USB caddy, unfortunately I left the SATA cable in my new machine..
    >
    > But I understand I should be able to just as much with it on the USB as Iwould be able to do it it on SATA?
    >
    >
    >
    > I think HDtune and some other drive testing stuff is already on the HP from previously trouble.
    >
    >
    >
    > So I will have a go and see if I can run any test on it.
    >
    >
    >
    > So it seem I have two more thing to do, sort out the AVG thing and investigate the failed 3TB drive.
    >
    >
    >
    > I will have a go at those a late I need calm down a little and get thingsstraight in my head.
    >
    >
    >
    > One thing which concerned me a little was when had finished testing the cloned 2T drive I shutdown and it gave out a little shriek!! Not too loud but a noise none the less. I am probably gonna have to retest that now.


    OK a few things to report. I connected the £TB failed drive to the HP , as usually it did not show up in the 'my computer' as a drive.
    Actually a thing called 'autoplay' started and it make like it is copying stuff or whatever, it actually finished doing that but the drive still does not show up.
    It does show up in device manager/Dick drives as 'seagate external USB drive' though. Also I note the green LED on the drive periodically fades.
    I went into trouble shoot in the drives properties and auto play seemed to start for a while, but nothing much happening. It slows the machine down a lot when I try to view the drive in 'my computer'.

    Anyhow I have gone in a utility called diskCheckup, it shows up in there with a big red 'no entry' sign (stop) so not good. I cant run a self test on it in there says it can't do it as it is not a SMART drive.
    Is there any issue with it being USB or bigger than 2TB, which is too big for XP, so maybe I will be better off trying things on the new machine (win8..1)


    OK I tried running Recuva on it but it says 'Unable to read MFT. master file table presumably?

    Tried HD tune, the drive comes up as Seagate (375GB) and the temp just cays- C
    I tried a scan on it and it came up (pretty quickly) "damaged blocks! 100%!!


    So it is not looking good.

    Interesting thread here http://www.tonymacx86.com/general-h...eagate-barracuda-3tb-drives-keep-failing.html


    "I am on my third Seagate Barracuda 3TB drive. They all have the same problems. Sometimes it says needs to be initialized. Sometimes the drive is not seen at all."

    Third!! That's loyalty!!
    , Jun 10, 2014
    #18
  19. Paul Guest

    wrote:
    > On Monday, June 9, 2014 11:41:23 PM UTC+1, wrote:
    >> On Monday, June 9, 2014 9:15:47 PM UTC+1, Paul wrote:
    >>
    >>> wrote:
    >>>> Oh and anther thing what are these network drives? Are they lower spec?
    >>>> They seem to be cheaper. Apart from the 3TB which is more expensive.
    >>>> On and I forgot to say I had heard the head screeching before when I was not
    >>>> moving the drive, ages ago. Didn't think too much of it but not a good sign
    >>> The screech could be the FDB (fluid dynamic bearing) spindle
    >>> motor running out of oil. Only a couple of drops of
    >>> oil are inside those motors. To detect oil loss under
    >>> laboratory conditions at the factory, they actually weight
    >>> the motors when new, and compare to the motor weight later
    >>> (when they've failed or otherwise). You would think it would make
    >>> sense to have ounces of oil present, but they only provide a
    >>> few drops. The spindle of the motor is patterned, to function
    >>> as a pump, and "circulate" the drops of oil over the shaft
    >>> of the motor.
    >>> When the motor starts, it is dry for the first few rotations,
    >>> and if the screech was extremely short, maybe that's OK. Some
    >>> FDB motors have one support point (and rely on the fluid bearing
    >>> once the motor is up to speed). A few motors have two support
    >>> points, so they cannot "wobble around" at startup. FDB is a
    >>> great concept - it is used at hydroelectric dams, to cause
    >>> generator bearings to be frictionless and last for a
    >>> calculated 1000 year lifetime. The FDB motor is truly
    >>> frictionless when up to speed. But in the case of the
    >>> hard drive spindle motor, the fluid used is of limited
    >>> volume, and can be forced out of the motor by
    >>> excessive heat. Given enough time, the motor can dry out.
    >>> If there was an oil filler hole, maybe things would
    >>> be different :)
    >>> Paul

    >>
    >>
    >> OK first a progress report to get things up to date.
    >>
    >> I have successfully cloned my 500GB drive on my new ASUS machine (i3) onto
    >>
    >> the new 2TB drive I got today.
    >>
    >> Just to avoid confusion there is also a working 500GB old machine (a Hewett Packard AMD 3800 X2) not sure if I mention that but it could cause confusion.
    >>
    >> I probably should back up the HP 500GB drive in the near future and that was previously backed up onto the failed 3TB drive.
    >>
    >> SO I booted up the ASUS on the new 2TB drive OK I then put the ASUS 500GB drive
    >>
    >> back in. When I booted on that I got to this screen, a BIOS screen
    >>
    >> http://images.anandtech.com/doci/6516/ASUS P8Z77-I Deluxe BIOS 01 - EZ.png
    >>
    >>
    >>
    >> Not sure if I accidentally hit ESC or something or if it went in their because
    >>
    >> it detected a hardware profile change? Thinking about it I may have connected it to a different SATA port, I think I did because it originally have a connector with a corner (right angle) on it, I think I connected it onto the flat connector I used for the clone. Hopefully that won't be a problem, I don't think it will. I could not seem to get out of that menu so I ended up rebooting and it booted normally.
    >>
    >>
    >>
    >>
    >>
    >> Now.......regarding the failed 3TB drive, that came from an USB backup drive I got, so I never made it bootable I just copied files to it. However it did come with some backup software on it, although I never used it I just made a folder and copied stuff into it.
    >>
    >>
    >>
    >> So I think it may be just one big partition, but I don't know, it always showed up as one drive. H: usually.
    >>
    >> So I don't know if it has a MBR on it or not, I am not too familiar with USB drives. All it really had was a bunch of folders I back up to.
    >>
    >> It may have a full backup of my 500GB HP drive, however I think it only has partial backup on, no complete operating system.
    >>
    >>
    >>
    >> anyway I have booted up my old HP and I am going to try the failed 3TB drive in the USB caddy, unfortunately I left the SATA cable in my new machine.
    >>
    >> But I understand I should be able to just as much with it on the USB as I would be able to do it it on SATA?
    >>
    >>
    >>
    >> I think HDtune and some other drive testing stuff is already on the HP from previously trouble.
    >>
    >>
    >>
    >> So I will have a go and see if I can run any test on it.
    >>
    >>
    >>
    >> So it seem I have two more thing to do, sort out the AVG thing and investigate the failed 3TB drive.
    >>
    >>
    >>
    >> I will have a go at those a late I need calm down a little and get things straight in my head.
    >>
    >>
    >>
    >> One thing which concerned me a little was when had finished testing the cloned 2T drive I shutdown and it gave out a little shriek!! Not too loud but a noise none the less. I am probably gonna have to retest that now.

    >
    > OK a few things to report. I connected the £TB failed drive to the HP , as usually it did not show up in the 'my computer' as a drive.
    > Actually a thing called 'autoplay' started and it make like it is copying stuff or whatever, it actually finished doing that but the drive still does not show up.
    > It does show up in device manager/Dick drives as 'seagate external USB drive' though. Also I note the green LED on the drive periodically fades.
    > I went into trouble shoot in the drives properties and auto play seemed to start for a while, but nothing much happening. It slows the machine down a lot when I try to view the drive in 'my computer'.
    >
    > Anyhow I have gone in a utility called diskCheckup, it shows up in there with a big red 'no entry' sign (stop) so not good. I cant run a self test on it in there says it can't do it as it is not a SMART drive.
    > Is there any issue with it being USB or bigger than 2TB, which is too big for XP, so maybe I will be better off trying things on the new machine (win8.1)
    >
    >
    > OK I tried running Recuva on it but it says 'Unable to read MFT. master file table presumably?
    >
    > Tried HD tune, the drive comes up as Seagate (375GB) and the temp just cays - C
    > I tried a scan on it and it came up (pretty quickly) "damaged blocks! 100%!!
    >
    >
    > So it is not looking good.
    >
    > Interesting thread here http://www.tonymacx86.com/general-h...eagate-barracuda-3tb-drives-keep-failing.html
    >
    >
    > "I am on my third Seagate Barracuda 3TB drive. They all have the same problems. Sometimes it says needs to be initialized. Sometimes the drive is not seen at all."
    >
    > Third!! That's loyalty!!


    If the LED fades, that could be a powering problem.

    How is the 3TB drive powered ? By an adapter ?

    Paul
    Paul, Jun 10, 2014
    #19
  20. Guest

    On Tuesday, June 10, 2014 2:43:54 AM UTC+1, Paul wrote:
    > wrote:
    >
    > > On Monday, June 9, 2014 11:41:23 PM UTC+1, wrote:

    >
    > >> On Monday, June 9, 2014 9:15:47 PM UTC+1, Paul wrote:

    >
    > >>

    >
    > >>> wrote:

    >
    > >>>> Oh and anther thing what are these network drives? Are they lower spec?

    >
    > >>>> They seem to be cheaper. Apart from the 3TB which is more expensive.

    >
    > >>>> On and I forgot to say I had heard the head screeching before when Iwas not

    >
    > >>>> moving the drive, ages ago. Didn't think too much of it but not a good sign

    >
    > >>> The screech could be the FDB (fluid dynamic bearing) spindle

    >
    > >>> motor running out of oil. Only a couple of drops of

    >
    > >>> oil are inside those motors. To detect oil loss under

    >
    > >>> laboratory conditions at the factory, they actually weight

    >
    > >>> the motors when new, and compare to the motor weight later

    >
    > >>> (when they've failed or otherwise). You would think it would make

    >
    > >>> sense to have ounces of oil present, but they only provide a

    >
    > >>> few drops. The spindle of the motor is patterned, to function

    >
    > >>> as a pump, and "circulate" the drops of oil over the shaft

    >
    > >>> of the motor.

    >
    > >>> When the motor starts, it is dry for the first few rotations,

    >
    > >>> and if the screech was extremely short, maybe that's OK. Some

    >
    > >>> FDB motors have one support point (and rely on the fluid bearing

    >
    > >>> once the motor is up to speed). A few motors have two support

    >
    > >>> points, so they cannot "wobble around" at startup. FDB is a

    >
    > >>> great concept - it is used at hydroelectric dams, to cause

    >
    > >>> generator bearings to be frictionless and last for a

    >
    > >>> calculated 1000 year lifetime. The FDB motor is truly

    >
    > >>> frictionless when up to speed. But in the case of the

    >
    > >>> hard drive spindle motor, the fluid used is of limited

    >
    > >>> volume, and can be forced out of the motor by

    >
    > >>> excessive heat. Given enough time, the motor can dry out.

    >
    > >>> If there was an oil filler hole, maybe things would

    >
    > >>> be different :)

    >
    > >>> Paul

    >
    > >>

    >
    > >>

    >
    > >> OK first a progress report to get things up to date.

    >
    > >>

    >
    > >> I have successfully cloned my 500GB drive on my new ASUS machine (i3) onto

    >
    > >>

    >
    > >> the new 2TB drive I got today.

    >
    > >>

    >
    > >> Just to avoid confusion there is also a working 500GB old machine (a Hewett Packard AMD 3800 X2) not sure if I mention that but it could cause confusion.

    >
    > >>

    >
    > >> I probably should back up the HP 500GB drive in the near future and that was previously backed up onto the failed 3TB drive.

    >
    > >>

    >
    > >> SO I booted up the ASUS on the new 2TB drive OK I then put the ASUS 500GB drive

    >
    > >>

    >
    > >> back in. When I booted on that I got to this screen, a BIOS screen

    >
    > >>

    >
    > >> http://images.anandtech.com/doci/6516/ASUS P8Z77-I Deluxe BIOS 01 - EZ.png

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Not sure if I accidentally hit ESC or something or if it went in theirbecause

    >
    > >>

    >
    > >> it detected a hardware profile change? Thinking about it I may have connected it to a different SATA port, I think I did because it originally have a connector with a corner (right angle) on it, I think I connected it onto the flat connector I used for the clone. Hopefully that won't be a problem, I don't think it will. I could not seem to get out of that menu so I ended up rebooting and it booted normally.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Now.......regarding the failed 3TB drive, that came from an USB backupdrive I got, so I never made it bootable I just copied files to it. However it did come with some backup software on it, although I never used it I just made a folder and copied stuff into it.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> So I think it may be just one big partition, but I don't know, it always showed up as one drive. H: usually.

    >
    > >>

    >
    > >> So I don't know if it has a MBR on it or not, I am not too familiar with USB drives. All it really had was a bunch of folders I back up to.

    >
    > >>

    >
    > >> It may have a full backup of my 500GB HP drive, however I think it only has partial backup on, no complete operating system.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> anyway I have booted up my old HP and I am going to try the failed 3TBdrive in the USB caddy, unfortunately I left the SATA cable in my new machine.

    >
    > >>

    >
    > >> But I understand I should be able to just as much with it on the USB as I would be able to do it it on SATA?

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> I think HDtune and some other drive testing stuff is already on the HPfrom previously trouble.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> So I will have a go and see if I can run any test on it.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> So it seem I have two more thing to do, sort out the AVG thing and investigate the failed 3TB drive.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> I will have a go at those a late I need calm down a little and get things straight in my head.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> One thing which concerned me a little was when had finished testing the cloned 2T drive I shutdown and it gave out a little shriek!! Not too loud but a noise none the less. I am probably gonna have to retest that now.

    >
    > >

    >
    > > OK a few things to report. I connected the �TB failed drive to the HP , as usually it did not show up in the 'my computer' as a drive.

    >
    > > Actually a thing called 'autoplay' started and it make like it is copying stuff or whatever, it actually finished doing that but the drive still does not show up.

    >
    > > It does show up in device manager/Dick drives as 'seagate external USB drive' though. Also I note the green LED on the drive periodically fades.

    >
    > > I went into trouble shoot in the drives properties and auto play seemedto start for a while, but nothing much happening. It slows the machine down a lot when I try to view the drive in 'my computer'.

    >
    > >

    >
    > > Anyhow I have gone in a utility called diskCheckup, it shows up in there with a big red 'no entry' sign (stop) so not good. I cant run a self teston it in there says it can't do it as it is not a SMART drive.

    >
    > > Is there any issue with it being USB or bigger than 2TB, which is too big for XP, so maybe I will be better off trying things on the new machine (win8.1)

    >
    > >

    >
    > >

    >
    > > OK I tried running Recuva on it but it says 'Unable to read MFT. masterfile table presumably?

    >
    > >

    >
    > > Tried HD tune, the drive comes up as Seagate (375GB) and the temp just cays - C

    >
    > > I tried a scan on it and it came up (pretty quickly) "damaged blocks! 100%!!

    >
    > >

    >
    > >

    >
    > > So it is not looking good.

    >
    > >

    >
    > > Interesting thread here http://www.tonymacx86.com/general-h...eagate-barracuda-3tb-drives-keep-failing.html

    >
    > >

    >
    > >

    >
    > > "I am on my third Seagate Barracuda 3TB drive. They all have the same problems. Sometimes it says needs to be initialized. Sometimes the drive is not seen at all."

    >
    > >

    >
    > > Third!! That's loyalty!!

    >
    >
    >
    > If the LED fades, that could be a powering problem.
    >
    >
    >
    > How is the 3TB drive powered ? By an adapter ?
    >
    >
    >
    > Paul


    Yes but I don't think it is the adaptor, certainly the drive didn't seem towork when connected on SATA either. However that was on XP which only supports up to 3TB I think.

    I may try it in this new machine, I am currently running on my new 2TB drive, but it's installed properly in a bay. However I am going to go back on the 500GB one now and see it it powers down OK ie without a noise as happened before when I powered down.
    , Jun 10, 2014
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. TrickTrash
    Replies:
    12
    Views:
    3,785
    TrickTrash
    Jan 21, 2007
  2. hi2u
    Replies:
    3
    Views:
    966
    philo
    Jul 30, 2007
  3. Gerard Bok

    Re: Problem with USB 2.0 devices in USB 1.1 system

    Gerard Bok, Aug 24, 2005, in forum: A+ Certification
    Replies:
    0
    Views:
    444
    Gerard Bok
    Aug 24, 2005
  4. Glenn
    Replies:
    0
    Views:
    546
    Glenn
    Aug 25, 2005
  5. Replies:
    0
    Views:
    1,114
Loading...

Share This Page