Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Can I get the data off this 2.5" HDD?


  • Please log in to reply
38 replies to this topic

#16 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 07 April 2024 - 08:02 PM

I ninja'd you. See post #14 now that I've edited it. 

 

Testdisk recognized the partition in question as being EUFI. I assumed it was probably correct. Does anyone know how good Testdisk is at guessing format type?

 

Here's what the Deeper command has output so far:

 

Do I need to let this scan finish, or are the results that show already enough to tell me what I need to know?

 

 

        

Attached Files


Edited by Shplad, 07 April 2024 - 08:21 PM.

- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


BC AdBot (Login to Remove)

 


#17 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 34,434 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:41 AM

Posted 07 April 2024 - 08:16 PM

Let the scan finish and go from there

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra


#18 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 07 April 2024 - 08:29 PM

Guys?

 

Am I even doing the right scan? I don't know whether this partition was EUFI formatted, I'm just guessing because there are other partitions on the drive that are tagged [EFI System Partition], so I'm assuming all partitions are EUFI/GPT method here, right?

 

I'm estimating it's going to take over 20 hours straight to do the scan. That's why I'm asking. If the current output results are enough to tell me all I need to know, I don't wanna finish the scan. Wouldn't they be adequate, since Testdisk already reported there was no backup boot sector or does the Deeper command scan through the whole partition to look for a backup boot sector?

 

The Testdisk docs aren't really all that clear to me. I know John will know the answers to these questions. Not sure if you do, Dan.


Edited by Shplad, 07 April 2024 - 08:33 PM.

- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#19 JohnC_21

JohnC_21

  •  Avatar image
  • Members
  • 34,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 07 April 2024 - 08:29 PM

The MSdata that is listed as Acer. Use the arrow keys to highlight it. Change the Deleted Partition to Primary using the arrow keys. Press the upper case P key. Do you see your files? The last two MSdata partitions should stay deleted.

 

In your edited image can you highlight it? If yes, then press the upper case P key. Do you see your files?

 

Was the image previous to your edited image from using a Quick Scan?


Edited by JohnC_21, 07 April 2024 - 08:39 PM.


#20 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 07 April 2024 - 08:48 PM

OOh, wait...I'm getting confused. 

 

The current (Deeper) scan is now still at 1%. It seems to be still trying but not moving.

 

You want me to change the deleted partition to primary? Or...I'm confused. Can you please restate, maybe using numbers, step by step?


- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#21 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 07 April 2024 - 08:52 PM

Oops! The progress indicator started moving again. 


- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#22 JohnC_21

JohnC_21

  •  Avatar image
  • Members
  • 34,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 07 April 2024 - 09:01 PM

Just let it run. I was inquiring about your first image which is now gone. That shows about 5 partitions. Was that image after a Quick Scan? Can you post that image again?


Edited by JohnC_21, 07 April 2024 - 09:02 PM.


#23 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 07 April 2024 - 09:20 PM

Which image was that?


- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#24 JohnC_21

JohnC_21

  •  Avatar image
  • Members
  • 34,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 08 April 2024 - 07:08 AM

Okay, that was my fault. I must have been tired. I meant the image in your post #14. Was that after a Quick Search?



#25 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 08 April 2024 - 09:13 AM

I think so. It took just a few minutes to get that data.

 

I'm still in the Deeper scan, at the 40% mark. Will keep you posted.


- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#26 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 08 April 2024 - 02:15 PM

Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63

Analyse cylinder 63957/121600: 52%

Read error at 17924/147/15 (lba=287958335) 

 

 

Currently at 52% and has been trying the same sector for about 1 hour. Is it going to repeat efforts to re-read the sector infinitely, because if so, that's not going to do me much good. Anyone know if there is a/what is the maximum number of retries value before Testdisk times out?                                                                                   


Edited by Shplad, 08 April 2024 - 02:15 PM.

- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#27 wee-eddie

wee-eddie

  •  Avatar image
  • Members
  • 3,871 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Ayr, Scotland
  • Local time:06:41 AM

Posted 08 April 2024 - 02:28 PM

An hour is neither here nor there. Give it 12 but, you may need to give it an overnighter., at least



#28 JohnC_21

JohnC_21

  •  Avatar image
  • Members
  • 34,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 08 April 2024 - 03:20 PM

If it doesn't move off that sector in the next couple of hours I would stop the scan then go back and do a Quick Search. After a Quick Search post an image.



#29 Shplad

Shplad
  • Topic Starter

  •  Avatar image
  • Members
  • 6,554 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:41 AM

Posted 09 April 2024 - 10:31 AM

Okay, it's been trying to read 64034/244/13 for about 12-13 hours. Here's the output. I assume the Mac HFS and FAT entries are just the program trying to figure out which partition type is the partition in question?
 
What now?
 
TestDisk 7.2-WIP, Data Recovery Utility, May 2021                                                                              Christophe GRENIER <grenier@cgsecurity.org>                                                                                    
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
Analyse cylinder 64034/121600: 52%
Read error at 64031/244/13 (lba=1028673399)


Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
     MS Data                 54178387   54184560       6174
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
     MS Data                 54184560   54190733       6174 [Boot]
check_FAT: number of bytes per sector mismatches 20150 (FAT) != 512 (HD)
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
     MS Data                132325107  132331280       6174
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)                               
MS Data                132331280  132337453       6174 [Boot]
     Mac HFS                266066735 1549523760 1283457026                                      
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 4 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 17 (FAT) != 63 (HD)
     MS Data                384322518  384343256      20739 [NO NAME]
check_FAT: Unusual, only one FAT
check_FAT: Bad number of entries in root dir
     MS Data                961159456 2878292255 1917132800
                                                                                  

Edited by Shplad, 09 April 2024 - 10:48 AM.

- Use this to collect and post information about your PC hardware, software and configuration (Whether or not you have crashing).

 

Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 & Vista

https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

 

 


#30 JohnC_21

JohnC_21

  •  Avatar image
  • Members
  • 34,803 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 09 April 2024 - 11:18 AM

I would stop the scan. Start Testdisk again and do a Quick Scan. Post an image after the Quick Scan.






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users