Best app for partition recovery

On 17/02/2014 00:57, Paul wrote:
Jim wrote:
On 16/02/2014 20:48, Paul wrote:
Jim wrote:

Hi guys thanks for your replies so far i'm in a real pickle here.
The drive is a new WD3TB Black, however it is only showing up in
recover software as 747GB, i need it to be able to show me what is
on the whole 3TB drive any idea folks?
I love these fat drives but when you loose em it's a nightmare.

Jim

Piece of cake. I've seen this, but it's a function of
the OS you're using. I get similar symptoms in Win2K.
(I have a 3TB WD Black.)

It also depends, on what you used to prepare the drive.
Western Digital provides a free copy of Acronis TIH, suitable
for installing the Extended Capacity Manager. Only problem is,
at some point in the past, I installed some other Acronis
software, it installed a driver, and the driver was not
removable. So the new software, could not install its driver.
This complicates the process of getting the
Extended Capacity Manager working.

I can promise you, that the data is still accessible. I was
able to access the upper 747GB, using a loopback mount in
Linux, using a little-known offset parameter. That allows
me to get to the partitions that might be hiding up near
the end. But to do that, I had a fairly good idea, what
the offset should be. It only took a little bit of searching,
by taking snapshots with "dd", to figure out where the file
system header was.

I doubt one of the older data recovery programs is going
to be entirely happy working on your problem. So perhaps
you can provide a few details of what you've tried, and
I'll see if I can jog my memory as to what I did to fix it.

I've worked with the Extended Capacity Manager twice,
and both experiences were horrible (blinding rage horrible).

The Acronis TrueImage Cleanup Utility is here. It
can remove the old driver, if one is present. The Acronis
staff thought you could not successfully write one of these,
but a user in one of their forums, showed them how.
(If the driver is uninstalled in the wrong order, it
would cause the OS to blue screen.)

http://kb.acronis.com/content/34876

A standalone driver package exists. When I installed
this in Windows 8.1 Preview for example, I was able
to use the entire 3TB of disk, just as I see it in
WinXP today. But the required metadata was already on
the disk, for that driver to use.

https://kb.acronis.com/system/files/...ksetup2013.zip


But what that doesn't do, is it doesn't do the
Extended Capacity Manager step. ECM writes a 256KB
chunk of metadata, at the 2TiB mark. The upper virtual
disk, appears just after that point. And both times I
worked with ECM, it *refused* to allow me to click the
button, and install. And I didn't keep careful notes,
with all the flailing I was doing, of what fixed it.

So bottom line is:

1) Your data isn't lost. It can be accessed from Linux, for
free, with a bit of work. The upper 747GB or whatever,
is treated like a big bitmap. The -o loop option in the
Linux mounter, allows a file system to be mounted on a
mount point. Even though Linux would not normally allow
access above 2TiB on an MBR disk, the offset in the loopback
mounter supports 64 bit numbers.

2) Depending on OS, the OSes behave stupidly, even when you
do things mostly right. I've tried cranking down the
first 2TB partition by small amounts, to get them to behave
better. But I think what was really ****ing off the OS,
was cylinder offsets (WinXP style) versus megabyte offsets
(Windows 7 style). The Extended Capacity Manager, was using
one style on the lower disk, and another on the virtual disk.

Acronis should be soundly whipped, for the mess they made there.
Not a pleasant experience at all, and double the work for
me that it should have been. Thank God they made that
Cleaner utility, or I'd still be swearing and tearing
out my hair!

Paul
Hi Paul thanks for the reply, boy is this a can of worms i wish i had
never opened and stuck with my smaller 1TB Blacks.

OK when i started using these 3TB drives i was coming up withthe
2.2TB issue and suggested to use GPT or something like that but what
i didn't like was at the begining of the drive was a smaller 128mb
hidden partition so i wanted to find a way round it and format the
drive keeping it nice and clean and i used so many differnt apps to
get it the way I wanted i thinkn i used a free app from Paragon
called "Paragon partition manager free edition" but i can't be 100%
to be hobnest on how it was formated it could have been a number of
way. i was going to reformat it using GPT but thought better of it,
as yet i have wrote nothing to the dud drive. I know my data is there
but getting it is not straight forward.

I am running a new instal of win 7 U x64 to be honest i should be
able to get my hands on any of the latest software most offer
shareware with option to upgrade to recover so i'm happy to do that,
i'm willing to buy anything to get my data back.

Jim

According to this, the partition type on the protective MBR would be
0xEE if you had set it up GPT.

http://en.wikipedia.org/wiki/GUID_Partition_Table

You can use PTEDIT32, to look at the MBR partition table. Even if
it's the "fake" "protective" MBR, you can still look at it to verify
you did set it up as GPT. You unzip that first. Then, right click
on the ptedit32.exe program, and select "Run as Administrator". The
program returns an Error 5 if you attempt to use it without the
Administrator authority (since it accesses the raw disk).

ftp://ftp.symantec.com/public/englis...s/PTEDIT32.zip


Once you've got some positive feedback, as to what it is,
you can try TestDisk, as a confidence builder. The idea
would be, to see if TestDisk sees GPT or not.

http://en.wikipedia.org/wiki/Testdisk

"TestDisk recognizes the following disk partitioning:

...
GUID Partition Table === GPT
"

Note that, most of the time, you get an "opinion" from TestDisk,
and don't accept it's offer to write anything back. If you
need to quit TestDisk, you can press control-C to stop it.
It would probably take a long time, for it to scan the whole
disk on 1MB boundaries or something, looking for file system
headers. The reason for not immediately accepting an offer
to write a new disk header, is because it doesn't do enough
checks and balances. But still, it can be educational, to
see what it is capable of digging up.

TestDisk can display the file names in a partition it finds.
Which would be another confidence builder.

http://www.cgsecurity.org/mw/images/List_files.gif

( http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step )

*******

The article on "GUID_Partition_Table" says:

"GPT also provides redundancy, writing the GPT header and
partition table both at the beginning and at the end of
the disk.
"

That suggests to me, if something has "gone missing", it's
the file system header in the partition itself that
got damaged somehow.

You might also check Event Viewer, to see if the
software that attempts to mount file systems, has left
any error message(s) about what it found.

Using CHKDSK, would be reserved for the home stretch,
when the partition is mountable. CHKDSK is a double-edged sword,
in that, if the disk is health, it's probably worth running.
If the disk has problems with read/write or mechanical problems,
CHKDSK can make things much worse than when you started. CHKDSK
has been known to entirely trash a partition, when the disk itself
is sick or an IDE cable is slightly loose.

Paul
Afternoon Paul, well this is looking more worrying as it only ever seems
to show up as 750 odd GB, having ran PTEDIT32 and testdisk i took some
screen shots and stopped because testdisk gave a message saying not to
go any further if disk size was reported wrong which it is, below are
the links for screen shots.

http://imageshack.com/a/img716/2622/34nm.jpg
http://imageshack.com/a/img593/9896/gk7c.jpg

I was being quite optimistic last night and thought if this went well i
will not have enough spare space to take stuff off so i bought another
3TB Black last night, looks like i might have been kidding myself

Jim