Recovery efforts on a 1TB external HDD

[v1nsai]

I'll try to keep this short, but Western Digital sucks.

An external hard drive broke recently and I wasn't able to re-solder the micro usb back to the board, so I threw it out and kept the hard drive, thinking it's just a regular sata drive. Turns out that whenever the drive was used when it worked (it only recently became mine) a little Western Digital menu would pop up and had options, but since the connector for the board was broken and too small to re solder I threw it out. Apparently the MBA and/or partition table were stored on that little mini-BIOS, so now the drive is unusable.

I have tried changing the partition type with fdisk to all sorts of different things and then mounting, but I keep getting superblock errors. Not sure if that means I'm choosing the wrong partition or what.

Does anyone know how to detect the filesystem that was used on the disk? I have NOT formatted with fdisk, so that means the data is still there (right?). I'm a little unsure what to do next, never tried to fix anything like this before

[Carnildo]

What operating system are you trying to do this with?

[v1nsai]

For a problem like this my first choice was Linux but I have access to Windows and OSX as well if you know any good recovery programs on those platforms

[Jorpho]

These days the optimal way to do recovery is with a live CD or USB drive that runs Linux without having to do anything to your hard drive.

Specifically, last time I had this problem, http://www.ultimatebootcd.com was recommended.

However, if I'm not mistaken, the data on that little doohickey you tossed may be something even more vital, irreplaceable, and low-level than just the MBR (is that what you meant?) and partition table.

[Carnildo]

I'm pretty certain that the filesystem used is NTFS, with an outside chance of FAT32 (designing a filesystem is hard work, and corporations tend to be lazy). The partition table format I'm less certain about: it could be MBR, it could be GPT, it could be something proprietary, or it could be un-partitioned. In the last case, you could try mounting the disk directly ("mount /dev/sdx /mnt/cdrom -t ntfs" or "mount /dev/sdx /mnt/cdrom -t vfat") and see if it works. If all else fails, you can probably get most of the data back by running an appropriate data recovery tool.

This is all assuming an unencrypted hard drive. If it's encrypted, you could try cracking the encryption (easier than it sounds: the encryption on external hard drives is often badly flawed).

[v1nsai]

I'm pretty certain that the filesystem used is NTFS, with an outside chance of FAT32 (designing a filesystem is hard work, and corporations tend to be lazy). The partition table format I'm less certain about: it could be MBR, it could be GPT, it could be something proprietary, or it could be un-partitioned. In the last case, you could try mounting the disk directly ("mount /dev/sdx /mnt/cdrom -t ntfs" or "mount /dev/sdx /mnt/cdrom -t vfat") and see if it works. If all else fails, you can probably get most of the data back by running an appropriate data recovery tool.

This is all assuming an unencrypted hard drive. If it's encrypted, you could try cracking the encryption (easier than it sounds: the encryption on external hard drives is often badly flawed).

Code: Select all

Okay I found some data recovery tools, here's the output of 'testdisk /list /log'

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition                  Start        End    Size in sectors
[b]No FAT, NTFS, EXT2, JFS, Reiser, cramfs or XFS marker[/b]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]


The part I bolded looks useful, but I haven't figured out what a marker is yet......

I'm going to try using ddrescue to make an image of the disk, but its a 1tb so I'm going to have to get another disk to put it on. Can I mount a disk image with the mount command? Seems like that should work......would making an image then formatting the external hdd then burning the image onto it with dd solve anything? I'm going to spend some more time with ddrescue later, looks like I'm going to need an output disk to finish this.

These days the optimal way to do recovery is with a live CD or USB drive that runs Linux without having to do anything to your hard drive.

Specifically, last time I had this problem, http://www.ultimatebootcd.com was recommended.

However, if I'm not mistaken, the data on that little doohickey you tossed may be something even more vital, irreplaceable, and low-level than just the MBR (is that what you meant?) and partition table.

I'm not sure what could have been on that got dang adapter I threw away, what do you think could have been on it? If I hadn't thrown the housing away I could look up what model the whole enclosure was and maybe get some info, but the lady and I share a pretty small room and the computer parts everywhere were a pain in the ass and I'm pretty sure the enclosure got "cleaned up" from wherever I stashed it.

[Carnildo]

Can I mount a disk image with the mount command?

Assuming your copy of Linux was built with loopback filesystem support (it almost certainly was).

would making an image then formatting the external hdd then burning the image onto it with dd solve anything?

Unlikely. Unless you're dealing with bizarre or defective hardware, disk -> image -> disk should result in no overall change.

[Jorpho]

I'm not sure what could have been on that got dang adapter I threw away, what do you think could have been on it?

I cannot readily find the references I came across the last time I looked into this, but one possibility is "encryption" data. According to http://community.wdc.com/t5/Off-Topic-D ... d-p/353839 , it is a factor that comes into play even if you didn't set a password, but had a model that supported setting a password.

[v1nsai]

I'm not sure what could have been on that got dang adapter I threw away, what do you think could have been on it?

I cannot readily find the references I came across the last time I looked into this, but one possibility is "encryption" data. According to http://community.wdc.com/t5/Off-Topic-D ... d-p/353839 , it is a factor that comes into play even if you didn't set a password, but had a model that supported setting a password.

Damn. It.......I'm quite screwed unless I can find another enclosure huh? I don't know if I mentioned it already but the guy who owns the hard drive said that it had a special program built into it that popped up every time it was plugged in. He hated it and said it tried to make everything more user friendly which as we all know leads to more points of failure. What your talking about is starting to sound more likely. The possibility of finding a working enclosure is starting to sound a lot more likely than cracking what's going on here.

Gonna see if I can figure out what the heck I threw away....

[Jorpho]

Damn. It.......I'm quite screwed unless I can find another enclosure huh?

Not just any enclosure. If this is what it appears to be, you'll need a genuine Western Digital enclosure of the same model that the drive came in.

I don't know if I mentioned it already but the guy who owns the hard drive said that it had a special program built into it that popped up every time it was plugged in. He hated it and said it tried to make everything more user friendly which as we all know leads to more points of failure.

I've never dealt with fancy stuff like Passport before. What you are describing could just be an ordinary autorun program.