Notifications
Clear all

disk recovery

3 Posts
2 Users
0 Reactions
578 Views
(@cforpro)
Trusted Member
Joined: 16 years ago
Posts: 45
Topic starter  

I have an 80GB 2.5" SATA drive that was brought to me. The owner has important photos that they would like to keep (but not bad enough to back them up). I had a hard time imaging the drive but finally got it using FTK Imager 2.7. The summary showed that sectors 5,735,497-5,735,555 were bad, as well as 5,736,288-143,524,735. According to PhotoRec there are 163,834,868 sectors. I'm currently recovering everything that I can get from the sectors that were good (from the image, not the drive). Any suggestions on getting anything from the bad sectors? ddrescue? anything else? The image is a raw (dd).

EDIT forgot to mention that it's a Dell with XP using NTFS. There should be a factory recovery partition on there, too.


   
Quote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

It is slightly surprising that you can read certain sectors, but the majority 5,736,288-143,524,735 are unreadable. This probably includes the MFT, typically at 0x60003f

Try reading middle sections incrementally, and add to an overall image of the disk. If possible, do try the MFT (at 0x60003f).

Disks can fail by losing a head that may be 25% gone in stripes, but the pattern you describe, in my view, is not typical


   
ReplyQuote
(@cforpro)
Trusted Member
Joined: 16 years ago
Posts: 45
Topic starter  

PhotoRec got back a lot of stuff. I'm sure there are more in those sectors though. I haven't tried opening it in FTK or EnCase since finally imaging it. I'll check the MFT table tomorrow. I don't want to spend too much time on it as it's for a former co-workers daughter and I don't want to charge her too much but I'll do what I can.

Thanks,
Danny


   
ReplyQuote
Share: