Hi Team,
I have 500 GB data on WD 1 TB external USB hard drive. i have connected this drive on a Linux box and copied some data. Now it is asking for format the drive on windows 7 as it is detected as RAW.
I feel that partition table must have corrupted. How to retrieve the same. I know that I can retrieve the data by using any data recovery software. I need to restore the partition table as it was. any help?
Tried using Encase and FTK, but no luck . kindly advise.
Thanks
I hope you didn't removed the harddisk from the case. WD is great in attaching a specific controller with encryption between the USB connection and the HD.
If you know what filesystem it was before, probably NTFS of exFAT, there are lots of (free) tools to recover a corrupt partition.
For NTFS you could have a look at EaseUS partition recovery.
Google is your friend.
Thanks @ kbertens
i have not removed hdd from WD case. It is NTFS partitions only, even i tried with easus partition recovery and the proceed option was disabled.
one more thing i noticed that a EXT partition has created on first sectors.
Thanks @ kbertens
i have not removed hdd from WD case. It is NTFS partitions only, even i tried with easus partition recovery and the proceed option was disabled.
one more thing i noticed that a EXT partition has created on first sectors.
I feel that partition table must have corrupted. How to retrieve the same. I know that I can retrieve the data by using any data recovery software. I need to restore the partition table as it was. any help?
Tried using Encase and FTK, but no luck . kindly advise.
Well it depends on WHICH "data recovery software", TESTDISK attempts to rebuild a valid partition table.
You can use DMDE to the same (or similar) effect.
Usually however, and particularly in the case of primary partitions (if disk is MBR style) it is rather easy to recreate a partition table manually, as long as the volumes are "sound" and have a valid PBR/bootsector, and in the case of NTFS there is (hopefully) the added "safety" of the backup bootsector.
In a nutshell
1) TESTDISK will be able to rebuild a valid partition table in most cases
2) if it cannot or you want more control on the procedure you can use *any* hex/disk editor to find the bootsectors and extract form their BPB the data to recreate the corresponding partition table entry.
Shameless plug wink but if you use Tiny Hexer and my "Structure Viewers"
http//
it might be easier, the "Sectors Before" and "Large Sectors" in Boot Sector View (if FAT or similar) are the same values as "Start LBA" and "Num LBA" in MBR view (for NTFS "Num LBA" = "Total Sectors" +1 )
jaclaz
Thanks @ Jaclaz
even i tried with TESTDISK and it could not find a valid ptable.
I will try with the second method you mentioned )
Are you sure there is data on the disk.
The best starting point is looking with a Hex editor. Start at typical points for the MFT eg 0x600800, 0x60003f
Do some data carving on the disk to make sure you can see valid files. If you can see valid data, then it worth 'playing' with partition searching. If not, you will need to start with plan 'B', ie why is the data corrupted, encrypted etc.
Most disks have some jpegs, data carving will find these.