• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

HDD "blanked" overnight

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Hardware // Upgrades

View previous topic :: View next topic  
Author Message
graycat
SF Mod
SF Mod


Joined: 29 Apr 2005
Posts: 16777195
Location: London, UK

Offline

PostPosted: Fri Aug 01, 2008 12:56 pm    Post subject: HDD "blanked" overnight Reply with quote

Morning all

Wonder if some of you guru's can throw some light on a weird situation.

A while ago I gave my old Smasung X10 laptop to my brother for uni and whilst it was a few years old, it was more than up to the task. It had a minor quirk in that boot up into windows xp would sometimes hang at the splash screen but by making sure the hdd connection was pressed in firmly, it'd leap into action. Other than that, it's been a rock.

I got a call the other night saying it won't boot at all and was saying it couldn't find the media. He dropped it in at a PC shop to get assessed and the local techie says the hdd is now blank bar a 10Mb partition. Shocked

This worries me as
a) there hasn't been a partition of that size on there since I got it from the manufacture and blanked it completely
b) he was using it two days before quite happily
c) the techie says the drive is happy and healthy just not partitioned at all

to me this sounds like the MBT has gone out the window (Windows maybe?! Smile) so the disk is displaying as having nothing / the wrong config. However, I'm not sure and I certainly don't know of anything that'd cause this.

Also, I need tor recover some data off that disc so other than having them install a new 80Gb hdd and reinstall for me, i'm getting the drive sent on over. Any idea if it'll be readable or recoverable?

Any thoughts, comments, suggestions, advice is most appreciated.
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
PhiBer
SF Mod
SF Mod


Joined: 11 Mar 2003
Posts: 20
Location: Your MBR

Offline

PostPosted: Fri Aug 01, 2008 5:47 pm    Post subject: Reply with quote

Hi Graycat,
It is possible that the techie wiped it accidentally himself, unaware of what he was doing. Rolling Eyes

In terms of recovery, your first bet before you try anything is to pop a liveCD in (e.g. Knoppix) and move/backup the files to a share or USB stick. You might still be able to get some of the files.
Back to top
View user's profile Send private message
capi
SF Senior Mod
SF Senior Mod


Joined: 21 Sep 2003
Posts: 16777097
Location: Portugal

Offline

PostPosted: Fri Aug 01, 2008 6:59 pm    Post subject: Reply with quote

That's very strange indeed. It is of course quite possible that the tech screwed things up worse than they already were; however, something was wrong to begin with, since the laptop wasn't booting and complained of inexistent media.

My first bet would be a corrupt partition table. If the laptop had been having some issues with the hard drive (well, with the connectors or whatever) it is possible that the hard drive has suffered and become damaged over time. I'd get the drive back in my own hands, plug it in a working computer and check the S.M.A.R.T. logs. You can do this easily on a GNU/Linux system, by using the smartmontools suite of programs - in fact, there's even a port of that for Windows, so you should be able to get by if that's all you've got (in which case, shame on you Razz)

You can check the drive's S.M.A.R.T. status with a command such as:
Quote:
smartctl -a /dev/hda

where /dev/hda would be the device name of the hard drive you want to check (in Windows you'd use a different syntax, don't know it by heart but it's in the documentation).

As for getting data out. If you have the space and time, I would follow PhiBer's recommendation and do an exact image of the drive before doing anything else. If the drive does happen to be dieing, at least you will have saved its contents elsewhere for future recovery. Again, you can accomplish this very easily with any GNU/Linux system, by doing something such as:
Quote:
dd if=/dev/hda of=/path/to/backup.img

This would read all the raw data from the hard drive (in this example assuming the hard drive is at /dev/hda, i.e. the master on the primary IDE controller) and save it to a file called backup.img.

You will want to be very careful with using dd, though, if you're not familiar with the command's syntax and with Linux device names! dd will do whatever you tell it to do without asking. If you get the parameters wrong (e.g. you swap the input parameter "if" with the output parameter "of") you may end up unwittingly erasing files, partitions, or entire drives.

Something like Norton Ghost should work for the backup too, as long as you make sure to do a raw backup and not just a backup of the files or whatever, since the whole point is the filesystem is hosed).

After you have the backup, I would recommend trying TestDisk. This is a very good free and open source program designed to recover lost partitions and filesystems. It can, for example, scan the drive looking for signatures of known filesystem types and tell you where it thinks a partition existed, so that you can rebuild your partition table. If you're lucky and the problem is just a corrupt MBR then you should be able to rebuild the partition table without problems using TestDisk. If the situation is worse, the program may still be of help at least for partial recovery.

Of course, if all else fails, there's always the The Sleuth Kit.

Edited to fix wrong name for TestDisk software


Last edited by capi on Sat Aug 02, 2008 11:54 am; edited 1 time in total
Back to top
View user's profile Send private message
RoboGeek
SF Mod
SF Mod


Joined: 13 Jun 2003
Posts: 16777166
Location: LeRoy, IL

Offline

PostPosted: Sat Aug 02, 2008 1:29 am    Post subject: Reply with quote

Boot to a linux CD like knoppix (easy because of the drive icons) and you should see the missing partition. Its a common windows problem - the 10m partition you can see is most likely a FAT32 recovery partition - the NTFS partition is missing. I get about 2 a week in the shop like that.

btw.. booting it slaved in a windows box won't work. When windows cant see the partition natively it won't see it slaved either - including with UBCD and others
Back to top
View user's profile Send private message Visit poster's website
capi
SF Senior Mod
SF Senior Mod


Joined: 21 Sep 2003
Posts: 16777097
Location: Portugal

Offline

PostPosted: Sat Aug 02, 2008 2:20 am    Post subject: Reply with quote

RoboGeek wrote:
Boot to a linux CD like knoppix (easy because of the drive icons) and you should see the missing partition. Its a common windows problem - the 10m partition you can see is most likely a FAT32 recovery partition - the NTFS partition is missing. I get about 2 a week in the shop like that.

Damn... You know you've got a great operating system when it starts to not see valid partitions that are still there. Have fun with Windows, I'll stick with OSes that work Wink

I would assume the so-called tech would've at least used some sort of disk partitioning tool to check the contents of the disk, though. Then again, that's probably too much to expect from the average I'm-a-computer-guru-because-I-can-use-the-DOS-prompt shop tech.

Regarding the 10mb partition, the strange thing is that graycat says he blanked the drive himself prior to installing it. So there shouldn't be any recovery partition there unless something else created it, or the partition table got hosed (or Windows has yet another stupid bug that makes up partitions).
Back to top
View user's profile Send private message
AdamV
SF Mod
SF Mod


Joined: 06 Oct 2004
Posts: 24
Location: Leeds, UK

Offline

PostPosted: Sat Aug 02, 2008 7:41 am    Post subject: Reply with quote

TestDisk from cgsecurity was one which came up when I Googled about this problem trying to find a solution for Tim offline ("repair MFT" was my search).
It's good to know this has good things said about by trusted members here too, as I have been lucky enough to never need to recover anything as badly hosed as this.
Back to top
View user's profile Send private message Visit poster's website
capi
SF Senior Mod
SF Senior Mod


Joined: 21 Sep 2003
Posts: 16777097
Location: Portugal

Offline

PostPosted: Sat Aug 02, 2008 12:00 pm    Post subject: Reply with quote

Yup I meant to type TestDisk in my post above, not TestDrive. Just fixed that now.

The software is excellent indeed, and has saved me before on occasions where a partition had been deleted by accident, or the MBR had been hosed (can't remember how that happened, though). In the best case (where it's just the partition table that got erased and the data is all still there), recovery can literally be as easy as selecting the Scan option and letting the program find the filesystems itself to rebuild the partition table. It is possible to achieve full recovery in such situations. In tougher cases, you can still use it to manually edit the partition table, specify where partitions begin and where they ends, undelete files, things like that.

There are executable versions of TestDisk available for download that can run inside an existing GNU/Linux, Windows, DOS, and a bunch of other operating systems, and there are also bootdisks and live CDs that boot to run the program from scratch. Of course, for a recovery situation, the ideal is to boot from scratch instead of running from an OS that resides in the disk being recovered.
Back to top
View user's profile Send private message
graycat
SF Mod
SF Mod


Joined: 29 Apr 2005
Posts: 16777195
Location: London, UK

Offline

PostPosted: Wed Aug 13, 2008 3:28 pm    Post subject: Reply with quote

Cheers for all the replies, guys.

I've had them replace the drive with a new one and the original one has just landed on my desk this lunchtime so I'll be getting that mounted over a USB connection tomorrow, all things permitted.

One thing I did notice is that there's a nice rattle when you shake the drive so it may well be dead dead but we'll see.

Phiber - I hope it's something simple like that Laughing

capi - cheers for the pointers on the smartmontools. I knew there's be something about that'd do that kind of thing so thanks again. Yes, I'll be using the windows version to start off with as no linux here .... got OSX at home if that counts?

At the moment my plan of attack is to chuck it on a USB connection and see what windows sees first but I'm not hoping for much. After that i'll have to try and image it somehow probably using Knoppix or the like. If that still doesn't work then I'm looking at repairing the partition table. TestDisk and SleuthKit will be coming out to play at that point too.
One problem I've got at the moment is not having a spare laptop to throw it in and work on it that way. Well, technically I've got a spare laptop ... but it's missing the pin from the power supply so effectively a brick Smile lol

Again, many thanks for the suggestions, guys. Will post back how I get on. Smile
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Hardware // Upgrades All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Looking for more Windows Networking info?

Sign up to the WindowsNetworking.com Monthly Newsletter, written by Enterprise Security MVP Deb Shinder, containing news, the hottest tips, Networking links of the month and much more. Subscribe today and don't miss a thing!
View a sample newsletter.

Become a WindowsNetworking.com member!

Discuss your Windows Networking issues with thousands of other Windows Newtorking experts. Click here to join!

Community Area

Log in | Register

Readers' Choice

Which is your preferred data recovery solution?

Follow TechGenix on Twitter