Need Help Recovering Hard Drive Files - Unknown Partitions

sampardee · 2017-03-01T16:28:08.000Z

Hi folks,

We have a Dell XPS L501X (circa 2010) on site. The motherboard died in it and I need to recover files from the drive. Naturally, I connected it to another PC with a USB/SATA interface connector, but it is showing up as RAW and cannot access any partitions on the disk.

I saw this with another Dell laptop (new laptop) a few weeks ago. I pulled the disk, connected it to another Windows PC and same thing, showed up as RAW. However, when I put the drive back in the laptop (which was still working) it booted right up.

Is there some kind of protection or encryption going on? How can I get access to these files? Using the original laptop is not an option as the motherboard isn’t receiving power from the charger, and the charger is fine. We don’t have another one to charge the battery, etc.

So far here is what I tried:

I tried connecting the drive to a Linux laptop. It at least picks up 2 partitions on the disk:

-Disk: Parition = MBR

-Part 1: /dev/sdb1 - HPFS/NTFS (Bootable) 839MB

-Part 2: /dev/sdb2 - Unknown, 499GB

mount -t ntfs-3g /dev/sdb2 /media/myntfsvol

-Got error messages, cannot read partition, etc…

We tried cloning to another drive w/ Clonezilla (so we can experiment with the clone and not do damage to original) and Clonezilla wouldn’t recognize partitions either, gave us errors while trying to clone from disk to disk and from disk to image.

I don’t know what else to try, or even have a technical explanation as to why I cannot access the files. Perhaps there is some kind of protection that was enabled from the original laptop? I’d greatly appreciate any help… thanks.

Sam

alexgraham3 · 2017-03-01T16:40:55.000Z

It’s not part of a RAID array is it?

sampardee · 2017-03-01T16:57:20.000Z

It is a single drive, I don’t know for certain though. How can I tell? I can’t boot the original laptop up.

sampardee · 2017-03-01T17:19:12.000Z

I think the drive may have a “Hidden Protected Area” which could be causing the issues… I’m not sure how to deal with this. I only need to recover files off of it.

mike-drivesavers · 2017-03-01T17:23:35.000Z

There should be some metadata on the front of the drive, even if it’s not part of a RAID. If you find more than one drive in the system, then it’s mostly likely part of a RAID. testdisk can search for the start of the partition and update the MBR. If you truly don’t have a backup, it’s best to dd the drive to another drive before writing new partitions, etc. If testdisk doesn’t work for you then any data recovery software should catch the partition properly.

If none of that works, then give DriveSavers a call and provide DS98006 to receive a discount for recovery. You have a really good chance that all data is on the drive, so nothing to fear here.

mike-drivesavers · 2017-03-01T17:25:01.000Z

Sorry, in re-reading your post you said that clonzilla had errors. What errors? Possible media damage?

alexgraham3 · 2017-03-01T17:26:39.000Z

Could be windows built in encryption; Bit Locker, but I don’t know much about it…

sampardee · 2017-03-01T18:05:14.000Z

It is a single drive, from a laptop. How can I DD this to another drive to be safe?

sampardee · 2017-03-01T18:07:27.000Z

Would BitLocker or some other encryption be turned on? I can’t even boot off of the drive in another laptop. It was a Dell XPS L501X.

UPDATE: I tried booting the drive from another laptop as well, and it did not work. However, I threw it in an old HP Pavilion G6 series laptop AND THE WINDOWS BOOT MENU IS SHOWING. Safe mode, Normal, etc. WTF?

sampardee · 2017-03-01T18:18:11.000Z

Guys, update: I’m in the desktop of Win 7 on the drive I was having problems with on a different laptop, recovering files now! Maybe it was maybe SATA/USB interface adapter that was goofing things up

I’d still like to know how to do a low level copy with dd

mike-drivesavers · 2017-03-01T18:19:37.000Z

Cheap adapter strikes again!! Maybe…can’t wait to hear the final news.

onikirimaru · 2017-03-01T18:23:03.000Z

first use a partition manager to identify the partitions in use on the drive. try to boot from a bootable cd or usb thumb drive (not the drive you are having issues with) that has drive utilites on it like Acronis, Linux live cd, BartPE. **note Acronis can copy most drives

@acroniscorporate5648

sampardee · 2017-03-01T18:26:45.000Z

Copying files to USB flash drive now! It booted up in safe mode, :D!

sampardee · 2017-03-01T18:29:01.000Z

I used HDAT2 to verify that it definitely was not a Hidden Protected Area, etc. Just throwing that out there… I will look into testdisk and dd so I can learn how to use those tools for future occurrences.

mike-drivesavers · 2017-03-01T18:47:11.000Z

dd is easy. On a non-critical drive, blow away the mbr and then use testdisk to find the partitions. Try is with 2 or 3 partitions to make sure you get it down. Not too hard.

sampardee · 2017-03-01T19:51:40.000Z

Using DD for disk cloning - Server Fault using dd easy as:

dd if=/dev/sda of=/dev/sdb bs=32M

^ regular clone

dd if=/dev/sda of=/dev/sdb bs=32M conv=noerror,sync

^ if disk has bad blocks

sampardee · 2017-03-01T19:52:56.000Z

The data has been fully recovered. Thanks guys!!!

mike-drivesavers · 2017-03-01T20:19:19.000Z

woot woot!! Now backup before you have 100 more SpiceHeads yell at you to do so, lol.

sampardee · 2017-03-02T00:52:55.000Z

Lol, We definitely will be

edwineekelaers2 · 2017-03-02T03:38:38.000Z

Meh had something like that happen to me on an old Lacie 2Tb drive where I stored a backup copy from my kids favourite cartoons… Still have them somewhere else but the sad thing is that it contained the complete Chinese soap series I used to watch with my wife before we got married ( the actual first HK drama we watched together ).

But no budget to send it of to Drivesavers so it’s bye bye files