Go Back   Technibble Forums > General Computers > Tech-to-Tech Computer Help

  Technibble Sponsor

Reply
 
Thread Tools Display Modes
  #1  
Old 04-05-2012, 09:31 PM
computerdoc computerdoc is offline
 
Join Date: Sep 2009
Posts: 255
computerdoc is on a distinguished road
Default Rawcopy yields unreadable drive

Downloaded raw copy from roadkil.net. Ran a copy from a drive that is having some corruption errors. The copy took around 3 hours and completed with no errors. When we try to explore the drive it copied to the following error appears: f:\ is not accessible. The file or directory is corrupted and unreadable. Do we have a backup? We want to run chkdsk but are concerned about running it with no reliable backup.

Crystal Dlisk Info reports the source drive as healthy.
Reply With Quote
  #2  
Old 04-05-2012, 09:45 PM
Mr.Mike Mr.Mike is offline
 
Join Date: Aug 2009
Location: California Central Coast
Posts: 1,130
Mr.Mike is on a distinguished road
Default

Quote:
Originally Posted by computerdoc View Post
Downloaded raw copy from roadkil.net. Ran a copy from a drive that is having some corruption errors. The copy took around 3 hours and completed with no errors. When we try to explore the drive it copied to the following error appears: f:\ is not accessible. The file or directory is corrupted and unreadable. Do we have a backup? We want to run chkdsk but are concerned about running it with no reliable backup.

Crystal Dlisk Info reports the source drive as healthy.
Tried fixing the MBR? Was this machine subjected to rootkit damage?
Reply With Quote
  #3  
Old 04-05-2012, 09:50 PM
computerdoc computerdoc is offline
 
Join Date: Sep 2009
Posts: 255
computerdoc is on a distinguished road
Default

Do we need to fix the MBR in order to look at the drive as an external drive?

The source drive may be subject to rootkit damage but no virus has been identified to this point.
Reply With Quote
  #4  
Old 04-05-2012, 10:01 PM
Mr.Mike Mr.Mike is offline
 
Join Date: Aug 2009
Location: California Central Coast
Posts: 1,130
Mr.Mike is on a distinguished road
Default

Quote:
Originally Posted by computerdoc View Post
Do we need to fix the MBR in order to look at the drive as an external drive?

The source drive may be subject to rootkit damage but no virus has been identified to this point.
NO, you don't have to try to fix the MBR, but you indicated the F:/ drive was not accessible (Drive is not recognized by the OS). I recently had a client who had a rootkit (unclear if it was Zero Access variant) that scrambled the MBR. That kept me from using Fix MBR, CHKDSK, and other command level fixes, even when slaved to my bench rig. See if you can actually run one of these from the command prompt. If it's still inaccessible, then I would suspect a rootkit.

I am assuming you have done all the basic diagnostics for drive integrity and sector evaluations.

Last edited by Mr.Mike; 04-05-2012 at 10:04 PM.
Reply With Quote
  #5  
Old 04-05-2012, 10:17 PM
iisjman07's Avatar
iisjman07 iisjman07 is offline
 
Join Date: Jul 2009
Location: South End Of The UK
Posts: 3,045
iisjman07 has a spectacular aura aboutiisjman07 has a spectacular aura about
Default

RawCopy does a sector-by-sector copy of the drive, but didn't find any unreadable parts - reading between the lines here suggests logical file system/partition damage rather than physical.

Assuming you got your source and targets correct then yes, you should have a backup.
__________________
put that in your pipe and grep it
Reply With Quote
  #6  
Old 04-05-2012, 11:40 PM
Mr.Mike Mr.Mike is offline
 
Join Date: Aug 2009
Location: California Central Coast
Posts: 1,130
Mr.Mike is on a distinguished road
Default

Quote:
Originally Posted by iisjman07 View Post
RawCopy does a sector-by-sector copy of the drive, but didn't find any unreadable parts - reading between the lines here suggests logical file system/partition damage rather than physical.

Assuming you got your source and targets correct then yes, you should have a backup.
I should have mentioned that partition damage was also a result of the fore-mentioned rootkit. The OP should scan the backed-up drive for any nasties before restoration. Can't be too cautious.
Reply With Quote
Reply

Tags
chkdsk, hard drive errors, rawcopy

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 06:19 PM.


Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Technibble.com is based out of MELBOURNE, AUSTRALIA.