Rawcopy yields unreadable drive

[computerdoc]

Downloaded raw copy from roadkil.net. Ran a copy from a drive that is having some corruption errors. The copy took around 3 hours and completed with no errors. When we try to explore the drive it copied to the following error appears: “f:\ is not accessible. The file or directory is corrupted and unreadable.” Do we have a backup? We want to run chkdsk but are concerned about running it with no reliable backup.

Crystal Dlisk Info reports the source drive as healthy.

[Mr.Mike]

Originally Posted by computerdoc

Downloaded raw copy from roadkil.net. Ran a copy from a drive that is having some corruption errors. The copy took around 3 hours and completed with no errors. When we try to explore the drive it copied to the following error appears: “f:\ is not accessible. The file or directory is corrupted and unreadable.” Do we have a backup? We want to run chkdsk but are concerned about running it with no reliable backup.

Crystal Dlisk Info reports the source drive as healthy.

Tried fixing the MBR? Was this machine subjected to rootkit damage?

[computerdoc]

Do we need to fix the MBR in order to look at the drive as an external drive?

The source drive may be subject to rootkit damage but no virus has been identified to this point.

[Mr.Mike]

Originally Posted by computerdoc

Do we need to fix the MBR in order to look at the drive as an external drive?

The source drive may be subject to rootkit damage but no virus has been identified to this point.

NO, you don't have to try to fix the MBR, but you indicated the F:/ drive was not accessible (Drive is not recognized by the OS). I recently had a client who had a rootkit (unclear if it was Zero Access variant) that scrambled the MBR. That kept me from using Fix MBR, CHKDSK, and other command level fixes, even when slaved to my bench rig. See if you can actually run one of these from the command prompt. If it's still inaccessible, then I would suspect a rootkit.

I am assuming you have done all the basic diagnostics for drive integrity and sector evaluations.

[iisjman07]

RawCopy does a sector-by-sector copy of the drive, but didn't find any unreadable parts - reading between the lines here suggests logical file system/partition damage rather than physical.

Assuming you got your source and targets correct then yes, you should have a backup.

[Mr.Mike]

Originally Posted by iisjman07

RawCopy does a sector-by-sector copy of the drive, but didn't find any unreadable parts - reading between the lines here suggests logical file system/partition damage rather than physical.

Assuming you got your source and targets correct then yes, you should have a backup.

I should have mentioned that partition damage was also a result of the fore-mentioned rootkit. The OP should scan the backed-up drive for any nasties before restoration. Can't be too cautious.