Need help recovering pictures (recovery in general)

[shosterman]

Hello all,

A friend has given me a dead drive asking for some help retrieving some very important family pictures and I need some assistance with issues I'm not experienced in. But first, here is what I've done to date.

Drive: 60GB Hitachi Travelstar IC25N060ATMR04
Connected drive via USB to IDE. Drive was detected by Win7, but could not explore, was asked to format before using. Used TestDisk to open drive and Analyze, drive reports the following:

5013 MB / 4781 MiB - CHS 609 255 63
Warning: Incorrect number of heads / cyclinders 240 (NTFS) !=255
1 * HPFS - NTFS 0 1 1 7295 14 63 117195057
Warning: Bad ending cylinder (CHS and LBA don't match)

Since the above error is what I'm not familiar with, I wanted to be cautious with my troubleshooting. So what I did was use TestDisk to create a dd image of the drive (which came out to be about 55GB). Using GetDataBack I selected that image and was seemingly able to successfully restore the entire directory tree and files.

I say seemingly because when checking the integrity of the pictures I noticed that about 90% of them appeared corrupted and would not open.

This is where I am stuck and need your assistance. What would be the best method, if any, in getting those corrupted pictures restored correctly? Should I go back to the original drive and try to solve the incorrect size issue, fix that and create a new image? Should I clone the entire drive to another drive and work from that? Should I continue to work from that DD image and use specialized software in repairing those images? Or, should I do something else entirely, like hand this off to a professional recovery service?

I apologize this was so long, I just wanted to make sure I was able to get everything out. I should also state, I don't mind purchasing new software as long as it works and it's something I could add to my collection. Lastly, I consider myself fairly adept with many areas of the PC, just cautious when entering new territory.

I look forward to hearing your advice. However, since it's 2:00AM on the start of a large US holiday, I understand replies might not come immediately.

Take care,
Steve

 

[NickCat11]

Depending on how important the pictures are to the family I would most likely hand it off to a professional data recovery company like Drivesavers or Gillware at this point. It's a small drive so the cost of sending it out won't be to expensive. Gillware will probably be under $500. Drivesavers will probably be around $700-$800. Plus if you are a reseller you get a 15% kickback which you could always give back to the family if you are doing this one on the house.

 

[MobileTechie]

I've seen Testdisk give errors like this before and it wasn't a hardware problem. Testdisk reports this when CHS doesn't tally with the size of the disk. I've seen drives with this error work perfectly well despite it's rather critical appearance. I don't like Testdisk becase of this. I've no idea if this is the same in your case of course.

Did the user do anything like partitioning or formatting which might have messed the geometry up?

Have you checked the original disk with MHDD or similar? It would be good to know if there was anything actually wrong with the drive or whether this is purely a files system problem.

Have you tried Testdisk's stablemate PhotoRec?

BTW I agree with Nick that if the data is really important you might want to take it to a proper DR firm.

 

[shosterman]

I did ask about the partitions or maybe an accidental format but he could not remember as the drive was sitting in a closet for a couple years before he let me take a look at it.

I will consider MHDD and photorec this weekend, but ultimately both of you gave me reassurance to what I was thinking earlier, proper data recovery. The drive may appear fine now, but I would hate to have it suddenly die before a professional takes a look.

Thanks again. I'll update sometime later on final cost and results for future reference.

 

[MobileTechie]

My money would be on a corrupted file system and nothing more but I'll be interested to hear the next installment!

 

[CoffeeBean]

Try the Native OS first

You might try reading that drive on the same OS that formatted it. I've had trouble reading 32-bit XP Formatted drives under 64-bit 7, but they read fine on XP.

 

[Christophe Grenier]

Drive: 60GB Hitachi Travelstar IC25N060ATMR04
Connected drive via USB to IDE. Drive was detected by Win7, but could not explore, was asked to format before using. Used TestDisk to open drive and Analyze, drive reports the following:

5013 MB / 4781 MiB - CHS 609 255 63
Warning: Incorrect number of heads / cyclinders 240 (NTFS) !=255
1 * HPFS - NTFS 0 1 1 7295 14 63 117195057
Warning: Bad ending cylinder (CHS and LBA don't match)

Run TestDisk, in Geometry, set 240 heads, Advanced, select the NTFS partition, choose Boot, List (RebuildBS and List if it failed), select the files you want to recover and choose 'c' to copy them.

If it doesn't work, use PhotoRec, select the HD, select the NTFS partition, Search, choose '[Whole]' instead of '[Free]'. This will recover all your pictures (and other files).
Once the recover is done, use Windows file explorer to check the recup_dir.1, recup_dir.2... directories, sort the files by date/time.

Good luck

 

[Christophe Grenier]

I've seen Testdisk give errors like this before and it wasn't a hardware problem. Testdisk reports this when CHS doesn't tally with the size of the disk. I've seen drives with this error work perfectly well despite it's rather critical appearance. I don't like Testdisk becase of this. I've no idea if this is the same in your case of course.

Guess why TestDisk says Warning and not Error. With a mismatching geometry/CHS/LBA, the partition may be unbootable or it may be harder to undelete a lost partition (unable to find the lost partition or overlapping partitions). Geometry can be modified using the menu Geometry.