repair security descriptors - entire drive - how?

[16k_zx81]

Doing a gfx card replacement, hard drive on machine suddenly decided not to boot

Slaved it to another machine. SMART OK, but filesystem all messed up. No idea why - hadnt touched it.

Ran several passes chkdsk - which has made the drive readable. Took most of the day to run.

but now the security descriptors are borked.

Does anyone know of a way to repair this without a reformat?

Thanks

screenshot
http://prntscr.com/2vvx5v

 

[FremontPC]

I would think that checkdisk would have handled that. Are you using the same sata cable from the afflicted PC to slave it to yours?

Just for the halibut:

1:
HDD model
PC/Mobo model
OS

2:
What SMART test(s) did you run?
UDMA CRC error count?

Something just ain't right here. Can't quite put my finger on it.

 

[16k_zx81]

I would think that checkdisk would have handled that. Are you using the same sata cable from the afflicted PC to slave it to yours?

Just for the halibut:

1:
HDD model
PC/Mobo model
OS

2:
What SMART test(s) did you run?
UDMA CRC error count?

Something just ain't right here. Can't quite put my finger on it.

No. Two different systems.

WD5000AAKS
GA-M57SLI-S4
Windows Vista (TM) Home Premium Service Pack 2

http://prntscr.com/2vwtjr
http://prntscr.com/2vwto4

 

[FremontPC]

The raw read error rate bothers me a bit. Keep an eye on it and if it increments, I'd call the drive. I've seen Nforce chips fail from heat and AMD boards can be intolerant of the same cards that would work fine on Intel-based boards.

Map it with MHDD and see what the >500ms count is.

All that aside and in response to your initial question, I'm coming up empty-handed on the descriptors fix, perhaps 300DDR or lcoughey can jump in here and give some guidance.

Shot in the dark, clone it to a known good drive and run chkdsk on that?

 

[lcoughey]

My guess is that the timing of the drive failure might be coincidental. The running of a chkdsk on a drive before getting a full clone was a very bad move, as it fixes a broken MFT and doesn't take into consideration why it is broken. So, if a head is weak or there is sector damage within the MFT, you just made a huge mess.

That being said, if you haven't done so already, now would be a good time to get a full clone of the drive, if you still can.

The AAKS series of WD drives are known for PCB and head issues...take the PCB off and see if there are are signs of scorch marks around the chips.

If the data is of any value, it might be worth getting assessed by a data recovery professional before too much more damage is caused. Unfortunately, nobody can undo any damage caused by chkdsk, but we may still be recover the files that are now no longer referenced.

 

[lcoughey]

Here are the steps that I would have recommended taking right away...you can try them now, assuming that the drive is healthy and there is no chance that this project will end up at a data recovery lab.

1. Verify that the drive is stable. Check the PCB. You may need to replace it with an identical match with the ROM contents (U12 or programming) transferred.
2. Mirror the drive to a known healthy drive of equal or larger capacity that has been cleanly wiped with zeroes (we don't want cross contamination) with ddrescue - if you encounter any significant volume of read errors, you should seriously reconsider outsourcing the job
3. Scan the clone drive with a program like R-Studio
4. Save the recovered data to a destination other than the original or the clone drive
5. Open and verify random files (doc, xls, jpg) to confirm that the recovered files are not corrupt
6. Confirm with the client that you have found 100% of their files and that nothing is missing.

Good luck.

 

[FremontPC]

Thanks, Luke.

Is the Raw Read Error Rate something worth looking out for on WD drives? I know Seagate reports this differently and you typically see huge numbers that mean nothing without interpretation.

Otherwise, SMART on this drive is looking clean, no reallocations, nothing pending, UDMA CRC is clean, etc.

 

[lcoughey]

I generally pay no attention to SMART reports. I'd say that this report certainly suggests that this drive should be replaced.

 

[FremontPC]

"I generally pay no attention to SMART reports."

Not too surprising, as by the time a drive gets to you, you're not asking that sort of question. I would imagine the model number is of more use to you than a SMART report.

On my side of the bench, it's one of the tools I use first, before a SMART self-test (something I rarely use). If the SMART numbers look bad, I'm on the phone to the customer, asking about backups, is the data important, etc.

That assumes that the drive isn't making odd noises right off the bat.

 

[KovaTech]

Sorry if iv got the wrong end of the stick here, but are you looking to reset the file permissions?

This might help http://www.tweaking.com/content/page/reset_file_permissions.html

 

[citizensmith]

Im on that other end of that stick ^ too Do you mean how to Reset ACLS to defualts using secedit? link http://social.technet.microsoft.com...all-security-permissions-to-default-windows-7
Used to be a tool for that in the ol'nt4 days