Root Access

Hennes

14:10

Now I am wondering about F-O-O-O-F...

xCare

@Bob, you can read my extensive discussions about the issue to get a overview of the problem and steps I been trying to find a solution

Discussion on question by xCare: Reco…

Imported from a comment discussion on superuser.com/questions/...

and this was the original question:

2

Q: Recovering files when Windows 7 MBR has been corrupted

System Stats: Type: 64-Bit Desktop; OS: Windows 7 Premium; HD: Seagate Barracuda 750GB, S.M.A.R.T. Enabled. History: There is the complex situation I'm dealing with, I'll do my best to break it down: I've been up against some nasty guys in the gaming field and a few days ago, security soft...

Bob

@xCare First: have you taken an image of the disk?

xCare

I did figure out how to get MBR Wizard functioning. MBR Wizard is a tool that claims it can copy or restore an MBR (Master Boot Record), something I thought might be able to bring the drive into readable state

Bob

Testdisk is really the tool to use here.

Your goal at this point isn't to restore the MBR.

Don't even bother thinking about the MBR.

Your goal is to recognise and mount the filesystem to get some data off it.

@xCare Three questions.

1. Have you taken an image of the disk?

2. How many partitions were on the disk previously?

3. How were the partitions originally created?

xCare

1- I been trying but am having difficulty with that because I don't have drives big enough to store the image other than my 3.0 drives, and those won't recognize without windows.

There were 3 Partitions, one with MBR, one with MFT and one with the data

Bob

14:20

@xCare I would say you need a clone before continuing.

xCare

2- 3 Partitions.

Bob

I can think of a few options, but many are potentially destructive.

xCare

3- They came with the drive when I bought it, so manufacturer installed

Bob

@xCare That's not how partitions work.

The MBR is not part of any partition. It contains the table describing partitions.

The MFT is an artefact of FAT and NTFS filesystems and sits on the same partition as the FS.

In fact, the FS is completely internal to a partition - it doesn't care about anything outside of its own partition.

xCare

Right, but if you read in the steps of stuff I did, I used MiniTool which wrote the wrong MBR, and that conflicts I believe with the file table, making it difficult to read any data

Bob

14:22

...

This is why data recovery ALWAYS starts with an image.

You never, ever take destructive actions with your only copy of the data.

Bit late in hindsight, but keep that in mind for the future.

Also a very good reason to take an image now before continuing.

Buy another 1TB HDD if you have to, if this data is at all important to you.

xCare

can I ask a hypothetical question... say you have a drive with 1 TB, but the partition on it is 700 GB, how can you extend that partition to cover the whole drive?

Bob

As of now, I can think of a couple nondestructive options, which basically sum up to: trying to find the actual partition with testdisk (I suspect the offsets are currently incorrect, unless part of the FS was overwritten which is even worse), try to find the individual files with photorec (better luck if they were small files and of some specific formats) or some fiddling with mounting under ntfs3g as readonly.

xCare

assuming it has only 1 OS

Bob

@xCare Take a backup, then attempt to resize the partition and pray it works.

xCare

what tools resize a partition?

Bob

14:26

Alternatively, if it's NTFS and it's Windows and there's nothing after the partition and it's an expand-only operation then increasing the size is reasonably safe.

@xCare Ask the actual question.

xCare

yes, that's what I meant, the scenario you described

Bob

Don't ask hypotheticals then find out it destroys your data when you try something that doesn't apply to your specific case.

xCare

It's not a hypothetical really, I do have a 1TB backup with 1 OS and nothing else on it, but the partition on it currently is 600GB or something

Bob

Any operation that involves manipulating the FS structure is risky.

Backups are always recommended.

However, purely expanding (without resize or shrink involved) is the safest of the lot.

And will generally work, though that depends on the specific FS and the tools involved.

xCare

If I could resize that partition successfully, it would fit to hold a image of the corrupt HDD as you describe.

what tools would you recommend?

or tool

Bob

14:29

9 mins ago, by xCare

1- I been trying but am having difficulty with that because I don't have drives big enough to store the image other than my 3.0 drives, and those won't recognize without windows.

^ as far as that, I'm 100% sure you don't need Windows to access those drives, unless you happened to encrypt them with BitLocker.

xCare

I don't have Ubuntu installed on any drive and the 3.0 drive bay needs drivers installed to work, that adds to the difficulty

Bob

@xCare For safely expanding NTFS partitions under Windows? The built in disk management is your best bet.

@xCare Drivers aren't required if it uses the standard USB protocols (UAS or UMS).

UAS is only natively supported in Windows 8+ though, so that might be where you had driver installation in the past.

Any modern *nix distro should happily accept UAS.

xCare

It does not show in Ubuntu though since I'm running it from disk

I'm in Ubuntu right now

Bob

@xCare Version?

You need kernel 3.15.

xCare

If I switch to Windows, think you can run through the steps with me of expanding the partition in Drive Management?

DavidPostill

14:34

which version of windows?

xCare

Windows 7

Hennes

start run drivemgmt.msc

Bob

@xCare It is quite literally called "Disk Management"

xCare

wait wait please lol, need to switch. brb

DavidPostill

How To Shrink & Extend Volumes Or Partitions in Windows 7

Bob

14:37

@DavidPostill That is a horrible article. (the bit at the end with Easus)

I expect any advice that involves moving partitions to come with a giant bold warning to make a backup first.

Hennes

Aye.

allquixotic

hii

Bob

@allquixotic iih?

DavidPostill

@Bob Is this any better How to Shrink and Extend NTFS Volumes in Windows? If not feel free to provide your own link ;)

Bob

@DavidPostill Oh, I just meant the first article just seemed far too light for such a dangerous operation. It wasn't too bad until they got into recommending Easus.

Second one is much wordier but probably better set out overall :P

xCare

14:42

In Windows 7. Right clicked Computer -> clicked Management and am in the Computer Management screen

Where to from here?

Bob

@xCare Disk Management on left.

Hennes

Next, select the drive you want to work on and right click.

xCare

alright, shows a list of Drives

Hennes

You should have a screen like this:

xCare

yes I do, select the drive in the top or bottom half pane?

Hennes

14:45

uhm, I always click on the partition I want to work on.

I even did that without thinking about it when I took the screenshot.

xCare

let me get a shot of this and show you what I'm seeing

Bob

I don't remember the last time I seriously looked at the top pane :P

@Hennes Needs more disks :D

Hennes

I am down to 6 disks atm

Bob

I love the "DataStore" name though.

Hennes

But 4 of those are HW RAID, so windows does not realise that those four are one

Descriptive names FTW

xCare

14:47

imgur.com/6PtNqFE

Bob

Yes, that is almost 2TB.

@xCare Just right-click the partition you want to expand and click "Extend Volume"

xCare

as you can see, the 1TB drive shows 931.51GB and has 4 partitions, the one with 600+ is the one I want to expand and th elast partition has unalocated space

Bob

@xCare fyi, the last is not a partition

A partition is has a well-defined definition under both MBR and GPT partitioning schemes.

Unallocated space is simply space that hasn't been assigned to a partition.

At its core, a partition is a 3-tuple: offset, size and type.

xCare

Extend Volume Wizard shows this:

imgur.com/uQZg29F

haven't clicked anything yet.

Bob

@xCare You can just go next.

Note that you might not be able to shrink the partition later.

xCare

14:53

this is what it shows now:

imgur.com/OrUAn2N

did that succeed?

doesn't show any more unalocated space

Bob

@xCare Yea.

As I said, expanding is a relatively simple and safe operation.

It's shrinking and especially moving that have high potential for data loss.

xCare

yup, looks like it worked far as I can tell. Awesome, thanks!

Now we can image the other drive!

can you help me with that?

Bob

As for imaging: pick your favourite tool, really, but for ease of recovery (especially in *nix), it's better to make a raw image.

dd is your friend there, but you have to be very careful.

Specifically, the basic dd command is of the form dd if=/path/to/input of=/path/to/output

xCare

how about Active Partition Recovery?

Bob

if you swap the if and of you can destroy data

Hennes

14:56

Aye. dd and dd-rescue (first one works fine, second one if the disk is physically failing. Which is not the case here)

I think we have several posts on Super User about copying with dd

Bob

in this particular case, you figure out which device the drive is (/dev/sdX) and that's your if

xCare

those are command line tools and I'm not familiar with commands

any non CLI tools that would work the same?

Bob

dd if=/dev/sda of=/mnt/otherdrive/blah/folders/image.img

@xCare Eh... clonezilla might work.

allquixotic

funnily enough I'm in a partition recovery situation right now, myself... trying to use testdisk

Hennes

Maybe there are. I never used the GUI tools if I can avoid it since they rarely staye what they are going to do in detail

Bob

14:58

@allquixotic o.O

what happened?

xCare

I have one called Zar X

Bob

@xCare Basically, you want a raw image. You want a file that contains every byte of the drive, directly copied.

No fancy compression. No fancy formats.

xCare

right, let me check if any of these tools I have does that

Bob

Also, face it, you will have to delve into the CLI for this kind of recovery.

xCare

how so?

Bob

15:00

@xCare The other option is you can take an image in whatever format, work on the physical disk directly, and then restore from the image if something happens.

You can go that route if you want.

Actually, that might be better for you.

@xCare testdisk is very much a CLI tool. You will have to deal with funny mounting. Probably more.

allquixotic

I had a 961 GiB SSD with an encrypted partition (proprietary encryption program, not BitLocker) and the remainder of the disk as an unencrypted NTFS partition.

I non-destructively shrunk the unencrypted partition on the SSD. This apparently sent the crypto in a paranoid rage and made it refuse to boot, but I didn't try booting until after I dd'ed off everything from the first sector up til the end of the second partition from the 961 GiB SSD to a 931 GiB SSHD.

Then I realized that neither cryptoed boot FS was usable due to the crypto going wacky about the partition shrink.

Journeyman Geek

o0

allquixotic

So I think I can get back the unencrypted partition since nothing has been writing to those blocks, and NTFS won't randomly decide to write to unallocated space.

Journeyman Geek

@allquixotic: I hope this was a home box?

Bob

@allquixotic my head's spinning just trying to follow that path o.O

allquixotic

15:04

@JourneymanGeek work, but all the important documents I create/use for work are in email or file servers

I only lost stuff like Chrome settings, a few programs, the upgrade from VMware 11 to 12, etc

I had a bit of personal stuff on the unencrypted partition that I'd like to recover tho

not high priority but it would be nice to get it back... reduces effort in bringing the old partition back to working order

Bob

@allquixotic Should be fairly easy, if you haven't touched the partition.

xCare

well I can't image copy until I shut down and hook the corrupt HDD up (I keep it unhooked as much as possible to prevent accidental writing), so I'll take a break, grab some lunch then get the other HDD hooked up again and work on making this image.

Really appreciate the help guys, ttyl

Bob

@xCare The image will probably take a while and I'll probably be asleep by the time it's done, but this might get you started: cgsecurity.org/wiki/TestDisk_Step_By_Step, cgsecurity.org/wiki/Data_Recovery_Examples

Once the image is done you can safely write to the disk, and restore from the image if you stuff it up further.

Journeyman Geek

lol

Bob

(if you're paranoid, you should also test the image to make sure it works... advantage of a dd image is you can mount it directly)

Journeyman Geek

15:08

@Bob: He should have those links ._.

also gddrescue is probably a better idea here

known damaged data + simpler syntax

Bob

@JourneymanGeek At this point I'm working with the assumption that he doesn't know anything about testdisk usage.

Journeyman Geek

@Bob: I mean

Bob

@JourneymanGeek Damaged data, but not damaged disk. And he wants to use other GUI programs, so... meh.

Journeyman Geek

I linked him those ;p

Bob

I also didn't feel like explaining ddrescue again.

Journeyman Geek

15:09

and the step by step guide

since that's what I use whenever I run testdisk

Bob

But, here goes: ddrescue is the new one, and the good one. it's in the gddrescue package (apt-get install gddrescue). dd_rescue is the old (bad) one. it's in the ddrescue package. Do not install the ddrescue package.

Stupid naming.

@JourneymanGeek I don't know what he ended up following/doing exactly.

I should probably save that ddrescue explanation somewhere. Must've said it a dozen times by now.

Journeyman Geek

he didn't. He felt he needed to be walked through it, and well... I'd have used the guide anyway

Bob

... -_-

Journeyman Geek

and well, at this point, I'm not convinced its a productive use of time

Hennes

15:43

oh, it is Thursday, not Friday

Bob

@Hennes Nah, definitely Friday.

(timezones, yay!)

Hennes

Mentally it is Friday for me.

JohnB

16:23

would any non mods mind screenshotting this page for me? Just the first event is all I need, not the whole page

DavidPostill

Just a moment ...

@JohnB imgur.com/ZrP3mn6

JohnB

perfect, thanks David!

DavidPostill

No probs ;)

allquixotic

17:48

fightthetpp.org

TPP: The Dirtiest Trade Deal You've Never Heard Of

►

2

That Brazilian Guy

Boooo! Bad Citrix, bad!

DragonLord

@allquixotic It's being steamrolled through the process by corporations which together have hundreds of millions of dollars available for lobbying.

This is why I suggest a big fundraiser to fight back:

Oct 10 at 21:21, by DragonLord

Perhaps a big fundraiser ($100M+ goal) is in order?

Oct 10 at 21:25, by DragonLord

Any opposition will have to be on a similar scale to have a reasonable shot at succeeding.

DragonLord

18:27

@ThatBrazilianGuy Chrome's API is significantly larger than Firefox's.

Chrome's market share is also significantly higher.

Firefox is becoming a niche product. It's no longer a mainstream browser.

Usage share is currently at about 20% and falling fast.

Microsoft Edge is gaining ground, too.

That Brazilian Guy

18:56

@DragonLord 15% according to gs.statcounter.com

That said, the highest it's ever been is 32% in 2009, and a very slow decline since then

DragonLord

Firefox has a reputation of being heavy, slow, insecure, and unreliable.

I believe it's the last of the mainstream browsers to use a monolithic single-process model.

Chrome has always been multiprocess. IE has been multiprocess since version 8.

That Brazilian Guy

Well, I can't say anything about insecure, but on every computer I ever touched, Firefox seems to perform better.

But yeah, if nothings change we're headed back again into browser monopoly times and their "this sites permorms better in IE6 at 800x600"

No, forget that, it's already happening.
History repeats itself.

DragonLord

Safari is multiprocess since version 5. Edge is multiprocess. Even Opera is multiprocess.

Firefox is single-process and Electrolysis still has a long way to go.

In essence, because Firefox is the only major browser to continue to use a single-process model, Firefox is obsolete!

arstechnica.com/information-technology/2015/08/…

Plugin compatibility is the real reason.

> Mozilla needs to implement features such as Electrolysis to maintain parity with Firefox's competition—it's the only mainstream browser that lacks this kind of multiprocess model—and one of the things that made Electrolysis complicated to develop is the need to preserve support for XPCOM add-ons; a burden that neither Chrome nor Edge suffers.

> it's the only mainstream browser that lacks this kind of multiprocess model

It's ABOUT F--ING TIME, Mozilla!

That Brazilian Guy

That doesn't change the fact Citrix's GoToWebinar choses to, apparently, cater only to Chrome users.
I don't get it, people develop web apps to be compatible with IE8 and its 3% market share, but not Firefox.

> Google requires Chrome extensions to be signed and installed via the Chrome store. Microsoft will do the same for Edge; its extensions will be digitally signed and distributed through the Windows store. Mozilla has similar plans for its new extensions.

~~Walled gardens~~ app stores everywhere...

DragonLord

Just had to let out some steam.

I'm going to continue to use Firefox for the time being. The problem is that Firefox is unreliable and leaks memory all over the place necessitating a browser restart every one or two days. A multiprocess browser would not suffer from these problems.

Tabs will have their memory cleared on close because their processes will have terminated, greatly reducing the potential for a memory leak.

In Firefox, a problem such as a stalled or hung script in one tab will lock up or crash the entire browser. No other major browser suffers from this limitation.

I am on the edge (pun intended) of giving up on Firefox.

DavidPostill

19:19

@DragonLord That's strange. I leave Firefox running all the time, typically several weeks. Only restart if there is an update. No memory leaks and never goes above a couple of GB Of memory. With 35 plugins and a bunch of users scripts.

allquixotic

20:01

chipworks.com/sites/default/files/…

xCare

20:24

@DavidPostill lol Firefox is the default browser I'm using atm but I close down the PC much earlier, never leave it on + 12 hours unless doing scanning or updating

anyways, hit a new snag

I am prepped to make an image of the old drive to the one where we expanded the partition, but now it won't detect the old drive to read from. some of the imaging software tools I've tried do detect the drive, but minus the last partition where the data is.

on Ubuntu atm, with the new drive unplugged and only the new one and DVD drive where I'm running the OS from plugged in.

standing by for any ideas.

@JourneymanGeek I'm on Ubuntu and I have a copy of testdisk to try if it detects the disk

someone will need to help me with that though

sudo: testdisk-7.0/testdisk_static: command not found

Mokubai

20:56

@DragonLord It's just a pity that all other browsers suck...

Chrome has poor management of unused tabs, lacks key useful features and is generally just another webkit browser

Tab grouping is an awesome feature and I can't use it at work because we're not allowed FF and addons are disabled in Chrome.

The only tabs that Firefox loads when it starts up are the currently open tab and the "pinned" tabs, all others wait until you actually use them and so saves loading time and network bandwidth.

xCare

working with testdisk and smartmon tools in Ubuntu currently

not showing much

ubuntu@ubuntu:~$ smartctl -P show /dev/sda
smartctl 6.2 2013-07-26 r3841 [x86_64-linux-3.19.0-25-generic] (local build)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

/dev/sda: Unknown USB bridge [0x0bda:0x0181 (0x8197)]
Please specify device type with the -d option.

Use smartctl -h to get a usage summary

Michael Frank

@xCare Looks like your command is incomplete or not pointing at the right location. Try listing the disks: unix.stackexchange.com/questions/157154/… and seeing what comes up.

xCare

@MichaelFrank we're looking for the 750GB HDD with the corrupt MBR

ubuntu@ubuntu:~$ df -h
Filesystem Size Used Avail Use% Mounted on
/cow 3.0G 355M 2.6G 12% /
udev 2.9G 4.0K 2.9G 1% /dev
tmpfs 597M 1.4M 596M 1% /run
/dev/sr0 1006M 1006M 0 100% /cdrom
/dev/loop0 963M 963M 0 100% /rofs
none 4.0K 0 4.0K 0% /sys/fs/cgroup
tmpfs 3.0G 2.7M 3.0G 1% /tmp
none 5.0M 4.0K 5.0M 1% /run/lock
none 3.0G 80K 3.0G 1% /run/shm
none 100M 64K 100M 1% /run/user

tereško

21:14

well .. shit: twitlonger.com/show/n_1snlj3r

3

Insane

21:25

@tereško holy...

allquixotic

@tereško oh no :(

Michael Frank

@tereško can't see Twitter at work... What is it?

allquixotic

poor TB

Insane

@MichaelFrank Total Biscuit's cancer came back and is considered incurable.

Michael Frank

@Insane Ahh man.. That's rough.

xCare

21:29

indeed. hope for the best.

tereško

@Insane the issue is that it is considered extremely risky to operate liver

Michael Frank

Never really seen much from the guy, but definitely know about him.

Insane

@tereško yeah apparently it's in his blood or something

tereško

no, the thing is, if there is cancerous growth in liver (even if it's not metastasized), you cannot really cut the bit's simply out

all of your blood gets filtered through it

there have been first successful operations (like this), but it's all currently at the testing stages

Insane

oh, got it.

Mokubai

21:36

@tereško As you say... "shit."

Dude seems pretty cool from the vids I watched

tereško

yes, he is

Ramhound

22:33

My employer can be so inefficient at time. "Mr. Ramhound your tentative stat date is Nov 23rd" me "great I mr. apartment complex I need something by the 19th" "Mr. Ramhound your firm start date is Dec 14th" me :cry:

xCare

feeling the same after yet another unsuccessful attempt at finding a fix for my HDD

Ramhound

care to explain?/

xCare

22:52

@Ramhound: expanded the partition on a 1TB HD in order to copy an image of the corrupt HD to it but it won't find the other drive because of corrupt MBR

2

Q: Recovering files when Windows 7 MBR has been corrupted

System Stats: Type: 64-Bit Desktop; OS: Windows 7 Premium; HD: Seagate Barracuda 750GB, S.M.A.R.T. Enabled. History: There is the complex situation I'm dealing with, I'll do my best to break it down: I've been up against some nasty guys in the gaming field and a few days ago, security soft...

windows-7 hard-drive boot mbr partition-recovery

that's the original thread, and this is the discussion where you can follow all the stuff I been going through:

Discussion on question by xCare: Reco…

Imported from a comment discussion on superuser.com/questions/...

had a full day today, talked to the kind folks at bleepingcomputer, ran a full battery of diags; even they are baffled.

taking a break now, hopefully tomorrow has better news in store.

Bob

23:41

@xCare Told you to make an image of the entire drive.

Not a partition.

The whole drive.

ChatBot John Cavil

23:58

I have just been restarted! This happens daily automatically, or when my owner restarts me. Ready for commands.

Discussion on question by xCare: Reco…

Discussion on question by xCare: Reco…

Transcript for