Ex WD MyBook shown as RAW

[<<Onafets>>]

Hey all, hope you had a good Christmas!
I've migrated my friends WD MYBook 2TB out of its enclosure into his PC as an internal SATA drive and its data is now inacessable. It appears as a RAW file system in disk management and I have run TestDisk to see what I could gather. The results are as follows (I'm not sure how to use spoilertags ) :





Any help would be much appreciated as always. My understanding is that the partition tables are corrupted as Easeus and RecoverMyFiles finds files but with incorrect names (FILE001.png, FILE002.png, etc). This could also be related to the mft records but I'm really stuck in the dark here.
Thanks
Ona

[<<Onafets>>]

Bump for justice :3

[A Cheese Danish]

If you put the drive back in the enclosure, can you access the data then?

I've had several WD drives suddenly show RAW and I couldn't get it to format or anything.

[Aquinus]

How about in a Linux LiveCD? You sure it's not just Windows? Obviously you will want to back up your stuff before playing with it so you might want to throw it back in the enclosure to get your stuff back, then maybe try nuking it. When I "nuke it" I mean format, of course. Mounting the drive in linux lets your force file systems and such. It may be more forgiving if the enclosure doesn't help.

[<<Onafets>>]

Originally Posted by A Cheese Danish

If you put the drive back in the enclosure, can you access the data then?

I've had several WD drives suddenly show RAW and I couldn't get it to format or anything.

I didn't keep the original enclosure due to it being destroyed when we removed the drive. All WD drive enclosures require a degree in breaking and entering. Will a SATA to USB adapter do the same thing? If so I'll have to buy one because I don't have any drive enclosures lying around.

Originally Posted by Aquinus

How about in a Linux LiveCD? You sure it's not just Windows? Obviously you will want to back up your stuff before playing with it so you might want to throw it back in the enclosure to get your stuff back, then maybe try nuking it. When I "nuke it" I mean format, of course. Mounting the drive in linux lets your force file systems and such. It may be more forgiving if the enclosure doesn't help.

I was thinking of seeing what something like GParted could do about it but I didn't really think it would provide any tools that relate to the issue. By forcing a file system does it write to the drives MBR or other important bits?

[Aquinus]

Originally Posted by <<Onafets>>

By forcing a file system does it write to the drives MBR or other important bits?

No it writes nothing. What is does is it will let you say, "this isn't really RAW, try reading this if it were vfat (fat16 and 32) instead." You'll want to try and find out what linux things it is first. I would do this from the terminal instead of using GParted or something where it is really easy to shoot yourself in the foot (point and click makes it easy.)

Just use regular parted. Find out what it has to say.

Example:

~$ ls -l /dev/sd*
brw-rw---- 1 root disk 8, 0 Jan  2 07:33 /dev/sda
brw-rw---- 1 root disk 8, 1 Dec 12 08:05 /dev/sda1
brw-rw---- 1 root disk 8, 2 Dec 12 08:05 /dev/sda2
brw-rw---- 1 root disk 8, 3 Dec 12 08:05 /dev/sda3
~$ sudo parted -l /dev/sda
Model: ATA WDC WD800JD-60JR (scsi)
Disk /dev/sda: 80.0GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start   End     Size    Type     File system     Flags
 1      1049kB  8000MB  7999MB  primary  ext2            boot
 2      8000MB  24.0GB  16.0GB  primary  linux-swap(v1)
 3      24.0GB  80.0GB  56.0GB  primary  ext4

Lets say I had another drive, we'll call it sdb, and it has one partition and we know it to be fat32, which would be /dev/sdb1 in my case. You would try mounting it this way.

sudo mkdir /mnt/ext
mount -t vfat /dev/sdb1 /mnt/ext

[<<Onafets>>]

Here is what parted has to say about this drive:

Model: ATA WDC WD20EARX-00P (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos

Number  Start   End     Size    Type     File system  Flags
 1      1049kB  2000GB  2000GB  primary

After trying to mount as ntfs which is what we thought the drive was in here's what I get.

jack@jack:~$ sudo mount -t ntfs-3g /dev/sdb1 /mnt/ext
NTFS signature is missing.
Failed to mount '/dev/sdb1': Invalid argument
The device '/dev/sdb1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

jack@jack:~$ sudo mount -t ntfs-3g /dev/sdb /mnt/ext
NTFS signature is missing.
Failed to mount '/dev/sdb': Invalid argument
The device '/dev/sdb' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Here it is as fat32.

jack@jack-To-be-filled-by-O-E-M:~$ sudo mount -t vfat /dev/sdb1 /mnt/ext 
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

jack@jack-To-be-filled-by-O-E-M:~$ sudo mount -t vfat /dev/sdb /mnt/extmount: wrong fs type, bad option, bad superblock on /dev/sdb,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

Does that help us at all?
Also this:

[Aquinus]

I take it that just a regular mount doesn't work either?

sudo mount /dev/sdb1 /mnt/ext

Also what does fdisk have to say?

sudo fdisk -l /dev/sdb

It sounds odd that it thinks that it is formatted fat16. I didn't think fat16 supported partitions that large.

[<<Onafets>>]

I take it that just a regular mount doesn't work either?

mount: you must specify the filesystem type

Also what does fdisk have to say?

Disk /dev/sdb: 2000.4 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x4869c773

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1            2048  3907026943  1953512448    6  FAT16

It sounds odd that it thinks that it is formatted fat16. I didn't think fat16 supported partitions that large.

Neither did I lol. Any ideas? So far data recovery has proven insufficient at this stage
FAT16 is a worry because most files on the drive were over 4GB which is the limit for FAT32. Everything is probably destroyed under FAT16's file size limits.

[Aquinus]

You could always check SMART to see if the drive is failing but beyond that I don't know what's going on. I would say try re-creating the partition table and formatting the drive, but that doesn't give you a backup.

[<<Onafets>>]

Smart tests all come up as ok so no dice there unfortunately. What's the best way to go about partition table recreation?
Thanks for all the help so far!

[A Cheese Danish]

Supposedly this tool will help you recover the data off the drive.
It may/may not recover the partition that was lost though

[OneMoar]

some of the mybook drives have controller level encryption what happens if you put it back in the enclosure ?

[<<Onafets>>]

Originally Posted by A Cheese Danish

Supposedly this tool will help you recover the data off the drive.
It may/may not recover the partition that was lost though

We tried to use testdisk and there were no helpful options for the drive unfortunately. I think i have a few screens in the original post of post scans

Originally Posted by OneMoar

some of the mybook drives have controller level encryption what happens if you put it back in the enclosure ?

The original enclosure was destroyed and got thrown out (stupid I know). Will any mybook enclosure suffice? I might be able to purchase a case off ebay or something.

[OneMoar]

Originally Posted by <<Onafets>>

We tried to use testdisk and there were no helpful options for the drive unfortunately. I think i have a few screens in the original post of post scans



The original enclosure was destroyed and got thrown out (stupid I know). Will any mybook enclosure suffice? I might be able to purchase a case off ebay or something.

no idea drive might be keyed to each controller it might not(assuming thats the problem)

[<<Onafets>>]

Originally Posted by OneMoar

no idea drive might be keyed to each controller it might not(assuming thats the problem)

Assuming this is the problem does that mean that data recovery will be useless aswell then?
And I'm also assuming Western Digital won't tell me any more about if they encrypt their usb controllers :/