Kingwin EZ dock wiped HDD. Any chance of recovery?

wm_b wrote on 2/24/2011, 3:11 AM
1 TB WD black was wiped by inserting and removing. Is there any chance of a software recovery tool? The drive WAS the backup of a couple older drives I still have and that still function. There are a few things on there that were unique but nothing I can't get back. It would be handy to bring it back to life if possible. I just had a few different sample libraries all in one place that was more handy than the places they were originally spread about.

Drive recovery software is the land of despair for many and every scam in the software business knows it. Is there anything out there that might put this back together. Nothing has been written to the drive since it appears the think it's unformatted. Maybe a tool could find the old file system or something. I doubt anything actually got wiped, just one thing changed from 0 to 1 or something.

I'm really surprised by this. I've hot swapped drives many, many times without issue. This drive was fine this morning and I tried to check it out on this new EZ dock and bam. I can tell you there was no heavy handed movement. I inserted it and the drive didn't show up, a minute later I removed it. No activity of any kind by the drive (other than the motor spinning) or like the computer was searching. I rebooted and the drive shows up as New Volume. It previously was nearly full. Boo.

I appreciate any suggestions.

Comments

farss wrote on 2/24/2011, 6:27 AM
"I appreciate any suggestions."

Really hard to offer anything concrete without being there.
My suggestion, if you haven't already tried this, is to plug it into a different interface on a different port, even try a different computer. I've sort of had this kind of thing happen and all I think it was, was Windoz getting confused by something like having two drives assigned to the same drive letter.

Bob.
JohnnyRoy wrote on 2/24/2011, 6:36 AM
Acronis Disk Director 11 can recover lost partitions. Acronis is a very well respected software company and you can install Disk Director on a USB stick to boot and use with any PC. I have also use EASEUS Data Recovery with great success*.

Here's a story for you: My son was using his laptop and closed it to come talk to me. I asked him something and he said, let me check on the web site Dad, so he opened his laptop and the hard drive was no longer recognized! Flat out gone. I took the hard drive out and plugged it into my PC and there were no partitions at all! I couldn't imagine what had happened. I use EASEUS Data Recovery and it found the partition and recovered all of the data.

* (Your mileage may vary, some assembly required, batteries not included, void where prohibited by law.) ;-)

~jr
gpsmikey wrote on 2/24/2011, 7:50 AM
The chances of the disk being wiped by just plugging it in and removing it are extremely small - it takes quite a bit of time actually to "wipe" that much data. More likely, what has happened is the MBR got trashed or something along those lines so windows can't see it, but the data should still be there on the drive. Definitely give something like Acronis Disk Director a shot at it (I sure wish there was an option on the drives like the old stuff used to have where you could flip a switch or install a jumper to prevent writes to the drive making it read only). The MBR (Master Boot Record) is at the front of the disk and tells where the (up to) 4 physical partitions are on the disk (starting block and ending block etc). If that gets trashed, all looks like it is lost, but there are a number of utilities (like Acronis) that can still find the partitions and rebuild the MBR for you.

mikey
wm_b wrote on 2/24/2011, 9:53 AM
Maybe I was drastic in saying "wiped" but generally implying the drive forgot who it was and windows thinks it's empty when I know it's not. I guess there is a chance the head crashed into the platter but I doubt it. The drive was spinning when I pulled it out of the dock. I could feel the gyro force of the spinning disk but there was no extreme movement or force needed to extracting the drive. (That is "hot swapping" right?) One reason I think all the data is intact is because windows thinks it's an unformatted drive and wouldn't be able to write anything to it anyway.

I'm just hoping to save time and hassle since the data can be recovered from other drives that are IDE and it's not convenient for me to connect those to anything these days. I'll check out that software and see what happens.

Thanks.
MarkWWW wrote on 2/24/2011, 1:08 PM
You might like to have a look at this page which has a beginners guide to recovering data and/or filing systems on hard drives. In particular it has details of the free TestDisk program which can be very helpful in these situations.

You might also like to check the final page of the guide which refers to a particular problem which affects WB 1TB Black drives whereby they suddenly lose almost all of their capacity and appear as a 32MB (unallocated) drive. The guide also provides a solution for this. It may be that this is what has happened to your drive.

Best of luck

Mark
John_Cline wrote on 2/24/2011, 1:11 PM
Was this EZ Dock a USB device? Did you eject the media using the Windows "Safely Remove Hardware" or did you just pull it out of the dock?
wm_b wrote on 2/24/2011, 2:18 PM
It was connected via eSATA. I just go the dock and had a seagate drive in installed. It was empty but showing up in explorer (windows7/64 btw). I pulled the drive out (it was spinning). The drive didn't disappear in explorer though. I waited a minute and hit F5 a few times to refresh it but the seagate drive persisted. At this point I installed the WD 1TB drive and waited. Nothing happened. I hit F5 a few times but the Seagate drive didn't disappear and the WD drive didn't show up. I opened disk manager and it still showed the seagate being present and no sign of the WD. I waited some more, maybe a total of 5 minutes maximum but not more. There was no activity with the lights or noticeable sound from the WD disk in the EZ Dock. I pulled it out. I waited some more and finally the Seagate drive disappeared from the Explorer and Drive Manager.

Once it was gone I put the Seagate back into the EZ Dock and it quickly appeared and I could see and open the folder I placed on it. At this point I put the WD drive back into the KingWin BK1000 trayless HDD bay and that's when it showed up as Local Disk and asked if I wanted to format it. To be clear, the WD drive was not in the computer when I turned it on to start all of this. I did not pull it from one place in the computer and put it in another place all in one session of the computer being on. I do know that the drive worked earlier that day because I had used it and removed it from the system after turning it off.

I have all my removable drives set with their properties configured for quick removal without using the Safely Remove Hardware option. It doesn't even seem to exist for SATA devices that I know of.
Byron K wrote on 2/24/2011, 3:55 PM
Here's a utility disk that I've used to recover and restore PCs w/ various issues.

http://www.hiren.info/pages/bootcd

I've also used Puppy linux to recover data on crashed drives, by copying from one USB drive directly to another USB.

You can create a bootable cd and it should just detect the usb devices if it is readable.

http://www.puppylinux.com/download/index.html

You may have to experiment with various tools to recover the data.
John_Cline wrote on 2/24/2011, 4:29 PM
I know eSATA is supposed to be hot-swappable in Win7, but I've never completely trusted it. My data is way too valuable, so I usually shut down, change drives and reboot. It's an inconvenience, but I've never had a problem.
jpenn wrote on 2/24/2011, 8:15 PM
wm b

Sometimes in Windows 7 my external usb HD's aren't recognized when plugged into the computer.

Try This. Go to Start and type in the run box "diskmgmt.msc" without the quotes You should get a screen like this

http://jpenn.com/jpennimages/diskmgr.png

See if you have a disk that does not have a designation

ie: (C:), (F:) ect.

If so go to the offending disk ( Disk 2 in my example) and right click and go to "Change drive letter and paths..."

click add. It should give you a default drive letter assignment. Then click ok.


Hope this works for you.

John



wm_b wrote on 2/25/2011, 1:10 AM
As it stands in the computer where all of this took place the disk shows up in disk manager as unformatted and healthy at 931.5 GB. I connected it via USB with the EZ dock to my laptop where it also shows up in DIsk Manger as unformatted and healthy.

Disk Director 11 on my laptop shows Local Volume E:, 931.5 GB, Healthy and can find nothing on the drive to recover.

PC Inspector File Recovery says "bad parameter in boot sector: Bytes Per Sector (0) + 0 !" and can do nothing with it.

Pretty wild that nothing is visible on the drive and it appears unformatted to my OS's. Surprising amount of damage in a ms. I will give myself a couple days to find a solution and I will move on. I was looking at the contents of the drive awhile ago and thinking it had a bunch of stuff on it that was superfluous. I think I'm about to have a fresh drive to format. Maybe I will come up with a few ideas in the next couple days.

I'm surprised at the great response to my problem. Thank you all for the suggestions. I've learned about a couple programs that are very cool today. Too bad none of them are helping me.

Cheers, William
akwaaba wrote on 2/25/2011, 2:32 AM
Just 2 bits worth [pun] ....I have used the free RECUVA programme to get info back on SD cards.
May work with hard drive too.
best of luck
Chris

http://www.piriform.com/recuva/download
craftech wrote on 2/25/2011, 3:15 AM
If there is data on it and it shows up as unformatted I agree with Mikey. The MBR got hosed.

You could try to mount it with this freeware utility.

John
ritsmer wrote on 2/25/2011, 3:23 AM
ntfsundelete worked for me last time.

Try this or any of the above. Let them recover the files TO ANOTHER DRIVE and see which one gives the best result.
John_Cline wrote on 2/25/2011, 3:31 AM
"The MBR got hosed."

If that is actually the case, then under Windows 7 the Recovery Environment can be used to write new MBR code to a hard disk by clicking on Command Prompt and typing "bootrec /FixMbr"
---------------------
DISCLAIMERS: Not intended as legal, medical or financial advice. Void where prohibited. Batteries not included. No purchase necessary to win. Open to legal US residents 18 or older. Not responsible for items left in vehicle. Dealer participation may affect actual cost. Rebates must be postmarked by 5/31/05. Any reproduction or rebroadcast without the expressed written consent of Major League Baseball is prohibited. Cash value 1/1000. Any resemblance to any person living or deceased is coincidental. Actual retail price may vary. Shake well before use. Keep frozen until ready to serve. Contents under pressure. Caution may be hot. Has been known to cause birth defects in laboratory animals. Not to be taken internally. Should not be used by pregnant women or nursing mothers. Avoid direct contact with eyes and skin. If rash develops discontinue use. Keep hands and feet inside railing at all times. In case of ingestion induce vomiting. All prices MSRP, tax, tags and destination charges extra. Certain blackout periods may apply. Professional driver on closed course. Do not attempt this at home. No clients were harmed in the making of this post.This disclaimer was copied and modified without permission. Use only as directed. Substantial penalty for early withdrawal. Member FDIC.
craftech wrote on 2/25/2011, 4:04 AM
"The MBR got hosed."
------------------------------------------------------------------------------
If that is actually the case, then under Windows 7 the Recovery Environment can be used to write new MBR code to a hard disk by clicking on Command Prompt and typing "bootrec /FixMbr"
--------------------------------------------------------------------------------
John,

I believe that only works with a drive that has an OS on it.

John

EDIT: Love the Disclaimers. Thanks for my laugh of the day.
wm_b wrote on 2/25/2011, 12:10 PM
Recuva is the only program so far that has meaningfully looked at the disk contents. It found a a few hundred files that are mostly unrecoverable but it's a good reminder of what was on the drive that I couldn't remember. There are folders on the list from projects that I have deleted. None of my sample library is on there at all. I had used this drive as a Vegas Pre-render disk before and there are many things from that folder.

From what I can tell, many of these programs are looking at the problem from a different angle than what I feel like I need. It's possible that what I need can't be done. I understand what a MBR is but I don't know what it actually is. Is it like a current address book of all the files on the disk and where all of the pieces are stored? I don't know.

At least there's hope of getting a couple things off of there but none of the assets that represent the largest amount of work to rebuild. I had converted nearly all the sample libraries from my FCP suite to wave files so I could use them with with Vegas and other recording projects I do. It is quite healthy on my mac but it sure was convenient to have it available in without have to jump through the soundtracks pro hoops to export a sound or music file if I wanted it.
JohnnyRoy wrote on 2/25/2011, 12:43 PM
> "Recuva is the only program so far that has meaningfully looked at the disk contents"

Did you try EASEUS Data Recovery? I didn't see you mention it. This is what recovered my drive.

`jr
Red Prince wrote on 2/25/2011, 1:21 PM
eSATA is only hot swappable if it is not connected directly to the SATA connectors on the motherboard, i.e., if it is connected via an eSATA extension card and even then it may not always be hot swappable. If it is connected directly to the motherboard, all it is is an extension cable, but to the computer it appears the same as an internal SATA drive and cannot be hot swapped. You need to power down the computer, then swap the drives while the power is off, then turn the power on.

If the option to eject safely does not even exist for the drive, then it is not safe to eject.

Assuming you have not damaged the drive by swapping it with the power on, try powering down the computer, place the drive back into your EZ Dock, then turn on the power and see if Windows can recognize the drive and its data. If not, you may be out of luck, but you can still try the recovery software solutions others have suggested.

He who knows does not speak; he who speaks does not know.
                    — Lao Tze in Tao Te Ching

Can you imagine the silence if everyone only said what he knows?
                    — Karel Čapek (The guy who gave us the word “robot” in R.U.R.)

amendegw wrote on 2/25/2011, 1:39 PM
SpinRite Sometimes it works wonders - sometimes it doesn't help at all. Should be run before the file recover utilities.

...Jerry

System Model:     Alienware M18 R1
System:           Windows 11 Pro
Processor:        13th Gen Intel(R) Core(TM) i9-13980HX, 2200 Mhz, 24 Core(s), 32 Logical Processor(s)

Installed Memory: 64.0 GB
Display Adapter:  NVIDIA GeForce RTX 4090 Laptop GPU (16GB), Nvidia Studio Driver 566.14 Nov 2024
Overclock Off

Display:          1920x1200 240 hertz
Storage (8TB Total):
    OS Drive:       NVMe KIOXIA 4096GB
        Data Drive:     NVMe Samsung SSD 990 PRO 4TB
        Data Drive:     Glyph Blackbox Pro 14TB

Vegas Pro 22 Build 239

Cameras:
Canon R5 Mark II
Canon R3
Sony A9

John_Cline wrote on 2/25/2011, 2:34 PM
" I understand what a MBR is but I don't know what it actually is. Is it like a current address book of all the files on the disk and where all of the pieces are stored?"

The MBR may be used for one or more of the following:
Holding a disk's primary partition table.
Bootstrapping operating systems, after the computer's BIOS passes execution to machine code instructions contained within the MBR.
Uniquely identifying individual disk media, with a 32-bit disk signature; even though it may never be used by the machine on which the disc is running.

If the MBR really got "hosed" on your drive, it likely would have lost the partition table.

The "address book" is called the FAT (File Allocation Table) on FAT12, FAT16 and FAT32 drives or the MFT (Master File Table) on NTFS drives. (The structure of an NTFS-formatted drive is much more complex than a FAT drive.) Anyway, the MFT describes all the files on the drive, including file names, timestamps, data streams and lists of cluster numbers where data streams reside. It also contains indexes, security identifiers, and file attributes like "read only", "compressed", "encrypted", etc.

The MFT can be written to and read from by the operating system even when you are not actively saving or reading a file, if it is interrupted for any reason, like improperly removing the drive, the MFT would be scrambled and the address book would be trashed. I'm reasonably sure this is what happened to you.

Just because you can theoretically hot swap a drive doesn't mean it's a good idea. USB drives can be safely ejected using the "Remove Hardware" icon in the system tray. Like Red Prince mentioned earlier, if you do not have that option for your eSATA drive, then it is never safe to just pull it out of the dock even if you think it is just sitting there doing nothing.

By the way, Spinrite can often perform miracles, but it's purpose is not to fix file system errors. Its only function is to recover data from damaged drive sectors. It doesn't care what file system is on a drive since it's operating at the hardware sector level. It can't hurt to run it before you attempt any file recovery.
wm_b wrote on 2/25/2011, 2:49 PM
The eSATA connector is on the backplane of the motherboard along with all the USB, 1394 and network connectors. During POST I see a special listing of a Marvell something or another that will say something different when I have a drive connected.

As I understand SATA on my ASUS P6T Deluxe V2 it is hot swappable and I've been doing that for over a year with Kingwin KF 1000 Tray-less Hot Swap Racks on 3 drives connected to 3 of 6 ports on the motherboard with standard SATA cables. I just make sure the drives are idle and not being read or written to and pop them in or out as needed. I'm not crazy with doing this constantly but I do it fairly frequently without any panic from the OS to suspect I am doing something wrong. For example pulling a USB stick out of a Mac without ejecting it earns a stern message from the OS.

The drives appear and disappear in explorer similarly to USB drives and the like. On the properties for all the disks I do this with there is a tick box for quick removal without using Safely Remove Device or whatever the terminology. That's why I am not surprised to see the safely remove option for the devices.

Don't get me wrong, I'm not confronting your statement as untrue but as the opposite of my experience and understanding. Maybe I've been wrong all along and just lucky that after 100s or insertions and removals that it only happened once.

So far I haven't taken any corrective action. All my efforts have been toward looking at what is on the drive. I will only try to fix it if something comes along a recognizes pretty much the whole thing. I'm not too interested in pulling odds and ends from the drive. All or nothing.
John_Cline wrote on 2/25/2011, 4:03 PM
As someone once said to me, "snakes are fun to play with until one bites you." My motherboard, along with Win7, also provides for eSATA hot swapping, but I've never completely trusted the technology and I will continue to power down to swap drives.

Since this is an "all or nothing" situation, you're likely out of luck with this particular drive. However, you wisely have most of this data backed up elsewhere, so at least there is some comfort in that.
lynn1102 wrote on 2/25/2011, 4:16 PM
Some time back I installed a new drive and wanted to format it. I hit the wrong button and formatted a good 500g drive that was 3/4 full. As soon as I realized what I did, I unplugged the drive to make sure nothing could access it.
I used a program called GetDataBack (not free) and it recovered every file. There is a version for FAT and NTFS.

Lynn