Inaccessable HDD's baffling problem!!

Discuss Malware removal, techniques, trends, etc. and repairing Windows after removal.
Forum rules
1. Try to give more than you take, when possible.
2. Don't be a prick.

Inaccessable HDD's baffling problem!!

Postby Darc » Sat Nov 02, 2013 5:06 pm

Hello All,

This week I had two of these come in. The machines wont boot off anything - cd, usb, HDD etc. Removed the drives and try to inspect them offline with hyrens mini xp, puppy linix, kaspersly rescue cd, etc. After the host machine boots with any of these Os'es and any of these drives are attached via usb, there is a pause as the drive is discovered and then the os becomes sluggish but does not freeze up. The drive light carries on flashing as though it is in some kind of process ( actually in puppy linix I got it display a PID number so something is going on). Once the drive is discovered, there is nothing I can do through any OS to stop the process.

In hyrens, I started sysinternals process explorer and then connected the drive to see if something pops up. As soon as the drive light starts blinking after the drive is connected the only action that can be seen is under the system entry. In the lower pane in sysinternals with handles showing, an entry pops up that shows a new drive has been added. The drive light continues blinking and does not stop. I believe that something on these drives immediately patches the memory of the machine regardless of the os being used as soon as it is discovered.

After much experimenting I discovered that some applications in Hyrens will continue to work if they are started before the drives are connected. One of the apps "boot ice" was able to show a 2mb area at the end of the drives. Here I could give this space a drive number - not a letter. After doing this and many restarts the drives showed up in "partition magic" and the space I numbered was presented as an unformatted partition with no drive letter. It was not able to be formatted or deleted as there was a size problem reported, so I shrunk the big partition by a few gigs and extended the small space and formatted it. I also wiped the new partition with 0 and 1's with the partition magic app. Even after this wipe, the partition shows used space as 1.6mb but you cannot see any files or folders in there through any OS file manger. It shows blank but the used space shows 1.6mb.

One of the drive partitions can now be seen and the folders are showing but as soon as I try to perform any action like copy, the machine freezes. I have managed to run a chkdsk and it reported a few errors in the first run and fixed them and then I was able to see the folders and files. It seems as if something has got to the chip level of these drives as even trying to copy them on a dumb drive duplicator fails. I do not think the drives are broken or worn out because they do start up some kind of process when they are discovered. It's driving me nuts!

Any ideas on what is going on would be greatly appreciated. I would like to at least recover something or know I am not going mad.

Cheers Darc
Darc
 
Posts: 14
Joined: Wed Apr 17, 2013 7:12 pm

Re: Inaccessable HDD's baffling problem!!

Postby rharvey » Fri Feb 14, 2014 9:31 am

Hirens - boot from a cd not a usb for this one. (better chance of hdat2 working)
choose dos programs instead of the mini xp
choose hard disk tools
choose hdat2
let it auto run
choose your hard drive
choose drive level test menu
choose check and repair bad sectors
let it run
it will take a while - longer if many bad blocks are detected ( you can turn off the beeping if needed)

your symptoms fit bad blocks being present.
chkdsk does not do the job.
run hadat2
if you have bad blocks this will allow you to get access to the drive.
If you have a bunch of bad block I recommend you get another hard drive and clone it after the hdat2 repair. (I use acronis 2014 - use ignore errors (bad blocks))
then run chkdsk /r in the new hard drive. (/r - This option initiates chkdsk to discover bad sectors and also recover any intact information.)
This will clean up any false bad blocks that were copied over.
try to access your data/partitions now.
rharvey
 
Posts: 67
Joined: Wed Nov 13, 2013 1:45 am

Re: Inaccessable HDD's baffling problem!!

Postby hubzone37 » Mon Feb 24, 2014 10:08 pm

Thanks for the tip.
User avatar
hubzone37
 
Posts: 32
Joined: Sat Feb 09, 2013 5:36 pm

Re: Inaccessable HDD's baffling problem!!

Postby Marshall » Mon Mar 24, 2014 3:02 pm

Hi hubzone37.

I agree with rharvey pretty much, and have a practical suggestion.

When you have a system boot related problem I suggest that you always do a few things right off the cuff.
Pull the HD and slave it to another known good working system.
View the HD in BIOS to ensure it's visible and doesn't have a corrupt MBR/Boot Sector, etc.
If the HD is visible in BIOS, run a HD Diagnostic tool on it to determine it's general health, and if it's found to be corrupt or damaged immediately power it off to prevent further damage to the data and get your HD Recovery Solution/Provider involved if necessary.

Never continue down a path without a process to the madness. In the instance of "solving" HD related issues you are putting your clients data at risk with ongoing use of the drive, if it's failing physically, or if you're using an untested/vetted process to fix the real issue.

This places your company and/or you, into an unwanted liability scenario for that data. If your clients are not already signing a service waiver that includes a clause to protect you from the unintended loss of their data, you should.

Your first step, with every computer should always be diagnosing the health of the HD in my opinion. Having a machine come into your shop, or providing service remotely, to a machine with unknown issues always implies the possibility of these risks. If you're not actively monitoring, and managing the system, can you within reason say to yourself that the system couldn't possibly have at least a 1% risk of having this happen, and if it does happen, are you not going to be the one held accountable?

Remember...CYA
Help Me With My Computer Tech
IT Services & IT Consulting Services In Southern IL and St. Louis MO
User avatar
Marshall
 
Posts: 509
Joined: Thu Feb 14, 2013 3:14 am


Return to Malware Removal