Author Topic: Erased harddrive index – Help!  (Read 4670 times)

0 Members and 1 Guest are viewing this topic.

SkynetCore

  • Guest
Erased harddrive index – Help!
« on: October 12, 2011, 08:12:44 PM »
Hi! :)

I need qualified help with one of my harddrives that got it's boot record index wiped by the TDL3 virus.

(See what happened in this thread:)
http://forum.avast.com/index.php?topic=81685.0


All the files are still on there, but the boot record file index, or whatever it's called, got erased,
and now Windows thinks the disc is not initiated and need to be formated.


EDIT: Or at least it thought so when I was able to see it, a few months
back...





What I want to do is to restore the disc index and be able to access the files on the disc.

I once had to do this on another disc years ago, but then I had a friend who  did all the work.
Unfortunately he's too busy to help me this time.


The harddrive disc is a 250 GB SATA disc.
I run XP.


Apparently the operation itself shouldn't be absurdly complicated and there's supposed to be a freeware
program out there that does this.  :P
(I know it isn't SpinDisk, but something similar...)


The next thing I want to do is to copy the content to a brand new 500 GB disc. Should I do this directly,
during the recovery process, or should I do it as a second step?

I would prefer to muck about as little as possible with the original 250 GB drive, as the files are
valuable to me...


* What program should I use?

* If I'm careful and read everything, will I manage this on my own?

* Which method is most likely not to result in data loss?


Any help much appreciated! :-\


« Last Edit: October 13, 2011, 06:54:35 AM by SkynetCore »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
« Last Edit: October 12, 2011, 08:46:52 PM by essexboy »

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #2 on: October 12, 2011, 08:57:57 PM »
Wooow! Super fast reply!  8)


No I haven't tried any of those two. I'll pull out my other drives and mount the one
with faulty boot index.

I take it I can try both of these without suddenly getting my files wiped?

They're only going to try restoring the boot record, right?


 :)
« Last Edit: October 13, 2011, 04:16:50 AM by SkynetCore »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Erased harddrive index – Help!
« Reply #3 on: October 12, 2011, 08:59:37 PM »
I believe it may be the MFT which the second should be able to repair quite happily

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #4 on: October 13, 2011, 05:35:48 AM »
 :'(  Maybe I'm just asking for trouble when I try to do this on the
same computer that once got the TDL3. It's not 100% stable...

I've got the Windows Recovery Console on there, but XP won't boot when
the faulty SATA disc is connected to the system. I've tried both SATA
slots... 

And if I connect it after the boot neither XP or TestDisk can see that disc.


I know the files are still on there, because the wipe took less than a second, so
there wasn't time to write over the acctual files.

I don't think there's anything wrong with the SATA connection or controller, as
I always have another SATA disc connected there normally....


Maybe I should get another computer (which I've lent to my sister) that can handle
SATA discs and try with that one instead.


What do you think?
 :-\

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #5 on: October 13, 2011, 06:51:10 AM »
Okay, a little progress has been done, but not with the important
disk.


Nevertheless, I connected the original TDL3 infected disc from my
sister and booted, when the CheckDisk/ScanDisk found it and repaired
and deleted some files. After that it was healthy and could be NTFS
formated as usual from the DiscManager. Now I can rebuild and install
that computer at least.

Freeing the one I've lent her...



Don't know what's going on with my wiped SATA disc. It's like it is
not recognised at all. TDL3 might of course be on there, preventing
the boot somehow, but now I do have the WRC installed...

???

When that disc is connected it freezes my boot just when XP is about
to show it's welcoming screen with the different user accounts.
Just like it did when TDL3 had hit...


Sorry for being a bore. Despite thinking I was properly Backed Up, there
was about a years worth of downloaded films (bought), music and unfortunately
a few of my work files that I had put serious effort into...

 ::)
« Last Edit: October 13, 2011, 07:07:27 AM by SkynetCore »

timcan

  • Guest
Re: Erased harddrive index – Help!
« Reply #6 on: October 13, 2011, 07:33:41 AM »
SkynetCore, Hirens boot cd has alot of utilities including MBR tools you may want to look at.
Info here http://www.hiren.info/pages/bootcd

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #7 on: October 13, 2011, 07:52:25 AM »
Thanks! I'll have a look at that.

Ehrrm, that's way beond my comp skillz...  :-[ I would'nt even know
where to start.

But I agree a CD or DVD boot might be needed here...


- - - - - -

I have to use a boot selection screen to manually choose boot disc
ever since the TDL3 struck, and if the "faulty" disc is connected
it does present itself correctly as the Hitachi disc it is.

But it still interferes with the boot somehow, regardless of which
SATA connection it is attached to...

 ???
« Last Edit: October 13, 2011, 07:58:04 AM by SkynetCore »

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #8 on: October 13, 2011, 08:29:53 AM »



Weee!  :D


I managed to boot in Safe mode and now I see the disc.
TestDisc also sees the disc.

Now I must calm down so I don't do anything stupid...

 :P

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #9 on: October 13, 2011, 08:54:24 AM »
Anybody who will hold my hand through this?


I've found my files on the hit disc and I'm reading up on TestDisk
and very reluctantly tries the program out a little, but I don't
want to f*** someting up at this stage...  :-\

The disc is a NTFS one.


What option should I choose in the various menues, and what
exactly is it I want to do?

Is it Repair An NTFS MFT I should do?



Sorry about sounding so thick...  :-[
« Last Edit: October 13, 2011, 10:09:18 AM by SkynetCore »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Erased harddrive index – Help!
« Reply #10 on: October 13, 2011, 09:19:37 PM »
Yep that would be the way, as you can now see the disc I would use the opportunity to back up anything that is visible

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #11 on: October 18, 2011, 03:57:13 PM »
 :)


Just reporting that a file copying process is ongoing and has
been running for over 40 hours.

I can see the files slowly being resurected and copied on to
a brand new harddrive. It's a slow process, but I'm in no hurry...

It's a big drive with loads and loads of files on there, so I
was well aware this would take some time.



I'm just happy to get my files back!

 :D


(Though, I'm not celebrating until all is back...)  ;)

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Erased harddrive index – Help!
« Reply #12 on: October 18, 2011, 08:21:28 PM »
Fingers crossed  ;D

SkynetCore

  • Guest
Re: Erased harddrive index – Help!
« Reply #13 on: October 22, 2011, 03:43:07 PM »



I have successfully saved all info from a 250 GB harddrive with a virus erased MBR!
It run uninterrupted for over 5 days...

And as a bonus I have gotten a little of the fun with computers back!





Thanks for all the help guys! :)


It wasn't easy and I had to try many different methods, but now my computer is
back to a similar state as before I got hit with the virus!

I've gained some experience and will be fanatically Prussian about Back Ups from
now on!

My rig also got 1 TB new harddrive space. (2 x 500 GB)


Anyway, Thanks guys!

And this is a brilliant forum...

 ;)


- - - - - -

PS: My sisters Vista comp will be thrown away. There was nothing to be done with it.
It might be a genuine motherboard failure and the TDL3 was on there from before,
or the TDL3 induced the motherboard failure, or broke some crucial components.

We'll never know for sure...

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Erased harddrive index – Help!
« Reply #14 on: October 22, 2011, 04:05:21 PM »
Glad it was a good result ..  I have had a few where there was a coincidental hardware failue.  Malware removal does stress the system