Wednesday, August 12, 2015

Unable to see data on an external HDD, is it infected?


I will try to describe the problem directly: suddenly I am unable to acces the data I have on my external HDD. It's name has changed, both Ubuntu and Windows(7 and 8) complain when I plug in the device and both show files with strange characters (Ubuntu shows just 3 files with strange names, and Windows shows several files).


The USB 3.0 port where I plug in the drive works fine with other drives. The HDD is new.


I have no idea of what happened here, is this a virus?


UBUNTU 14.04


This is the error that shows up when connecting the drive in Ubuntu:



This location could not be displayed.


Sorry, could not display all the contents of «957C-714E»: Error when getting
information for file «/media/adri/957C-714E/├π√╨ ▀2<.╚k7»: Input/output error



Properties of the volume in Ubuntu:


Name: 957C-714E
Type: Folder(inode/directory)
Contents: 3 items,totalling 4.5GB
Location: /media/adri
Volume: 1TB volume
280,6 GB used
719.1 GB free
FileSystem Type: msdos

sudo lsblk -f /dev/sdb


NAME   FSTYPE LABEL MOUNTPOINT
sdb
└─sdb1 vfat /media/adri/957C-714E

sudo fdisk -l:


Disk /dev/sdb: 1000.2 GB, 1000170586112 bytes
255 heads, 63 sectors/track, 121597 cylinders, total 1953458176 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0001d7e2
Device Boot Start End Blocks Id System
/dev/sdb1 * 63 1953455804 976727871 c W95 FAT32 (LBA)

WINDOWS 7 and 8 using virtual box in Ubuntu 14.04


Both have some problems at first to detect the drive (specially on windows 7) but finally it manages to show it. A message pops up saying that there is a problem with the device and that I could scan and fix it. I haven't used this because I don't know if it could damage the data.


I have tried to scan the drive with AVAST and KASPERSKY, but both were unable to do a proper scan of the drive. There is a link below with pictures of the result of avast.


I tried to use Partition, Find and Mount, but the first two kinds of scan (I will try the 3d) were unable to find any partition.




Here it is a link to an album with pictures of how I see the HDD in Ubuntu, W7 and W8. There is also a picture of the avast scan:


Pictures




When this happened?


I installed Ubuntu 14.04 for the first time in my computer. I was trying to create a live USB using an ISO stored in my external HDD. I was using "usb-creator-kde" from the ubuntu software center. I pluged in both the pendrive and the HDD in my computer, opened "usb-creator-kde", chose the ISO from the HDD and selected my pendrive as disk to use. Both the HDD and the usb appeared as options in the device list. I selected the pendrive and pressed the erase disk. I wasn't able to create the live usb because the ISO file was a W8 ISO and usb-creator is not for non-linux SO. But after I did that I unpluged the HDD pluged it again and it no longer worked.


Answer



That is most likely due to corrupt data on the drive. As others have said, it could be you disconnected it during a write.


However, it is more likely that the drive itself has corrupted the data. This is all too common on modern drives that hold so much data. It is even more common on removable drives, especially cheap ones. It is possible that the drive hasn't parked the heads before being moved or was moved during operation.


There is a chance that the data could be recovered with a decent disk recovery tool but these tend to come at a price. The best one I've used is GRC's Spinrite but that costs around US$90.


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...