Cannot access slave drive of older HP Compaq with XP SP3 1

[Ngolem]

About a year ago I suffered a pretty severe cyber attack. In cleaning up the mess that was left behind I must have deleted a critical file or did something that makes it impossible to access my slave "D" drive any more. I could for a while with trouble and moved absolutely critical files but things like photos and misc documents were left behind.

The drive is recognized in Windows Explorer but it says the drive needs to be formatted. I never, wiped the disk clean as far as I know.

I know that this is an old computer but it still does 99% of what I want it to do and even in its crippled state I can have 4-5 windows open on my monitor and operate Skype at the same time.

I was advised that perhaps I should remove the slave drive and buy an enclosure to convert it into an external HD and this sounds like reasonable advice but if there is an easy fix otherwise I would like to try that first. I should point out that USB Flash drives, my 2 cdroms, an external Backup drive, all work fine albeit a little slow sometimes.

It is only the small slave drive that has the problem.

Any help in troubleshooting/fixing this problem is greatly appreciated... I have learned enough now to know my creativity in these matters is limited

Jim Broadbent

 

[goombawaho]

Can you clarify - are you running the computer that had the malware and it has two hard drives in it - one for operating system and one that is the D: drive? Or can you not see the hard drive when slaved to a DIFFERENT computer?

What is your goal - getting back deleted files or just getting the drive working as a 2nd drive?

In cleaning up the mess that was left behind I must have deleted a critical file or did something that makes it impossible to access my slave "D" drive any more.

.
This does not make any sense. A functioning operating system will access a second/third internal drive or external USB drive without a problem ASSUMING that HDD is ok.

Run manufacturer's diagnostic tools from bootable CD with only the problem drive attached to the system.
[link]

https://www.ultimatebootcd.com/download.html

][/url] Mirror Sites, down the page

If test is OK, then run a trial of GetDataBack and see if you can SEE the deleted files if that's what you're after
Otherwise, format and move on.



"Living tomorrow is everyone's sorrow.
Modern man's daydreams have turned into nightmares.

 

[Ngolem]

>> Can you clarify - are you running the computer that had the malware and it has two hard drives in it - one for operating system and one that is the D: drive? <<

Yes, I have an older HP Compaq with 2 HD (C/D) the D drive is a slave internally. The (C)drive was mainly for operation systems and applications, the smaller slave drive (D) was for data storage. The data files on the (D) drive were never deleted and the drive was never reformatted to my knowledge. The messages I get say the drive needs to be formatted so it does recognize its existence.

If the drive had crashed physically I would have expected to hear noise or something. But I have never had a HD crash before so have nothing to compare it to.

My goal is to get the files back... I don't think they have been deleted but that may be so. Also I would like to restore my computer to 100%... as it is though it is a tiny bit slower than normal AND sometimes I have difficulty installing a new software but it performs very well in most respects.

>> This does not make any sense.<< Cleaning up the mess means that I deleted several registry entries which were related to the PUPS that flooded my computer... Norton Anti-virus did nothing to stop this attack which ticked me off. I probably deleted something I should not have is my thinking... though in the main I got the machine back to running 90%.

>>> Run manufacturer's diagnostic tools from bootable CD with only the problem drive attached to the system. <<<

You want me to disconnect my C drive for this?

One thing I cannot do is update SKYPE for some reason though the old version runs fine. I don't know if this is related.

Jim Broadbent

 

[goombawaho]

If the drive had crashed physically I would have expected to hear noise or something.

Not necessarily. There are all kinds of different failure modes/symptoms.
I've seen drives spontaneously lose their partitions and still work later. Very strange, but............

Malware doesn't normally affect slave drives UNLESS it's the cryptolocker malware that encrypts your data files.

You want me to disconnect my C drive for this?

Yes. Download the CD. Burn the CD image to a CD. Set the computer BIOS to boot to CD. Turn off computer. Disconnect the C: drive power and SATA and then boot to the Ultimate Boot CD and run the manufacturer's test for YOUR brand of hard drive. Identify it first before starting.

If the hard drive tests OK, then I would do the following:
1. I don't believe your computer is completely clean or fixed from the malware infection. Don't plug the slave drive in yet. What operating system are you running?
2. Run ADW Cleaner, Junk Removal Tool, MalwareByte's anti-malware and then if you are still suspicious or want to be sure, remove your antivirus software (YES), reboot and run Combofix LAST.
All can be found by Googling like this: ADW Cleaner Bleeping
3. Run SFC /SCANNOW for your operating system to check for system file corruption. Reboot once and check operating system.
4. Turn off PC and plug in the slave drive, boot up and see what you can see.
5. If nothing, use the GetDataBack trial as I suggested to see if there is data on the slave drive.



"Living tomorrow is everyone's sorrow.
Modern man's daydreams have turned into nightmares.

 

[Ngolem]

I have not done this yet...hardware is not something I am really comfortable with.

But I did enter the computer using dos and when I do a directory listing on the C drive all is fine. When I change to the d Drive it finds it alright but it returns nothing when I ask for a listing of the drive.

I recently purchased an external drive enclosure. I was thinking of removing the drive in question... once out is it possible to try to recover the files?

This is new to me and while most of the files are not critical to me there are photos that I would like to recover.

Jim Broadbent

 

[Ngolem]

Perhaps this might help a little. I ran CHKDSK D:/F on the drive and it started to fix things so as far as I can see I think my files are there but there is a problem as you can see in the attached screenshot

Jim Broadbent

 

[goombawaho]

Based on that picture, I would test the hard drive before you go any further. It might be starting to crap out. If you want to roll the dice, keep running chkdsk d: /f until no errors. If it never ends with errors, the HDD is having a problem.

I was thinking of removing the drive in question... once out is it possible to try to recover the files?

For recovering the files, it doesn't make a difference internal vs. external.

For TESTING the drive, it would be better to leave it internal. If you make it external, then download one of the Windows-based hard drive testing utilities, like SeaTools for Windows (Seagate) or Data Lifeguard Diagnostics (Western Digital) and install that on your C: drive within Windows. Not all brands have windows-based diagnostic utilities though. If your brand doesn't have one, you MUST use the bootable diagnostic tool.



"Living tomorrow is everyone's sorrow.
Modern man's daydreams have turned into nightmares.

 

[Ngolem]

This is a rather old HD...I transferred it to this computer when the previous computer died. So I was wrong when I said that I had a slave connection problem. It is a HD approaching death throes as I see it now following that attack or perhaps it was just a coincidence that it happened then.



Jim Broadbent

 

[Ngolem]

Well I have been making progress but not complete.

this was the first run that I loaded as an attachment

this is one trial and as you can see some repair has been completed

...getting quite far and seconds later it started to recover files but then it hit a bump in the road and the process shut down as flies flew past my eyes

So I tried again a couple of times... some of those runs were very short and stopped very quickly but this last run I was read for the recovery part which did not last long but I caught it as it started

Now when I try to access the drive I don't get an error saying the drive needs formatting... I get this error

Which I view as progress...

Do I just keep attacking it with CHKDSK /F or is there a better approach now


Jim Broadbent

 

[goombawaho]

Go back to my last post. I recommended that you test the drive FIRST so you don't waste your time with the CHKDSK and you don't waste time that you might use trying to recover files IF the drive is getting toasty.

Nothing more to do here. A test will give you the drive's fate. The file corruption could be due to a windows issue OR hard drive failure.

"Living tomorrow is everyone's sorrow.
Modern man's daydreams have turned into nightmares.

 

[Ngolem]

YAHOOO!!!!!!

I set the chkdsk d:/f to come on when the computer was rebooted and it made only 2 corrections and noted a few unreadable sectors. It made it completely true with no fatal errors.

So I brought up Explorer and the drives sorted themselves out in a second.... I clicked on the D drive and I got ALL my files back... 100+ meg worth.

I will back them up immediately of course .... CHKDSK works... took 5 times with progressively less errors but it works.

It is a wonder why it took me a year to try this...hahaha

Thanks for your patience with me... I needed a hand to hold frankly.

Jim Broadbent

 

[Ngolem]

Ooopps... I meant 46GB not 100meg...too excited

Jim Broadbent

 

[goombawaho]

Ok, good. I would still test that drive before you trust it again. Fair warning if you don't.

"Living tomorrow is everyone's sorrow.
Modern man's daydreams have turned into nightmares.

 

[Ngolem]

I hear you....While I had access I downloaded all files that were important in anyway to an external HD, which went very well.

2 days later, same problem...so that drive is in death throes but I do not care anymore.

Jim Broadbent

 

[zelgar]

Before you shout for joy, the file may be corrupted. Hopefully they're not, but you're still not out of the woods.

Additionally, for screen captures, if you press <Print Screen> you copy an image of your screen to the clipboard, but if you hit <Alt><Print Screen> together, you only copy the active window.