Drive healing from scratch (Windows version)

Lab setup: PC + USB to SATA adapter + Seagate 1T HDD

run>msinfo32, shows:

  • Microsoft Windows 10 Professionnel, 10.0.18363
  • ASUSTeck, X556UB, x64, Intel i7-6500U CPU @ 2.50GHz, 2 core, 4 logical processors
  • BIOS UEFI

Lets gather some information on this drive?

  • msinfo32 shows nothing!
  • disk management (diskmgmt.msc) shows nothing!

Fault in system (os, driver)? usb port (controller, etc.)? cable? disk itself?

  • in File Explorer (Win + E, run>explorer.exe), and additional disk is present (F:)right click and click on properties: no utilization information, tools (chkdsk, defragmenter) do not have access to it.
  • in Device Manager (devmgmt.msc) + unplug/plug usb cable: the adapter is detected and handled by MS driver 10.0.18362.1 (21/06/2006) version, USBSTOR.SYS.
  • uninstall/install this device does not respond in an acceptable time! not able to close it either (usb device unplugged)! hopefully i was able to kill it under (taskmgr) ; it’s still there in Device Manager
  • let’s uninstall the controller and see: not able neither!
  • restart an see… not able to just restart, needed to force shutdown! any results? now the drive has disappeared from File Explorer, from Device Manager and from Disk Management.
  • replug the adapter: the drive appears now under Disk Mgmt using an MS (21/06/2006) 10.0.18362.1 version driver (disk.sys, EhStorClass.sys, partmgr.sys, EPMVoIFI.sys) but no information on the vendor is in there?!
  • a lookup for drivers, tools to diagnose at Seagate website: SeaTools for Windows returns nothing (did not detect the usb drive); Drive Detect? No help…
  • What can MiniTool Partition Wizard Free offer? something wrong with the partition? lets run partition recovery wizard: the good news is that the adapter led is blinking: analysis is going on, drive accessible, readable.
  • The utility discovered an existing NTFS partition (and its file structure, data) but the Disk Management not!

How the drive is written at the lowest level? let’s deep into this using Hex Workshop application and check MBR table information (Bootstrap, Partition table, Signature).

  • The image shows the MBR table organization: .
  • The first partition hex is (00)(0A0902) (EE)(FEFFFF)(00800000)(00E06F74).
  • The first field (1 bytes) indicates if the partition is active (is set to 80 hex, Windows labels this partition as SYSTEM (visible in MiniTool Partition Wizard or diskmgmt.msc for example), in our case it is set to 00 hex whick indicates that the partition does not have the boot flag set (no other values are possible), a non-active partition.
  • The 2nd field (3 bytes) represents the partition starting sector in CHD.
  • The 3rd field (1 byte) represents the partition file system (07 for NTFS, EE for GPT protective MBR).
  • The 4th field (3 bytes) represents the ending sector of the partition in CHD.
  • The 5th field (4 bytes) indicates the starting sector on disk.
  • The 6th field (4 bytes) indicates the size of the partition (the number of sectors indeed which is multiplied by the sector size).

Analyzing the other partitions information in MBR table indicates only one partition (the 1st) is existing, which contradicts MiniTools Partition Wizard findings (at least one NTFS partition is found) after a deeper analysis of the drive storage area!

What are some available healing methods that works

One thought on “Drive healing from scratch (Windows version)”

Leave a Reply