Worst Message From Windows?

Sep 22, 2025 Last reply: 9 months ago 21 Replies

Devices just die and are no longer detected, if their critical data storage is ruined.

A device which identifies itself, displays SMART table, and so on, that's "mostly functional", and the fact that the softwares attempt to read the partitions and "find no data", means for the most part it is working (delivering data when queried, even if the interpretation of the data is not there).

You could, for example, corrupt the FDE key on the drive and scramble everything beyond repair. That has not happened, as you have a partition table, with partition declarations.

If the MBR (on a legacy partitioned storage device) was overwritten by a new MBR, that would result in the filesystems on the partitions to not be recognized. On Windows, if you look in Disk Management, if it says RAW or NTFS, that helps tell you whether there is "organization" present in the partition.

There is all sorts of info to be harvested from this device... because it is not dead.

I've lost several (HDD) devices, and during the rescue phase had them wink out and stop IDing themselves at BIOS level, after which all attempts to rescue, must fail. The controller board on a lot of these drives, would be fully functional and could answer questions asked of it, but that is not how they choose to design them. The feeling is, once the defectivity passes a certain level, the device must remain silent, as a signal to the user. I did have one controller that continued to chat, past the point it should have stopped. It was a 40GB drive. I gave the 40GB drive a query, and it said it was a 10GB drive. And instead of saying Maxtor blahblah, it said it was Falcon and it was a 10GB drive (which corresponds to a single platter config). But after one more device reset, that leaked ID was gone, and no more chats were available.

One reason for practicing your forensic skills, is for when the day comes you don't have a backup for something, and data recovery is required.

Paul

A corrupted partition table seems to explain the behaviour.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required