1 important problem that needs a serious fix. (Acer Aspire E5-575G)

TF21045

So I was playing Growtopia then sometime later, it crashed.. and it won't boot..
Then I realized that the FS is RAW.
I was like: wtf??

Then I search up: How to convert the file system from RAW to NTFS without formatting
but nothing happened..

So can anyone provide me on how to change the file system without formatting?
School's coming and I need a PC ASAP.

TF21045

(alright why is no one answering-)
(i'm not mad or anything)
(it's free to leave the answers below)

aphanic

I bet many of us have stumbled upon your thread at one moment or another, but it doesn't seem... quick to diagnose, those are not the words but they'll have to do for lack of better ones.

The thing is, filesystems are low level enough that you can't change them by playing games for example, I don't know Growtopia personally, but I'd say it wasn't the culprit. Some kind of malware on the other hand would seem more plausible, if it was able to run with admin privileges it would have raw access to the disk and then overwrite the initial part of the partition where the identification of the filesystem is.

First things first, have you done anything else to the machine? Because we're looking at a scenario where we need to boot off of an USB and try to diagnose things from there. Ideally we'd need to make a forensic-style image of that drive not to lose any data, but for that you'd need another drive where to hold the data and it would need to be at least as big as that one.

Do you have access to another machine where you can create a bootable USB stick? I'd like to at least examine the disk from an environment that wouldn't touch it. For example, I'd like to see if there are still partitions in that disk, or if the partition table has been wiped out. If there are, that's good news, we could try to forcibly set the type of that partition as NTFS and see if you could access your data.

That's destructive though, hence the image made before. One of the metadata information NTFS has is a mirror of the MFT, a structure that holds information of which files are in there and where they are located, which is useful for data recovery programs like R-Studio to recover data. I named R-Studio because in my opinion if it's not the best in the field it's certainly among the best, but it's a paid one. The good news is that you can see if it would be able to recover data before you attempt to recover it, you don't have to pay straight away.

Then there are other kinds of programs able to recover in-situ (also risky) the partition table if it has been wiped out, but there are remnants enough that they're able to tell what was there...

All in all, you're looking at a complicated process, one for which there's no easy fix in my opinion and many steps before you arrive at anything. Hell, another option could even be that the disk is damaged and it's failing, but for that we'd also need another machine where to connect the disk through an external adapter or boot from a USB stick as well.

TF21045

1. First things first, have you done anything else to the machine?
No, I didn't.

2. Do you have access to another machine where you can create a bootable USB stick?
Yes I do, but i'm stuck with the Aomei thing that typically takes forever to start..

Plus I never installed more s**ts that can affect my system.. (replying to: >Some kind of malware)

TF21045

> the disk is damaged and it's failing
It's not damaged.. I can still see my partitioned Team's ISO Drive and E:Team's Acer Videos except the C:Team's Acer Drive is the RAW one..

aphanic

Oh but malware may install on its own without you even noticing I'm afraid.

So what are the state of things, do you have the disk out of that system, connected to another and running it with that Aomei or can we use that other system to create a boot USB of something else?

The first thing I'd like to know if if the partition table is intact or has been modified, as well as the status of the disk. If you can connected it to another machine great because we don't have to use a bootable Windows or Linux for it, but if not I can provide you with an image that you can use to create a bootable disk for some basic diagnosis.

TF21045

Intact.. I can see my Team's (oh god yes, Team's Disk Drives) but I tried the Aomei thing ONCE just to rebuild the MBR. It saw my Team's Acer Drive but it won't show my the files.. Then I crashed Aomei so it reboots.. (then I say: that's it im going to do macrium) It showed it as NTFS and 1400+ GB free all that stuff but, it froze to I rebooted it to the ST200LM007 and it just locks up again to Acer splash logo..

> do you have the disk out of that system, connected to another
Well, I did once but I ain't gonna cuz I might damage the pins.. but do USB to USB work or I need to do something else to make it work?

> can provide you with an image
that is at least 1GB? I lost my 8GB somewhere though and never found ;-;

> Oh but malware may install on its own without you even noticing I'm afraid.
I had my Windows Security on at that time.. All the time..

C2517

I have Aspire V3-575  Model # N15Q6 and I need to know where I would enter this info to see what kind of a wifi card to order, as I think mine is out?

TF21045

C2517 said:

I have Aspire V3-575  Model # N15Q6 and I need to know where I would enter this info to see what kind of a wifi card to order, as I think mine is out?

Uhm not in here..

aphanic

So you were running Aomei and everything directly in the same device?

Don't worry about the pins, the SATA spec lists it good for at least 50 cycles, but we can try the USB drive if you wish. I'll try to build something that can fit in a 1GB drive. Give me some time and let's see what I can come up with.

As for Windows Security, it doesn't mean anything, just like any other antimalware vendor. They just give you a false sense of security but no solution is infallible. Unless you're physically unplugged, disconnected to the Internet, there's always the possibility of an infection. 0-day exploits, drive-by downloads, I don't know, just know it's possible but also know it's not usual for it to happen.

TF21045

> I'll try to build something that can fit in a 1GB drive.
Alright! I might fix it now at 1AM lol..

aphanic

Or tomorrow man, I'll just leave it made for you to use whenever you want to haha

The problem with these sorts of things is that they're usually done in real time, because I could tell you what does that say, and then do that, and then and now what do you see, that kind of interaction. That's why troubleshooting this from afar is complicated.

So, basically the image I built is based around Macrium's free offering, but I added some extras in the image. You should access them through the included file explorer at the lower left part of the screen:
 - CrystalDiskInfo and/or GSmartControl may be able to read the SMART data off the disk and tell us if there is anything to worry about regarding its health.
 - R-Studio, while still being a demo is able to scan that partition and try to recognize filesystems and files in there, for you to examine afterwards. Recover is going to be disabled for most files being a demo and all, but it's an indication of how things are (remember to run the RStudio64.exe directly)
 - TestDisk (testdisk_win.exe), I added it because I think it is able to recover partitions as well. I never used the software myself, but I've heard good things from it. There's a manual on how to use it here: https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

And if all else fails, we'll switch to Linux, GParted Live for example should be able to scan and recover partitions as well and the image also fits in a 1 GB drive.

To create any of the bootable disks use Rufus, it should setup the right parameters once you select the appropriate image.

---

And one thing I wanted to leave for the end is manually setting the partition type to that of NTFS via DiskPart for example. That will automatically make Windows detect and work under the assumption that the partition is NTFS, but I leave it for the end becase at that point Windows could be making changes to it that are destructive in nature.

In any case instructions would be, from the same Macrium USB disk for example, open the command prompt and access DiskPart:



Then select the partition that is currently being RAW and set its ID to 07 if the disk is MBR partitioned (doesn't have that * in the Gpt column on the output of list disk) or "ebd0a0a2-b9e5-4433-87c0-68b6b72699c7" if it is a GPT partitioned disk, those are the ones for NTFS:



Aaaanyway, I left the image here: https://mega.nz/file/ANFEBCBS#qGQo4P9siNvBItiWcSx-ug-NU7PHII7xqhx_dv90Lw0

I hope it helps in any way.

TF21045

O-kay..
what to do next?
nevermind I have to make it GPT for FAT32..

TF21045

Uhhhhhh..

aphanic

Oh... your hard drive is undetected over there?

Try switching the SATA operation mode in the BIOS, you may need to press Ctrl+S in the Main tab for it to appear. I don't recall if I had included the drivers for RST

X: is that live environment and F: seems to be the USB stick where the utilities are and all, but no letters seem to appear.

It could be that you need to assign it letters as well. Check with DiskPart in the CMD, see if "list disk" is able to show your internal disk by any chance.

TF21045

I did press the Ctrl + S but nothing appeared in the Main tab
But in Boot, it literally saw the ST2000LM007-1R8174

I did the DISKPART but it shows Disk 1 but where the hecc is the Disk 0?

aphanic

Huh, where indeed, tell me the full model name of yours, the letters that go after the E5-575G, for example mine is an A515-54G-70Y9. That should help me find out the rest of the specs to know which drivers to include in the image.

Just to verify, the disk spins and all right? It is detected in the BIOS.

TF21045

Yeah it spins up and detects the BIOS
and it's 728J (my full model)

aphanic

Just checked, it's a 7th gen core i, the drivers in there ought to be compatible with your system despite being newer. It's odd that you can't change the SATA mode either, is it set to RST or something like that?

I can try to recreate the drive image and include the drivers directly off of your support page, if it's not seen like that then we'd need to think about going to Linux directly with that GParted Live for example, or getting that drive into another computer, which ever seems easier.

In fact, while I create the image you can try any of the options for now.

TF21045

Irdk about Linux though.. but Iadk if it's in RST or SATA.

aphanic

It could be listed in the information tab of the firmware settings, how SATA is operating. For Linux I'd put some pictures to guide you too, I'm recreating the image again now though, I'll add drivers from your support page just in case.