Inaccesible Drive

**Kodiak** · May 11th, 2012, 09:20 AM

Here the past couple week's I have ran into three of these. Test the drive and it is fine but try to access the data it's inaccessible. Most of the time even if it's a virus you can get at the data. Tougher virus out lately? Anyone else run into this? I do get the data with get data back.

**slgrieb** · May 11th, 2012, 10:16 AM

Have you tried Unhide from Lawrence Abrams? It usually does the trick for me. Abrams is also the author of RKill, by the way.

**Niclo Iste** · May 11th, 2012, 11:43 AM

Depends on many things, what kind of drive is this? Are these encrypted such as TrueCrypt or PGP? Are they Windows drives (I've noticed ubuntu formatted drives confuse the heck out of windows machines) It is possible that they are corrupted espeically if they all came from the same batch or the same machine that has faulty wires/board/power supply.

***Steve R Jones*** · May 11th, 2012, 12:31 PM

What happens/doesn't when you try to access the drives?

Are you getting an error message that would help a lot and or allow you to GOOGLE it

**Kodiak** · May 12th, 2012, 08:40 AM

These drive are out of different windows machines and the customer is saying they click on something and they now get a blue screen. I have tried chkdsk. What I have done is just format the drive then run get data back and I get there stuff but nothing else works. You cannot access the drive at all even with ERD or UBCD. Seen three or four of these now in the past couple week's. The drive tests good.

**slgrieb** · May 12th, 2012, 10:53 AM

Overall, it still sounds like some variant of FakeHDD is the culprit. That's surprising since the purpose of the rogue software is to give you enough access to the computer to purchase a "repair" tool, while rendering the machine mostly useless. Blocking access completely isn't going to make the bad guys any money.

When you say that the drive isn't accessible from boot CDs, what exactly are you seeing? I mean, does the drive show as unallocated space, but correct capacity? Is it formatted, but shows no files?

**Kodiak** · May 12th, 2012, 10:50 PM

All it says is it inaccessible. One drive showed 0gb space until I nuked it then I could use it again. In each case I have been able to retrieve there data. I think your right slgrieb. It looks more like just some sort of data corruption to the point it make it inaccessible and just a coincidence I've seen this many in a short period of time. Just wondering if anyone else was seeing this also.