Write Delayed Failed Logical Drive

billdaju

Distinguished
Apr 18, 2007
6
0
18,510
Need help from you all geek and suggest how I can recover.

i. OS windows 2000 server
ii. OS HD (IDE) MAXTOR STM3200820A 200GB
Working fine with logical drives C, D, E, G with 40 plus GB each.
iii. SATA Seagate 1.5 TB


I am sorry, the above did not capture the image or screen shots.
Please take a look at this page where I ahve the PDF file with screen shots.
http://postimg.org/gallery/8oonb6tc/2361e785/
Thank you

This bad boy has 5 logical partitions worth 78 GB each named as H, I, J, K, L, M, V. The rest drives were not formatted but partitioned and not used W, X, Y, Z. (195.31 GB each).
The screen shots are shown below.
This drive does not have OS installed. Other laptops can access the logical drives with an ID/PASS, working as a shared workstation. Education, Music, Video, etc.

On some random time, I got delayed write failed with infamous $Mft.
Few screen shots are shown below.
Windows- Delayed write Failed.
a. Windows was unable to save all the data for the file \Device\hardDiskDmVolumes\PhysicalDmVolumes\BlockVolume6\installedSoftware\DB2\sqllib\java\jdk\jre\lib\fonts. The data has been lost. The error maybe caused by failure of a computer hardware or network connection. Please try to save this file elsewhere.

b. \Device\hardDiskDmVolumes\PhysicalDmVolumes\BlockVolume6\$Mft

c. \Device\hardDiskDmVolumes\PhysicalDmVolumes\BlockVolume1\$Mft

d. \Device\hardDiskDmVolumes\PhysicalDmVolumes\BlockVolume1\.

iv. Device manager shows as

When accessing I: drive and a folder under it, the disc immediately disconnects
And throws the pop ups like below for $Mft
Tried using Dos Navigator, but when I select that folder, it does the same thing, disconnects from device manager and starts throwing $Mft errors as below.

(v) write delayed screens









(vi) The drive still shows in device manager.


(vii) since it is gone from Disk management, now running re-scan hardware devices, kicks out completely,


(viii)
Shutdown the computer normally, and plug-out the cable from SATA and re-connect it will show in device manager, but I have to re-scan and re-activate to make it online.


Once the drive is invisible, it does not show in disk manager as well.



When re-activated the disk1, then the offline state converts to online.


(ix) Now the device manager shows as well, the second disk, yes write cache is disabled.



I immediately tried to backup data on all the drives. The Windows device manager did not see the drive. I had shutdown win2k server (that is where these 2 drives are), changed the SATA Cable and SATA port. Reboot, the drive is visible in device manager.
Now I see offline under windows drive manager as a second drive “Drive 1”
I right click and activate disk. It comes back online.
(x) Windows explorer shows folders too, but when click on certain folder, that is the ‘main’ folder I am looking for, the disconnect happens again with $Mft write delayed errors.
To me the logical drive is bad. How can I recover data from these logical drives?

Please suggest the next step.

 
Solution
the following is credit to http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

"If both NTFS boot sectors are corrupted and you need to rebuild the NTFS boot sector, TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr). It reads the MFT record size, it computes the cluster size, and it reads the size of the Index Allocation Entry in the root directory index. Using all these values, TestDisk can provide a new boot sector. Finally it lets the user list the files before writing.

Repair An NTFS MFT

The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair...

billdaju

Distinguished
Apr 18, 2007
6
0
18,510


Yes I did, but the drive gets disconnects when I chose the folder.
I am worried, at the same time, it shows still with 11GB used space.
Thanks
 
the following is credit to http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

"If both NTFS boot sectors are corrupted and you need to rebuild the NTFS boot sector, TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr). It reads the MFT record size, it computes the cluster size, and it reads the size of the Index Allocation Entry in the root directory index. Using all these values, TestDisk can provide a new boot sector. Finally it lets the user list the files before writing.

Repair An NTFS MFT

The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT. "

http://www.cgsecurity.org/wiki/TestDisk

there is another method people talk about which is format the drive using quick format then run a data recovery program on the drive but result very using this method


the basics of this problem is the file table is messed up to even a point that chkdsk cant fix it which means its really bad issue. the file record is most likely assigned to a bad sector of the hard drive. that means the info to where files are stored on that partition is partially or completely messed up. id start with the testdisk method if it was my hard drive.

note all this info came from searching google for info and putting it together with what I know to be right info(I weeded out some bad methods that wouldn't be good for you to try.)
 
Solution

billdaju

Distinguished
Apr 18, 2007
6
0
18,510



That was a good tool, yes the tool analyzed all cylinder and reported no error. I could go to the drive in question and list folders, (I was able to go to see folders even w/o this tool), but when I reach certain folder. e.g I:/<your folder>/<second folder>
It does not list files. I can post the screen shots from this tool. I can also send logs from this tool, but it is very big text file 1.7 GB to be exact.
What are my options ?
Thank you

I also used Oem3Sr2.zip frole from Microsoft to see if NFI list them.
This tool's log lists as (one of the many entries in it look as below)

File 88
\Eye Doctor\Eye Doctor 2008\John Lense Power.PDF
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$OBJECT_ID (resident)
$DATA (nonresident)
logical sectors 20514624-20515599 (0x2c890b8-0x2c89777)

source:
http://forum.sysinternals.com/understanding-chkdsk-output_topic5829.html


 
I honestly don't know where to go from here.

I was hoping the following was going to fix it to where your files where displayed. did you do this part?

" The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT."