Sign in with
Sign up | Sign in
Your question

Comparison of NTFS/MFT recovery software?

Last response: in Storage
Share
Anonymous
a b G Storage
August 27, 2004 3:43:56 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

There appear to be hundreds of software packages out there to restore
an NTFS partition with a corrupted MFT. Does anybody know of any
reviews with a feature comparison matrix?

What utilities do you recommend?
Anonymous
a b G Storage
August 27, 2004 3:52:30 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

I recommend OnTrack's Recovery Software. Their software has saved me
many times even after a repartition/format (which actually doesn't
destroy any data but does make it difficult to get the data back without
specialized software).

Check it out at www.ontrack.com ;) 

----
Nathan McNulty


*no spam* wrote:
> There appear to be hundreds of software packages out there to restore
> an NTFS partition with a corrupted MFT. Does anybody know of any
> reviews with a feature comparison matrix?
>
> What utilities do you recommend?
Anonymous
a b G Storage
August 27, 2004 12:34:41 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

In article <34300eeb.0408262243.16cc82f@posting.google.com>,
*no spam* <no0spam@yahoo.com> wrote:
>There appear to be hundreds of software packages out there to restore
>an NTFS partition with a corrupted MFT. Does anybody know of any
>reviews with a feature comparison matrix?
>
>What utilities do you recommend?

If it's corrupted, why do you want to restore it ? Do you mean recover
or repair ? Can you point to one or two packages for example, I'm not
sure what you are referring to.

A google for "NTFS partition with a corrupted MFT" doesn't come up
with any obvious packages.

There's lots of good info in http://www.ntfs.com/.
Under recovery concepts the is nothing about corrupted MFT.

In my experience (many thousands of systems, from the first days of
NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.
About the only way to kill it is for the underlying hardware to die.
I know that some people with more experience have seen an ocasional
problem. It's vastly superior to FAT32, esp for very large disks.

Do you have a problem, or is this a hypothetical question ?


--
Al Dykes
-----------
adykes at p a n i x . c o m
Related resources
Anonymous
a b G Storage
August 29, 2004 11:18:52 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

Stephen H. Fischer wrote:
[snip]
> "NTFS is a profoundly reliable file system." ... NOT!!!

Oh I don't know. I've been running systems on it for years and had very few
problems considering. I run the occasional chkdsk for the sake of good
health and i've never had a file system problem on these system that was not
ultimately down to a hardware fault. Maybe my experiences are not typical,
but that doesn't make them any less true.

> Sorry to break in, but loosing a complete partition, perhaps to a
> corrupted MFT makes NTFS worthless in most cases.

As opposed to what other file system thats immune to corruption? If a file
system becomes corrupted then you risk losing what is on it, which is why we
always tell people to back up on a regular basis.
Anonymous
a b G Storage
August 30, 2004 3:04:14 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

*no spam* wrote:
>
> There appear to be hundreds of software packages out there to restore
> an NTFS partition with a corrupted MFT. Does anybody know of any
> reviews with a feature comparison matrix?
>
> What utilities do you recommend?

There are hundreds of thousands of permutations from which I
(successfully, normally) choose.

Chipsets, CPU, operating system, slave / master - just to kick off.

Can't tell you how I am so successful, but don't think for one second
it's all down to one or other software package.

Practice is essential - years of it.

I know this is not a commercial group, but I would be happy to do a
fixed-price repair of this drive for £120 plus cost of media to store
recovered data.

I have clients across the globe - not restricted to the UK by any means.

I also consider myself to be better than the "big boys" for almost all
types of recovery - and at less than 10% of the cost.


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk
August 30, 2004 7:52:03 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"Odie Ferrous" <odie_ferrous@hotmail.com> wrote in message
news:4132FB9E.F6A413D7@hotmail.com...
> *no spam* wrote:

> I also consider myself to be better than the "big boys" for almost all
> types of recovery - and at less than 10% of the cost.


a.. The initial recovery deposit payable is £65 plus VAT (£76.38.) Please
include the payment with your hard drive. (Cheques must be payable to D
Clarke.)


a.. The first Gigabyte of data recovered is included in the initial deposit.
Thereafter, the recovery process costs £2.00 plus VAT (£2.35) per Gigabyte.

Assume a 80 Gb drive containing 50 Gb of data. 50 x £2.35 = 117.50

a.. Transferring recovered data to CD or DVD costs £1.50 plus VAT (£1.76)
per Gigabyte, which includes the cost of media. Please let us know whether
you would prefer the data on CD or DVD. This is a fairly lengthy process,
which maintains your original directory / folder structure, and is designed
to be absolutely trouble-free to copy the data back once you receive your
returned drive and the CD or DVD media.

Assuming all 50 Gb is recovered 50 x £1.76 = 88

BTW ... this is all the Standard service, if you need your data faster it
will be more expensive.

Adds up to:

76.38
117.50
88.00
---
In US Dollars = $ 533,26 ... this means the big boys would ask $5330 (as you
do it for 10% or less)? Or, DiskLabs according to their online quote form
asks $ 690. 10% would mean you'd do it for $ 69?

Either there's something wrong in my calculations (for which I then
appologize) or something is wrong with yours. Assuming my calcualtions are
correct, I find some of your claims hard to believe.

--
Joep
Anonymous
a b G Storage
August 30, 2004 7:52:04 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

Joep wrote:
>
> Either there's something wrong in my calculations (for which I then
> appologize) or something is wrong with yours. Assuming my calcualtions are
> correct, I find some of your claims hard to believe.
>
> --
> Joep

Sorry, Joep - I don't mean to mislead.

For obvious reasons, I need to have plain facts and figures on my
website. There *are* individuals who will try to take advantage of me,
and I need to keep that to a minimum.

However, there has not been one single case where the recovery of more
than 30GB of data has resulted in the total charge being assessed.

Additionally, I will often forego the charge to copy the data to the
media. Certainly if there are only 5GB of data required (a common
volume) the charges will be complete. But for 30GB? No way.

The different service levels are there for a reason but, again, I am not
going to take a Priority Plus fee for something if there is a recovery
machine not busy with someone else's recovery. If the client is
desperate for the data and I don't have to interrupt other processes, I
am not going to charge extra.

This will come as a huge surprise to you and many others, but I am NOT
in the business of stitching people up.

I have never had a complaint from a client, and I intend to keep things
that way.

Sure, any old bad guy can say he's one of the good guys - what's he got
to lose? But me? Well, I *am* one of the good guys!

There is every chance some of my existing clients will be reading this.
I know for a fact that not one will complain or even have cause to raise
an issue. My confidence is valid!


Odie
--

RetroData
Data Recovery Experts
www.retrodata.co.uk
August 30, 2004 9:01:42 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"Odie Ferrous" <odie_ferrous@hotmail.com> wrote in message
news:41333EBB.EDC2B51D@hotmail.com...
> Joep wrote:
> >
> > Either there's something wrong in my calculations (for which I then
> > appologize) or something is wrong with yours. Assuming my calcualtions
are
> > correct, I find some of your claims hard to believe.
> >
> > --
> > Joep
>
> Sorry, Joep - I don't mean to mislead.
>

Okido ;-)

--
Joep
Anonymous
a b G Storage
August 31, 2004 2:35:44 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On 27 Aug 2004 08:34:41 -0400, adykes@panix.com (Al Dykes) wrote:
>In article <34300eeb.0408262243.16cc82f@posting.google.com>,
>*no spam* <no0spam@yahoo.com> wrote:

>>There appear to be hundreds of software packages out there to restore
>>an NTFS partition with a corrupted MFT. Does anybody know of any
>>reviews with a feature comparison matrix?

I'd like to see that, too.

>Do you mean recover or repair ?

I'd like tools to do either.

>There's lots of good info in http://www.ntfs.com/.
>Under recovery concepts the is nothing about corrupted MFT.

>In my experience (many thousands of systems, from the first days of
>NFTS file system (NT3.51?)) NTFS is a profoundly reliable file system.

All well and good, but it can only be as reliable as the hardware
allows it to be, and it can do nothing against malware attack, if the
malware enjoys the appropriate level of access (see Witty).

>About the only way to kill it is for the underlying hardware to die.

Well, that happens. Losing data is not a matter of "Oh, that was
because the hardware was bad. That's OK then!"

>I know that some people with more experience have seen an ocasional
>problem. It's vastly superior to FAT32, esp for very large disks.

>Do you have a problem, or is this a hypothetical question ?

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC, and will have to be careful to stop XP writing
SR junk on the at-risk volume). Most purported to pull stuff off,
recover partitions, undelete files etc. One in-place repair tool,
diskette-based, that didn't boot when I tested it.

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

Still looking...



>--------------- ----- ---- --- -- - - -
Hello DOS mode my old friend
I've come to hack with you again
>--------------- ----- ---- --- -- - - -
August 31, 2004 2:38:35 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message
>
> I did find a number of tools, mainly Windows-based (meaning you'd have
> to have a recovery PC

Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).
If you can still download recovery software, then it may be assumed you have
access to an additional PC anyway.

> , and will have to be careful to stop XP writing
> SR junk on the at-risk volume). Most purported to pull stuff off,
> recover partitions, undelete files etc. One in-place repair tool,
> diskette-based, that didn't boot when I tested it.
>

Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
tell you much about the tool itself. The tool itself probably doesn't boot,
it needs to be started once the OS (DOS/Linux) runs.

--
Joep
Anonymous
a b G Storage
August 31, 2004 10:48:54 AM

Archived from groups: microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general (More info?)

On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>
> I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
> structures, document them, let me scribble.
>
> Still looking...

In that case you might want to check out my DFSee tool:

http://www.dfsee.com/dfsee.htm

That will display many filestructures (including most NTFS stuff)
is a readable (decoded) format, or when needed as HEX dumps.

Apart from displaying, it has lots of specific 'fix' commands to
repair 'common' problems like damaged bootsectors
or partition-table problems.

It also has file copy/recover commands for undeleting
and saving data from damaged filesystems.

The program is NOT free, but it is not that expensive either.

You can download the evaluation version and play with that
for a month or so to see what it can do.

There is a Windows (console, NT/W2K/XP only), plus a DOS
and an OS2 version in the same package, and a native Linux
one will be added to the package shortly ...

Regards, JvW

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com
September 1, 2004 1:23:33 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"Stephen H. Fischer" <sfischer1@mindspring.com> wrote in message
news:p D2Zc.3775$8d1.1106@newsread2.news.pas.earthlink.net...
> Hi,
>
> The current state of NTFS recovery software (I.E. supplied with the O.S.)
> appears to me to violate "The Goal of Trustworthy Computing",

I think this is a far fetched point. I don't understand how my car works in
great detail, still I trust it. Also it appears to me, the main focus of
"Trustworthy Computing" is privacy: I don't want my information to become
available to others without my approval. And beside that, I don't appreciate
it that much, IMO it's mainly marketing.

> Reliability:
> The customer can depend on the product to fulfill its functions.
>

Wake up call: There is no softeware in the world that will under all
circumstances deliver what it is intended for. This can be due to software
bugs or external factors. Chkdsk's main purpose is file system consistency
and integrity, not data recovery per se. File system structures can simply
be beyond repair.

> There appears to be a dichotomy in the handling of file system errors.
>
> CHKDSK will run or CHKDSK will not run is the dividing point.
>
> If CHKDSK will run, it does its work and repairs the file system with
> minimal reporting.

You're making a mistake. The fact that chkdsk runs does not mean by
defintion it delivers and actually will repair the file system. In a data
loss scenario chkdsk may be the last thing you want ...

> The decision apparently has been made to have it do its
> work now behind a blank screen during the boot process.

If you want you can see chkdsk run and you can also learn what it actually
does. Just search the MS KB.

> Thus it has passed
> into to the realm of programs that to weekend computer warriors will
always
> succeed as it is started and runs without input from the user.
>

To weekend computer warriors (who ever they are) software will always
succeed. Unfortunely this is not the case.

> As the years have gone by, less and less information on what it has done
is
> being reported. This has been mirrored by Norton,

Many weekend PC warriors actually prefer this. Many people are actually able
to use a PC because it's complexity is hidden from them. Many people say,
spare me the techno babble, I don't care how you do it, just do it. And they
want it to be as easy as possible. And this is normal, we all probably use
many machines, devices and techniques all day we do not have a very deep
understanding of, of how they work.

> appearing to long term
> Norton users that they are getting less and less for their money.
>

The problem with Norton is that they make you pay for non substantial
upgrades, but that is a different matter. Besides that, millions don't seem
to care as they happily upgrade every year.

> If CHKDSK will not run, then there is no path to recover.

Yes there is ...

> That is the
> violation.
>

Untrue. In every simple PC magazine, in every manual it is repeated over and
over again to make backups. So no one can claim he wasn't warned that
something may go wrong.

> Persons who are trying to protect their rice bowl think this is just fine
> and apparently are stifling any improvement in documentation, reporting of
> what is wrong and actually doing the repair.
>

Bull. I have a Saab, if there's something wrong, the car's computer will
tell me there's "engine trouble" and advises me to take it to the garage. I
am fine with that, I don't want it to talk about parts being broken I don't
know what they do anyway. If I take in my car for repairs, I want it
repaired, I don't want to be lectured in car maintenance. So the mechanic
hooks up the car to a computer which will give much more info. I pay the guy
for the service to interpret the info and do something about it. I can not
be knowledgable on every possible subject.

If I do want to know about car maintenance, I buy a book or do a course on
the subject. If I study the subject enough I can fix other peoples cars and
get payed for that or maybe even create tools allowing other to fix their
own car.

So if you insist of fixing your NTFS trouble yourself; happy reading!

> To those who say that the only method of repair if CHKDSK will not run is
to
> hire a person who has many years of experience and makes a living doing
data
> recovery just adds to the dichotomy.

You can be stuborn, but that won't change the truth. Some scenarios require
extensive knowledge. See car example.

> CHKDSK is trusted (and Norton) to
> repair the file system all by its self for the second case.
>

I don't trust them to that. In data loss scenarios I'd even be against
running any of those 2.

> That it cannot be trusted for the first case is a false position. The
rules
> for discovering what is wrong and what to do to repair the file system can
> be included in the CHKDSK program and need not as data recovery persons
say,
> be kept only in the human brain.

There are books on NTFS and there is extensive open source and free NTFS
documentation available (http://linux-ntfs.sourceforge.net/ntfs/). Still,
many rather pay someone who studied that documentation and provides software
based on the knowledge.

> The rules for finding what is wrong when
> CHKDSK will run were transferred from the human brain, why not the rules
for
> when it will not run.
>

It did tell why it didn't run: "Unable to determine Volume Version and
State".

> Repair in place I have stated is the only viable solution for gargantuan
> sized external hard drives that cannot be backed up currently.

Any disk can be backed up, just buy a same size disk.

>
> It may be useful to keep copies of various data structures to aid in the
> recovery by CHKDSK., that is what I wish to do now but my list is
incomplete
> I suspect.
>

Tools you referred to (Norton) do keep copies of some structures, though
they may simply not be enough. NTFS itself keeps copies of some structures.
Don't you understand? Anything man made can be broken. And some things
simply can not be fixed or forseen. To increase your chances keep copies of
all structures and data, it's called a backup.


> The argument that confusing and intimidating information must not be shown
> to the users is an strong argument towards eliminating the dichotomy and
> doing the job without the user being involved.
>

Nonsense. For years end users have asked to hide the techno babble - Linux
will grow as soon as they start to understand that. Those interested in the
techno side of stuff can do so. Try Linux. BTW, XP comes with loads of
command line tools that allow you to configure chkdsk and every thing else
you can't do from behind a nice GUI.

In Linux, everything is open source. It is however a misconception that all
people will know be able to understand how everything works. There's simply
too much info, plus many people don't even care.

> Furthermore, keeping information from all persons because some may not
> understand is elitist and should not be condoned.
>

Nothing to do with elite. It sounds good though, but it is a statement and
not a valid argument.

> -----------------------------------------
>
> What will follow now I suspect will be a massive attempt by persons
wishing
> to stop their rice bowls from being broken.
>

Well, I do not feel like attempting to do *that* at all. I am not afraid of
that all. It's really easy to make statements like your last statement; to
anyone responding you can now say: "you see, told you so! He's trying to
protect his rice bowl, no matter what he says".

--
Joep
Anonymous
a b G Storage
September 1, 2004 2:08:15 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"
<sfischer1@mindspring.com> wrote:

>Hi,
>
>The current state of NTFS recovery software (I.E. supplied with the O.S.)
>appears to me to violate "The Goal of Trustworthy Computing", Reliability:
>The customer can depend on the product to fulfill its functions.

Under normal circumstances. Which it does quite well, better than FAT32
ever did, so there's no violation.

>
>There appears to be a dichotomy in the handling of file system errors.
>

As well there should be.

>CHKDSK will run or CHKDSK will not run is the dividing point.
>
>If CHKDSK will run, it does its work and repairs the file system with
>minimal reporting. The decision apparently has been made to have it do its
>work now behind a blank screen during the boot process. Thus it has passed
>into to the realm of programs that to weekend computer warriors will always
>succeed as it is started and runs without input from the user.
>
>As the years have gone by, less and less information on what it has done is
>being reported. This has been mirrored by Norton, appearing to long term
>Norton users that they are getting less and less for their money.

Norton users were never able to understand anything of what they were
seeing. It was just a sort of lavalight show of technospeak. Then support
lines got tied up as Norton users tried tediously and pointlessly to repeat
the useless information that they'd seen passing by on their screens.

The bottom line was, and still is, was it fixed or was it not? And any
filesystem can get screwed up so badly that a 'bot can't fix it. FAT32
certainly did!

>
>If CHKDSK will not run, then there is no path to recover. That is the
>violation.

That's not a violation at all. That merely means that the problem is beyond
the ability of some mindless little automatic recovery program to fix and
the path to recovery lies in a manual fix by an informed human who can
bring real intelligence to bear.

>
>Persons who are trying to protect their rice bowl think this is just fine
>and apparently are stifling any improvement in documentation, reporting of
>what is wrong and actually doing the repair.

This is just uninformed, silly, and naive nonsense. You need to undertake a
thorough study of advanced filesystems yourself. There's a wealth of
documentation readily available, though understandably you may not find it
on the racks at your nearest truckstop.

<snip>

>
>That it cannot be trusted for the first case is a false position. The rules
>for discovering what is wrong and what to do to repair the file system can
>be included in the CHKDSK program

No they cannot.

>and need not as data recovery persons say,
>be kept only in the human brain. The rules for finding what is wrong when
>CHKDSK will run were transferred from the human brain, why not the rules for
>when it will not run.

Ridiculous. So why aren't robots doing heart bypass operations? Could you
do your own? Why have health insurance or pay doctors when you can do it
all yourself?

>
>Repair in place I have stated is the only viable solution for gargantuan
>sized external hard drives that cannot be backed up currently. Until sugar
>cubes holding more data bits than grains of sand in the universe are
>perfected, this will be the case.

Well, you just get a hard drive the same size as you have and with
compression you should have at least 30% left over, assuming the original
drive is full.

Gag. I can't stand to continue reading and responding to this silly
nonsense, sorry. And I have no rice bowl interest in the matter.
Anonymous
a b G Storage
September 1, 2004 3:55:26 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

In article <j8caj0lm8nv2dcai8d0ubae6clhnuj1bvr@4ax.com>,
J. S. Pack <me@privacy.net> wrote:
>On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"
><sfischer1@mindspring.com> wrote:
>
>>Hi,
>>
>>The current state of NTFS recovery software (I.E. supplied with the O.S.)
>>appears to me to violate "The Goal of Trustworthy Computing", Reliability:
>>The customer can depend on the product to fulfill its functions.
>
>Under normal circumstances. Which it does quite well, better than FAT32
>ever did, so there's no violation.
>
>>
>>There appears to be a dichotomy in the handling of file system errors.
>>
>
>As well there should be.
>
>>CHKDSK will run or CHKDSK will not run is the dividing point.
>>
>>If CHKDSK will run, it does its work and repairs the file system with
>>minimal reporting. The decision apparently has been made to have it do its
>>work now behind a blank screen during the boot process. Thus it has passed
>>into to the realm of programs that to weekend computer warriors will always
>>succeed as it is started and runs without input from the user.
>>


If what's on your disk is valuable to you, you'll back it it and keep
a copy at another location, and never overwrite your most-recent
backup media. There are any number of ways you can lose the contents
of your disk dive that dtaa recovery can't fix. Theft and lightning
are obvious ones.

And, if you're protected against fire, flood, theft, etc, you are, by
definition, protected against a file system failure (whatever that
means.)

It's not clear to me that the OP has an NTFS problem, because two file
systems became unavailable at the same time. To me that sounds like
losing partition information or a hardware failure. I'd like to know,
when the dust settles if the disk formats correctly and works OK.

It's also not clear what the OP was doing when the problem happened.

NTFS is better than any non-journalling FS I've ever worked with, from
a reliability standpoint. Performance is a different question and not
revevant unless you have a million files, or so,

IMO NTFS is more reliable that the disks it runs on.

IMO NTFS is amazingly tolerant of failing hardware that the disk is
connected to.




--
Al Dykes
-----------
adykes at p a n i x . c o m
Anonymous
a b G Storage
September 2, 2004 11:49:53 AM

Archived from groups: microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage (More info?)

On Wed, 1 Sep 2004 23:05:05 UTC, "Folkert Rienstra"
<see_reply-to@myweb.nl> wrote:

> Wow, you tested evaluation versions 'professionally' (whatever that means)

Picky picky ...
Testing system software has been part of my job for many years ...

> Yet simply setting up your newsreader properly you can't manage.

I notice you mention that a lot to anyone who's posts you don't seem
to
like for some reason, yet you never tell anyone WHAT is wrong.
I am not to old to learn ...

I don't understand your behaviour at times, i KNOW you are a
knowledgable
person from many valuable posts I have seen from you, yet you seem
to enjoy pissing everybody off most of the time.

<snip >
> > There is a timeout on un-registred versions (60 days from release),
> > but if you need further evaluation, simply download the latest ...
>
> Or if you're not downright stupid you just set your clock back
> and save you the 1.5 MB download that may not even be different.

Of course, if you feel happy with it, that will work too :-)

Regards, JvW

(not offended, just amused)

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com
Anonymous
a b G Storage
September 4, 2004 3:11:44 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Mon, 30 Aug 2004 22:38:35 +0200, "Joep" <
>"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message

>> I did find a number of tools, mainly Windows-based (meaning you'd have
>> to have a recovery PC)

>Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
>example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).

Ah, Bart'sPE - I must have another look at that, once it's SP2-ready
(current change log mentions changes to accomodate an SP2 RC, but
dunno if that makes it OK for RTM SP2).

I've tried Bart's PE before, and liked it, except without a full av
that I could run from it (and a way to update that av from USB camera
or flash drive) it wasn't that useful to me at the time.

For every data recovery, I usually need to do 10-20 formal av scans,
and for a while it looked as if Bit Defender Live would be better
there. But so far that's been too unstable to complete a full scan.

>If you can still download recovery software, then it may be assumed you have
>access to an additional PC anyway.

Yes, but I'd still rather not run NT if I can avoid it - too much risk
of it fiddling with the at-risk HD I dropped in (SR, AutoChk, etc.)

>> One in-place repair tool, diskette-based, that didn't boot when I tested it.

>Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
>tell you much about the tool itself. The tool itself probably doesn't boot,
>it needs to be started once the OS (DOS/Linux) runs.

Like MemTest86+ and several HD vendor's diags, it was an .EXE download
that writes a self-booting diskette when "installed". This diskette
may well be Linux-based, as MemTest86+ is, or it may use a FreeDOS as
some similar utilities do. Whatever the details, it didn't boot.




>--------------- ------- ----- ---- --- -- - - - -
Sucess-proof your business! Tip #37
When given an NDA to sign, post it on your web site
>--------------- ------- ----- ---- --- -- - - - -
Anonymous
a b G Storage
September 4, 2004 3:17:46 AM

Archived from groups: microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general (More info?)

On 31 Aug 2004 06:48:54 GMT, "Jan van Wijk" <jvw.no.spam@dfsee.com>
>On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"

>> I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
>> structures, document them, let me scribble.

>In that case you might want to check out my DFSee tool:

> http://www.dfsee.com/dfsee.htm

>That will display many filestructures (including most NTFS stuff)
>has lots of specific 'fix' commands to repair 'common' problems
>It also has file copy/recover commands for undeleting
>and saving data from damaged filesystems.

>The program is NOT free, but it is not that expensive either.
>You can download the evaluation version and play with that
>for a month or so to see what it can do.

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)



>-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
>-------------- ---- --- -- - - - -
Anonymous
a b G Storage
September 4, 2004 4:04:27 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

No one has truly said anything about whether there are files to fix a
corrupted $Mft however. Or recover all data off a disk that has one.


I have an external USB hard drive that has been having problems
writing to G:/$Mft, and has been hanging on those scans when you plug
in your drive. It finally (it meaning the $Mft file?) died and
decided to show up as a Local Drive that was unnamed (the hard disk
had been named in XP for easy reference).

Now when I try to open the hard disk, I get "The parameter is
incorrect" or "The file or folder may be corrupted". Considering my
previous $Mft troubles, I truly suspect the $Mft to be the culprit,
but perhaps much more experienced hands can tell me if that is the
case.

I daren't spend money on file recovery programs until I'm sure they
will solve my problems! :( 

==============
Posted through www.HowToFixComputers.com/bb - free access to hardware troubleshooting newsgroups.
Anonymous
a b G Storage
September 4, 2004 4:23:07 AM

Archived from groups: microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general (More info?)

"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message news:rnnhj0lure7cvl9loemsoqe3pncvoln5pg@4ax.com
> On 31 Aug 2004 06:48:54 GMT, "Jan van Wijk" <jvw.no.spam@dfsee.com>
> > On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"
>
> > > I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
> > > structures, document them, let me scribble.
>
> > In that case you might want to check out my DFSee tool:
>
> > http://www.dfsee.com/dfsee.htm
>
> > That will display many filestructures (including most NTFS stuff)
> > has lots of specific 'fix' commands to repair 'common' problems
> > It also has file copy/recover commands for undeleting
> > and saving data from damaged filesystems.
>
> > The program is NOT free, but it is not that expensive either.
> > You can download the evaluation version and play with that
> > for a month or so to see what it can do.
>
> Thanks; I've downloaded it, but will wait until I have time before I
> try it (else the demo period may time out before I get a round tuit)

"There is a timeout on un-registred versions (60 days from release),"

Maybe you should read first before you snip?

>
>
>
> > -------------- ---- --- -- - - - -
> "I think it's time we took our
> friendship to the next level"
> 'What, gender roles and abuse?'
> > -------------- ---- --- -- - - - -
Anonymous
a b G Storage
September 4, 2004 12:09:30 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

In article <41393ecb$1_4@alt.athenanews.com>,
alchow <alchow@gmail-dot-com.no-spam.invalid> wrote:
>No one has truly said anything about whether there are files to fix a
>corrupted $Mft however. Or recover all data off a disk that has one.
>
>
>I have an external USB hard drive that has been having problems
>writing to G:/$Mft, and has been hanging on those scans when you plug
>in your drive. It finally (it meaning the $Mft file?) died and
>decided to show up as a Local Drive that was unnamed (the hard disk
>had been named in XP for easy reference).
>
>Now when I try to open the hard disk, I get "The parameter is
>incorrect" or "The file or folder may be corrupted". Considering my
>previous $Mft troubles, I truly suspect the $Mft to be the culprit,
>but perhaps much more experienced hands can tell me if that is the
>case.
>
>I daren't spend money on file recovery programs until I'm sure they
>will solve my problems! :( 
>
>==============
>Posted through www.HowToFixComputers.com/bb - free access to hardware
>troubleshooting newsgroups.

There is no certainty in this life. There are so may ways a disk can
fail that there is no all-purpose tool. It's possible that the mft is
a cause, or just happens to be the file that is being refered to when
something else dies. If it's a hardware problem, there may be nothing
you can do. The data may be lost, beyond recovery.

IMO Ontrack is the big dog in the data recovery services business.

http://www.ontrack.com/Homepage.aspx?id=2&pagename=Serv...

They've recovered the server disk for one on my clients that was too
lazy to put tapes in the tape drive. It cost him $4000 to get his
data back, but they did it.

--
Al Dykes
-----------
adykes at p a n i x . c o m
Anonymous
a b G Storage
September 4, 2004 4:29:12 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Fri, 03 Sep 2004 23:11:44 +0200, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>On Mon, 30 Aug 2004 22:38:35 +0200, "Joep" <
>>"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message
>
>>> I did find a number of tools, mainly Windows-based (meaning you'd have
>>> to have a recovery PC)
>
>>Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
>>example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).
>
>Ah, Bart'sPE - I must have another look at that, once it's SP2-ready
>(current change log mentions changes to accomodate an SP2 RC, but
>dunno if that makes it OK for RTM SP2).

Yes, it makes it OK.

URL http://65.108.230.150/downloads/mybootdisks_com/nu2/peb...

>
>I've tried Bart's PE before, and liked it, except without a full av
>that I could run from it (and a way to update that av from USB camera
>or flash drive) it wasn't that useful to me at the time.
>

This has *exactly* what you need:

http://www.windowsubcd.com/index.htm

Get Bart's first.
Anonymous
a b G Storage
September 4, 2004 6:40:11 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"

>The current state of NTFS recovery software (I.E. supplied with the O.S.)
>appears to me to violate "The Goal of Trustworthy Computing", Reliability:
>The customer can depend on the product to fulfill its functions.

Breaks the safe hex principle that the system should not initiate
potentially destructive system changes.

>If CHKDSK will run, it does its work and repairs the file system with
>minimal reporting. The decision apparently has been made to have it do its
>work now behind a blank screen during the boot process.

This is the bad news.

>If CHKDSK will not run, then there is no path to recover.
>That is the violation.

No, that's not the violation.

ChkDsk is inadequate and IMO is unfit for use, period. Users in the
21st century deserve better than a tool dating from DOS 5 or older.

If it is not allowed to "fix" automatically, it is known to return
spurious errors when checking a volume that is in use. Most PCs are
setup as one big C: that is always in use. Join the dots.

If you allow the thing to "fix" automatically, it will discard
conflicting data when it "fixes", thus breaking the ability to use
that data to really "fix" if ChkDsk guesses wrong. After ChkDsk
"fixes", the "fixed" data is likely to be broken, the info needed to
really fix is thrown away, and it can no longer be detected as a
damaged file because the "fix" has rubbed off the sharp edges.

What you want is the ability to *interactively* check the file system,
as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
such-and-such an error and (more info) I plan to "fix" this by doing
X, Y, Z. Continue, or abort?" but it's too brain-dead for that.

AutoChk (that runs after bad exits) is even worse; it can only run in
"fix" mode. The point about "fix" mode is that this does NOT have an
interest in preserving user data; it is only concerned with keeping
the file system sane. If you read the fine print in MS's NTFS
documentation, they are quite clear on this, e.g. transaction rollback
may preserve sane metatdata but it does NOT preserve user data.

When it comes to management of physical disk errors, it gets worse.
As it is, the HD's firmware attempts to paper over failing sectors on
the fly, by copying material from a failing sector to a spare and then
doing an address switcheroo. Now the OS (on NTFS volumes) tries to do
exactly the same thing. Too many cooks? You bet! Hide information
you urgently need to be aware of? You bet!

So I choose to avoid NTFS altogether, and use DOS mode Scandisk for
elective and controlled file system repair.

>To those who say that the only method of repair if CHKDSK will not run is to
>hire a person who has many years of experience and makes a living doing data
>recovery just adds to the dichotomy. CHKDSK is trusted (and Norton) to
>repair the file system all by its self for the second case.

ChkDsk is NOT a data recovery tool, and has no right to presume to be
one. Automating data-destructive "fixes" may help MS cut down on
support calls, but it is detremental to data safety as it robs the
user of the option to manually repair.

And yes, a compitent tech (or an end-user recovery tool) can do better
than autofixing logic to manually repair, even if only because it can
pull data based on both items of conflicting data.

>Repair in place I have stated is the only viable solution for gargantuan
>sized external hard drives that cannot be backed up currently.

Backup, by definition, loses data. So a need for data recovery is not
going to go away, no matter how much you backup.

The perfect backup contains all content except unwanted changes.
Ponder on how you separate unwanted changes (loss) from all data you
saved right up to the present moment, and see the problem.

>The argument that confusing and intimidating information must not be shown
>to the users is an strong argument towards eliminating the dichotomy and
>doing the job without the user being involved.

That's lazyware, i.e. "let's cut support costs, and if that breaks
user's stuff, who cares; we aren't liable for that".

>Furthermore, keeping information from all persons because some may not
>understand is elitist and should not be condoned.

Absolutely!

>The recording of what CHKDSK has done behind the blank screen when booting
>is being done is perhaps a model of presenting the information to persons
>who can understand it and not showing it to others.

Well, burying it the depths of Event Viewer under "Logon" on something
seemingly unrelated is pretty opaque and user-hostile.



>-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
>-------------- ---- --- -- - - - -
Anonymous
a b G Storage
September 4, 2004 6:40:12 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

Time to read the Win 2K/XP resource kits, if you want to be a MVP.

Chkdsk is not based on DOS. Everything in NT is written in C, not ASM, for one
thing.

"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message
news:D kcjj0lu1105adui6t6idb7g4ts80oud7a@4ax.com...

> ChkDsk is inadequate and IMO is unfit for use, period. Users in the
> 21st century deserve better than a tool dating from DOS 5 or older.
>
> If it is not allowed to "fix" automatically, it is known to return
> spurious errors when checking a volume that is in use. Most PCs are
> setup as one big C: that is always in use. Join the dots.
>
Of course there is a tool to override autochk defaults.
Anonymous
a b G Storage
September 4, 2004 6:44:31 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sat, 04 Sep 2004 12:29:12 +0700, J. S. Pack <me@privacy.net> wrote:

>URL http://65.108.230.150/downloads/mybootdisks_com/nu2/peb...

>>I've tried Bart's PE before, and liked it, except without a full av
>>that I could run from it (and a way to update that av from USB camera
>>or flash drive) it wasn't that useful to me at the time.

>This has *exactly* what you need:

>http://www.windowsubcd.com/index.htm

I get a 404 on that link...



>-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
>-------------- ---- --- -- - - - -
Anonymous
a b G Storage
September 4, 2004 7:29:38 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware (More info?)

On Fri, 3 Sep 2004 21:17:46 UTC, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

> >The program is NOT free, but it is not that expensive either.
> >You can download the evaluation version and play with that
> >for a month or so to see what it can do.
>
> Thanks; I've downloaded it, but will wait until I have time before I
> try it (else the demo period may time out before I get a round tuit)

That will not really help :-)

The period is 62 days starting from release-date of that
particular version. Best to download just before you
want to test it ...

Regards, JvW

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com
Anonymous
a b G Storage
September 5, 2004 3:56:43 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"alchow" <alchow@gmail-dot-com.no-spam.invalid> wrote in message news:41393ecb$1_4@alt.athenanews.com
> No one has truly said anything about whether there are files to fix a
> corrupted $Mft however. Or recover all data off a disk that has one.
>
> I have an external USB hard drive that has been having problems
> writing to G:/$Mft, and has been hanging on those scans when you plug
> in your drive. It finally (it meaning the $Mft file?) died and
> decided to show up as a Local Drive that was unnamed (the hard disk
> had been named in XP for easy reference).
>
> Now when I try to open the hard disk, I get "The parameter is
> incorrect" or "The file or folder may be corrupted".

" The parameter is incorrect " has been seen for a missing bootsector
when the backup bootsector was still in tact for a Fat32 volume.
That was good enough for Win98 or linux to see the volume contents but
not for the NT follow-ups.

Run Findpart from www.partitionsupport.com and let's see what it thinks of it.

> Considering my previous $Mft troubles, I truly suspect the $Mft to be
> the culprit, but perhaps much more experienced hands can tell me if that
> is the case.
>
> I daren't spend money on file recovery programs until I'm sure they
> will solve my problems! :( 
>
> ==============
> Posted through www.HowToFixComputers.com/bb - free access to hardware troubleshooting newsgroups.
Anonymous
a b G Storage
September 5, 2004 2:00:18 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sat, 04 Sep 2004 14:44:31 +0200, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>On Sat, 04 Sep 2004 12:29:12 +0700, J. S. Pack <me@privacy.net> wrote:
>
>>URL http://65.108.230.150/downloads/mybootdisks_com/nu2/peb...
>
>>>I've tried Bart's PE before, and liked it, except without a full av
>>>that I could run from it (and a way to update that av from USB camera
>>>or flash drive) it wasn't that useful to me at the time.
>
>>This has *exactly* what you need:
>
>>http://www.windowsubcd.com/index.htm
>
>I get a 404 on that link...

I don't.

Maybe better go just directly to the downloads page:

http://www.windowsubcd.com/downloads.htm
Anonymous
a b G Storage
September 5, 2004 2:20:47 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"
>
>What you want is the ability to *interactively* check the file system,
>as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
>such-and-such an error and (more info) I plan to "fix" this by doing
>X, Y, Z. Continue, or abort?" but it's too brain-dead for that.
>

This is all well and good for techies who can use disk editors and know
their way around the file system.

It's meaningless in the real world where the vast majority of users don't
even know what a file system is. Most of them have used the ol' scandisk
and that little question of "Continue or abort" did them no good at all.
They wouldn't know which answer to choose. If they aborted, their disk
still had errors and their data was lost. If they continued, their data was
lost as well in .chk files. Not uncommonly their disk was still trashed and
they ended up reformatting and reinstalling. That sort of thing happens a
lot less under NTFS and the vast majority of users would therefore benefit
from using it.
<snip>

>>To those who say that the only method of repair if CHKDSK will not run is to
>>hire a person who has many years of experience and makes a living doing data
>>recovery just adds to the dichotomy. CHKDSK is trusted (and Norton) to
>>repair the file system all by its self for the second case.
>

Anybody who's used scandisk doesn't trust it, either. And plenty of
professionals did well fixing FAT32 disks.

>ChkDsk is NOT a data recovery tool, and has no right to presume to be
>one. Automating data-destructive "fixes" may help MS cut down on
>support calls, but it is detremental to data safety as it robs the
>user of the option to manually repair.

Well, better tools are always welcomed. I wonder why Norton hasn't cashed
in on the shortcomings of CHKDSK?

>
>And yes, a compitent tech (or an end-user recovery tool) can do better
>than autofixing logic to manually repair, even if only because it can
>pull data based on both items of conflicting data.
>

Yes, no matter which filesystem is chosen.

>That's lazyware, i.e. "let's cut support costs, and if that breaks
>user's stuff, who cares; we aren't liable for that".

It's really not that simple. Otherwise, as I said, Norton would be cashing
in. Where there's such a need, the market responds.

>
>>Furthermore, keeping information from all persons because some may not
>>understand is elitist and should not be condoned.
>
>Absolutely!

But nobody's really hiding information.

>
>Well, burying it the depths of Event Viewer under "Logon" on something
>seemingly unrelated is pretty opaque and user-hostile.

Not to the vast majority of users. Take a look at the headers in this
newsgroup! :) 
Anonymous
a b G Storage
September 5, 2004 4:44:04 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>
>Backup, by definition, loses data.

Um, by your definition, perhaps. That's just a little too facile to be a
general definition.

A bitwise mirror image of your disk saves whatever data you have saved on
the disk you're mirroring. That's entirely expected and reasonable.

> So a need for data recovery is not
>going to go away, no matter how much you backup.
>

Indeed not. You can reasonably expect to have saved only what data you've
saved in your backup before your head crashed or the cosmic ray hit and an
ailing DIMM dribbled all over your files.

With a good backup regimen, you shouldn't lose much. If your data is that
real-time critical, you should be computing in a failsafe, redundant,
transaction rollback environment anyway, not in Windows XP.

If my filesystem or disk crashes (and any disk can crash at any time,
leaving moot the question of running chkdsk), I count myself lucky if I can
save *anything*. That's why I often backup.

>The perfect backup contains all content except unwanted changes.
>Ponder on how you separate unwanted changes (loss) from all data you
>saved right up to the present moment, and see the problem.

Well, the unwanted changes mean that it will be more difficult to retain
the wanted changes that didn't make into the last backup set. I fail see
how this point moves us further down the road towards solving the problem
of *how* a naive user may recover data from a crashed disk or severely
damaged filesystem.

I would note FWIW that the winubcd http://www.windowsubcd.com/index.htm I
noted earlier in this thread does have some free file/disk tools that can
be run from the boot CD itself. Again, average users would not know about,
or be able to build, such a CD.
Anonymous
a b G Storage
September 5, 2004 4:44:05 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

>On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
><cquirkenews@nospam.mvps.org> wrote:
>
>>
>>Backup, by definition, loses data.


Huh ? If it lost data it wouldn't be called a backup.

ntbackup, the MS-provided backup/restore tool, does a fine job of full
backup of running NT/w2k/XP/home/pro systems. I've rebuilt servers
from bare iron with netbackup-produced tapes.

As for simple full backup-recovery tools, there are a couple of
home-user oriented packages that burn a full-image onto bootable DVDs
that will restore to bare iron. These are one-click-full-backup
tools, if you set them up that way. These were practical until the
arrival of home-digital video.

The computer user has to make a realistic assesment of the value of
his data and buy enough big disks to keep a couple generations of
backups. It's called a risk assesment and businesses have been doing
this for years.

Anyone that depends on recovery tools is clueless.

>
>Um, by your definition, perhaps. That's just a little too facile to be a
>general definition.
>
>A bitwise mirror image of your disk saves whatever data you have saved on
>the disk you're mirroring. That's entirely expected and reasonable.
>
>> So a need for data recovery is not
>>going to go away, no matter how much you backup.
>>
>
>Indeed not. You can reasonably expect to have saved only what data you've
>saved in your backup before your head crashed or the cosmic ray hit and an
>ailing DIMM dribbled all over your files.
>
>With a good backup regimen, you shouldn't lose much. If your data is that
>real-time critical, you should be computing in a failsafe, redundant,
>transaction rollback environment anyway, not in Windows XP.
>
>If my filesystem or disk crashes (and any disk can crash at any time,
>leaving moot the question of running chkdsk), I count myself lucky if I can
>save *anything*. That's why I often backup.
>
>>The perfect backup contains all content except unwanted changes.
>>Ponder on how you separate unwanted changes (loss) from all data you
>>saved right up to the present moment, and see the problem.
>
>Well, the unwanted changes mean that it will be more difficult to retain
>the wanted changes that didn't make into the last backup set. I fail see
>how this point moves us further down the road towards solving the problem
>of *how* a naive user may recover data from a crashed disk or severely
>damaged filesystem.
>
>I would note FWIW that the winubcd http://www.windowsubcd.com/index.htm I
>noted earlier in this thread does have some free file/disk tools that can
>be run from the boot CD itself. Again, average users would not know about,
>or be able to build, such a CD.
>


--
Al Dykes
-----------
adykes at p a n i x . c o m
September 5, 2004 5:27:27 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"Al Dykes" <adykes@panix.com> wrote in message
news:cheu9o$grc$1@panix2.panix.com...


> Anyone that depends on recovery tools is clueless.


There are instances where a little bit of knowledge in recovery can go a
long way. Not in replacing the essential need for backups, but in removing
the necessity of having to do a full scale restore.

The example I'll quote is a recent example when one problematic corrupted /
damaged file on my NTFS system, was causing all sorts of havoc. All the
usual tricks, like closing down explorer to delete via command prompt, or
deletion via recovery console / safe mode had failed. Chkdsk was also unable
to deal with it (it aborted unceremoniously halfway through its operations )
and it also prevented any defragmentation of the drive. The fragmentation
level of files on the drive was rising by the minute. A simple manual
blanking out of its entry in the MFT, followed by a quick chkdsk, solved the
problem and the drive was completely back to normal. Would have been a right
pain to have had to go through a complete restore for the sake of one tiny
file.

Jon
Anonymous
a b G Storage
September 5, 2004 10:19:26 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sat, 4 Sep 2004 08:10:38 -0700, "Eric Gisin"
>"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org>

>Chkdsk is not based on DOS.

I didn't say ChkDsk was "based on DOS". It dates from DOS;
specifically, the pathetic UI dates from DOS's ChkDsk.

And by UI, I'm not saying "make it prettier". I'm saying "put the
user back in control over what it does".

The code itself is obviously different, given that it works on a
completely different file system ;-)

>Of course there is a tool to override autochk defaults.

The only control I know of will suppress AutoChk for particular HD
letters. There is no way to get AutoChk to run like ChkDsk (with no
/F or /R parameter) and, like ChkDsk, AutoChk has no interactive mode.

Compare that to the fine-grained control Scandisk.ini gives you over
the implicit /Custom mode that automatic Scandisk uses in Win95/98.



>-------------------- ----- ---- --- -- - - - -
Tip Of The Day:
To disable the 'Tip of the Day' feature...
>-------------------- ----- ---- --- -- - - - -
Anonymous
a b G Storage
September 5, 2004 10:35:14 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sun, 05 Sep 2004 10:20:47 +0700, J. S. Pack <me@privacy.net> wrote:
>On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
>>On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"

>>What you want is the ability to *interactively* check the file system,
>>as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
>>such-and-such an error and (more info) I plan to "fix" this by doing
>>X, Y, Z. Continue, or abort?" but it's too brain-dead for that.

>This is all well and good for techies who can use disk editors and know
>their way around the file system.

Yes it is; and it should be there for that reason alone, if nothing
else. It's easier to understand what Scandisk says about what it
finds than, say, a raw register dump you get in Stop errors ;-)

>It's meaningless in the real world where the vast majority of users don't
>even know what a file system is. Most of them have used the ol' scandisk
>and that little question of "Continue or abort" did them no good at all.

Now you are saying that becausae most folks lack clue, we should
declare darkness as the standard? The "ChkDsk Knows Best, even if it
kills your data to the point that it can no longer be recovered" is
high-handed nonsense, geared to the convenience of "support" at the
expense of the client. We'd like a lot less of that, please.

>Anybody who's used scandisk doesn't trust it, either. And plenty of
>professionals did well fixing FAT32 disks.

Sure; that's a given - it's a one-pass automated tool with no
"big-picture" awareness, how smart can you really expect it to be?

If I show you a FAT1 that has 512 bytes of ReadMe.txt in it, and FAT2
that has sane-looking values in it, your guess at what to do would be
correct. If a few sectors further in, you found the same thing, but
the other way round, you'd guess how to fix that too.

You would not just splat the whole of FAT1 over FAT2 because it
"looked better", on the ASSumption that every part of FAT1 is as
correct or otherwise as every other part of FAT1.

You'd also not be so dumb as to chop the Windows directory in half,
just because at that point a dir entry started with a null, and throw
the rest of it away. In fact, even if there were 512 bytes of zeros
or ReadMe.txt content in the middle of a dir, you would recognise that
as a sector splat and append the distant part of the same dir,
excising the garbaged sector's contents.

That's not rocket science to a tech with an interest in such matters,
even if "your average user" couldn't do that themselves.

What a number of "average" users can (and do) do is call up and say:

"I had a bad exit, and Scandisk ran as usual, but this
time it wanted to delete half the Windows directory.
So I switched off the PC and I'm bringing it in for file
system repair and data recovery."

With NTFS, AutoChk robs them of that chance.



>-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
>-------------- ---- --- -- - - - -
Anonymous
a b G Storage
September 5, 2004 10:35:15 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

cquirke (MVP Win9x) wrote:

> On Sun, 05 Sep 2004 10:20:47 +0700, J. S. Pack <me@privacy.net> wrote:
>>On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
>>>On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"
>
>>>What you want is the ability to *interactively* check the file system,
>>>as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
>>>such-and-such an error and (more info) I plan to "fix" this by doing
>>>X, Y, Z. Continue, or abort?" but it's too brain-dead for that.
>
>>This is all well and good for techies who can use disk editors and know
>>their way around the file system.
>
> Yes it is; and it should be there for that reason alone, if nothing
> else. It's easier to understand what Scandisk says about what it
> finds than, say, a raw register dump you get in Stop errors ;-)
>
>>It's meaningless in the real world where the vast majority of users don't
>>even know what a file system is. Most of them have used the ol' scandisk
>>and that little question of "Continue or abort" did them no good at all.
>
> Now you are saying that becausae most folks lack clue, we should
> declare darkness as the standard? The "ChkDsk Knows Best, even if it
> kills your data to the point that it can no longer be recovered" is
> high-handed nonsense, geared to the convenience of "support" at the
> expense of the client. We'd like a lot less of that, please.

This is one of the most ludicrous arguments I've ever seen. If you don't
like chkdsk then just don't use it.

>>Anybody who's used scandisk doesn't trust it, either. And plenty of
>>professionals did well fixing FAT32 disks.
>
> Sure; that's a given - it's a one-pass automated tool with no
> "big-picture" awareness, how smart can you really expect it to be?
>
> If I show you a FAT1 that has 512 bytes of ReadMe.txt in it, and FAT2
> that has sane-looking values in it, your guess at what to do would be
> correct. If a few sectors further in, you found the same thing, but
> the other way round, you'd guess how to fix that too.
>
> You would not just splat the whole of FAT1 over FAT2 because it
> "looked better", on the ASSumption that every part of FAT1 is as
> correct or otherwise as every other part of FAT1.
>
> You'd also not be so dumb as to chop the Windows directory in half,
> just because at that point a dir entry started with a null, and throw
> the rest of it away. In fact, even if there were 512 bytes of zeros
> or ReadMe.txt content in the middle of a dir, you would recognise that
> as a sector splat and append the distant part of the same dir,
> excising the garbaged sector's contents.
>
> That's not rocket science to a tech with an interest in such matters,
> even if "your average user" couldn't do that themselves.
>
> What a number of "average" users can (and do) do is call up and say:
>
> "I had a bad exit, and Scandisk ran as usual, but this
> time it wanted to delete half the Windows directory.
> So I switched off the PC and I'm bringing it in for file
> system repair and data recovery."
>
> With NTFS, AutoChk robs them of that chance.

You might want to study what's publicly available about the file structure
of NTFS. It doesn't work the way you seem to think it does.
>
>
>
>>-------------- ---- --- -- - - - -
> "I think it's time we took our
> friendship to the next level"
> 'What, gender roles and abuse?'
>>-------------- ---- --- -- - - - -

--
--John
Reply to jclarke at ae tee tee global dot net
(was jclarke at eye bee em dot net)
Anonymous
a b G Storage
September 5, 2004 11:31:27 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Sun, 05 Sep 2004 12:44:04 +0700, J. S. Pack <me@privacy.net> wrote:
>On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"

>>Backup, by definition, loses data.

>Um, by your definition, perhaps. That's just a little too facile to be a
>general definition.

It's inevitable if you take user expectations as to what "backup" does
into account, i.e. that it loses unwanted changes while preserving
wanted changes. Implicit is the idea that the unwanted changes are
more recent than the changes you want to keep; therefore, falling back
to an earlier state will preserve data while losing the damage.

Clearly, falling back to an earlier state loses data saved or changes
made after the backup was made; thus "loses data".

Now you can hedge this in various ways:

1) Reduce time lapse between backup and live data

The extreme of this is real-time mirroring, such that changes are made
to "live" and "backup" data at the same time - in essence, both copies
of data are "live". This protects against a very specific type of
problem; death of one half of the mirror.

But anything that writes junk to the HD will write junk to both HDs
equally, unless the junk arises within half of the HD subsystem of
course. So in that sense, zero-lag backup isn't really a "backup".

Also, several things that kill one HD will very likely kill both HDs;
power spike, site disaster, theft of PC, flooding, etc.

2) Keep multiple time-lapse backups

Now we're getting somewhere; instead of having one big backup, you
keep a number of these made at different times, and can fall back as
far as needed; assuming you discover the data loss you wish to reverse
within the time period you are covering in your backup spread.

You will still lose whatever data you saved between the last sane
backup, and the time of data loss. The only way to avoid that is to
have transaction-grain steps between successive backups.

The assumption this approach rests on is that the disaster is such
that all further work ceases, so that the time between the data state
you want to keep and the disaster you want to lose is always positive.

3) Selective scope

This counters the negative lead time problem that is inherent in the
malware infection-stealth-payload sequence of events.

By including only non-infectable data in your backup, you will lose
malware, as well as losing content that ties the backup to particular
hardware or application version.

These backups can then be restored onto new replacement PCs with less
worry about inappropriate drivers, version soup, or malware restore.

>> So a need for data recovery is not going to go away, no
>> matter how much you backup.

>You can reasonably expect to have saved only what data you've
>saved in your backup before your head crashed

My point exactly; if you want anything more recent that - or you find
all your backups are unacceptable when restored - then the "other"
stuff you want to see again will have to be recovered.

>If my filesystem or disk crashes (and any disk can crash at any time,
>leaving moot the question of running chkdsk), I count myself lucky if I can
>save *anything*. That's why I often backup.

Sure, that's why we <cough> all backup. My approach is to:
- keep a small data set free of infectables and incoming junk
- automate a daily backup of this elsewhere on HD
- scoop the most recent of these to another PC daily
- dump collected recent backups from that PC to CDRW

If you can image the entire system, then you'd keep the last image
made after the last significant system change, and use that as your
rebuild baseline before restoring the most recent data backup.

In practice, users tend to skip the "last mile" to CDRW for one reason
or another (out of disks, didn't get it together, etc.). If it's a
stand-alone PC, that leaves only the local HD backups, which remain
available only as long as that part of the HD works. If they have
been switching the PC off overnight, they won't even have that.

>>Ponder on how you separate unwanted changes (loss) from all data you
>>saved right up to the present moment, and see the problem.

>I fail see how this moves us towards *how* a naive user may
>recover data from a crashed disk or severely damaged filesystem.

My point was that backups do not remove the role of data recovery,
even if they do reduce what is at stake.

The user's environment includes support techs, and in such cases,
you'd expect these to be involved if the user isn't keen on firing up
the Diskedit chainsaw themselves.

Data recovery is not always a costly clean-room epic undertaking;
sometimes it's a couple of snips here and there, and can be faster and
cheaper than rebuilding from scratch and restoring backups.

http://www.windowsubcd.com/index.htm

Ah! This time the page loaded!!
Looks verry interesting, thanks!!



>--------------- ----- ---- --- -- - - -
The memes will inherit the Earth
>--------------- ----- ---- --- -- - - -
Anonymous
a b G Storage
September 5, 2004 11:31:28 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

In article <cdhmj0lpe8m16636edv8iv2q85pc09ta18@4ax.com>,
cquirke (MVP Win9x) <cquirkenews@removethis.mvps.org> wrote:
>On Sun, 05 Sep 2004 12:44:04 +0700, J. S. Pack <me@privacy.net> wrote:
>>On Sat, 04 Sep 2004 14:40:11 +0200, "cquirke (MVP Win9x)"
>
>>>Backup, by definition, loses data.
>
>>Um, by your definition, perhaps. That's just a little too facile to be a
>>general definition.
>
>It's inevitable if you take user expectations as to what "backup" does
>into account, i.e. that it loses unwanted changes while preserving
>wanted changes. Implicit is the idea that the unwanted changes are
>more recent than the changes you want to keep; therefore, falling back
>to an earlier state will preserve data while losing the damage.

What the F are your talking about ?

You do a full backup of a system, with an appropriate tool, and if you
rebuild from that backup you get a functional equivalent system when
you are done.

If you have open files while you are running a backup you have to know
what you're doing or you get what you deserve.



--
Al Dykes
-----------
adykes at p a n i x . c o m
Anonymous
a b G Storage
September 5, 2004 11:34:10 PM

Archived from groups: microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general (More info?)

On Sat, 4 Sep 2004 00:23:07 +0200, "Folkert Rienstra"
>"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote

>> Thanks; I've downloaded it, but will wait until I have time before I
>> try it (else the demo period may time out before I get a round tuit)

>"There is a timeout on un-registred versions (60 days from release),"
>Maybe you should read first before you snip?

Ah, so it's going to die on Day 60 even if I don't install it or use
it until Day 59. Bummer; I'll just have to take my chances then.

That's assuming "release" isn't already 50+ days ago ;-p



>--------------- ----- ---- --- -- - - -
Memes don't exist - pass it on
>--------------- ----- ---- --- -- - - -
Anonymous
a b G Storage
September 6, 2004 4:59:25 AM

Archived from groups: microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.general (More info?)

"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message news:p cjmj0hk4u7kktmvvjcihg6aahd93rifpm@4ax.com
> On Sat, 4 Sep 2004 00:23:07 +0200, "Folkert Rienstra"
> > "cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote
>
> > > Thanks; I've downloaded it, but will wait until I have time before I
> > > try it (else the demo period may time out before I get a round tuit)
>
> > "There is a timeout on un-registred versions (60 days from release),"
> > Maybe you should read first before you snip?
>
> Ah, so it's going to die on Day 60 even if I don't install it or use
> it until Day 59. Bummer; I'll just have to take my chances then.
>
> That's assuming "release" isn't already 50+ days ago ;-p

As I said in another post:
... if you're not downright stupid you just set your clock back
and save you a 1.5 MB download that may not even be different.

>
>
>
> > --------------- ----- ---- --- -- - - -
> Memes don't exist - pass it on
> > --------------- ----- ---- --- -- - - -
Anonymous
a b G Storage
September 9, 2004 5:09:44 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On 5 Sep 2004 13:30:24 -0400, adykes@panix.com (Al Dykes) wrote:
>cquirke (MVP Win9x) <cquirkenews@removethis.mvps.org> wrote:

>What the F are your talking about ?

>You do a full backup of a system, with an appropriate tool, and if you
>rebuild from that backup you get a functional equivalent system when
>you are done.

Yes - with loss of all data done since the backup was created.

Got it?



>------------ ----- ---- --- -- - - - -
Our senses are our UI to reality
>------------ ----- ---- --- -- - - - -
Anonymous
a b G Storage
September 9, 2004 5:09:45 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

How about running chkdsk without any switches, reading the log and deciding
how you want to proceed?
"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message
news:s74vj0hioa92e67e4g4ae5b3vc6nitvm0r@4ax.com...
> On 5 Sep 2004 13:30:24 -0400, adykes@panix.com (Al Dykes) wrote:
>>cquirke (MVP Win9x) <cquirkenews@removethis.mvps.org> wrote:
>
>>What the F are your talking about ?
>
>>You do a full backup of a system, with an appropriate tool, and if you
>>rebuild from that backup you get a functional equivalent system when
>>you are done.
>
> Yes - with loss of all data done since the backup was created.
>
> Got it?
>
>
>
>>------------ ----- ---- --- -- - - - -
> Our senses are our UI to reality
>>------------ ----- ---- --- -- - - - -
Anonymous
a b G Storage
September 10, 2004 1:41:48 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message news:s74vj0hioa92e67e4g4ae5b3vc6nitvm0r@4ax.com
> On 5 Sep 2004 13:30:24 -0400, adykes@panix.com (Al Dykes) wrote:
> > cquirke (MVP Win9x) <cquirkenews@removethis.mvps.org> wrote:
>
> > What the F are your talking about ?
>
> > You do a full backup of a system, with an appropriate tool, and if you
> > rebuild from that backup you get a functional equivalent system when
> > you are done.
>
> Yes - with loss of all data done since the backup was created.
>

> Got it?

Doubtful.

>
>
>
> > ------------ ----- ---- --- -- - - - -
> Our senses are our UI to reality
> > ------------ ----- ---- --- -- - - - -
Anonymous
a b G Storage
September 12, 2004 3:35:35 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.hardware,comp.sys.ibm.pc.hardware.storage,microsoft.public.windowsxp.help_and_support (More info?)

On Wed, 08 Sep 2004 23:12:19 GMT, "Frank Jelenko"

>How about running chkdsk without any switches, reading the log and deciding
>how you want to proceed?

That's what I'd do, but there are limitations here:
- ChkDsk known to throw spurious errors if volume "in use"
- AutoChk simply will NOT work in this mode
- the log is so buried in Event Log it's near-impossible to find
- requires NT to run, which writes to at-risk file system (if C:) 
- Event Log also requires NT to run, risks as above

What one typically wants to do is:
- after bad exit, before OS writes to HD, have AutoChk check
- AutoChk should stop and prompt on errors
- then can either proceed, or abort both AutoChk and OS boot
- if abort, then need a safe mOS from which to re-test etc.

That's exactly how the original auto-Scandisk works. Win.com runs DOS
mode Scandisk with implicit /Custom parameter, which thus facilitates
fine-grain control via Scandisk.ini, before Windows starts booting up
or writing to the file system.

Scandisk.ini can be set so the scan stops on errors. At that point,
it's safe to reset out of the boot process, press F8 on next boot,
choose Command Prompt Only as a safe mOS, and do an elective Scandisk
from there (or run alternate recovery/repair tools).

A "better" OS should at least match this sensible and prudent design.



>------------ ----- ---- --- -- - - - -
The most accurate diagnostic instrument
in medicine is the Retrospectoscope
>------------ ----- ---- --- -- - - - -
!