Sign in with
Sign up | Sign in
Your question

help: hard drive lost ntfs partition

Last response: in Storage
Share
Anonymous
a b G Storage
March 13, 2005 12:12:06 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I am having trouble with 120 GB NTFS drive in an external enclosure
(hybrid usb2/firewire), used with Windows XP.

Yesterday Windows popped up with an error like "could not write to
drive, bad block found". I tried to open the drive in My Computer and
although the drive letter was listed, the volume name was gone and I
could no longer browse the drive.

If you look at the Computer Management screenshot:

http://www.geocities.com/usenet_daughter/hdd1.jpg

drive F is the drive and is listed as Healthy, but no file system or
volume name is present. This should be an NTFS partition.

Any help recovering this volume would be most appreciated.

Thanks

PS I would prefer to use Svend's findpart utility:
http://www.partitionsupport.com/utilities.htm
which has worked like a charm in the past (with the author's help). I
am more comfortable using this than a commercial product like Norton
Diskdoctor. However I haven't been able to reach him - if anyone else
knows how to use Findpart to recover an NTFS partition, any help would
be appreciated.
Anonymous
a b G Storage
March 14, 2005 12:06:10 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

In article <39jjp4F61f95cU1@individual.net>,
Rod Speed <rod_speed@yahoo.com> wrote:
>
>"Al Dykes" <adykes@panix.com> wrote in message
>news:D 11u9q$a7d$1@panix5.panix.com...
>> In article <1110733926.724474.164100@f14g2000cwb.googlegroups.com>,
>> Mad Scientist Jr <usenet_daughter@yahoo.com> wrote:
>>>I am having trouble with 120 GB NTFS drive in an external enclosure
>>>(hybrid usb2/firewire), used with Windows XP.
>>>
>>>Yesterday Windows popped up with an error like "could not write to
>>>drive, bad block found". I tried to open the drive in My Computer and
>>>although the drive letter was listed, the volume name was gone and I
>>>could no longer browse the drive.
>>>
>>>If you look at the Computer Management screenshot:
>>>
>>> http://www.geocities.com/usenet_daughter/hdd1.jpg
>>>
>>>drive F is the drive and is listed as Healthy, but no file system or
>>>volume name is present. This should be an NTFS partition.
>>>
>>>Any help recovering this volume would be most appreciated.
>>>
>>>Thanks
>>>
>>>PS I would prefer to use Svend's findpart utility:
>>> http://www.partitionsupport.com/utilities.htm
>>>which has worked like a charm in the past (with the author's help). I
>>>am more comfortable using this than a commercial product like Norton
>>>Diskdoctor. However I haven't been able to reach him - if anyone else
>>>knows how to use Findpart to recover an NTFS partition, any help would
>>>be appreciated.
>>>
>>
>> We need to know a little more about this guys problem before we can
>> make conculsion, maybe his disk died. but I've been watching usenet
>> groups for NTFS issues for about a year paying attention to people
>> reporting NTFS "failure" and my thoroughly unscientific poll shows
>> that a huge number of the people that have had these problems are
>> using external USB boxes. This guy's story is typical.
>>
>> I (and many other sysadmins) have been using NTFS from the day it was
>> available. In my case for many thousands of systems. 99% of these are
>> IDE and the rest SCSI. Except for hardware failure it's 100%
>> reliable, IME.
>
>> I could conjecture that backpack problems
>> could be explained by one of these reasons:
>
>> - Problems with LBA48 issues and big disks.
>
>Nope, the drive isnt big enough to see those.
>
>> - Heat killing the disk. (not a USB problem, but
>> related to the cheapo case design and full time use.)
>
>Possible.
>
>> - Power fulction/problems caused by
>> the enclosure's wall wart being sub-par
>
>Possible but not that likely, it aint rocket science at that power level.
>
>> or subject to VAC fulctuation that the PC power supply deals with,
>
>Ditto.
>
>> or common mode ground problems.
>
>Very unlikely indeed. Its a digital system.
>


"digital" is really a very carefull analog simulation. It works great
until it stops. Look at digital signals with a o'scope for an example.

--

a d y k e s @ p a n i x . c o m

Don't blame me. I voted for Gore.
Related resources
Anonymous
a b G Storage
March 14, 2005 8:46:18 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Other than turning it on for a minute to get the chipset/driver I have
not touched the drive since the crash. Do any of you know how to use
the FindNTFS or similar utility to recover the partition? NTFS stores
backups of partition tables, right? I don't trust Norton to fix this.
Anonymous
a b G Storage
March 14, 2005 9:18:17 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I appreciate the discussion, but what would you recommend? I have used
a similar enclosure (same silver plastic case, same fan, but it had an
oxford chipset, and noname, where this is a bytecc) and another large
WD drive for almost 3 years daily with no problems. Also I was on the
net when it happened - could it have been from a malicious attack? In
any case all I want is to recover the data and avoid this happening
again (including making more frequent backups). Are there any external
hybrid enclosures you would recommend? I am running findpart.exe all,
we will see if Svend replies or if I can figure out where to take it
from there.

Rod Speed wrote:
> "Al Dykes" <adykes@panix.com> wrote in message
> news:D 12rii$6iv$1@panix5.panix.com...
> > In article <39jjp4F61f95cU1@individual.net>,
> > Rod Speed <rod_speed@yahoo.com> wrote:
> >>
> >>"Al Dykes" <adykes@panix.com> wrote in message
> >>news:D 11u9q$a7d$1@panix5.panix.com...
> >>> In article
<1110733926.724474.164100@f14g2000cwb.googlegroups.com>,
> >>> Mad Scientist Jr <usenet_daughter@yahoo.com> wrote:
> >>>>I am having trouble with 120 GB NTFS drive in an external
enclosure
> >>>>(hybrid usb2/firewire), used with Windows XP.
> >>>>
> >>>>Yesterday Windows popped up with an error like "could not write
to
> >>>>drive, bad block found". I tried to open the drive in My Computer
and
> >>>>although the drive letter was listed, the volume name was gone
and I
> >>>>could no longer browse the drive.
> >>>>
> >>>>If you look at the Computer Management screenshot:
> >>>>
> >>>> http://www.geocities.com/usenet_daughter/hdd1.jpg
> >>>>
> >>>>drive F is the drive and is listed as Healthy, but no file system
or
> >>>>volume name is present. This should be an NTFS partition.
> >>>>
> >>>>Any help recovering this volume would be most appreciated.
> >>>>
> >>>>Thanks
> >>>>
> >>>>PS I would prefer to use Svend's findpart utility:
> >>>> http://www.partitionsupport.com/utilities.htm
> >>>>which has worked like a charm in the past (with the author's
help). I
> >>>>am more comfortable using this than a commercial product like
Norton
> >>>>Diskdoctor. However I haven't been able to reach him - if anyone
else
> >>>>knows how to use Findpart to recover an NTFS partition, any help
would
> >>>>be appreciated.
> >>>>
> >>>
> >>> We need to know a little more about this guys problem before we
can
> >>> make conculsion, maybe his disk died. but I've been watching
usenet
> >>> groups for NTFS issues for about a year paying attention to
people
> >>> reporting NTFS "failure" and my thoroughly unscientific poll
shows
> >>> that a huge number of the people that have had these problems are
> >>> using external USB boxes. This guy's story is typical.
> >>>
> >>> I (and many other sysadmins) have been using NTFS from the day it
was
> >>> available. In my case for many thousands of systems. 99% of these
are
> >>> IDE and the rest SCSI. Except for hardware failure it's 100%
> >>> reliable, IME.
> >>
> >>> I could conjecture that backpack problems
> >>> could be explained by one of these reasons:
> >>
> >>> - Problems with LBA48 issues and big disks.
> >>
> >>Nope, the drive isnt big enough to see those.
> >>
> >>> - Heat killing the disk. (not a USB problem, but
> >>> related to the cheapo case design and full time use.)
> >>
> >>Possible.
> >>
> >>> - Power fulction/problems caused by
> >>> the enclosure's wall wart being sub-par
> >>
> >>Possible but not that likely, it aint rocket science at that power
level.
> >>
> >>> or subject to VAC fulctuation that the PC power supply deals
with,
> >>
> >>Ditto.
> >>
> >>> or common mode ground problems.
> >>
> >>Very unlikely indeed. Its a digital system.
>
> > "digital" is really a very carefull analog simulation.
>
> Nope.
>
> > It works great until it stops.
>
> It doesnt stop due to common mode ground problems.
>
> > Look at digital signals with a o'scope for an example.
>
> You can make the same silly claim about say the PCI bus signals.
Anonymous
a b G Storage
March 14, 2005 10:02:47 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Wow, it seems the PL3507 could be the culprit...
http://www.hardwareanalysis.com/content/topic/31408/
and many more pages tell of similar problems.
Now if only I can recover the data.
Then I'll just go back to using the Oxford chipset.

Mike Tomlinson wrote:
> In article <1110807236.205040.43510@f14g2000cwb.googlegroups.com>,
Mad
> Scientist Jr <usenet_daughter@yahoo.com> writes
> >It's listed as:
> >Prolific PL3507 Combo Device (1394 ATAPI_Rev 1.00) IEEE 1394 SBP2
> >Device
>
> Thanks. You may find this thread of interest:
>
>
<http://groups.google.co.uk/groups?hl=en&lr=&threadm=t7G...
>
40jasper.org.uk&rnum=1&prev=/groups%3Fq%3Duk.comp.homebuilt%2BMike%2BTom
>
linson%2BProlific%26hl%3Den%26lr%3D%26selm%3Dt7GTprA%252B3vLCFw87%2540ja
> sper.org.uk%26rnum%3D1>
>
> http://snipurl.com/deuz
>
> --
> Rarely do people communicate; they just take turns talking.
> (source unknown)
Anonymous
a b G Storage
March 14, 2005 1:04:44 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

You have to upgrade the firmware:
http://forums.storagereview.net/index.php?showtopic=154...

"Mad Scientist Jr" <usenet_daughter@yahoo.com> wrote in message
news:1110807236.205040.43510@f14g2000cwb.googlegroups.com...
> It's listed as:
> Prolific PL3507 Combo Device (1394 ATAPI_Rev 1.00) IEEE 1394 SBP2
> Device
>
> The driver is listed as Microsoft.
>
> http://www.geocities.com/usenet_daughter/hdd_chipset.jp...
> http://www.geocities.com/usenet_daughter/hdd_details.jp...
>
Anonymous
a b G Storage
March 14, 2005 2:01:30 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

many thanks... this should save me the trouble and $ of having to buy
oxford enclosures.

anyone out there who can help with findpart and recovering the
partition? svend olaf? are you out there?

i think i have gone as far as i can on my own

many thanks in advance
Anonymous
a b G Storage
March 14, 2005 2:21:42 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

The official drivers page is at Prolific internet support center
http://tech.prolific.com.tw/visitor/v_filebrw_result.as...

also one person put up some drivers at
http://member.newsguy.com/~siccos/PL3507%20Firmware.htm

One question - how do I know if I have chip version A, B or C? The
device is listed on my system as:
Prolific PL3507 Combo Device (1394 ATAPI_Rev 1.00) IEEE 1394 SBP2
Anonymous
a b G Storage
March 14, 2005 3:49:50 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

In article <1110748935.670766.280990@g14g2000cwa.googlegroups.com>, Mad
Scientist Jr <usenet_daughter@yahoo.com> writes

>The enclosure is by Bytecc:
>http://www.newegg.com/app/ViewProductDesc.asp?descripti...

And what's the chipset in it?

--
Rarely do people communicate; they just take turns talking.
(source unknown)
Anonymous
a b G Storage
March 14, 2005 4:45:43 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Easy Recovery Pro... will look into it. I read up on various posters'
comments and it seems the prolific PL3507 chipset in my enclosure needs
firmeware update.. but there are two variants, one for chipset vrsn A
and one for chipset version B & C. I would *guess* my enclosures (i
have two, this is the first time I have had a problem) are the latter
versions since these were purchased in the past 6 mos, but that's no
guarantee, they could have sat in a warehouse for 2 yrs. Does anyone
know how to tell which version chipset you have?
Anonymous
a b G Storage
March 14, 2005 4:47:06 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

In article <1110807236.205040.43510@f14g2000cwb.googlegroups.com>, Mad
Scientist Jr <usenet_daughter@yahoo.com> writes
>It's listed as:
>Prolific PL3507 Combo Device (1394 ATAPI_Rev 1.00) IEEE 1394 SBP2
>Device

Thanks. You may find this thread of interest:

<http://groups.google.co.uk/groups?hl=en&lr=&threadm=t7G...
40jasper.org.uk&rnum=1&prev=/groups%3Fq%3Duk.comp.homebuilt%2BMike%2BTom
linson%2BProlific%26hl%3Den%26lr%3D%26selm%3Dt7GTprA%252B3vLCFw87%2540ja
sper.org.uk%26rnum%3D1>

http://snipurl.com/deuz

--
Rarely do people communicate; they just take turns talking.
(source unknown)
Anonymous
a b G Storage
March 14, 2005 11:25:51 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Al Dykes" <adykes@panix.com> wrote in message
news:D 12rii$6iv$1@panix5.panix.com...
> In article <39jjp4F61f95cU1@individual.net>,
> Rod Speed <rod_speed@yahoo.com> wrote:
>>
>>"Al Dykes" <adykes@panix.com> wrote in message
>>news:D 11u9q$a7d$1@panix5.panix.com...
>>> In article <1110733926.724474.164100@f14g2000cwb.googlegroups.com>,
>>> Mad Scientist Jr <usenet_daughter@yahoo.com> wrote:
>>>>I am having trouble with 120 GB NTFS drive in an external enclosure
>>>>(hybrid usb2/firewire), used with Windows XP.
>>>>
>>>>Yesterday Windows popped up with an error like "could not write to
>>>>drive, bad block found". I tried to open the drive in My Computer and
>>>>although the drive letter was listed, the volume name was gone and I
>>>>could no longer browse the drive.
>>>>
>>>>If you look at the Computer Management screenshot:
>>>>
>>>> http://www.geocities.com/usenet_daughter/hdd1.jpg
>>>>
>>>>drive F is the drive and is listed as Healthy, but no file system or
>>>>volume name is present. This should be an NTFS partition.
>>>>
>>>>Any help recovering this volume would be most appreciated.
>>>>
>>>>Thanks
>>>>
>>>>PS I would prefer to use Svend's findpart utility:
>>>> http://www.partitionsupport.com/utilities.htm
>>>>which has worked like a charm in the past (with the author's help). I
>>>>am more comfortable using this than a commercial product like Norton
>>>>Diskdoctor. However I haven't been able to reach him - if anyone else
>>>>knows how to use Findpart to recover an NTFS partition, any help would
>>>>be appreciated.
>>>>
>>>
>>> We need to know a little more about this guys problem before we can
>>> make conculsion, maybe his disk died. but I've been watching usenet
>>> groups for NTFS issues for about a year paying attention to people
>>> reporting NTFS "failure" and my thoroughly unscientific poll shows
>>> that a huge number of the people that have had these problems are
>>> using external USB boxes. This guy's story is typical.
>>>
>>> I (and many other sysadmins) have been using NTFS from the day it was
>>> available. In my case for many thousands of systems. 99% of these are
>>> IDE and the rest SCSI. Except for hardware failure it's 100%
>>> reliable, IME.
>>
>>> I could conjecture that backpack problems
>>> could be explained by one of these reasons:
>>
>>> - Problems with LBA48 issues and big disks.
>>
>>Nope, the drive isnt big enough to see those.
>>
>>> - Heat killing the disk. (not a USB problem, but
>>> related to the cheapo case design and full time use.)
>>
>>Possible.
>>
>>> - Power fulction/problems caused by
>>> the enclosure's wall wart being sub-par
>>
>>Possible but not that likely, it aint rocket science at that power level.
>>
>>> or subject to VAC fulctuation that the PC power supply deals with,
>>
>>Ditto.
>>
>>> or common mode ground problems.
>>
>>Very unlikely indeed. Its a digital system.

> "digital" is really a very carefull analog simulation.

Nope.

> It works great until it stops.

It doesnt stop due to common mode ground problems.

> Look at digital signals with a o'scope for an example.

You can make the same silly claim about say the PCI bus signals.
Anonymous
a b G Storage
March 15, 2005 10:51:16 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Mad Scientist Jr <usenet_daughter@yahoo.com> wrote in message
news:1110807978.591675.155250@z14g2000cwz.googlegroups.com...

> Other than turning it on for a minute to get the chipset/driver I have
> not touched the drive since the crash. Do any of you know how to use
> the FindNTFS or similar utility to recover the partition? NTFS stores
> backups of partition tables, right? I don't trust Norton to fix this.

I've only used Easy Recovery Pro in that situation. It works fine, but isnt
free.
Anonymous
a b G Storage
March 15, 2005 10:56:27 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Mad Scientist Jr" <usenet_daughter@yahoo.com> wrote in message
news:1110809897.113470.80030@g14g2000cwa.googlegroups.com...

> I appreciate the discussion, but what would you recommend?

I havent seen enough failures over years to be able to recommend
any specific enclosure, and the use varys too, some only have it
turned on while doing a backup to it, others use it like a regular drive.

It isnt even that easy to monitor the drive
temp using SMART in an external drive.

> I have used a similar enclosure (same silver plastic case, same fan,
> but it had an oxford chipset, and noname, where this is a bytecc)
> and another large WD drive for almost 3 years daily with no problems.

Yeah, plenty do use them without problems.

> Also I was on the net when it happened -
> could it have been from a malicious attack?

Not very likely. And I use a full hardware firewall, so that cant happen.

> In any case all I want is to recover the data and avoid this
> happening again (including making more frequent backups). Are
> there any external hybrid enclosures you would recommend?

See above.

> I am running findpart.exe all, we will see if Svend replies
> or if I can figure out where to take it from there.


> Rod Speed wrote:
>> "Al Dykes" <adykes@panix.com> wrote in message
>> news:D 12rii$6iv$1@panix5.panix.com...
>> > In article <39jjp4F61f95cU1@individual.net>,
>> > Rod Speed <rod_speed@yahoo.com> wrote:
>> >>
>> >>"Al Dykes" <adykes@panix.com> wrote in message
>> >>news:D 11u9q$a7d$1@panix5.panix.com...
>> >>> In article
> <1110733926.724474.164100@f14g2000cwb.googlegroups.com>,
>> >>> Mad Scientist Jr <usenet_daughter@yahoo.com> wrote:
>> >>>>I am having trouble with 120 GB NTFS drive in an external
> enclosure
>> >>>>(hybrid usb2/firewire), used with Windows XP.
>> >>>>
>> >>>>Yesterday Windows popped up with an error like "could not write
> to
>> >>>>drive, bad block found". I tried to open the drive in My Computer
> and
>> >>>>although the drive letter was listed, the volume name was gone
> and I
>> >>>>could no longer browse the drive.
>> >>>>
>> >>>>If you look at the Computer Management screenshot:
>> >>>>
>> >>>> http://www.geocities.com/usenet_daughter/hdd1.jpg
>> >>>>
>> >>>>drive F is the drive and is listed as Healthy, but no file system
> or
>> >>>>volume name is present. This should be an NTFS partition.
>> >>>>
>> >>>>Any help recovering this volume would be most appreciated.
>> >>>>
>> >>>>Thanks
>> >>>>
>> >>>>PS I would prefer to use Svend's findpart utility:
>> >>>> http://www.partitionsupport.com/utilities.htm
>> >>>>which has worked like a charm in the past (with the author's
> help). I
>> >>>>am more comfortable using this than a commercial product like
> Norton
>> >>>>Diskdoctor. However I haven't been able to reach him - if anyone
> else
>> >>>>knows how to use Findpart to recover an NTFS partition, any help
> would
>> >>>>be appreciated.
>> >>>>
>> >>>
>> >>> We need to know a little more about this guys problem before we
> can
>> >>> make conculsion, maybe his disk died. but I've been watching
> usenet
>> >>> groups for NTFS issues for about a year paying attention to
> people
>> >>> reporting NTFS "failure" and my thoroughly unscientific poll
> shows
>> >>> that a huge number of the people that have had these problems are
>> >>> using external USB boxes. This guy's story is typical.
>> >>>
>> >>> I (and many other sysadmins) have been using NTFS from the day it
> was
>> >>> available. In my case for many thousands of systems. 99% of these
> are
>> >>> IDE and the rest SCSI. Except for hardware failure it's 100%
>> >>> reliable, IME.
>> >>
>> >>> I could conjecture that backpack problems
>> >>> could be explained by one of these reasons:
>> >>
>> >>> - Problems with LBA48 issues and big disks.
>> >>
>> >>Nope, the drive isnt big enough to see those.
>> >>
>> >>> - Heat killing the disk. (not a USB problem, but
>> >>> related to the cheapo case design and full time use.)
>> >>
>> >>Possible.
>> >>
>> >>> - Power fulction/problems caused by
>> >>> the enclosure's wall wart being sub-par
>> >>
>> >>Possible but not that likely, it aint rocket science at that power
> level.
>> >>
>> >>> or subject to VAC fulctuation that the PC power supply deals
> with,
>> >>
>> >>Ditto.
>> >>
>> >>> or common mode ground problems.
>> >>
>> >>Very unlikely indeed. Its a digital system.
>>
>> > "digital" is really a very carefull analog simulation.
>>
>> Nope.
>>
>> > It works great until it stops.
>>
>> It doesnt stop due to common mode ground problems.
>>
>> > Look at digital signals with a o'scope for an example.
>>
>> You can make the same silly claim about say the PCI bus signals.
>
Anonymous
a b G Storage
March 15, 2005 3:56:42 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Mad Scientist Jr" <usenet_daughter@yahoo.com> wrote:

> Other than turning it on for a minute to get the chipset/driver I have
> not touched the drive since the crash. Do any of you know how to use
> the FindNTFS or similar utility to recover the partition? NTFS stores
> backups of partition tables, right? I don't trust Norton to fix this.

NTFS doesn't store a backup of the partition table (actually the MBR and
extended partition *sectors*) but it's relatively simple to rebuild the table
from scratch if you know how to assess the partitions geometry. There are
several tools for the purpose, most of them are free (including RESQ, for this
purpose).

NTFS stores a backup of the boot sector, though, as the last sector of the
partition, respectively.

Regards
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
March 15, 2005 6:09:00 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Would TestDisk (http://www.cgsecurity.org) rebuild the partition table?


The problem I am having with FindNTFS is I have it output a list of
folders and files, but it is incomplete. For instance, "findpart all"
listed cylinder/head/sector 0, 1, 7, so I did
findntfs 5 0 1 7 file5017.txt files

which created a file that lists certain folders/files:

2005-02-27 23:50:58 <DIR> 10000000 myfolder1
2005-02-28 14:02:31 <DIR> 10000000 myfolder2
2005-03-07 23:50:18 <DIR> 10000000 myfolder3
2005-02-28 11:45:30 <DIR> 10000000 myfolder4
2005-02-28 12:44:19 <DIR> 10000000 myfolder5
2005-03-02 22:46:43 <DIR> 10000000 myfolder6
2005-02-28 13:37:47 <DIR> 10000000 myfolder7
2005-03-07 23:41:44 <DIR> 10000000 myfolder8

97691 mydata\myfolder1\
2004-11-22 20:47:50 8368128 00000020 file1.doc
2004-11-22 20:47:50 8368128 00000020 file2.doc
2004-11-22 20:48:22 8368128 00000020 file3.avi
2004-11-22 20:48:22 8368128 00000020 file4.doc

97685 mydata\myfolder2\
2004-12-05 00:41:09 28344 00000020 file5.doc
2002-11-10 11:14:44 14483456 00000020 file6.doc
2002-11-10 11:14:44 14483456 00000020 file7.doc
2002-11-10 11:14:44 14483456 00000020 file8.doc
2002-11-10 11:14:44 14483456 00000020 file9.doc

97680 mydata\myfolder7\
2004-11-22 19:55:37 8687616 00000020 file10.avi
2004-11-22 19:55:37 8687616 00000020 file11.wav
2004-11-22 19:55:59 8687616 00000020 file12.wav
2004-11-22 19:55:59 8687616 00000020 file13.wav

etc.

But while myfolder4, myfolder5 and myfolder6 appear in the list above,
they do not appear below broken out with files. And if I try generating
a dir list with

findntfs 5 0 1 7 dirs5017.txt dirs

those folders don't appear at all.

I tried searching sector 1 instead
findntfs 5 0 1 1 file5011.txt files
findntfs 5 0 1 1 dirs 5011.txt dirs

and the output files are about 1/2 the size of the sector 7 ones, and
are also missing the folders.

Also, when I try to do findpart copy, for some of the folders it
doesn't restore all the files, and for some it restores none,
outputting "no info":

Searching ... .

------Date ----Time -------Size ---Flags Name

61732 mydata\myfolder9\
2005-02-19 09:09:22 2498604 00000020 myfile14.wav No info
2005-02-19 09:11:30 2762796 00000020 myfile15.wav No info
2005-02-19 09:13:58 3203116 00000020 myfile16.avi No info
2005-02-19 09:19:00 2555948 00000020 myfile17.wav No info
2005-03-01 00:37:38 1552428 00000020 myfile18.aif No info
2005-03-03 15:01:52 1651756 00000020 myfile19.wav No info

Directories: 7650
Files: 134380
Trees: 25
Exe/dll files: 1963
Exe/dll files signature: 1952
Copied files: 0
Cluster KB: 4
MFT record used: None
Listed files MB: 102530

So it seems the folders I am trying to recover only exist in the files
list of sector 7. They are listed, so hopefully I am using findntfs
wrong or another tool can recover them. Maybe there is more information
stored elsewhere that can locate the particular directories.

Any more detailed help appreciated.

Zvi Netiv wrote:
> NTFS doesn't store a backup of the partition table (actually the MBR
and
> extended partition *sectors*) but it's relatively simple to rebuild
the table
> from scratch if you know how to assess the partitions geometry.
There are
> several tools for the purpose, most of them are free (including RESQ,
for this
> purpose).
Anonymous
a b G Storage
March 16, 2005 2:19:06 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I suggest you use partition table doctor.It provides very useful
functions: Backup partition table, Restore partition table, Rebuild
partition table, undelete partition,Fixboot.
see more:http://www.ptdd.com/recoverylostpartition.htm
Anonymous
a b G Storage
March 17, 2005 12:16:28 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks to everyone who replied or made suggestions, I ended up
recovering my data using EasyRecovery Professional (www.ontrack.com)
!