Sign in with
Sign up | Sign in
Your question

Data Recovery from lost NTFS. Help!

Last response: in Storage
Share
Anonymous
a b G Storage
May 24, 2005 9:37:20 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this. Thanks Gregg
Anonymous
a b G Storage
May 25, 2005 2:23:07 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> I need some advice. I was transferring info from a 160 gig IDE Western
> Digital hard drive and forgot the drive was in use when I renamed it in
> Drive properties. The drive instantly lost its file system asks if I want to
> format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the file
system. If it wasn't legit then the operating system would have blocked it.
From the little info provided above, I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file
system).

Other possible causes to the disappearing of the file system of your drive could
be a modified partition table, in its MBR, or changed settings for that drive,
in the CMOS. Yet given the symptoms described, I would think that a damaged
boot sector is the most likely.

> I've used GetDataBack and recovered some files but it doesn't seem to find
> much.

File recovery such as GetDataBack and EasyRecovery are appropriate when there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

> Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 25, 2005 4:20:18 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Gregg OBanion <gobanion@msn.com> wrote in
message news:eNPke.3700$Xh.1255@fed1read07...

> I need some advice. I was transferring info from a 160 gig IDE Western Digital
> hard drive and forgot the drive was in use when I renamed it in Drive
> properties. The drive instantly lost its file system asks if I want to format
> it when I click on the drive letter.

I like Easy Recovery Pro, but it aint free.

> I've used GetDataBack and recovered some files but it doesn't seem to find
> much.

> Can someone tell me of a good newsgroup for this.

This one is as good as any for that.
Related resources
Anonymous
a b G Storage
May 26, 2005 2:06:12 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thank You for the advice. It makes sense to me.

>I would guess that something went wrong
> when the OS tried to rewrite the boot sector with the modified volume name
> (the
> volume name is written to the boot sector, in addition to the entry in the
> file
> system).
>For starters, NTFS partitions keep a backup of the boot sector in the very
>last
> sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg


"Zvi Netiv" <support@replace_with_domain.com> wrote in message
news:b56891pf7qk95ina2e7lidh07dka3dt8qk@4ax.com...
> "Gregg OBanion" <gobanion@msn.com> wrote:
>
>> I need some advice. I was transferring info from a 160 gig IDE Western
>> Digital hard drive and forgot the drive was in use when I renamed it in
>> Drive properties. The drive instantly lost its file system asks if I want
>> to
>> format it when I click on the drive letter.
>
> There is no reason why the renaming of a volume would cause loss of the
> file
> system. If it wasn't legit then the operating system would have blocked
> it.
> From the little info provided above, I would guess that something went
> wrong
> when the OS tried to rewrite the boot sector with the modified volume name
> (the
> volume name is written to the boot sector, in addition to the entry in the
> file
> system).
>
> Other possible causes to the disappearing of the file system of your drive
> could
> be a modified partition table, in its MBR, or changed settings for that
> drive,
> in the CMOS. Yet given the symptoms described, I would think that a
> damaged
> boot sector is the most likely.
>
>> I've used GetDataBack and recovered some files but it doesn't seem to
>> find
>> much.
>
> File recovery such as GetDataBack and EasyRecovery are appropriate when
> there is
> no better choice. I would first check the above and fix the necessary, if
> possible. This would give a better chance to fully recover the drive and
> data,
> lock, stock and barrel. Yet it requires some skill and low level (DOS)
> operation.
>
> For starters, NTFS partitions keep a backup of the boot sector in the very
> last
> sector of every partition, respectively.
>
>> Can someone tell me of a good newsgroup for this. Thanks Gregg
>
> This one is.
>
> Regards, Zvi
> --
> NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
> InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 26, 2005 8:05:53 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
<support@replace_with_domain.com> wrote:

Hi, Zvi

>"Gregg OBanion" <gobanion@msn.com> wrote:
>
>> I need some advice. I was transferring info from a 160 gig IDE Western
>> Digital hard drive and forgot the drive was in use when I renamed it in
>> Drive properties. The drive instantly lost its file system asks if I want to
>> format it when I click on the drive letter.
>
>There is no reason why the renaming of a volume would cause loss of the file
>system. If it wasn't legit then the operating system would have blocked it.
>From the little info provided above, I would guess that something went wrong
>when the OS tried to rewrite the boot sector with the modified volume name (the
>volume name is written to the boot sector, in addition to the entry in the file
>system).

With NTFS the volume label is not written to the boot sector but only
to the metadata file $Volume.

>Other possible causes to the disappearing of the file system of your drive could
>be a modified partition table, in its MBR, or changed settings for that drive,
>in the CMOS. Yet given the symptoms described, I would think that a damaged
>boot sector is the most likely.
>
>> I've used GetDataBack and recovered some files but it doesn't seem to find
>> much.

You need a tool that can do a raw mode recovery. I've never used
GetDataBack, so don't know if it can do that. I think that File
Scavenger can and it is reasonably priced.

>File recovery such as GetDataBack and EasyRecovery are appropriate when there is
>no better choice. I would first check the above and fix the necessary, if
>possible. This would give a better chance to fully recover the drive and data,
>lock, stock and barrel. Yet it requires some skill and low level (DOS)
>operation.
>
>For starters, NTFS partitions keep a backup of the boot sector in the very last
>sector of every partition, respectively.

May or may not help - probably not IMO. A missing boot sector can lead
drive manager to ask for a format, but so can a damaged MFT. This
really needs some diagnostic help.

>> Can someone tell me of a good newsgroup for this. Thanks Gregg
>
>This one is.
>
>Regards, Zvi


Bob
Anonymous
a b G Storage
May 26, 2005 8:05:54 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks Robert. I will try File Scavenger and report back here.

"Robert Green" <lasrpro@hotmail.com> wrote in message
news:rcha91943g0p2758ekk4lv64kqdg5d112l@4ax.com...
> On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
> <support@replace_with_domain.com> wrote:
>
> Hi, Zvi
>
>>"Gregg OBanion" <gobanion@msn.com> wrote:
>>
>>> I need some advice. I was transferring info from a 160 gig IDE Western
>>> Digital hard drive and forgot the drive was in use when I renamed it in
>>> Drive properties. The drive instantly lost its file system asks if I
>>> want to
>>> format it when I click on the drive letter.
>>
>>There is no reason why the renaming of a volume would cause loss of the
>>file
>>system. If it wasn't legit then the operating system would have blocked
>>it.
>>From the little info provided above, I would guess that something went
>>wrong
>>when the OS tried to rewrite the boot sector with the modified volume name
>>(the
>>volume name is written to the boot sector, in addition to the entry in the
>>file
>>system).
>
> With NTFS the volume label is not written to the boot sector but only
> to the metadata file $Volume.
>
>>Other possible causes to the disappearing of the file system of your drive
>>could
>>be a modified partition table, in its MBR, or changed settings for that
>>drive,
>>in the CMOS. Yet given the symptoms described, I would think that a
>>damaged
>>boot sector is the most likely.
>>
>>> I've used GetDataBack and recovered some files but it doesn't seem to
>>> find
>>> much.
>
> You need a tool that can do a raw mode recovery. I've never used
> GetDataBack, so don't know if it can do that. I think that File
> Scavenger can and it is reasonably priced.
>
>>File recovery such as GetDataBack and EasyRecovery are appropriate when
>>there is
>>no better choice. I would first check the above and fix the necessary, if
>>possible. This would give a better chance to fully recover the drive and
>>data,
>>lock, stock and barrel. Yet it requires some skill and low level (DOS)
>>operation.
>>
>>For starters, NTFS partitions keep a backup of the boot sector in the very
>>last
>>sector of every partition, respectively.
>
> May or may not help - probably not IMO. A missing boot sector can lead
> drive manager to ask for a format, but so can a damaged MFT. This
> really needs some diagnostic help.
>
>>> Can someone tell me of a good newsgroup for this. Thanks Gregg
>>
>>This one is.
>>
>>Regards, Zvi
>
>
> Bob
Anonymous
a b G Storage
May 26, 2005 2:03:43 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.

> >I would guess that something went wrong
> > when the OS tried to rewrite the boot sector with the modified volume name (the
> > volume name is written to the boot sector, in addition to the entry in the file system).
> >For starters, NTFS partitions keep a backup of the boot sector in the very last
> > sector of every partition, respectively.

> Can you tell me how to begin to check this problem. I've left the drive
> untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
> Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
to format the volume).

Could you please describe the drive configuration: What order is the problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
MBR, boot sector).

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

Regards, Zvi

> "Zvi Netiv" <support@replace_with_domain.com> wrote in message
> > "Gregg OBanion" <gobanion@msn.com> wrote:
> >
> >> I need some advice. I was transferring info from a 160 gig IDE Western
> >> Digital hard drive and forgot the drive was in use when I renamed it in
> >> Drive properties. The drive instantly lost its file system asks if I want
> >> to
> >> format it when I click on the drive letter.
> >
> > There is no reason why the renaming of a volume would cause loss of the
> > file
> > system. If it wasn't legit then the operating system would have blocked
> > it.
> > From the little info provided above, I would guess that something went
> > wrong
> > when the OS tried to rewrite the boot sector with the modified volume name
> > (the
> > volume name is written to the boot sector, in addition to the entry in the
> > file
> > system).
> >
> > Other possible causes to the disappearing of the file system of your drive
> > could
> > be a modified partition table, in its MBR, or changed settings for that
> > drive,
> > in the CMOS. Yet given the symptoms described, I would think that a
> > damaged
> > boot sector is the most likely.
> >
> >> I've used GetDataBack and recovered some files but it doesn't seem to
> >> find
> >> much.
> >
> > File recovery such as GetDataBack and EasyRecovery are appropriate when
> > there is
> > no better choice. I would first check the above and fix the necessary, if
> > possible. This would give a better chance to fully recover the drive and
> > data,
> > lock, stock and barrel. Yet it requires some skill and low level (DOS)
> > operation.
> >
> > For starters, NTFS partitions keep a backup of the boot sector in the very last
> > sector of every partition, respectively.
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 26, 2005 2:18:55 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Zvi Netiv <support@replace_with_domain.com> wrote:
> "Gregg OBanion" <gobanion@msn.com> wrote:
>
> > Thank You for the advice. It makes sense to me.
>
> Yet it doesn't to me. Since you already bothered moving part of the previous
> posts to the top (only a "half" top-poster), then why moving anything at all?
> Your follow-up would have made more sense if it was all in-line.
>
> > >I would guess that something went wrong
> > > when the OS tried to rewrite the boot sector with the modified volume name (the
> > > volume name is written to the boot sector, in addition to the entry in the file system).
> > >For starters, NTFS partitions keep a backup of the boot sector in the very last
> > > sector of every partition, respectively.
>
> > Can you tell me how to begin to check this problem. I've left the drive
> > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
> > Promise Ultra 100 PCI Card. Thanks Again. Gregg
>
> As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
> to format the volume).
>
> Could you please describe the drive configuration: What order is the problem
> drive (first, second, ... fourth?), and how was it partitioned (one big
> partition, several, what types?).
>
> If the drive is one of the first two (you can always make it that by
> disconnecting other drives), then you can use RESQDISK from
> www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
> MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as the
controller will set the drive in the BIOS list (not the same as CMOS!) with a
best fit to what's found in the MBR.

> If the above are OK then revert to data recovery software, or professional
> recovery, if you can afford it and the data is worth the expense.

Regards
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 26, 2005 2:18:56 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Sorry for the inexperience with my post. It's been a while.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

Thanks Zvi.

"Zvi Netiv" <support@replace_with_domain.com> wrote in message
news:2lta919gfvkraroj67g9fgkhhqu6tm8ac1@4ax.com...
> Zvi Netiv <support@replace_with_domain.com> wrote:
>> "Gregg OBanion" <gobanion@msn.com> wrote:
>>
>> > Thank You for the advice. It makes sense to me.
>>
>> Yet it doesn't to me. Since you already bothered moving part of the
>> previous
>> posts to the top (only a "half" top-poster), then why moving anything at
>> all?
>> Your follow-up would have made more sense if it was all in-line.
>>
>> > >I would guess that something went wrong
>> > > when the OS tried to rewrite the boot sector with the modified volume
>> > > name (the
>> > > volume name is written to the boot sector, in addition to the entry
>> > > in the file system).
>> > >For starters, NTFS partitions keep a backup of the boot sector in the
>> > >very last
>> > > sector of every partition, respectively.
>>
>> > Can you tell me how to begin to check this problem. I've left the drive
>> > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
>> > on a
>> > Promise Ultra 100 PCI Card. Thanks Again. Gregg
>>
>> As Bob Green pointed out, a damaged MFT could also cause the same effect
>> (offer
>> to format the volume).
>>
>> Could you please describe the drive configuration: What order is the
>> problem
>> drive (first, second, ... fourth?), and how was it partitioned (one big
>> partition, several, what types?).
>>
>> If the drive is one of the first two (you can always make it that by
>> disconnecting other drives), then you can use RESQDISK from
>> www.resq.co.il/resq.php to assess the boot chain (drive settings in the
>> CMOS,
>> MBR, boot sector).
>
> Correction: Forget the CMOS drive settings, since it uses the Ultra-100
> controller. Yet a corrupted partition table could have a similar effect
> as the
> controller will set the drive in the BIOS list (not the same as CMOS!)
> with a
> best fit to what's found in the MBR.
>
>> If the above are OK then revert to data recovery software, or
>> professional
>> recovery, if you can afford it and the data is worth the expense.
>
> Regards
> --
> NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
> InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 26, 2005 7:40:12 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> Sorry for the inexperience with my post. It's been a while.

I meant that top-posting isn't appreciated here. What alienates me in top-post
follow-ups is the liberty that some take in abusing the product of others' time
and efforts and transforming them into senseless babble. You aren't the only
one to seek help through newsgroups, many use their archives to look for
solutions to problems they have. Hence, top-posting is ungrateful to
contributors, it doesn't encourage them in helping you, and is unfair to
readers.

The same goes for trimming previous text and not fragmenting the lines of quoted
text, but the latter are more a matter of experience in newsgroups, while
top-posting is a conscious and selfish choice.

I realize that not all contributors do mind about top-posting, yet I am sure
that I reflect the feeling of the majority. Witness their posts.

> The drive is one big partition. The Info in Disk Management reads, Disk 3,
> Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
> 100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
> card.

The above doesn't exclude the possibility that either the MBR and/or the boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will write
its findings into a text file report named RESQDISK.RPT, in A:\. Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up), and
avoid top-posting!

Regards, Zvi

> "Zvi Netiv" <support@replace_with_domain.com> wrote in message
> >> "Gregg OBanion" <gobanion@msn.com> wrote:
> >>
> >> > Thank You for the advice. It makes sense to me.
> >>
> >> Yet it doesn't to me. Since you already bothered moving part of the previous
> >> posts to the top (only a "half" top-poster), then why moving anything at all?
> >> Your follow-up would have made more sense if it was all in-line.

[...]
> >> > Can you tell me how to begin to check this problem. I've left the drive
> >> > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
> >> > on a Promise Ultra 100 PCI Card. Thanks Again. Gregg
> >>
> >> As Bob Green pointed out, a damaged MFT could also cause the same effect
> >> (offer to format the volume).
> >>
> >> Could you please describe the drive configuration: What order is the
> >> problem drive (first, second, ... fourth?), and how was it partitioned (one big
> >> partition, several, what types?).
> >>
> >> If the drive is one of the first two (you can always make it that by
> >> disconnecting other drives), then you can use RESQDISK from
> >> www.resq.co.il/resq.php to assess the boot chain (drive settings in the
> >> CMOS, MBR, boot sector).
> >
> > Correction: Forget the CMOS drive settings, since it uses the Ultra-100
> > controller. Yet a corrupted partition table could have a similar effect as the
> > controller will set the drive in the BIOS list (not the same as CMOS!) with a
> > best fit to what's found in the MBR.
> >
> >> If the above are OK then revert to data recovery software, or professional
> >> recovery, if you can afford it and the data is worth the expense.
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 28, 2005 12:11:29 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions: Fix boot sector

Run the program and right click the partition and choose fixboot.


see more: http://www.ptdd.com/fixboot.htm
Anonymous
a b G Storage
May 28, 2005 5:55:43 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

[snip]

> My next step. Read the Hard drive section of my new Repair book. Use
> the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
> also looking into File Scavenger.

What I have been trying to suggest to you, with no success as it seems, is that
before purchasing data recovery software and trying to recover your stuff, file
by file, it would make more sense (and be cheaper too) to first try regaining
access to the drive / partition and the data on it, if possible.

In case the purchased SW doesn't yield the expected results: Make sure to not
write to the problem drive if you wish to maintain the option of switching back
to the above approach.

Good luck, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 28, 2005 5:55:44 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hello Zvi and Robert.

Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
post. (Below)

To further investigate, you can download RESQ from
www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
instructed in
the ResQ welcome message). If Win 98 is not available to you, then
download
also the FreeDOS boot floppy maker from
www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager)
with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let
it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files,
Hello Zvi and Robert.

Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
post. (Below)

To further investigate, you can download RESQ from
www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
instructed in
the ResQ welcome message). If Win 98 is not available to you, then
download
also the FreeDOS boot floppy maker from
www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager)
with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let
it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from
the one you
want to assess, boot from the RESQ floppy just made (leave the
diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK
/ASSESS

The program will initiate an assessment cycle of the hard drive and
will write
its findings into a text file report named RESQDISK.RPT, in A:\.
Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the
program
terminates and exits.

Post here the report file (just paste the text file into your
follow-up), and
avoid top-posting!

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.

Thanks Zvi.

>> My next step. Read the Hard drive section of my new Repair book.
>> Use
>> the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
>> also looking into File Scavenger.
>
> What I have been trying to suggest to you, is that
> before purchasing data recovery software and trying to recover
> your stuff, file
> by file, it would make more sense (and be cheaper too) to first
> try regaining
> access to the drive / partition and the data on it, if possible.

Yes Zvi. I have understood what you are telling me. The ultimate fix
here is to have the drive operate as before. Problem is, where do I
begin?

Zvi Said:
From the little info provided above, I would guess that something
went wrong
when the OS tried to rewrite the boot sector with the modified
volume name (the
volume name is written to the boot sector, in addition to the entry
in the file
system).

Robert Said:
With NTFS the volume label is not written to the boot sector but
only
to the metadata file $Volume.

Zvi Said:
Other possible causes to the disappearing of the file system of your
drive could
be a modified partition table, in its MBR, or changed settings for
that drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

For starters, NTFS partitions keep a backup of the boot sector in
the very last
sector of every partition, respectively.

Robert Said:
A missing boot sector can lead drive manager to ask for a format,
but so can a damaged MFT. This
really needs some diagnostic help.

Zvi Said:
Could you please describe the drive configuration: What order is
the problem
drive (first, second, ... fourth?), and how was it partitioned (one
big
partition, several, what types?).

Gregg Said:
I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. The drive is one big partition. The Info
in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise
Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
the PCI card.

Zvi Said:
If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in
the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the
Ultra-100
controller. Yet a corrupted partition table could have a similar
effect as the
controller will set the drive in the BIOS list (not the same as
CMOS!) with a
best fit to what's found in the MBR.

The above doesn't exclude the possibility that either the MBR and/or
the boot
sector were altered.

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The MFT?
How do I look at the corrupted partition table? What info do I need
to provide you to further assist me?

Zvi Said:
In case the purchased SW doesn't yield the expected results: Make
sure to not
write to the problem drive if you wish to maintain the option of
switching back
to the above approach.

My Response: (Gregg)

I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

I can tell you I won't be satisfied with the recovery method because
although it may recover the files, I still want the File structure
(Tree) in tact. So I want to continue to work on this problem and
see if I can solve it. Of course I won't be able to do it without
some help. Please continue to help me. I do appreciate it!

Thanks again, Gregg

and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from
the one you
want to assess, boot from the RESQ floppy just made (leave the
diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK
/ASSESS

The program will initiate an assessment cycle of the hard drive and
will write
its findings into a text file report named RESQDISK.RPT, in A:\.
Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the
program
terminates and exits.

Post here the report file (just paste the text file into your
follow-up), and
avoid top-posting!

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.

Thanks Zvi.

>> My next step. Read the Hard drive section of my new Repair book.
>> Use
>> the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
>> also looking into File Scavenger.
>
> What I have been trying to suggest to you, is that
> before purchasing data recovery software and trying to recover
> your stuff, file
> by file, it would make more sense (and be cheaper too) to first
> try regaining
> access to the drive / partition and the data on it, if possible.

Yes Zvi. I have understood what you are telling me. The ultimate fix
here is to have the drive operate as before. Problem is, where do I
begin?

Zvi Said:
From the little info provided above, I would guess that something
went wrong
when the OS tried to rewrite the boot sector with the modified
volume name (the
volume name is written to the boot sector, in addition to the entry
in the file
system).

Robert Said:
With NTFS the volume label is not written to the boot sector but
only
to the metadata file $Volume.

Zvi Said:
Other possible causes to the disappearing of the file system of your
drive could
be a modified partition table, in its MBR, or changed settings for
that drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

For starters, NTFS partitions keep a backup of the boot sector in
the very last
sector of every partition, respectively.

Robert Said:
A missing boot sector can lead drive manager to ask for a format,
but so can a damaged MFT. This
really needs some diagnostic help.

Zvi Said:
Could you please describe the drive configuration: What order is
the problem
drive (first, second, ... fourth?), and how was it partitioned (one
big
partition, several, what types?).

Gregg Said:
I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. The drive is one big partition. The Info
in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise
Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
the PCI card.

Zvi Said:
If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in
the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the
Ultra-100
controller. Yet a corrupted partition table could have a similar
effect as the
controller will set the drive in the BIOS list (not the same as
CMOS!) with a
best fit to what's found in the MBR.

The above doesn't exclude the possibility that either the MBR and/or
the boot
sector were altered.

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The MFT?
How do I look at the corrupted partition table? What info do I need
to provide you to further assist me?

Zvi Said:
In case the purchased SW doesn't yield the expected results: Make
sure to not
write to the problem drive if you wish to maintain the option of
switching back
to the above approach.

My Response: (Gregg)

I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

I can tell you I won't be satisfied with the recovery method because
although it may recover the files, I still want the File structure
(Tree) in tact. So I want to continue to work on this problem and
see if I can solve it. Of course I won't be able to do it without
some help. Please continue to help me. I do appreciate it!

Thanks again, Gregg
Anonymous
a b G Storage
May 28, 2005 8:46:05 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I suppose the drive is properly detected as Big ATA?

"Gregg OBanion" <gobanion@msn.com> wrote in message
news:J_fle.7960$tp.4626@fed1read05...
> Sorry for the inexperience with my post. It's been a while.
>
> The drive is one big partition. The Info in Disk Management reads, Disk 3,
> Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
> 100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the
> PCI card.
>
Anonymous
a b G Storage
May 28, 2005 4:04:49 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
> post. (Below)

[snipped]

> > Post here the report file (just paste the text file into your
> > follow-up), and avoid top-posting!
>
> My Response: (Gregg)
> Excellent info above.
> Sorry for overlooking this. What you'll see written below was
> written before I discovered your instructions (above).
> Wow do I feel dumb! Please read below as it may provide a valuable
> summary. I will follow your instructions right away.
> Yes I do have a Windows 98 machine.
> Thanks Zvi.

Took you long until the coin dropped ...

[snip]
> > What I have been trying to suggest to you, is that
> > before purchasing data recovery software and trying to recover your stuff, file
> > by file, it would make more sense (and be cheaper too) to first try regaining
> > access to the drive / partition and the data on it, if possible.
>
> Yes Zvi. I have understood what you are telling me. The ultimate fix
> here is to have the drive operate as before. Problem is, where do I
> begin?

With post <aneb919eicftk20p8b08dq0tj5gjoqjh80@4ax.com> of this thread, before
having been sidetracked (if you use Forte Agent, select the post link,
right-click it and select "jump to message URL").

[big snip]

> > The above doesn't exclude the possibility that either the MBR and/or
> > the boot sector were altered.
>
> My Response: (Gregg)
> The last two paragraphs are confusing to me. How do I look at the
> boot sector or MBR and what do I look for? How do I look at The MFT?
> How do I look at the corrupted partition table? What info do I need
> to provide you to further assist me?

The RESQDISK assessment report should have answered these questions, if you had
followed the instructions in my above post. I could then interpret the findings
and guide you to complete the recovery. Others in this newsgroup could assist
you just as well, based on the RESQDISK report.

> > Zvi Said:
> > In case the purchased SW doesn't yield the expected results: Make sure to not
> > write to the problem drive if you wish to maintain the option of switching back
> > to the above approach.
>
> My Response: (Gregg)
> I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
> ERP does have a RAW disk recovery tool. It is now writing to a
> different drive. Not the problem drive. It will take 20 hours to
> write that info to disk. Then I will report back to you.

Since you already started the ER session, then let it complete what it started.
Bear in mind that not all files that data recovery SW does "see" will recover
properly. If OTOH, file recovery SW shows all your files and directories in its
preview pane, then this is an indication that the damage is minor and you may
have regained access to the file system without too much effort (and spare the
expense on SW that you could have purchased later on, if full drive recovery
didn't work for you). ;-(

> I can tell you I won't be satisfied with the recovery method because
> although it may recover the files, I still want the File structure
> (Tree) in tact. So I want to continue to work on this problem and
> see if I can solve it. Of course I won't be able to do it without
> some help. Please continue to help me. I do appreciate it!

No problem here. Yet I see now that your posting problem might be caused by
Outlook Express as your default newsreader (OE is a classic Jack of all trades
and master of none)! Many prefer Forte Agent as their newsreader (I do) and
there is a free version available.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 28, 2005 5:34:12 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Zvi Netiv" <support@replace_with_domain.com> wrote in message
news:koag91phiqqlt8cmj3ii13niuvaa878csq@4ax.com...
> "Gregg OBanion" <gobanion@msn.com> wrote:
>
>> Zvi. Somehow I overlooked your instructions from your 5-26 5:40
>> am
>> post. (Below)
>
> [snipped]
>
>> > Post here the report file (just paste the text file into your
>> > follow-up), and avoid top-posting!

Hello Zvi
I don't think I used ResQ correctly. Why was it trying to detect
FAT? Came home a half hour later and it was still detecting fat so I
made it finish. Here are the results. Is this what you wanted or do
I need to run the program again.

27 May 2005 21:01
Evaluation Copy *************************************** CHS
mode W9x
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *
Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:FAT-16*
CHS address: Cyl 0 Head 0 Sector 1
*********
*********************** Setup Diagnostics
************************
* Disk Type: WDC WD1600JB-00HUA0
*
* BIOS/CHS IDE/LBA
data *
* Number of Heads: 255 16
*
* Number of Cylinders: 1024 266305
*
* Sectors per Track: 63 63
*
* Disk Capacity in Mbytes: 8032 131071
*
* IDE Access Time: 44 msec
*
* Total sectors on drive: 268435455
*
******* Use Space to toggle between IDE and Ext.BIOS mode
********
Disk 1, Master Partition Sector, F6 for Layout



27 May 2005 21:01
Evaluation Copy *************************************** CHS
mode W9x
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *
Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:FAT-16*
CHS address: Cyl 0 Head 0 Sector 1
******************** Partition Table Layout
**********************
*
*
* Partition Starting Ending Reserved Total
*
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors
Sectors *
* 7 1 0 1 254 1023 63 63
312576642*
* 0 0 0 0 0 0 0 0 0
*
* 0 0 0 0 0 0 0 0 0
*
* 0 0 0 0 0 0 0 0 0
*
*
*
******* Press Alt+B to see as boot sector, Alt+M to edit
*********
Disk 1, Master Partition Sector, F6 for Layout

>>
>> My Response: (Gregg)
>> Excellent info above.
>> Sorry for overlooking this. What you'll see written below was
>> written before I discovered your instructions (above).
>> Wow do I feel dumb! Please read below as it may provide a
>> valuable
>> summary. I will follow your instructions right away.
>> Yes I do have a Windows 98 machine.
>> Thanks Zvi.
>
> Took you long until the coin dropped ...
>
> [snip]
>> > What I have been trying to suggest to you, is that
>> > before purchasing data recovery software and trying to recover
>> > your stuff, file
>> > by file, it would make more sense (and be cheaper too) to first
>> > try regaining
>> > access to the drive / partition and the data on it, if
>> > possible.
>>
>> Yes Zvi. I have understood what you are telling me. The ultimate
>> fix
>> here is to have the drive operate as before. Problem is, where do
>> I
>> begin?
>
> With post <aneb919eicftk20p8b08dq0tj5gjoqjh80@4ax.com> of this
> thread, before
> having been sidetracked (if you use Forte Agent, select the post
> link,
> right-click it and select "jump to message URL").
>
> [big snip]
>
>> > The above doesn't exclude the possibility that either the MBR
>> > and/or
>> > the boot sector were altered.
>>
>> My Response: (Gregg)
>> The last two paragraphs are confusing to me. How do I look at the
>> boot sector or MBR and what do I look for? How do I look at The
>> MFT?
>> How do I look at the corrupted partition table? What info do I
>> need
>> to provide you to further assist me?
>
> The RESQDISK assessment report should have answered these
> questions, if you had
> followed the instructions in my above post. I could then
> interpret the findings
> and guide you to complete the recovery. Others in this newsgroup
> could assist
> you just as well, based on the RESQDISK report.
>
>> > Zvi Said:
>> > In case the purchased SW doesn't yield the expected results:
>> > Make sure to not
>> > write to the problem drive if you wish to maintain the option
>> > of switching back
>> > to the above approach.
>>
>> My Response: (Gregg)
>> I just used EasyRecovery Pro and recovered 100 GB of the RAW
>> disk.
>> ERP does have a RAW disk recovery tool. It is now writing to a
>> different drive. Not the problem drive. It will take 20 hours to
>> write that info to disk. Then I will report back to you.
>
> Since you already started the ER session, then let it complete
> what it started.
> Bear in mind that not all files that data recovery SW does "see"
> will recover
> properly. If OTOH, file recovery SW shows all your files and
> directories in its
> preview pane, then this is an indication that the damage is minor
> and you may
> have regained access to the file system without too much effort
> (and spare the
> expense on SW that you could have purchased later on, if full
> drive recovery
> didn't work for you). ;-(

I had to stop the data recovery from EasyRecovery Pro. It was taking
to long to write to the recovery drive/folder. (about 25 hrs was the
estimate). The files I looked at had lost all structure even file
names were changed. Of course I only used ERP's RAW recovery tool.
GetDataBack left most file names in tact but didn't near the info
back that ERP recovered. Very little was recovered with GetDataBack.

>
>> I can tell you I won't be satisfied with the recovery method
>> because
>> although it may recover the files, I still want the File
>> structure
>> (Tree) in tact. So I want to continue to work on this problem and
>> see if I can solve it. Of course I won't be able to do it without
>> some help. Please continue to help me. I do appreciate it!
>
> No problem here. Yet I see now that your posting problem might be
> caused by
> Outlook Express as your default newsreader (OE is a classic Jack
> of all trades
> and master of none)! Many prefer Forte Agent as their newsreader
> (I do) and
> there is a free version available.

I will look at Forte Agent then soon. Yes I think Outlook Express
does some strange things to text, breaking sentenances apart. Just
bad formating. It's probably just me though. Thanks for the info. I
will try Forte Agent.

Regards, Gregg

>
> Regards, Zvi
> --
> NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il
> (Hebrew)
> InVircible Virus Defense Solutions, ResQ and Data Recovery
> Utilities
Anonymous
a b G Storage
May 28, 2005 5:36:08 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks, I will take a look at Partition Table Doctor.

<wemaole@yahoo.com> wrote in message
news:1117249889.415209.18820@g47g2000cwa.googlegroups.com...
>I suggest you use Partition Table Doctor to resolve your
> problem.The software provides very useful functions: Fix boot
> sector
>
> Run the program and right click the partition and choose fixboot.
>
>
> see more: http://www.ptdd.com/fixboot.htm
>
Anonymous
a b G Storage
May 28, 2005 5:40:53 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Alexander Grigoriev" <alegr@earthlink.net> wrote in message
news:hISle.1196$s64.1157@newsread1.news.pas.earthlink.net...
>I suppose the drive is properly detected as Big ATA?

Yes. On System boot the Start Up Screen shows the Ultra 100
controller and the 4 drives as 149.05 GB.

>
> "Gregg OBanion" <gobanion@msn.com> wrote in message
> news:J_fle.7960$tp.4626@fed1read05...
>> Sorry for the inexperience with my post. It's been a while.
>>
>> The drive is one big partition. The Info in Disk Management
>> reads, Disk 3, Basic, 149.05 GB, Online. File System RAW. In
>> order on the Promise Ultra 100, It's on IDE 1 as a Slave. There
>> are 3 other Identical drives on the PCI card.
>>
>
>
Anonymous
a b G Storage
May 29, 2005 6:15:22 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
> "Gregg OBanion" <gobanion@msn.com> wrote in message news:lB4me.1967$fp.688@fed1read05
> > "Zvi Netiv" <support@replace_with_domain.com> wrote in message

Let me tell you a little story about a dog that tried to get accepted by a pack
of wolves ...

Attempting to make friends, he went sniffing the butt of his new mates, like
dogs do. When approaching to sniff one of his new mates, the partner
unexpectedly said: "look, I am a dog myself, but butt-sniffing among wolves is
considered vulgar and degrading. This is why they greet each other by rubbing
noses, instead". The newcomer said thanks for the advice, and happily went on
rubbing noses with the other wolves in the pack. Then, one day just the two
dogs met in the woods, with no wolf in sight. As the newcomer was approaching
for the nose rub greeting, the other dog said to him: "Wait! As we both know
exactly who you are, then you don't have to pretend with me, and I'll let you
sniff my butt".

[snip]

> Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
> IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
> heads used- for drives bigger than or equal to 8GB.
> The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.
> The information flag of Int13/ah=48 will say:
> cylinder/head/sectors-per-track information is valid: 'false' (cleared).

Clueless. You have been doing this (telling authors how they should write their
programs) to Svend, Joep and myself. Give it up, Folkert, this is way over your
league.

Besides, your trolling contributes nothing constructive to the discussion and
all it does is to mislead and confuse.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 29, 2005 7:50:29 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Zvi Netiv" <support@replace_with_domain.com> wrote in message
news:1a7j91t1vcslod84pvb1vb3kv0e9lbmsfe@4ax.com...
> "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
>
> > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
> > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the
number of
> > heads used- for drives bigger than or equal to 8GB.
> > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over
8GB.
> > The information flag of Int13/ah=48 will say:
> > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
>
> Clueless. You have been doing this (telling authors how they should write
their
> programs) to Svend, Joep and myself. Give it up, Folkert, this is way over
your
> league.
>
> Besides, your trolling contributes nothing constructive to the discussion
and
> all it does is to mislead and confuse.
>
Here, here.

Folknuts, you don't have a clue. Especially on CHS in NT.
Anonymous
a b G Storage
May 29, 2005 9:20:41 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> Hello Zvi. Your information was very encouraging. I hope It works
> but before I try let me give you some more information that may be
> important. I'm sorry I didn't mention it earlier.
>
> The 4 disk array (with the malfunctioning drive) was migrated from a
> Windows 2000 Pro Server machine and a Promise Ultra 133 PCI card.
> Remember the array is now on WinXP SP2 with a Promise Ultra 100 PCI
> card. I meant to tell you this long ago. I hope it doesn't present a
> problem. I will wait to hear from you before I follow your
> instructions below.

[snip]

> I have now disconnected the CD Rom on Secondary IDE and ran ResQdisk
> again. Here's the Report.

ResQdisk reports INT-13 devices, from 80h and up (BIOS notation), i.e. only HARD
drives. I didn't make it clear, since I thought it was obvious.

The new report from May 29 still shows the presence of additional HARD drives
connected in that PC. You should leave the CD drive(s) connected, how else will
you boot the CD repair console?

The installed Windows version is irrelevant, as there should be no "installed"
system at the time you run FIXBOOT. You should be working with a single HARD
drive connected and boot of a W2K or XP setup CD. Either have FIXBOOT as part
of their "repair console", and you may use the one or the other.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
May 30, 2005 4:34:06 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Zvi Netiv" <support@replace_with_domain.com> wrote in message news:1a7j91t1vcslod84pvb1vb3kv0e9lbmsfe@4ax.com...
> "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
> > "Gregg OBanion" <gobanion@msn.com> wrote in message news:lB4me.1967$fp.688@fed1read05
> > > "Zvi Netiv" <support@replace_with_domain.com> wrote in message
>

Idiotic sidetrack attempt snipped.

>
> [snip]
>
> > * BIOS/CHS IDE/LBA data *
> > * Number of Heads: 255 16 *
> > * Number of Cylinders: 1024 266305 *
> > * Sectors per Track: 63 63 *
> > * Disk Capacity in Mbytes: 8032 131071 *

> Oh look, the 'Number of Cylinders' line has been corrected although there was nothing
> (supposedly) wrong with it. Yet Resqdisk version is still v576. Naughty, naughty.

Introductory context restored. Typical how people like Netiv always have to snip that to
make themself believable, the sure sign that such person obviously has something to hide.

> > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
> > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
> > heads used- for drives bigger than or equal to 8GB.
> > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.

> > The information flag of Int 13-AH=48h will say:
> > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
(Or in the words of EDD-2: The geometry returned in bytes 4-15 shall be valid)

>
> Clueless.

Your deliberate snipping of the quoted error tells it all Netiv.
You are just posturing.
You are the 'clueless' one that obviously didn't check Int 13-AH=48h's
information buffer result of the word at offset 2, bit one, for the validity
of the geometry as returned in bytes 4-15: Number of default cylinders,
Number of default heads and Number of default sectors.

Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselfs.
Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
http://www.t13.org/project/d1484r3.pdf, page 13, 14.

And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
http://www.t13.org/project/d1410r0a.pdf

> You have been doing this (telling authors how they should write their
> programs) to Svend, Joep and myself.

At least one of them drew his conclusions and the other one created his own little
wolves-den (or is that doghouse?). Perhaps they are the smarter ones, Netiv.

> Give it up, Folkert, this is way over your league.

And miss all the fun of the wolves gathering, to tear the messenger apart?
See the Gisin newbee licking your arse? Nah. Too much fun.

So btw, if I got it all so very, very wrong, why then did you change the
BIOS/CHS IDE/LBA data reporting? It's obviously different from the
last time we 'discussed' this in "Re: mbr for 40G harddrive?"
news:428aa100$0$59548$892e7fe2@authen.white.readfreenews.net

That post where resqdisk managed to get the CHS wrong in the MBR
partition entry that it recreated.


* Disk Type: Maxtor 34098H4
* BIOS/CHS IDE/LBA data
* Number of Heads: 255 16
* Number of Cylinders: 1025 16383
* Sectors per Track: 63 63
* Disk Capacity in Mbytes: 8040 32253

Like I said before, Netiv, you are just posturing.
You wouldn't have changed that if I was so very wrong.

>
> Besides, your trolling contributes nothing constructive to the discussion and

I'm not so sure about that when you obviously changed something in RESQDISK.

> all it does is

Warn everyone that uses your software that there is a risk in doing so
since you are such a sloppy programmer that uses unsuspecting users to
do your testing for you.

> to mislead and confuse.

Of which you obviously know all about with your little anecdotes, Netiv.

Pot kettle black.

>
> Regards, Zvi
Anonymous
a b G Storage
May 31, 2005 11:51:35 AM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I was away for a couple days. Sorry for the delay. I will complete
your instructions later today. Thanks Zvi.

Regards Gregg

Zvi Netiv wrote:
> "Gregg OBanion" <gobanion@msn.com> wrote:
>
>> Hello Zvi. Your information was very encouraging. I hope It works
>> but before I try let me give you some more information that may
>> be
>> important. I'm sorry I didn't mention it earlier.
>>
>> The 4 disk array (with the malfunctioning drive) was migrated
>> from a
>> Windows 2000 Pro Server machine and a Promise Ultra 133 PCI card.
>> Remember the array is now on WinXP SP2 with a Promise Ultra 100
>> PCI
>> card. I meant to tell you this long ago. I hope it doesn't
>> present a
>> problem. I will wait to hear from you before I follow your
>> instructions below.
>
> [snip]
>
>> I have now disconnected the CD Rom on Secondary IDE and ran
>> ResQdisk
>> again. Here's the Report
>
> ResQdisk reports INT-13 devices, from 80h and up (BIOS notation),
> i.e. only HARD drives. I didn't make it clear, since I thought it
> was obvious.

How on earth do you read all that information from that little
report? I just don't see it. Amazing! If you have time would you
break it down for me so I have a clue? Where can I go to learn more
about hard drives?

>
> The new report from May 29 still shows the presence of additional
> HARD drives connected in that PC. You should leave the CD
> drive(s)
> connected, how else will you boot the CD repair console?

This I don't understand. There is only a floppy connected now and I
will reconnect the CD Rom as Secondary IDE, Master. Nothing Else is
connected. The network is connected still to the Router but ResQ
wouldn't detect that would it?

>
> The installed Windows version is irrelevant, as there should be no
> "installed" system at the time you run FIXBOOT. You should be
> working with a single HARD drive connected and boot of a W2K or XP
> setup CD. Either have FIXBOOT as part of their "repair console",
> and
> you may use the one or the other.
>
> Regards, Zvi
Anonymous
a b G Storage
June 1, 2005 7:01:43 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Gregg OBanion" <gobanion@msn.com> wrote:

> FIXBOOT Restored the drive although I'm missing most files I was
> hoping to regain.

Regaining access to the drive by restoring the boot sector confirms my
assessment as to what caused to lose it. Apparently, the boot sector wasn't the
only element that got damaged.

> It imeadiatly ran chkdisk on system start. Chkdisk said: Deleting
> orphan file record segment, up to about 60,000 + files. Then it said
> verifying Indexes, then Inserting index entry, Replacing invalid
> security ID, Inserting data attribute and correcting errors in boot
> file. I missed some of them. I wonder if I should have stopped check
> disk?

You shouldn't have let CHKDSK to start in the first place, by pressing a key
during the countdown before it started! You ran a long way to stumble just
before the finish line.

Chkdsk in XP's startup runs in auto repair mode and it doesn't let the user
decide to not repair its findings. It's possible that many of your files could
be copied of the drive if you didn't let Chkdsk to "fix" the file system.

> Remember the problem happened when I renamed the Drive and at the
> same time I was transfering a folder containing all my JPG images.
> That folder is gone.
>
> The Drive also Retained it's Drive letter (F) and I notice that the
> Drive name change took affect. It now has a new name I choose.
>
> It's funny that the one folder I had not yet transfered from the
> drive remained intact. Although the top folder in the hierarchy
> seemed to be renamed, (dir0000.chk) etc...the folders inside it
> retained their complete folder names as well as file names but
> folders were missing within thoose folders.

The dir0000x notation are the doing of Chkdsk.

> Whats my next step? Data recovery software. What is the best?

Right now, except professional data recovery (expensive), you could try the data
recovery packages that you already purchased. Having regained access to the
drive should facilitate the process.

If what you are after is mostly JPGs, then here is a link to the program that
Robert Green wrote to recover JPG after having been hit by the LoveLetter worm
(the problem you face is similar). http://www.claymania.com/zefrjpg.html

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
June 1, 2005 7:37:01 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Zvi, I want to thank you very much. It looks like I did drop the
ball at the finish line. I knew I shouldnt haver let CHKDisk run. It
started in the blink of an I and was well into running before I
realized the mistake so I just let it finish. I'll bet you if
Chkdisk hadn't run I would have recovered those files.

I'll post back here to let you know how the link you gave me below
works. If that doesn't work I'll try recovery software.

Zvi Netiv wrote:
> "Gregg OBanion" <gobanion@msn.com> wrote:
>
>> FIXBOOT Restored the drive although I'm missing most files I was
>> hoping to regain.
>
> Regaining access to the drive by restoring the boot sector
> confirms my
> assessment as to what caused to lose it. Apparently, the boot
> sector
> wasn't the only element that got damaged.
>
>> It imeadiatly ran chkdisk on system start. Chkdisk said: Deleting
>> orphan file record segment, up to about 60,000 + files. Then it
>> said
>> verifying Indexes, then Inserting index entry, Replacing invalid
>> security ID, Inserting data attribute and correcting errors in
>> boot
>> file. I missed some of them. I wonder if I should have stopped
>> check
>> disk?
>
> You shouldn't have let CHKDSK to start in the first place, by
> pressing a key during the countdown before it started! You ran a
> long way to stumble just before the finish line.
>
> Chkdsk in XP's startup runs in auto repair mode and it doesn't let
> the user decide to not repair its findings. It's possible that
> many
> of your files could be copied of the drive if you didn't let
> Chkdsk
> to "fix" the file system.
>
>> Remember the problem happened when I renamed the Drive and at the
>> same time I was transfering a folder containing all my JPG
>> images.
>> That folder is gone.
>>
>> The Drive also Retained it's Drive letter (F) and I notice that
>> the
>> Drive name change took affect. It now has a new name I choose.
>>
>> It's funny that the one folder I had not yet transfered from the
>> drive remained intact. Although the top folder in the hierarchy
>> seemed to be renamed, (dir0000.chk) etc...the folders inside it
>> retained their complete folder names as well as file names but
>> folders were missing within thoose folders.
>
> The dir0000x notation are the doing of Chkdsk.
>
>> Whats my next step? Data recovery software. What is the best?
>
> Right now, except professional data recovery (expensive), you
> could
> try the data recovery packages that you already purchased. Having
> regained access to the drive should facilitate the process.
>
> If what you are after is mostly JPGs, then here is a link to the
> program that Robert Green wrote to recover JPG after having been
> hit
> by the LoveLetter worm (the problem you face is similar).
> http://www.claymania.com/zefrjpg.html
>
> Regards, Zvi
Anonymous
a b G Storage
June 6, 2005 1:11:20 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Folkert Rienstra" <see_reply-to@myweb.nl> wrote:

[snip]

> Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselfs.
> Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
> http://www.t13.org/project/d1484r3.pdf, page 13, 14.
>
> And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
> Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
> http://www.t13.org/project/d1410r0a.pdf

Blah, blah, blah ...

In case you haven't noticed, this thread ended when I resolved what caused the
partition to disappear. To which you contributed absolutely nothing.
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Anonymous
a b G Storage
June 18, 2005 1:02:47 PM

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Zvi Netiv" <support@replace_with_domain.com> wrote in message news:8ap7a1l6jm3qmrj81lajje04lue69q32qr@4ax.com
> "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
>
> [snip]
[unsnip]
> > >
> > > > * BIOS/CHS IDE/LBA data *
> > > > * Number of Heads: 255 16 *
> > > > * Number of Cylinders: 1024 266305 *
> > > > * Sectors per Track: 63 63 *
> > > > * Disk Capacity in Mbytes: 8032 131071 *
> >
> > > Oh look, the 'Number of Cylinders' line has been corrected although there was nothing
> > > (supposedly) wrong with it. Yet Resqdisk version is still v576. Naughty, naughty.
> >
> > Introductory context restored. Typical how people like Netiv always have to snip that to
> > make themselves believable, the sure sign that such person obviously has something to hide.
> >
> > > > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
> > > > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
> > > > heads used- for drives bigger than or equal to 8GB.
> > > > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.
> >
> > > > The information flag of Int 13-AH=48h will say:
> > > > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
> > (Or in the words of EDD-2: The geometry returned in bytes 4-15 shall be valid)
> >
> > >
> > > Clueless.
> >
> > Your deliberate snipping of the quoted error tells it all Netiv.
> > You are just posturing.
> > You are the 'clueless' one that obviously didn't check Int 13-AH=48h's
> > information buffer result of the word at offset 2, bit one, for the validity
> > of the geometry as returned in bytes 4-15: Number of default cylinders,
> > Number of default heads and Number of default sectors.
> >
> >
> > > Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselves.
> > > Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
> > > http://www.t13.org/project/d1484r3.pdf, page 13, 14.
> > >
> > > And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
> > > Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
> > > http://www.t13.org/project/d1410r0a.pdf
> >
> Blah, blah, blah ...

Yup, what else can one say if one's nose is rubbed in the facts.

>
> In case you haven't noticed, this thread ended when I resolved what caused the
> partition to disappear.

Even a broken clock is right on time twice a day, every day of
the year, year in, year out, Doesn't mean it's actually running.

> To which you contributed absolutely nothing.

So what, didn't make the errors in your report any less wrong.
Or the risk one takes running your apps when you can't get your facts right.
!