XP/NTFS disk rescue

[JohnnieBoy]

Can anyone help on my problem with a Seagate 500Gb EIDE/IATA HDD - with one NTFS partition? Forgive the following preamble, but it is probably relevant.

I was surfing the web when the screen went to all-over small coloured squares and colours swapping every second. There was no mouse or keyboard response, and I couldn’t see how to stop it, so I cut the power. Was it a virus or a disk crash?

I tried to reboot the PC, but after loading the bios, it went straight to the “squares” screen – wouldn’t go into windows safe mode to run malwares.... I tried to boot from my XP load/rescue CD, but it still went straight to squares (but I’m not sure the CD camer before the HDD in boot priority). Anyway I next disabled the HDD boot option in the bios, formatted a floppy disk as a boot disk on another XP machine and tried to boot from that. The PC booted OK into DOS, but wouldn’t access the NTFS drive. I found READNTFS.EXE, and could then (hooray) view the files still on C: - though it looked as if the MyDocuments folder had gone (I need to search better). There are still thousands of files to rescue, and I’ve got nowhere practically to copy them to (and I haven’t tried to find the DOS XCOPY command yet to copy whole directory structures).

I have however reformatted an old 10Gb HDD (FAT32) and loaded XP-SP3 (no online connections). Configuring this as the master drive and the 500Gb Seagate as slave, I can now boot into XP. The Seagate drive comes up as F: with my CD/DVD drives as D:&E:, but I still can’t access it from XP (even via the DOS emulator) – it says the disk is not formatted. Consequently, I cannot do a virus scan on it (is there a DOS based virus scanner?).

However, I can still access the Seagate drive if I boot into DOS (it’s D: as I’ve not defined the CD/DVD drives on the boot floppy). Yet I now also seem able to access the files in DOS, and READNTFS doesn’t recognise the drive as NTFS. How can this be?

I’ve copied a few files from D: to C:, but not yet looked at them to see it they make any sense – I’ve not yet sorted out a WORD on C:. However, has anyone got a better idea of how I can get to these thousands of files? Does it sound like a boot record problem? Would the XP rescue CD be able to help? In general I’m sceptical of using such procedures, they often seem to do more harm than good. I’d really like to find that MyDocuments folder – but it will be tedious hunting around using DOS.

Can anyone help?

 

[JohnnieBoy]

Can anyone help on specific questions?

Why does XP think this is now a FAT32 disk? It was NTFS before the incident.

If XP cannot access the disk (says it is not formatted) how come I can copy files off it using DOS from a DOS boot floppy? - and why do some of the files seem to have copied OK while others won't open? These were in NTFS, so how can a DOS COPY command access them. Initially after the incident I could only see the disk using READNTFS.

Partition Table Doctor cannot rebuild a boot record using Fixboot, so what should I try using to salvage the data files that DOS cannot see (or copies badly)? Those are mainly in the MyDocuments folder.

Note the disk had a huge number of photos(jpgs) in MyPictures - but I have those backed up elsewhere. Its the proper WORD documents I really hope to find - they were in subdirectories under MyDocuments.

Any explanation or help would be very welcome

 

[JohnnieBoy]

Thank you anonymous1 - however, I've never used Linux and I'm not sure now is the time to load it onto my PC and start learning!

I have now confirmed the disk is indeed FAT32. I am sure I originally (2 or so years ago) formated it as NTFS and I'm sure it showed as such on various disk info/property views. However, I also used seagate's mirror program to copy OS and files from my previous disk. Maybe that overwrote the original format, leaving some residual NTFS fields and the rest as FAT32.

I have been using HxD to investigate the disk as at a low level. The Partition Boot Sector has been overwritten (but not the copy) with the bytes 00 40 00 40, etc, as have the first 18 sectors of both FAT1 and FAT2. However, I’ve not yet found any damage to the root directory or the rest of the data sectors. I’ve also now understand how the FAT works.

Should I mend the Partition Boot Sector, and will that let me see the root directory from Windows? However, would that also let Chkdsk identify lots of missing chains and start writing things to the disk – like new file entries in the root directory? I’ve tried to turn Chkdsk off in the boot.ini, but I’m not sure I have succeeded.

Presumably, if I could access the relevant directory information, any file (cluster chain) that avoids the first 18 sectors of the FAT could be easily salvaged. Any file needing those FAT sectors would probably need manual rebuilding from lost chains.
Can anyone recommend a windows/dos package that might help in this?

Otherwise I might just have to try to write my own in FORTRAN! (I’m an old scientist). I used to directly access miscellaneous buffers on tapes on a mainframe many years ago, but how I’d open and read sectors from a disc that Windows can’t open currently escapes me!

Any advice?

 

[eliasalberto]

I have just had similar problem. Vista installed on NTFS partition crashed, had to force it to shutdown and things got nasty. Tried to run System Recovery from Vista installation disk, but it won't recognize the ntfs partition. Then I ran some kind of utility (hidden in my laptop's bios or in some of those hidden partitions by dell) which took very long replacing headers of all files, and then sysyem recovery was able to see the partition and list the files under that msdos prompt. After running system recovery this thing even tries to boot up, I am able to move the mouse over a black screen and the screen would even turn off for energy saving, but the system never finishes the boot.

I removed the HD from the laptop and tried to put it as external usb HDD in another dell laptop (running seven) and in an old WinXP desktop. WinXP happily recognizes the partition and browses its files, but windows seven won't even open the partition. Tried all kinds of recovery, but couldn't get anything else. Now I will copy all my files to another HDD and format this drive (and try installing Ubuntu Linux on it; i got tired of being stuck to M$).

I guess files got corrupted because of some hardware failure that's supposed to be natural. HDDs are not 100% trustworthy, afterall. My HDD is somewhat new, only 18 months old of regular use, and hasn't been abused.

So, this is my tip for you: boot from the windows installation disk, try to use the "boot files recovery" or whatever they call it, then run that MS-DOS windows from the CD and type "chkdsk /r". After that, hook your unit as external or slave to a pc running WinXP SP3 and you should be able to browse your files. Backup them, format your old drive, install fresh OS. And don't forget to keep copies of your important stuff on other HDDs, DVDs or in the internet (there are some cool free 'cloud' services which would sync your documents, so you'll only have to download again your media)

 

[JohnnieBoy]

Thanks EliasAlberto, and sorry if I've not been slow to respond.

I've got many other jobs to do, and the PC has dropped in priority. Using the old disk as C:. the wife can surf the web OK, and I could delay trying to rescue my files.

However, I have decided to get a new disk and try to copy all the sectors from my duff one onto it. Then I'll try "rescuing" the new disk. That way I should avoid losing access to such info as still remains on the old disk.

I'm not sure if HXD will do a sector by sector copy, but if not, I am sure I can find something that does.

Thanks

John

 

[JohnnieBoy]

Best answer selected by JohnnieBoy.