Solved

Corrupt disk ?????????????

Posted on 1998-09-22
15
358 Views
Last Modified: 2013-12-28
hardware configuration:
NT 4.0 server(service pack3), 4G+4G(physical hard disk)
logical partition(2G-C drive,NTFS,boot partition), 2G+4G(volume set,D drive,NTFS))
problem: because unknown user's hacking, my system is corrupt,so I reinstall NT, but volume set is broken,
so I restore volume set using FTedit utility(NT resourceKit)
but hard disk(D drive,volume set) not accessed!!!!!
NT disk Administror is not recognized file system and showed "unknown"!!!!!!!
I'm very crazy(not backup)-this data is very very important, so I don't know well
hhhhhhhhhh,please tell me how to solve problem??????
0
Comment
Question by:k1024
15 Comments
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792900
Hi :)

The operating system has information about which disks are members of volumes, but it cannot distinguish between a stripe set, a stripe set with parity, a volume set, or a mirror set without the Registry information. In this situation, when the volumes are displayed in Disk Administrator, the file system might be displayed as Unknown, and there will be no drive letter assigned to the volumes. This is to prevent writing to the volume, which could corrupt it.

When using FTEdit to rebuild the DISK Registry subkey, you need to know the order in which the unused areas on the disks were combined to create the volume. The following scenario shows why order is important.

A previous user created a volume set by combining unpartitioned areas on three disks in this order:
2 MB on disk 2
3 MB on disk 0
4 MB on disk 1
 
When someone creates a volume set, the Partition Boot Sector is the first sector on the first area selected. Data are written to the areas in the order in which they are combined. Thus, if someone created a 6 MB file on this volume set, the file would occupy the following areas:
2 MB on disk 2
3 MB on disk 0
1 MB on disk 1
 
Now you need to use FTEdit to rebuild the volume set. You select the disks in the order disk 0, disk 1, and then disk 2. Windows NT will not be able to find the Partition Boot Sector for the volume set, because the first sector of the volume set that you rebuilt is on disk 0, which contains only data. The Partition Boot Sector is actually on disk 2, but that disk area is at the end of the volume set you created. Your attempt to rebuild the volume set has failed, because you did not know the order in which to combine the disk areas.

With the help of above example. Now only thing left with u is to use the ftedit and choose the correct order in which u have created the volume set in the first place.

Hope this clears the mystry and have your volume set back to u if u have not already messed it up :(
0
 

Author Comment

by:k1024
ID: 1792901
I attempt rebuilding volume set(previous-4G+2G,now-2G+4G), but same error is occurr!!!
this is registry subkey value(HKEY_LOCAL_MACHINE\System\Disk)
Å° À̸§:          SYSTEM\DISK
Ŭ·¡½º À̸§:Disk and fault tolerance information.
¸¶Áö¸· ¾´ ½Ã°£:98-09-23 - ¿ÀÈÄ 6:09
°ª0
  À̸§:            <À̸§ ¾øÀ½>
  Çü½Ä:            REG_SZ
  µ¥ÀÌÅÍ:            
 
°ª1
  À̸§:            Information
  Çü½Ä:            REG_BINARY
  µ¥ÀÌÅÍ:            
00000000   03 00 00 00 00 00 00 00 - 00 00 00 00 2c 00 00 00  ............,...
00000010   b0 00 00 00 dc 00 00 00 - 30 00 00 00 00 00 00 00  ........0.......
00000020   01 00 00 00 00 00 00 00 - 00 00 00 00 02 00 00 00  ................
00000030   02 00 00 00 ac 6a 35 a0 - 04 00 00 00 00 00 00 00  .....j5.........
00000040   00 7e 00 00 00 00 00 00 - 00 9a 63 83 00 00 00 00  .~........c.....
00000050   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000060   43 01 01 00 ff ff 00 00 - 01 00 00 00 03 00 00 00  C...............
00000070   00 00 00 00 00 18 64 83 - 00 00 00 00 00 ba b9 8b  ......d.........
00000080   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000090   00 00 00 00 45 01 02 00 - 00 00 01 00 01 00 00 00  ....E...........
000000a0   01 00 00 00 87 51 98 5d - 03 00 00 00 00 00 00 00  .....Q.]........
000000b0   00 7e 00 00 00 00 00 00 - 00 54 1d 0f 01 00 00 00  .~.......T......
000000c0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000d0   45 01 01 00 00 00 00 00 - 01 00 00 00 01 00 14 00  E...............
000000e0   02 00 03 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000f0   87 51 98 5d a8 00 00 00 - 01 00 00 00 00 00 14 00  .Q.]............
00000100   ac 6a 35 a0 6c 00 00 00 - 02 00 00 00              .j5.l.......
 
 

0
 

Author Comment

by:k1024
ID: 1792902
original data key value:
Å° À̸§:          SYSTEM\OLDDISK1
Ŭ·¡½º À̸§:
¸¶Áö¸· ¾´ ½Ã°£:98-09-22 - ¿ÀÈÄ 2:55
°ª0
  À̸§:            Information
  Çü½Ä:            REG_BINARY
  µ¥ÀÌÅÍ:            
00000000   03 00 00 00 00 00 00 00 - 00 00 00 00 2c 00 00 00  ............,...
00000010   b0 00 00 00 dc 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000020   01 00 00 00 00 00 00 00 - 00 00 00 00 02 00 00 00  ................
00000030   02 00 00 00 ac 6a 35 a0 - 04 00 00 00 00 00 00 00  .....j5.........
00000040   00 7e 00 00 00 00 00 00 - 00 9a 63 83 00 00 00 00  .~........c.....
00000050   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000060   43 01 01 00 ff ff 00 00 - 01 00 00 00 04 00 00 00  C...............
00000070   00 00 00 00 00 18 64 83 - 00 00 00 00 00 ba b9 8b  ......d.........
00000080   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000090   00 00 00 00 47 01 02 00 - ff ff 00 00 01 00 00 00  ....G...........
000000a0   01 00 00 00 87 51 98 5d - 04 00 00 00 00 00 00 00  .....Q.]........
000000b0   00 7e 00 00 00 00 00 00 - 00 54 1d 0f 01 00 00 00  .~.......T......
000000c0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
000000d0   46 01 01 00 ff ff 00 00 - 01 00 00 00              F...........
 
0
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792903
Hi :)

No u cannot do this i think u have not read my answer properly and followed the example.

If your orignal was 4+2 new one should be also 4+2 not 2+4 because 4 has your boot record information and 2 has data.

By doing 2+4 NT is not able to find the boot info.
0
 

Author Comment

by:k1024
ID: 1792904
original was 2+4, and so I changed properly order...
if not, by doing 4+2 NT is corrupt??? why???
0
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792905
Hi :)

Again i will say read my answer carefully and u will know why.

When NT makes volume set the first part u choose it creates a boot info on that part and then links or the other as u choose them.

So let say u creat a volume set in the following order

2MB disk 2
5MB disk 1

Now NT will treat the disk 2 partion as the root of your volume set and will write boot info their that how much space and all the link info and thing likes that.

so when u save file to it, it will start from disk2 first and then move on to disk1 if the space on disk2 is full.

Now if u remake the voulme info back again after crash and u link the volume set wrong. Ley say u tell NT that disk 1 was the boot disk and disk 2 came after.

Now when NT tries to locate the boot info it will not find any because disk1 contains only data while the boot info was on disk2. Still if u go ahead and assigned letter to it and force d NT to use this new configuration in this case NT will recreate the boot info on disk1 and will add disk2 after it, overwriting all other previous info.

Let say if u have not forced NT to use the new setting which was wrong then i will advise that u rebuild the info back again but this time in correct order. If nothing is overwritten u should get your volume set back.
0
 

Author Comment

by:k1024
ID: 1792906
I rebuild volume set using FTEdit utility..
and tell me How to recognize NT that boot disk info is what?
I'm sorry,please tell me  how to solve method step by step
concretely...
(NT is C drive(2G),volume set drive(2G+4G,E drive),NT booting is available,only volume set drive is not recognize on NT)

0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792907
Hi :)

If u remeber correctly which parition was the first one in your volume set only then NT can recongnise the boot info.

Do one thing since u have created the info previously wrong. Delete the entry from the registry key [(HKEY_LOCAL_MACHINE\System\Disk] and then using the ftedit utility re-create the volume set information again by providing the correct order of your orignal volume set.
0
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792908
Hi :)

If u have not damaged your volume set then follow the following instruction. (U know it is very difficult to tell someone how to do such things, which involve interaction over here now i am just using my imagination that how the screen would look like to u)

-run ftedit.

-The Disks group box identifies all of the disks connected to the computer. The Partitions group box contains information about the disk currently selected, or the first disk, if none are selected. Disk 0 is 4 gigabytes, and contains two partitions. 2 gig each (This i gather from the info u stated). Similary if u click on Disk 1, it will show one partion of 4 gig.

-On the Edit menu, click Create FT Set. In the FT Set Type dialog box, click Volume Set.

-In the Disks list box, select the first disk that will be a member of the volume. Available partitions are displayed in the Partitions list box on the right. Since u said that your volume set started from disk 0 with the second 2 gig partiotion and contains the full 4 gig partition of disk1. Doulbe click the partiotions one after another by choosing the 2 partition    of disk 0 by double clicking on it, and then choosing the disk 1 and double clicking the partition. After this operation the disk and partition information will be displayed in the list box on the lower right.

-Click the Save FT Set button. The information is transferred to the FT Set Member Information list box. Check to make sure the information is correct. The disks that are used in creating the new volume are those listed in the FT Set Member Information list boxes.

-On the Edit menu, click Save Changes to System. This point u will be shown a message box saying that information is save successfully and old information is saved in oldisk key.

-Exit FTEdit, close any open programs, and restart the system. You need to do this to get the new information loaded into the Registry.

-After reboot open Disk Administrator. from the Disk Administrator Tools menu, click Drive Letter. In the Assign Drive Letter dialog box, click Assign drive letter, and then choose a drive letter for the volume. If u have not dammaged the volume set before then it should be all ok now and after assiging the drive letter it will be available to use.

I hope u do get your volume set back. And if u do get it back do an export of the Disk key and keep it save so in the event of failure all u have to do is import the registry.
0
 

Expert Comment

by:PsychoEffer
ID: 1792909
Learn fault tolerance.
0
 

Author Comment

by:k1024
ID: 1792910
I eventually formatted volume set partition.......
0
 
LVL 1

Expert Comment

by:jordy
ID: 1792911
Why don't you use software to duplate your disk (such as Ghost)
just shoot a image of the disk . reinstall nt, fix your volumes and then place the image back.

0
 

Author Comment

by:k1024
ID: 1792912
I don't know well duplate disk,what do you mean shooting  a image of the disk?
0
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1792913
Hi :)

Shall i post one of my comments as answer to close this question. I did give u all the right information. But unfortunately u have already corrupted your volume set by recreating them in wrong order and for which u had to format them.
0
 
LVL 5

Accepted Solution

by:
Mujeeb082598 earned 150 total points
ID: 1792914
Hi :)

Check the comments for the prcedures. This is for any one who is coming to see the answer for this post.

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Recently Microsoft released a brand new function called CONCAT. It's supposed to replace its predecessor CONCATENATE. But how does it work? And what's new? In this article, we take a closer look at all of this - we even included an exercise file for…
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now