hossam102999
asked on
restoring a corrupt ntfs partition
++++++++++++++++++++++++++
System:
Operating System -- WINNT
Version -- WKST 4.0 (sp5)
Computer Make -- Fujitsu
Computer Model -- Lifebook 635T
Memory (Mb of RAM) -- 48
CPU Type -- I586
CPU Speed (MHz) -- 133
My NTFS partition became corrupted and I have searched for applications that can restore data from an unbootable partition (no backups available).
Disk Administrator now shows that on Disk 0 (1295M) I have two partitions:
1)- File type unknown, 1038M
2)- FAT, 258M
Using Partition Magic, it shows that partition 1 is actually formatted as HPFS?! How did this happen, at no time during this entire ordeal did I refomat the orig. NTFS partition as HPFS.
Partition Magic returns the error code when I ask for information on that "HPFS" partition: Error 1041.
From the Partition Magic Tech support page, I have provided the following information:
(http://www.powerquest.com/support/ER/er0000.html)
=====
Error #1041
Document: #er1041.html
Email:
Date Created: August 17, 1998
Date Modified: August 17, 1998
Product: PartitionMagic
Versions: All
Description: The error 1041- SuperBlk.ulSectsOnVol> Bs.bsHugeSects only occurs on HPFS partitions. Basically it indicates that the number of sectors reported in the SuperBlock disagrees with the number of sectors on thepartition. In simple terms it denotes an invalid volume size.
Solution: In most cases the data on the affected partition will have to be backed up, and the partition deleted and recreated.
Additional Information: The SuperBlock is comprised of a single sector situated at Logical Sector Number 16. Most of the data stored in this sector never changes. Important information is stored here such as the location of the Root Directory FNode, location of the Directory Band and where to find the sector listing the partition's disk-usage bitmap sectors. Information that can change includes the last time chkdsk /f was run on the partition, the last time an optimization operation was performed and the number of bad sectors.
=========
From the Microsoft KB, I found this information:
(http://support.microsoft.com/support/kb/ARTICLES/Q100/1/08.asp)
Super Block
The Super Block is located in logical sector 16 and contains a pointer to the FNODE of the root directory. One of the biggest dangers of using HPFS is that if the Super Block is lost or corrupted due to a bad sector, so are the contents of the partition, even if the rest of the drive is fine. It would be possible to recover the data on the drive by copying everything to another drive with a good sector 16 and rebuilding the Super Block. However, this is a very complex task.
(from setup.txt on winnt cd)
HPFS File Systems
==========================
Windows NT version 4.0 does not support the OS/2 File System (HPFS). You cannot access disks that are formatted with HPFS from Windows NT version 4.0. If you have a previous version of Windows NT installed on a disk formatted with HPFS, Setup cannot upgrade it to Windows NT version 4.0.
You can use the Convert.exe program supplied with previous versions of
Windows NT to convert disks formatted with HPFS to the Windows NT File
System (NTFS). Windows NT version 4.0 Convert.exe does not provide this
capability. Do not convert any disks you need to access when using other operating systems such as OS/2.
Note:
Convert.exe can convert only HPFS version 1.x drives smaller than 4
gigabytes (GB). It fails on HPFS 2.x drives (those HPFS drives larger than 4 GB).
========
Before I go searching for a machine running NT 3.51 or OS/2 and copying all my information to that drive, what can you tell me?
If I do end up loading all my information onto another drive, can you provide me with information on how to do this, since it is a 'very complex task'? Am I better off working with NT3.51 or OS/2 if I am going to try and convert and get as much data back as possible?
So far, I've come across OnTrack's Easy Recovery program.
I have also found some utils on www.sysinternals.com that look promising but I want to get some feedback before I attempt to use them.
Are there other programs that will also do the same thing? Do you have any recommendations as to which are the best and why?
In terms of competence level, I am an NT administrator, so a complex technical procedure wouldn't deter me as long as it was clearly documented -- I'm just looking for an application to work with.
Any information you can provide is greatly appreciated.
Thanks,
Hossam
(if you need any information from my system, please let me know)
System:
Operating System -- WINNT
Version -- WKST 4.0 (sp5)
Computer Make -- Fujitsu
Computer Model -- Lifebook 635T
Memory (Mb of RAM) -- 48
CPU Type -- I586
CPU Speed (MHz) -- 133
My NTFS partition became corrupted and I have searched for applications that can restore data from an unbootable partition (no backups available).
Disk Administrator now shows that on Disk 0 (1295M) I have two partitions:
1)- File type unknown, 1038M
2)- FAT, 258M
Using Partition Magic, it shows that partition 1 is actually formatted as HPFS?! How did this happen, at no time during this entire ordeal did I refomat the orig. NTFS partition as HPFS.
Partition Magic returns the error code when I ask for information on that "HPFS" partition: Error 1041.
From the Partition Magic Tech support page, I have provided the following information:
(http://www.powerquest.com/support/ER/er0000.html)
=====
Error #1041
Document: #er1041.html
Email:
Date Created: August 17, 1998
Date Modified: August 17, 1998
Product: PartitionMagic
Versions: All
Description: The error 1041- SuperBlk.ulSectsOnVol> Bs.bsHugeSects only occurs on HPFS partitions. Basically it indicates that the number of sectors reported in the SuperBlock disagrees with the number of sectors on thepartition. In simple terms it denotes an invalid volume size.
Solution: In most cases the data on the affected partition will have to be backed up, and the partition deleted and recreated.
Additional Information: The SuperBlock is comprised of a single sector situated at Logical Sector Number 16. Most of the data stored in this sector never changes. Important information is stored here such as the location of the Root Directory FNode, location of the Directory Band and where to find the sector listing the partition's disk-usage bitmap sectors. Information that can change includes the last time chkdsk /f was run on the partition, the last time an optimization operation was performed and the number of bad sectors.
=========
From the Microsoft KB, I found this information:
(http://support.microsoft.com/support/kb/ARTICLES/Q100/1/08.asp)
Super Block
The Super Block is located in logical sector 16 and contains a pointer to the FNODE of the root directory. One of the biggest dangers of using HPFS is that if the Super Block is lost or corrupted due to a bad sector, so are the contents of the partition, even if the rest of the drive is fine. It would be possible to recover the data on the drive by copying everything to another drive with a good sector 16 and rebuilding the Super Block. However, this is a very complex task.
(from setup.txt on winnt cd)
HPFS File Systems
==========================
Windows NT version 4.0 does not support the OS/2 File System (HPFS). You cannot access disks that are formatted with HPFS from Windows NT version 4.0. If you have a previous version of Windows NT installed on a disk formatted with HPFS, Setup cannot upgrade it to Windows NT version 4.0.
You can use the Convert.exe program supplied with previous versions of
Windows NT to convert disks formatted with HPFS to the Windows NT File
System (NTFS). Windows NT version 4.0 Convert.exe does not provide this
capability. Do not convert any disks you need to access when using other operating systems such as OS/2.
Note:
Convert.exe can convert only HPFS version 1.x drives smaller than 4
gigabytes (GB). It fails on HPFS 2.x drives (those HPFS drives larger than 4 GB).
========
Before I go searching for a machine running NT 3.51 or OS/2 and copying all my information to that drive, what can you tell me?
If I do end up loading all my information onto another drive, can you provide me with information on how to do this, since it is a 'very complex task'? Am I better off working with NT3.51 or OS/2 if I am going to try and convert and get as much data back as possible?
So far, I've come across OnTrack's Easy Recovery program.
I have also found some utils on www.sysinternals.com that look promising but I want to get some feedback before I attempt to use them.
Are there other programs that will also do the same thing? Do you have any recommendations as to which are the best and why?
In terms of competence level, I am an NT administrator, so a complex technical procedure wouldn't deter me as long as it was clearly documented -- I'm just looking for an application to work with.
Any information you can provide is greatly appreciated.
Thanks,
Hossam
(if you need any information from my system, please let me know)
Have you tried accessing the data by booting to a floppy and using something like ntfsdos ?
Partition Magic picks up NTFS as HPFS.
It happens to me too !
What you could try is taking the disk out, and hanging it off as slave to a primary disk that already has NTFS running on it.
Then boot up - NTFS will do what it can to repair the partition. It won't need the boot sector as it's used the one from your primary, so this should get around the corruption you've described.
It happens to me too !
What you could try is taking the disk out, and hanging it off as slave to a primary disk that already has NTFS running on it.
Then boot up - NTFS will do what it can to repair the partition. It won't need the boot sector as it's used the one from your primary, so this should get around the corruption you've described.
Both NTFS and HPFS have a 07 entry in the partition table.
PartitionMagic, when it encounters a partition of type 07, will check the bootsector of the partition to determine if it is a NTFS or HPFS partition.
When it identifies a NTFS being HPFS this points to a corrupted bootsector.
There is ofcourse something like minor corruption and major corruption. maybe it is just a corrpted signature.
Let us have a look at the bootsector;
Update to PM4.01 and then run a partinfo. Post the results here, maybe there's something that can be done.
Joep
PartitionMagic, when it encounters a partition of type 07, will check the bootsector of the partition to determine if it is a NTFS or HPFS partition.
When it identifies a NTFS being HPFS this points to a corrupted bootsector.
There is ofcourse something like minor corruption and major corruption. maybe it is just a corrpted signature.
Let us have a look at the bootsector;
Update to PM4.01 and then run a partinfo. Post the results here, maybe there's something that can be done.
Joep
I'm pretty sure Symantec has an NT tool that will repair partitions. They usually come with a bootable floppy.
ASKER
Hey jvsteen...
here is the info from my system...
i managed to get my system up and running again, but i am getting errors
#110
and #255 and #986 when i try to run pmagic.
i read about the erros and as i am sure you know, there is an inconsistency b/w the numbers of sectors reported by ntfs and dos.
i am assuming i can use ptedit to fix this?
if you could please reply and tell me how i can get the number of sectors to agree i would appreciate it.
thanks,
hossam
PowerQuest PartitionInfo 2.0 -- Windows 95 Version
Date Generated: 11/02/99 16:22:21
Copyright (c)1994-1998, PowerQuest Corporation
Permission is granted for this utility to be freely copied so long
as it is not modified in any way. All other rights are reserved.
General System Information:
Total Physical Memory (bytes): 49,729,536
Used Physical Memory: (bytes): 44,343,296
Maximum Page File Size: (bytes): 80,621,568
Current Page File Size: (bytes): 54,349,824
==========================
Disk Geometry Information for Disk 1: 658 Cylinders, 64 Heads, 63 Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect NumSects
==========================
0 1 80 154 0 1 07 656 63 63 620,928 2,032,128
Error #110: Number of sectors in partition is inconsistent.
ucSectors = 2032128
end - begin = 2028096
==========================
Partition Information for Disk 1: 1295.4 Megabytes
Volume PartType Status Size MB PartSect # StartSect TotalSects UsedSects FreeSects
==========================
Free Space Pri 303.2 None -- 63 620,865 0 620,865
C:khayr NTFS Pri,Boot 992.3 0 1 620,928 2,032,128 505,527 1,526,601
==========================
Boot Record for drive C: (Drive: 1, Starting Sector: 620928, Type: NTFS)
==========================
1. Jump: EB 5B 90
2. OEM Name: NTFS
3. Bytes per Sector: 512
4. Sectors per Cluster: 1
5. Reserved Sectors: 0
6. Number of FATs: 0
7. Root Dir Entries: 0
8. Total Sectors: 0
9. Media Descriptor: 0xF8
10. Sectors per FAT: 0
11. Sectors per Track: 63 (0x3F)
12. Number of Heads: 64 (0x40)
13. Hidden Sectors: 620928 (0x97980)
14. Total Sectors (>32MB): 0 (0x0)
15. Unused: 0x80008000
16. Total NTFS Sectors: 2032127
17. MFT Start Cluster: 12659
18. MFT Mirror Start Clust: 917279
19. Clusters per FRS: 2
20. Clusters per Index Blk: 8
21. Serial Number: 0x7A5496C654968493
22. Checksum: 0 (0x0)
23. Boot Signature: 0xAA55
here is the info from my system...
i managed to get my system up and running again, but i am getting errors
#110
and #255 and #986 when i try to run pmagic.
i read about the erros and as i am sure you know, there is an inconsistency b/w the numbers of sectors reported by ntfs and dos.
i am assuming i can use ptedit to fix this?
if you could please reply and tell me how i can get the number of sectors to agree i would appreciate it.
thanks,
hossam
PowerQuest PartitionInfo 2.0 -- Windows 95 Version
Date Generated: 11/02/99 16:22:21
Copyright (c)1994-1998, PowerQuest Corporation
Permission is granted for this utility to be freely copied so long
as it is not modified in any way. All other rights are reserved.
General System Information:
Total Physical Memory (bytes): 49,729,536
Used Physical Memory: (bytes): 44,343,296
Maximum Page File Size: (bytes): 80,621,568
Current Page File Size: (bytes): 54,349,824
==========================
Disk Geometry Information for Disk 1: 658 Cylinders, 64 Heads, 63 Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect NumSects
==========================
0 1 80 154 0 1 07 656 63 63 620,928 2,032,128
Error #110: Number of sectors in partition is inconsistent.
ucSectors = 2032128
end - begin = 2028096
==========================
Partition Information for Disk 1: 1295.4 Megabytes
Volume PartType Status Size MB PartSect # StartSect TotalSects UsedSects FreeSects
==========================
Free Space Pri 303.2 None -- 63 620,865 0 620,865
C:khayr NTFS Pri,Boot 992.3 0 1 620,928 2,032,128 505,527 1,526,601
==========================
Boot Record for drive C: (Drive: 1, Starting Sector: 620928, Type: NTFS)
==========================
1. Jump: EB 5B 90
2. OEM Name: NTFS
3. Bytes per Sector: 512
4. Sectors per Cluster: 1
5. Reserved Sectors: 0
6. Number of FATs: 0
7. Root Dir Entries: 0
8. Total Sectors: 0
9. Media Descriptor: 0xF8
10. Sectors per FAT: 0
11. Sectors per Track: 63 (0x3F)
12. Number of Heads: 64 (0x40)
13. Hidden Sectors: 620928 (0x97980)
14. Total Sectors (>32MB): 0 (0x0)
15. Unused: 0x80008000
16. Total NTFS Sectors: 2032127
17. MFT Start Cluster: 12659
18. MFT Mirror Start Clust: 917279
19. Clusters per FRS: 2
20. Clusters per Index Blk: 8
21. Serial Number: 0x7A5496C654968493
22. Checksum: 0 (0x0)
23. Boot Signature: 0xAA55
Before you proceed, what version of PM are you using ?
Using it WITHOUT patches can DAMAGE your NTFS partitions.
Make sure you've got the latest patch (if using PM 4 or less).
Using it WITHOUT patches can DAMAGE your NTFS partitions.
Make sure you've got the latest patch (if using PM 4 or less).
ASKER
thanks tim, i'm running pm 4.01 (i just installed the patch the other day)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
goto www.diydatarecovery.sites.cc and do a search for NTFS