File lost to NTFS / CHKDSK... Can it be retrieved?

I had made a very important backup of another hard drive that was about to go bad (failed the self-test and would not allow a boot up, was still able to access it when installed as slave). The backup was made using the Windows XP backup utility, made to a file, about 4 GB in size, on my desktop. The file was named "Backup.bkf". After the backup, a few things later required the system be restarted. On restart, Windows XP informed me that my hard drive needed to be checked for consistency. Not knowing exactly what might be wrong, I foolishly allowed the disk check to proceed. Among other things, CHKDSK reported such things as:
Attribute record of type 0x80 and instance tag 0x4 is cross linked starting at 0xc5714 for possibly 0x1 clusters.
(above repeated once more)

Some clusters occupied by attribute of type 0x80 and instance tag 0x4 in file 0x6b0 is already in use.
Deleting corrupt attribute record (128, "")

These errors showed up multiple times for many different records in the file-system, each with the first message repeated twice, followed by the message about "some clusters occupied..." and "deleting corrupt attribute record..."

After getting back into Windows, the backup file was missing.

Any chance of getting it back, or is that a pipe dream? The other drive cannot be backed-up again, sadly, and the info was important.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I wanna say something bad about Microsoft Backup utilities, and diags like checkdisk. But this looks like different problem.

Sadly, you probably cannot restore that file. While there are recovery programs, they can only succeed when original sectors are not rewritten, and it is quite likely some freed ones would have been reused by now, and it is even more likely that none were freed in first place. "is already in use" - when two or more files each thing that they get to use same sector, at least one of them loses. So the program removed access to sector(s) from one file, and the other gets to keep it. This is called cross linked.

What may have really happened here, is that the bad sectors were not for your file, but for the file_system, which has the indexes for finding all files. If so, then the original file is there, and for some reason checkdisk did not re-create it. But just in case, look for *.chk files. Possibly in root of c:\, but search all drive anyway, you might find the file(s). If no .chk, there are, as said above, a number of recovery tools that 'may' work. But it looks like something, since the backup was made, has been writing over sectors that are owned by other files. Not good situation.

Answer: Your system is dying, IMO. I think you got lemon HD's and you are about to lose it all. So I recommend getting new HDs from reliable manufacturer. At least they are cheaper and larger and faster these days than whatever you are using.

> Any chance of getting it back, or is that a

While I mentioned some recovery options above, I am more pessimistic on that, than, getting the files off the original drive. The dead drive. Define dead. Won't work 90% of time?  Then, how about rebooting for it 10 times, to get even odds of finding the files? Is it worth 20 or 30 more reboots?

I am thinking the HD had just crossed over a tolerance, that it did not just burn up or lose heads or freeze. So I consider it possible, that if you try it in a couple other machines, that one might still accept it as within some level of tolerance, for sufficient time for your to pull off the files. Sorry,

Answer 2: look for files on original HD. Try harder.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
LucFEMEA Server EngineerCommented:
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Points to SunBow

Please leave any comments here within the next seven days.


EE Cleanup Volunteer
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.