Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

File lost to NTFS / CHKDSK... Can it be retrieved?

Posted on 2003-02-18
3
Medium Priority
?
2,534 Views
Last Modified: 2009-12-16
I had made a very important backup of another hard drive that was about to go bad (failed the self-test and would not allow a boot up, was still able to access it when installed as slave). The backup was made using the Windows XP backup utility, made to a file, about 4 GB in size, on my desktop. The file was named "Backup.bkf". After the backup, a few things later required the system be restarted. On restart, Windows XP informed me that my hard drive needed to be checked for consistency. Not knowing exactly what might be wrong, I foolishly allowed the disk check to proceed. Among other things, CHKDSK reported such things as:
------------------------------------------------------
Attribute record of type 0x80 and instance tag 0x4 is cross linked starting at 0xc5714 for possibly 0x1 clusters.
(above repeated once more)

Some clusters occupied by attribute of type 0x80 and instance tag 0x4 in file 0x6b0 is already in use.
Deleting corrupt attribute record (128, "")
------------------------------------------------------

These errors showed up multiple times for many different records in the file-system, each with the first message repeated twice, followed by the message about "some clusters occupied..." and "deleting corrupt attribute record..."

After getting back into Windows, the backup file was missing.

Any chance of getting it back, or is that a pipe dream? The other drive cannot be backed-up again, sadly, and the info was important.
0
Comment
Question by:GuyPaddock
2 Comments
 
LVL 24

Accepted Solution

by:
SunBow earned 120 total points
ID: 7984366
I wanna say something bad about Microsoft Backup utilities, and diags like checkdisk. But this looks like different problem.

Sadly, you probably cannot restore that file. While there are recovery programs, they can only succeed when original sectors are not rewritten, and it is quite likely some freed ones would have been reused by now, and it is even more likely that none were freed in first place. "is already in use" - when two or more files each thing that they get to use same sector, at least one of them loses. So the program removed access to sector(s) from one file, and the other gets to keep it. This is called cross linked.

What may have really happened here, is that the bad sectors were not for your file, but for the file_system, which has the indexes for finding all files. If so, then the original file is there, and for some reason checkdisk did not re-create it. But just in case, look for *.chk files. Possibly in root of c:\, but search all drive anyway, you might find the file(s). If no .chk, there are, as said above, a number of recovery tools that 'may' work. But it looks like something, since the backup was made, has been writing over sectors that are owned by other files. Not good situation.

Answer: Your system is dying, IMO. I think you got lemon HD's and you are about to lose it all. So I recommend getting new HDs from reliable manufacturer. At least they are cheaper and larger and faster these days than whatever you are using.

> Any chance of getting it back, or is that a

While I mentioned some recovery options above, I am more pessimistic on that, than, getting the files off the original drive. The dead drive. Define dead. Won't work 90% of time?  Then, how about rebooting for it 10 times, to get even odds of finding the files? Is it worth 20 or 30 more reboots?

I am thinking the HD had just crossed over a tolerance, that it did not just burn up or lose heads or freeze. So I consider it possible, that if you try it in a couple other machines, that one might still accept it as within some level of tolerance, for sufficient time for your to pull off the files. Sorry,

Answer 2: look for files on original HD. Try harder.
0
 
LVL 32

Expert Comment

by:LucF
ID: 10096973
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Points to SunBow

Please leave any comments here within the next seven days.

PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

LucF
EE Cleanup Volunteer
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…
Suggested Courses
Course of the Month15 days, 1 hour left to enroll

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question