File lost to NTFS / CHKDSK... Can it be retrieved?

Posted on 2003-02-18
Medium Priority
Last Modified: 2009-12-16
I had made a very important backup of another hard drive that was about to go bad (failed the self-test and would not allow a boot up, was still able to access it when installed as slave). The backup was made using the Windows XP backup utility, made to a file, about 4 GB in size, on my desktop. The file was named "Backup.bkf". After the backup, a few things later required the system be restarted. On restart, Windows XP informed me that my hard drive needed to be checked for consistency. Not knowing exactly what might be wrong, I foolishly allowed the disk check to proceed. Among other things, CHKDSK reported such things as:
Attribute record of type 0x80 and instance tag 0x4 is cross linked starting at 0xc5714 for possibly 0x1 clusters.
(above repeated once more)

Some clusters occupied by attribute of type 0x80 and instance tag 0x4 in file 0x6b0 is already in use.
Deleting corrupt attribute record (128, "")

These errors showed up multiple times for many different records in the file-system, each with the first message repeated twice, followed by the message about "some clusters occupied..." and "deleting corrupt attribute record..."

After getting back into Windows, the backup file was missing.

Any chance of getting it back, or is that a pipe dream? The other drive cannot be backed-up again, sadly, and the info was important.
Question by:GuyPaddock
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 24

Accepted Solution

SunBow earned 120 total points
ID: 7984366
I wanna say something bad about Microsoft Backup utilities, and diags like checkdisk. But this looks like different problem.

Sadly, you probably cannot restore that file. While there are recovery programs, they can only succeed when original sectors are not rewritten, and it is quite likely some freed ones would have been reused by now, and it is even more likely that none were freed in first place. "is already in use" - when two or more files each thing that they get to use same sector, at least one of them loses. So the program removed access to sector(s) from one file, and the other gets to keep it. This is called cross linked.

What may have really happened here, is that the bad sectors were not for your file, but for the file_system, which has the indexes for finding all files. If so, then the original file is there, and for some reason checkdisk did not re-create it. But just in case, look for *.chk files. Possibly in root of c:\, but search all drive anyway, you might find the file(s). If no .chk, there are, as said above, a number of recovery tools that 'may' work. But it looks like something, since the backup was made, has been writing over sectors that are owned by other files. Not good situation.

Answer: Your system is dying, IMO. I think you got lemon HD's and you are about to lose it all. So I recommend getting new HDs from reliable manufacturer. At least they are cheaper and larger and faster these days than whatever you are using.

> Any chance of getting it back, or is that a

While I mentioned some recovery options above, I am more pessimistic on that, than, getting the files off the original drive. The dead drive. Define dead. Won't work 90% of time?  Then, how about rebooting for it 10 times, to get even odds of finding the files? Is it worth 20 or 30 more reboots?

I am thinking the HD had just crossed over a tolerance, that it did not just burn up or lose heads or freeze. So I consider it possible, that if you try it in a couple other machines, that one might still accept it as within some level of tolerance, for sufficient time for your to pull off the files. Sorry,

Answer 2: look for files on original HD. Try harder.
LVL 32

Expert Comment

ID: 10096973
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Points to SunBow

Please leave any comments here within the next seven days.


EE Cleanup Volunteer

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Create your own, high-performance VM backup appliance by installing NAKIVO Backup & Replication directly onto a Synology NAS!
Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question