Solved

250 GB NTFS file system gone after writing 2 files under win2k without large disk support

Posted on 2004-08-05
13
278 Views
Last Modified: 2010-08-05
How can I recover any or all of the files that were on my 250 gb NTFS disk
History
1. setup BIOS and  win2k SP3 plus registry to enable LBA. Drive is set for compression
2. Happy as can be, drive has about 135 gb
3. Booted to alternate w2k partition to backup drives. This w2k had registry fix but was not even SP1. Therefore not LBA enabled.
4. Created 2 disk image files and placed them on the 250GB file system (but I think this OS saw it as a 128 GB drive)
5. Booted original w2k SP3 os and drive now has no file system
6. I have found no recovery tools that can understand the current state of drive. I had hoped that most files would still be intact on drive and recovery tools could extract them as I have done for other drive issues.

Help Needed
Any info on what logically happend to the drive would help
Info on recovery tools would be great
Info on NTFS structures on disk that might be repairable with a disk editor, ideas, approach?
Any disk recovery experts that might be able to salvage my files?

Thanks for any help you can give

0
Comment
Question by:rr042600
  • 4
  • 3
  • 3
  • +1
13 Comments
 
LVL 18

Expert Comment

by:crissand
ID: 11736527
http://www.ontrack.com/easyrecoveryprofessional/

You can try to se if it recovers something, and buy it if ok.
0
 
LVL 69

Assisted Solution

by:Callandor
Callandor earned 100 total points
ID: 11737678
I recommend you try GetDataBack (www.runtime.org).  There are also some other utilities here: http://www.experts-exchange.com/Hardware/Q_20900970.html
0
 
LVL 5

Accepted Solution

by:
AshuraKnight earned 100 total points
ID: 11742788
Does your HDD detected as Dynamic Drive at Diskmanagement from control panel ?

If it does, it looks like you're in the same situation as I am last week :)

If it's still detected in BIOS you can get your data back
I'll advice GetDataBack software from runtime.org
You can do trial run to see whether it could get your data or not then you register to copy the data back to "healthy" HDD :)

And a link to bunch of file recovery softwares :

http://crazyone.tekmasters.com/datarecovery.html
0
 
LVL 5

Expert Comment

by:AshuraKnight
ID: 11742790
eh it's just the same advise like collandor did -.-
sorry..
0
 
LVL 69

Expert Comment

by:Callandor
ID: 11743184
No prob, AshuraKnight :-)
0
 

Author Comment

by:rr042600
ID: 11744447
Thanks for the tips, the problem I am having is finding the right tool that can scan the drive without the NTFS file system being recognized by the OS and also show me all the undeleted files.  Most of the tools seem to be oriented to showing and recovering only the deleted tools.   Active Data Recovery seems to be able to show the undeleted files but croaks on mounting the NTFS volume (which is not there). Active Undelete had the ability to define a virtual NTFS file system for the disk but it would only scan for deleted files.  

I am still going thru all the tools people have suggested. Any tips on which ones might be able to do the above would be welcome.

Any leads on how to repair the drive so it sees an NTFS file system?  If I format the drive NTFS do I lose what is in the MFT (directory) currently?

Thanks
rr
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 69

Expert Comment

by:Callandor
ID: 11744529
GetDataBack seems to be one of the better ones, and it should work with normal and deleted files.  Once you have retrieved your data, reformatting the drive should fix it, and yes, you will lose what's on it (which is why you need to retrieve the data first).
0
 
LVL 5

Expert Comment

by:AshuraKnight
ID: 11744848
Try getdataback :)
0
 
LVL 18

Expert Comment

by:crissand
ID: 11751218
Easy Recovery does'n't care if the file is deleted or not, it tries to recover all files.
0
 

Author Comment

by:rr042600
ID: 11827798
A little update, after reading up on NTFS on ntfs.com I used a disk editor called diskpatch (I think) to look at the $MFT and fount it hosed. I looked at the $MFT mirror and it looked good so I copied the mirror sectors over $MFT.

Many programs still did not recognize the partition as NTFS but some got a little further. I am still scanning with one that is slow as heck but is reporting it is finding files. The proof will be to try restoring. I think part of the problem might be the fact that the NTFS volume was compressed, but I am not sure.

If this scan yields nothing I may study a few MFT entries for knowledge sake. At least I will learn something.

I am surprised by how damaged the volume is given my circumstances. I expected a few files to be messed up but not the entire MFT directory. Maybe I got hit by a virus or ...

I'll keep you posted.  What is the convention for awarding points when no one quite hit it on the head?

rr
0
 

Author Comment

by:rr042600
ID: 11871758
It looks like the MFT and all of its entries were pretty well wiped out. In this situation you need a recovery tool that is diligent in scanning for lost files. "Recover My Data" seems to be able to find sectors and clusters that "look like xxx file type" and pull that data chain together and save it (pay version). You will then have to go see if the file really is an xxx type and whether it is damaged.  That is about the best you can do when the mft and mft directory entries are clobbered.  I also think that because the disk had compression turned on, you've got to have the right tool to understand compression without the OS doing the work. Recover My Data seems to handle compression.

0
 

Author Comment

by:rr042600
ID: 11872184
I need to correct the previous post, the program is really "Recover My Files" by GetData Software Development Company (http://www.getdata.com/)

Awards:
Just to clarify, while the responses by Callandor and AshuraKnight did not directly solve the problem I wanted to award points for their suggestions which might have solved the problem if so much of my disk was not wiped out.  

The actual answer in this case is documented in my previous comments:

diskpatch to restore $MFT from mirror
NTFS.com for understanding of NTFS structure
Recover My  Files    http://www.recovermyfiles.com/      finding deleted, not deleted, lost files
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

I have written before on the benefits of using a Boot media other than your HDD when it has become infected.   The article I wrote about creating a bootable CD/DVD/USB (http://e-e.com/A_2343.html) was mainly concerned with building a UBCD4Win on CD …
Create your own, high-performance VM backup appliance by installing NAKIVO Backup & Replication directly onto a Synology NAS!
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now