Solved

250 GB NTFS file system gone after writing 2 files under win2k without large disk support

Posted on 2004-08-05
13
280 Views
Last Modified: 2010-08-05
How can I recover any or all of the files that were on my 250 gb NTFS disk
History
1. setup BIOS and  win2k SP3 plus registry to enable LBA. Drive is set for compression
2. Happy as can be, drive has about 135 gb
3. Booted to alternate w2k partition to backup drives. This w2k had registry fix but was not even SP1. Therefore not LBA enabled.
4. Created 2 disk image files and placed them on the 250GB file system (but I think this OS saw it as a 128 GB drive)
5. Booted original w2k SP3 os and drive now has no file system
6. I have found no recovery tools that can understand the current state of drive. I had hoped that most files would still be intact on drive and recovery tools could extract them as I have done for other drive issues.

Help Needed
Any info on what logically happend to the drive would help
Info on recovery tools would be great
Info on NTFS structures on disk that might be repairable with a disk editor, ideas, approach?
Any disk recovery experts that might be able to salvage my files?

Thanks for any help you can give

0
Comment
Question by:rr042600
  • 4
  • 3
  • 3
  • +1
13 Comments
 
LVL 18

Expert Comment

by:crissand
ID: 11736527
http://www.ontrack.com/easyrecoveryprofessional/

You can try to se if it recovers something, and buy it if ok.
0
 
LVL 69

Assisted Solution

by:Callandor
Callandor earned 100 total points
ID: 11737678
I recommend you try GetDataBack (www.runtime.org).  There are also some other utilities here: http://www.experts-exchange.com/Hardware/Q_20900970.html
0
 
LVL 5

Accepted Solution

by:
AshuraKnight earned 100 total points
ID: 11742788
Does your HDD detected as Dynamic Drive at Diskmanagement from control panel ?

If it does, it looks like you're in the same situation as I am last week :)

If it's still detected in BIOS you can get your data back
I'll advice GetDataBack software from runtime.org
You can do trial run to see whether it could get your data or not then you register to copy the data back to "healthy" HDD :)

And a link to bunch of file recovery softwares :

http://crazyone.tekmasters.com/datarecovery.html
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 5

Expert Comment

by:AshuraKnight
ID: 11742790
eh it's just the same advise like collandor did -.-
sorry..
0
 
LVL 69

Expert Comment

by:Callandor
ID: 11743184
No prob, AshuraKnight :-)
0
 

Author Comment

by:rr042600
ID: 11744447
Thanks for the tips, the problem I am having is finding the right tool that can scan the drive without the NTFS file system being recognized by the OS and also show me all the undeleted files.  Most of the tools seem to be oriented to showing and recovering only the deleted tools.   Active Data Recovery seems to be able to show the undeleted files but croaks on mounting the NTFS volume (which is not there). Active Undelete had the ability to define a virtual NTFS file system for the disk but it would only scan for deleted files.  

I am still going thru all the tools people have suggested. Any tips on which ones might be able to do the above would be welcome.

Any leads on how to repair the drive so it sees an NTFS file system?  If I format the drive NTFS do I lose what is in the MFT (directory) currently?

Thanks
rr
0
 
LVL 69

Expert Comment

by:Callandor
ID: 11744529
GetDataBack seems to be one of the better ones, and it should work with normal and deleted files.  Once you have retrieved your data, reformatting the drive should fix it, and yes, you will lose what's on it (which is why you need to retrieve the data first).
0
 
LVL 5

Expert Comment

by:AshuraKnight
ID: 11744848
Try getdataback :)
0
 
LVL 18

Expert Comment

by:crissand
ID: 11751218
Easy Recovery does'n't care if the file is deleted or not, it tries to recover all files.
0
 

Author Comment

by:rr042600
ID: 11827798
A little update, after reading up on NTFS on ntfs.com I used a disk editor called diskpatch (I think) to look at the $MFT and fount it hosed. I looked at the $MFT mirror and it looked good so I copied the mirror sectors over $MFT.

Many programs still did not recognize the partition as NTFS but some got a little further. I am still scanning with one that is slow as heck but is reporting it is finding files. The proof will be to try restoring. I think part of the problem might be the fact that the NTFS volume was compressed, but I am not sure.

If this scan yields nothing I may study a few MFT entries for knowledge sake. At least I will learn something.

I am surprised by how damaged the volume is given my circumstances. I expected a few files to be messed up but not the entire MFT directory. Maybe I got hit by a virus or ...

I'll keep you posted.  What is the convention for awarding points when no one quite hit it on the head?

rr
0
 

Author Comment

by:rr042600
ID: 11871758
It looks like the MFT and all of its entries were pretty well wiped out. In this situation you need a recovery tool that is diligent in scanning for lost files. "Recover My Data" seems to be able to find sectors and clusters that "look like xxx file type" and pull that data chain together and save it (pay version). You will then have to go see if the file really is an xxx type and whether it is damaged.  That is about the best you can do when the mft and mft directory entries are clobbered.  I also think that because the disk had compression turned on, you've got to have the right tool to understand compression without the OS doing the work. Recover My Data seems to handle compression.

0
 

Author Comment

by:rr042600
ID: 11872184
I need to correct the previous post, the program is really "Recover My Files" by GetData Software Development Company (http://www.getdata.com/)

Awards:
Just to clarify, while the responses by Callandor and AshuraKnight did not directly solve the problem I wanted to award points for their suggestions which might have solved the problem if so much of my disk was not wiped out.  

The actual answer in this case is documented in my previous comments:

diskpatch to restore $MFT from mirror
NTFS.com for understanding of NTFS structure
Recover My  Files    http://www.recovermyfiles.com/      finding deleted, not deleted, lost files
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Benefits of SMB Fileshare 3 73
Raid 5 11 81
Equallogic factory reset 3 30
synology Replace Drives to Expand Storage Capacity 8 34
We wanted to provide an in-depth explanation of the Ping Node offering clarifications on its function and usage. Incorrect Ping Node configuration and functionality can cause problems with HA clusters. The importance of this article is critical for …
In this article, I provide some information on storage disks which go into calculations that will help you figure out how much Input/output Operations Per Second (IOPS) your disk subsystem can deliver. To effectively size & tune up applications l…
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question