250 GB NTFS file system gone after writing 2 files under win2k without large disk support

How can I recover any or all of the files that were on my 250 gb NTFS disk
History
1. setup BIOS and  win2k SP3 plus registry to enable LBA. Drive is set for compression
2. Happy as can be, drive has about 135 gb
3. Booted to alternate w2k partition to backup drives. This w2k had registry fix but was not even SP1. Therefore not LBA enabled.
4. Created 2 disk image files and placed them on the 250GB file system (but I think this OS saw it as a 128 GB drive)
5. Booted original w2k SP3 os and drive now has no file system
6. I have found no recovery tools that can understand the current state of drive. I had hoped that most files would still be intact on drive and recovery tools could extract them as I have done for other drive issues.

Help Needed
Any info on what logically happend to the drive would help
Info on recovery tools would be great
Info on NTFS structures on disk that might be repairable with a disk editor, ideas, approach?
Any disk recovery experts that might be able to salvage my files?

Thanks for any help you can give

rr042600Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
AshuraKnightConnect With a Mentor Commented:
Does your HDD detected as Dynamic Drive at Diskmanagement from control panel ?

If it does, it looks like you're in the same situation as I am last week :)

If it's still detected in BIOS you can get your data back
I'll advice GetDataBack software from runtime.org
You can do trial run to see whether it could get your data or not then you register to copy the data back to "healthy" HDD :)

And a link to bunch of file recovery softwares :

http://crazyone.tekmasters.com/datarecovery.html
0
 
crissandCommented:
http://www.ontrack.com/easyrecoveryprofessional/

You can try to se if it recovers something, and buy it if ok.
0
 
CallandorConnect With a Mentor Commented:
I recommend you try GetDataBack (www.runtime.org).  There are also some other utilities here: http://www.experts-exchange.com/Hardware/Q_20900970.html
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
AshuraKnightCommented:
eh it's just the same advise like collandor did -.-
sorry..
0
 
CallandorCommented:
No prob, AshuraKnight :-)
0
 
rr042600Author Commented:
Thanks for the tips, the problem I am having is finding the right tool that can scan the drive without the NTFS file system being recognized by the OS and also show me all the undeleted files.  Most of the tools seem to be oriented to showing and recovering only the deleted tools.   Active Data Recovery seems to be able to show the undeleted files but croaks on mounting the NTFS volume (which is not there). Active Undelete had the ability to define a virtual NTFS file system for the disk but it would only scan for deleted files.  

I am still going thru all the tools people have suggested. Any tips on which ones might be able to do the above would be welcome.

Any leads on how to repair the drive so it sees an NTFS file system?  If I format the drive NTFS do I lose what is in the MFT (directory) currently?

Thanks
rr
0
 
CallandorCommented:
GetDataBack seems to be one of the better ones, and it should work with normal and deleted files.  Once you have retrieved your data, reformatting the drive should fix it, and yes, you will lose what's on it (which is why you need to retrieve the data first).
0
 
AshuraKnightCommented:
Try getdataback :)
0
 
crissandCommented:
Easy Recovery does'n't care if the file is deleted or not, it tries to recover all files.
0
 
rr042600Author Commented:
A little update, after reading up on NTFS on ntfs.com I used a disk editor called diskpatch (I think) to look at the $MFT and fount it hosed. I looked at the $MFT mirror and it looked good so I copied the mirror sectors over $MFT.

Many programs still did not recognize the partition as NTFS but some got a little further. I am still scanning with one that is slow as heck but is reporting it is finding files. The proof will be to try restoring. I think part of the problem might be the fact that the NTFS volume was compressed, but I am not sure.

If this scan yields nothing I may study a few MFT entries for knowledge sake. At least I will learn something.

I am surprised by how damaged the volume is given my circumstances. I expected a few files to be messed up but not the entire MFT directory. Maybe I got hit by a virus or ...

I'll keep you posted.  What is the convention for awarding points when no one quite hit it on the head?

rr
0
 
rr042600Author Commented:
It looks like the MFT and all of its entries were pretty well wiped out. In this situation you need a recovery tool that is diligent in scanning for lost files. "Recover My Data" seems to be able to find sectors and clusters that "look like xxx file type" and pull that data chain together and save it (pay version). You will then have to go see if the file really is an xxx type and whether it is damaged.  That is about the best you can do when the mft and mft directory entries are clobbered.  I also think that because the disk had compression turned on, you've got to have the right tool to understand compression without the OS doing the work. Recover My Data seems to handle compression.

0
 
rr042600Author Commented:
I need to correct the previous post, the program is really "Recover My Files" by GetData Software Development Company (http://www.getdata.com/)

Awards:
Just to clarify, while the responses by Callandor and AshuraKnight did not directly solve the problem I wanted to award points for their suggestions which might have solved the problem if so much of my disk was not wiped out.  

The actual answer in this case is documented in my previous comments:

diskpatch to restore $MFT from mirror
NTFS.com for understanding of NTFS structure
Recover My  Files    http://www.recovermyfiles.com/      finding deleted, not deleted, lost files
0
All Courses

From novice to tech pro — start learning today.