Disk crash?! Invalid partition / Unusable backup file

An IDE drive (WD 160GB) in my company's only email server died and took all of the emails with it!

Fortunately, the drive hasn't fried, isn't making clicking/scratching noises, BIOS sees it fine and some utilities can detect the proper size of the partition.

Unfortunately, it's not readable in the email server or in any other computer as a valid NTFS partition.  In "My Computer," where it would normally give the Total Size and the Free Size, it's just blank.  When I double click on the drive letter that Windows assigned, it says "The disk in drive <X> is not formatted.  Do you want to format it now?"  Knoppix utilities don't help.  ERD Commander 2005 can't seem to do anything either.

Fortunately, I keep nightly backups of the contents of this drive (Exchange 2000 Information Store) via NTBackup just in case.

Unfortunately, the backup file (.bkf) is apparently corrupt!  When I went to restore it, I got the message "The backup file is unusable. You must erase it, or choose another file."  My jaw almost hit the floor!  I see some companies selling .bkf repair tools, but few can do ones with Exchange data, are quite expensive, and I would rather save as a last resort.  Microsoft's KB article (http://support.microsoft.com/?kbid=269826) is of no help either.

Double-whammy!  At this point, I feel that I have a better chance in recovering the files from the drive.  Are there any programs I should try out?  I'm desperate and just hope that this doesn't cost me my job!  Thanks in advance!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I get more luck with recovery using GetDataBack than quite a few other options I have tried in the past.
It's not perfect (or free) but does a reasonable job.
Gary CaseRetiredCommented:
Whatever you do, remember the #1 rule of data recovery -- STOP, STOP, STOP !!   Do NOT do anything, or use any program, that may WRITE on that drive.

The best do-it-yourself recovery option is GetDataBack from www.runtime.org ==> free to download and "see" what is recoverable;  not free to actually recover it.

My recommended professional data recovery company is Gillware at http://www.gillware.com/customers.php   They're very good, and much less expensive than many of their competitors.   They also have a "no recovery, no fee" policy -- but plan on paying (they have an excellent track record).

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
I would suggest pc inspecter very good and free only downside is it is slow i have recoverd stuff from severly messed up disk
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

nwruAuthor Commented:
Yeah, I made sure to not write to the drive or do anything that looked like it would write to the drive.

I'll try out these recommendations right away and keep you all posted.  Thanks for the lightning-quick responses!
nwruAuthor Commented:
GetDataBack doesn't look like it's going to do the trick.  After an hour of scanning, it gave me back a folder structure to browse.  Being that I'm just interested in recovering a few files from one particular folder, I found that folder, but only one of the files within it.  I skimmed through the rest to no avail.  Also, I estimate around 50GB of these files I need and the size of all the recoverable files was only 16GB or so.

I could not get PC Inspector to run.  After choosing the language, the program attempts to read the physical disks or something and gives me a Division by Zero error.  I tried this on two different computers and it only happens when the bad drive is connected.

Sigh...  Any more ideas?  I'm willing to try anything at this point!
usually if getdataback doesn't help the only other thing that might help is a professional data recovery service.


The above is probably one of the best and not the most expensive of these services.

Maybe just as another test, boot the PC with the bad drive using knoppix and check if that can see the files. If yes you should be able to copy them over to a networked HD.

nwruAuthor Commented:
Tried Knoppix already.  It said something along the lines of could not mount because it could not figure out what file system it was.

Gillware is starting to look pretty good.  My bosses (and users) aren't going to like the sound of "hopefully by the end of the week."
nwruAuthor Commented:
And even worse, I've tried a half dozen .bkf repair utilities and none of them seem to work.  They install and look like they're running as they should, but can never find any files.  I'm thinking that they can't handle ones that have Exchange data as opposed to normal files.

I'm currently investigating how difficult it would be to manually rip these files out of the .bkf file.  I happened to hex edit it real quick and see lots of email information in plain text, so there has to be a way to get some information out of there.  Does anyone have any insight on this?

I found that Veritas Backup Exec can catalog and restore .bkf files too.  I wonder if I could get more productive results if I tried a restore through that.
Gary CaseRetiredCommented:
... as for the drive -- as I suggested in my first post, I'd recommend you mail it off to Gillware.   If the data's recoverable, they'll get it ==> and with a "no recovery, no fee" policy it won't cost anything if they don't.

... as for the data -- based on your comment "... Fortunately, I keep nightly backups ..." ==>  Since you last backup is corrupted, just go back another day.   Surely ALL of your backups aren't corrupted.
nwruAuthor Commented:
The drive is off to Gillware as we speak.  Sent via UPS next day early AM, with priority "within 2 hours" handling once it arrives.  I filled out the form on their web site and a representative gave me a call no more than 2 minutes later!  They're even faster than you guys! ;)  They said that with this particular drives (WD Caviar 160GB), the heads tend to get up and die.  If that's the case (which the symptoms fit), they have about a 90% success rate.  Good enough for me.

As silly as it sounds, I wound up only had one full backup from the prior day.
Gary CaseRetiredCommented:
I suspect you'll hear good news from them in a day or two -- with one exception everyone I've suggested them to has been able to recover their data.   They're also very reasonably priced (by data recovery standards).   Post back with your results :-)
Dushan De SilvaTechnology ArchitectCommented:
I had a hard drive that crashed, right after the hurricane, down here due to a power failure.  I didn't realize that the old tech had put a DFS that rerouted the backup file to this HD, which also held all the roaming profiles.  I downloaded File Scavenger from http://www.quetek.com, and it scanned the 70GB Drive in about 12 to 16Hrs. I can't remember.  Aproximately a fourth of the disk was too destroyed to be readable, but fortunatetly for me, both the backups and the Profiles were fully intact and the program restored both.  Though that took another 20 Hrs. or so.
Michael RodríguezSystems EngineerCommented:
I have used handy recovery when it comes to harddrive crashes of this nature, where windows will see the drive but you cant access it.  www.handyrecovery.com

Give it a try, with the demo you can only restore 1 file at a time per day.  its only $30 for the full version.
nwruAuthor Commented:
So Gillware worked out pretty well.  When I filled out the form on their web site, I chose all the options that would get my drive back super-quick, including a $700 surcharge for priority service.  I overnighted the drive to them.  In the morning, I received a call from them outlining the work that they were going to do and gave an estimate of around $1300, so I told them to get on it and told them the files that I needed.  By 3:30PM or so, they gave me another call and told me that they were only able to recover one particular file.  The MFT or something that held the info for the other files was shot.  They offered to outsource the recovery of the "lost" files to OnTrack, since they have the resources to reassemble data in scenarios like this.  That would have cost me $5,000 - $10,000 and who knows how long, but my priority was getting the data back quick.  I told them to take what they have and overnight it back to me.  After I gave them credit card info, they put the file onto an external USB hard drive and I had it back the next day.

Looking at the invoice now, it was cheaper than I thought.  $379 for Windows Data Recovery + $100 for external hard drive + (only) $300 for priority service + $35 shipping = $814.  Not bad at all for such quick work.  I'll be sure to recommend them to others.

All in all, I wound up having better luck restoring the data out of the corrupt backup file.  See this post if interested:  http://www.experts-exchange.com/Networking/Email_Groupware/Exchange_Server/Q_21786381.html
Gary CaseRetiredCommented:
Just read your other thread -- glad you were able to restore most of what you needed.   It's amazing how often a "backup" proves to be defective -- even with high quality tape backups, it seems the most important tape is always the one you can't read.

I've become a huge fan over the years of having anything that's important stored in at least two "online" places (e.g. hard drives) AND on a backup media.   I'd give some serious thought to adding a RAID controller to your e-mail server and using a RAID-1 array for your e-mail storage.   This doesn't replace backups (obviously if the array becomes corrupted, BOTH of the disks in it will be equally corrupted), but it will protect you against a failed drive.

I haven't used NTBackup in a while, but as I recall it does not back up locked files.   Is your Exchange Server still in use when you run your backups?   You may want to use a backup utility that will copy locked files, so there's less likelihood of a corrupted copy.

Ntbackup doesn't backup locked files, but it does backup a running exchange server (at least from windows 2k server upwards). I'm not sure about SQL server, but I think it also back that up.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.