Could Windows XP have destroyed my FAT32 Partition Table?
Posted on 2006-11-01
Hello fellow experts
I have just lost all access LOT of data stored on one of my hard drives, and I was hoping you might be able to suggest whether there is any vague possibility of accessing it. Here's what happened.
1. I have an 80GB hard drive in my main Win98se machine that I use to store all my backup program setup files, experts-exchange and other notes accumulated over the years, *.reg tweaks, loads of photo's, etc, etc.
2. The drive is partitioned into C, D, E, and F partitions. The uses are immaterial at this time, but a lot of my program source files are in D, E, and F, as was the "My Documents" folder up until shortly before this occurred.
3. Drive has been scanned very recently with drive diagnostics, and also passed Scandisk cleanly. It was probably a bit fragmented from shuffling a load of data around in the past week or so.
3. As a lot of this is either irreplaceable or would be very time consuming to gather up again, I have always backed it up quite regularly using a variety of methods:
(a) Incremental backups once every couple of days from partition used for data on 1st drive to second 80GB hard drive which I remove and keep in a cupboard for safekeeping.
(b) CD-R backups made once every couple of weeks of any new data copied to that 2nd hard drive.
I've never bothered to create an image of the C: drive because I've never had data on it that wasn't already backed up, and it's easy enough to format and reinstall Windows and the applications from one of my partitions if anything goes wrong. Up until a week ago the "My Documents", OE Store Folder, etc were on one of my partitions, and cloned to the drive that I remove.
Now here's the bad news. My home was broken into about a week ago and quite a bit of my older computing stuff was stolen. They left my main computer and took two of the old base units that weren't any real loss. In so doing, however, they took my box of software and backup CD's from my cupboard, and also found and stole the backup hard drive containing all the valuable data which was in another box in the same room. So much for safe keeping. Yes, I know it should have been in a wall safe, but that's my fault. I lost a lot more stuff like guitars and stuff that were sitting in my living room, but I can claim insurance on them.
OK, so at least I still had my main hard drive still in the computer that I use. The word "had" is poignant here, because it crashed and system was rendered unbootable just as I started making new backups to a replacement 2nd hard drive.
I wish I had started by copying the My Documents, but I did the simplest thing first and decided to export my Favorites. Internet Explorer inexplicably froze and I couldn't kill the process without restarting the system. Scandisk ran as usual, but this time reported invalid directory names. I assumed it would be the odd long folder name at first, but the next thing I know it was half way through creating what ultimately ended up as C:\DIR00001 to C:\DIR00035.
Booting to DOS and doing directory listings told me that there were some crucial C:\Windows sub-folders converted into those directories, so I felt that the safest bet was to remove the drive, slave it to another computer, and copy out all my documents and files. I also intended to make copies of the Scandisk DIR???? folders so I could rename them, recover the files in them, and then at least try and transplant them back to where they belong to get the system booting. I've done it before, and it has worked out well enough for me to , but not with 35 of them!!
The only other PC I had left (in a downstairs cupboard) had Windows XP on it. I connected the drive as slave, ensured that the CMOS Setup automatically identified and configured it, and booted to XP. When I tried to access the drive, it just showed up as a G: Drive without any of the partitions listed in Windows Explorer. Clicking on it showed an error message to the effect that the drive wasn't formatted.
The layout of the drive, as FDISKED in Win98se, is:
C: - about 24% of the 80GB primary DOS active partition
D, E, and F - Logical drives all in Extended DOS partition taking up the remaining %
The XP Hard drive was partitioned as C: NTFS and D: FAT32 (Primary Master), then the DVD-R and CD-RW were assigned E; and F: (Secondary Master and Slave). My slaved hard drive on the Primary Slave was assigned G:
I checked the drive's "Properties" and it did not show as FAT32, but instead as "RAW". Device Manager showed that it was configured as a standard IDE Hard Drive using the same windows drivers as the system hard drive, but nothing allowed me to explore the contents without the "Drive Has Not Been Formatted - would you like to?" message. Obviously I said NO to this prompt.
I loaded the Disk Management console to see whether it would give an idea of whether it was being identified. It still showed as a single "Basic" drive formatted as type "MBR", which I understand is normal.
The WinXP System drive (a 20GB one) shows as:
DISK0 - 18.6GB Basic Online
C: 13.9GB NTFS Healthy (system)
D: 4.6GB FAT32 Healthy
The slaved 80GB Drive shows as:
DISK1 - 74.56GB Basic Online
G: 31.5GB Healthy (Active) (that's the Primary DOS FAT32 partition)
(No Letter) 43.06GB Unallocated (that's the extended DOS partition)
I left it at that without modifying anything in Disk management, and attached it back to the original PC to see if a Win98 boot floppy would still be able to see it. I had done directory listings off it to floppy immediately after the crash, so i assumed it would still be accessible. Unfortunately not.
FDISK reports it ONLY as a single active primary DOS partition but does not show the extended DOS partition or logical drives. I can change drive to the C: Drive, but it reports "Invalid Medium" when I try to list the contents. I get the "Not Reading ..... Abort, Fail, Retry" error when I now try to change into the D, E, or F partitions.
I booted to a "SpinRite" floppy just to see what it reported about the drives. I didn't try to actually run SpinRite, but it wouldn't have run anyway because it reports that the Drive Parameters in the CMOS Settings have changed, or something to that effect. I'll need to check exactly what it said, but I don't want to mess with the drive much more while I await your suggestions.
I already had System Restore disabled for all drives, and the Indexing Service has been uninstalled for a long time on that system, so no new files should have been dumped on the drive that could be messing with how it is detected.
I think I'm screwed here without any way of retrieving the data, but I am puzzled as to why this occurred. Could Windows XP's Disk management console have modified anything on the drive purely by VIEWING it? I KNOW that I didn't change any "properties" or access any of the other options.
What do you think?