Solved

Could Windows XP have destroyed my FAT32 Partition Table?

Posted on 2006-11-01
22
952 Views
Last Modified: 2008-01-09
Hello fellow experts
I have just lost all access LOT of data stored on one of my hard drives, and I was hoping you might be able to suggest whether there is any vague possibility of accessing it.  Here's what happened.

1. I have an 80GB hard drive in my main Win98se machine that I use to store all my backup program setup files, experts-exchange and other notes accumulated over the years, *.reg tweaks,  loads of photo's, etc, etc.
2. The drive is partitioned into C, D, E, and F partitions.  The uses are immaterial at this time, but a lot of my program source files are in D, E, and F, as was the "My Documents" folder up until shortly before this occurred.
3. Drive has been scanned very recently with drive diagnostics, and also passed Scandisk cleanly.  It was probably a bit fragmented from shuffling a load of data around in the past week or so.
3. As a lot of this is either irreplaceable or would be very time consuming to gather up again, I have always backed it up quite regularly using a variety of methods:
(a) Incremental backups once every couple of days from partition used for data on 1st drive to second 80GB hard drive which I remove and keep in a cupboard for safekeeping.
(b) CD-R backups made once every couple of weeks of any new data copied to that 2nd hard drive.

I've never bothered to create an image of the C: drive because I've never had data on it that wasn't already backed up, and it's easy enough to format and reinstall Windows and the applications from one of my partitions if anything goes wrong.  Up until a week ago the "My Documents", OE Store Folder, etc were on one of my partitions, and cloned to the drive that I remove.

Now here's the bad news.  My home was broken into about a week ago and quite a bit of my older computing stuff was stolen.  They left my main computer and took two of the old base units that weren't any real loss.  In so doing, however, they took my box of software and backup CD's from my cupboard, and also found and stole the backup hard drive containing all the valuable data which was in another box in the same room.  So much for safe keeping.  Yes, I know it should have been in a wall safe, but that's my fault.  I lost a lot more stuff like guitars and stuff that were sitting in my living room, but I can claim insurance on them.

OK, so at least I still had my main hard drive still in the computer that I use.  The word "had" is poignant here, because it crashed and system was rendered unbootable just as I started making new backups to a replacement 2nd hard drive.

I wish I had started by copying the My Documents, but I did the simplest thing first and decided to export my Favorites.  Internet Explorer inexplicably froze and I couldn't kill the process without restarting the system.  Scandisk ran as usual, but this time reported invalid directory names.  I assumed it would be the odd long folder name at first, but the next thing I know it was half way through creating what ultimately ended up as C:\DIR00001 to C:\DIR00035.

Booting to DOS and doing directory listings told me that there were some crucial C:\Windows sub-folders converted into those directories, so I felt that the safest bet was to remove the drive, slave it to another computer, and copy out all my documents and files.  I also intended to make copies of the Scandisk DIR???? folders so I could rename them, recover the files in them, and then at least try and transplant them back to where they belong to get the system booting.  I've done it before, and it has worked out well enough for me to , but not with 35 of them!!

The only other PC I had left (in a downstairs cupboard) had Windows XP on it.  I connected the drive as slave, ensured that the CMOS Setup automatically identified and configured it, and booted to XP.  When I tried to access the drive, it just showed up as a G: Drive without any of the partitions listed in Windows Explorer.  Clicking on it showed an error message to the effect that the drive wasn't formatted.

The layout of the drive, as FDISKED in Win98se, is:
C:  - about 24% of the 80GB primary DOS active partition
D, E, and F - Logical drives all in Extended DOS partition taking up the remaining %

The XP Hard drive was partitioned as C: NTFS and D: FAT32 (Primary Master), then the DVD-R and CD-RW were assigned E; and F: (Secondary Master and Slave). My slaved hard drive on the Primary Slave was assigned G:

I checked the drive's "Properties" and it did not show as FAT32, but instead as "RAW".  Device Manager showed that it was configured as a standard IDE Hard Drive using the same windows drivers as the system hard drive, but nothing allowed me to explore the contents without the "Drive Has Not Been Formatted - would you like to?" message.  Obviously I said NO to this prompt.

I loaded the Disk Management console to see whether it would give an idea of whether it was being identified.  It still showed as a single "Basic" drive formatted as type "MBR", which I understand is normal.

The WinXP System drive (a 20GB one) shows as:
DISK0 - 18.6GB Basic Online
            C: 13.9GB NTFS Healthy (system)
            D: 4.6GB FAT32 Healthy

The slaved 80GB Drive shows as:
DISK1 - 74.56GB Basic Online
            G: 31.5GB Healthy (Active)  (that's the Primary DOS FAT32 partition)
            (No Letter)  43.06GB Unallocated  (that's the extended DOS partition)

I left it at that without modifying anything in Disk management, and attached it back to the original PC to see if a Win98 boot floppy would still be able to see it.  I had done directory listings off it to floppy immediately after the crash, so i assumed it would still be accessible.  Unfortunately not.

FDISK reports it ONLY as a single active primary DOS partition but does not show the extended DOS partition or logical drives.  I can change drive to the C: Drive, but it reports "Invalid Medium" when I try to list the contents.  I get the "Not Reading ..... Abort, Fail, Retry" error when I now try to change into the D, E, or F partitions.

I booted to a "SpinRite" floppy just to see what it reported about the drives.  I didn't try to actually run SpinRite, but it wouldn't have run anyway because it reports that the Drive Parameters in the CMOS Settings have changed, or something to that effect.  I'll need to check exactly what it said, but I don't want to mess with the drive much more while I await your suggestions.

I already had System Restore disabled for all drives, and the Indexing Service has been uninstalled for a long time on that system, so no new files should have been dumped on the drive that could be messing with how it is detected.

I think I'm screwed here without any way of retrieving the data, but I am puzzled as to why this occurred.  Could Windows XP's Disk management console have modified anything on the drive purely by VIEWING it?  I KNOW that I didn't change any "properties" or access any of the other options.

What do you think?

Bill
0
Comment
  • 10
  • 4
  • 4
  • +1
22 Comments
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Damn
Yes, just looked at the notes I took again.  The G: Drive shows as 31.5GB capacity AND as 31.5GB Free (100%).
Looks like I'm doomed, but I still don't understand how this could have happened.
0
 
LVL 28

Accepted Solution

by:
burrcm earned 350 total points
Comment Utility
RAW is OK. Run the demo of GetDataBack for FAT. If the drive will spin it will find everything. Buy the license to recover. This is an outstanding prog.

Chris B
0
 
LVL 14

Expert Comment

by:FriarTuk
Comment Utility
Dude, that totally blows, seems like they might've known what they were looking for when grabbing computer equipment & backups.

If you boot from an w98 bootdisk, then run ghost, does it detect the drive?  If so, does it detect the partitions?  it might be worth a shot to clone the entire drive, or certain partitions, to another 80gb drv, then test repairing that one's FAT32 table. (fdisk /mbr)

If it only shows up as a 32gb, check the jumpers (drive limit?), or any cmos limits, did it have a drv overlay bios to be able to recognize the full 80gb.  Maybe reset cmos to defaults & auto detect.
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Thanks Chris, It will be worth the purchase if it is able to get some of it back.

FriarTuck, good thinking there but I did check the settings.  The drive does have a jumper setting to limit to 32GB, as does the BIOS Setup, but neither of these is limiting it.  It's just coincidence that the primary dos partition was created just around that size when I partitioned it by percentages originally.  No drive overlay was needed.

Here's the notes I jotted down from SpinRite.  The version I have only works with FAT32 partitions, but what it says about the "hard drive parameters" is this:

Drive not ready for use.  Problem while checking C:
The physical HD parameters of this system's drive(s) have apparently been altered since its partitions were originally formatted.
Suggests accessing BIOS Config Screen "to return the drive's physical parameters.
<so you then press spacebar to view the drive detection>

Original Param's:  63 Sectors, 191 Heads, 1,024 Cylinders
Current param's:  63 Sectors, 255 Heads,  1,024 Cylinders.

In fact, NEITHER of these are reported correctly, and i fail to see how the CMOS Settings actually alter the HD's PHYSICAL parameters.  All they do is set the CMOS Data to specified settings, as far as I know.

Good idea about resetting CMOS defaults, given the above SpinRite nonsense, and the idea of Ghost is certainly a good idea - except that they have the CD containing it.  I probably have a floppy kicking around with an old version somewhere.

I wish I had the money to have the drive professionally seen to by data recovery experts.

>>> "seems like they might've known what they were looking for when grabbing computer equipment & backups" <<<

Highly likely.  I noticed a new window cleaner working for the company I've used for years.  He appeared on the scene about a month ago, and a couple of nights after that the new neighbours across the road had their new Plasma TV and stuff stolen while they slept upstairs.  I'm often in the back room juggling between two or more computers when the window cleaners arrive.  Usually have the curtains and window open to let the cigarette smoke out, so it wouldn't take a telescope to see there might be something worthwhile in that room, especially having seen me with my electric guitar plugged into the PC.  Maybe sheer coincidence, but I believe he may like to offer some form of explanation when I track him down, or when he next comes to do my windows :~(

I'll let you know the results in the next couple of days.

Thanks
Bill
0
 
LVL 14

Expert Comment

by:FriarTuk
Comment Utility
what are the params when you set the bios to auto detect the settings & have you tried manually setting them per the settings listed on the drive or those from spinrite?
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
In case you think I'm blanking you guys, I'm not.  I just need a bit of time to collate some details, get a drive large enough to hold any files that GetDataBack may recover, and make sure that I understand the best way to use the program.

A couple of questions about GDB that I have yet to find adequately explained, if you don't mind me asking.

I assume that I am correct in saying that the program does not actually try to recover the directory structure, files, and all associated names IN PLACE on the affected hard drive.  It's not a program that actually tries to restore the FAT and data on the drive, is it?

I notice that they recommend running the Trial version to see if it WILL recover anything AND THEN pay for a registration to allow you the facility to copy out restored files to another drive.  That's obviously a good idea.

Assuming that it gets to the stage of being able to recover a load of worthwhile data as a Demo version, does it create a "map" of the affected drive and then make you close the program to register it, and THEN pick up the "map" as it runs in registered mode?
OR should you just halt the process, go online and register the program, enter the details you get emailed to you, and THEN continue with the recovery process until it now gets to a file copy option that wouldn't have been presented in Demo Mode?

I don't quite understand this part.

Does running the Demo affect ANY of the data on the drive if you just quit the scanning and attempted data recovery process?

That's the reason for my delay in running the Demo to see what gives.  I don't know how long it's likely to take, and I'm not sure whether I need to be present to make a decision at any stages, or else I would go to work and leave it running.

I'll double-check the drive parameters inserted when I set the CMOS setting for that drive to AUTO again.  I found some details in a few doc's at the Samsung Support site:

"hddspecs.pdf" downloadable from the link:
http://erms.samsungusa.com/customer/DownloadAnsTempl?AT_ID=5545&SEQ_NO=1

Drive is Spinpoint P80 Series Model Number SP0812N, and the details given are:
155,127 Cyl, 63 Hd, 16 Sec.  
The sticker on the drive shows the LBA as 156.368.016.

I tried applying the parameters shown in SpinRite to my CMOS, but it showed the wrong capacity so I didn't save and reboot with them.  I will have another look now that I have what seems to be the correct ones.

The jumper pin settings shown in the pdf user manual from this link:
http://tinyurl.com/ydg9fq
show the CORRECT ones for MY drive ie. Master = A+B, Slave = None.  There are other documents on the Samsung site that show the use of 2 jumper caps, but they apply to other drives.  I am using the correct jumper settings.

I found this wonderfully helpful FAQ on the Samsung site:
http://www.samsung.com/Products/HardDiskDrive/support/faqs/faqs_20050422_0000115200.htm

Incidentally, the drive is still covered by a 3 Yr warranty until 30.06.2007.  I checked the serial number for the date of manufacture.  It's not really an issue, unless the Drive Diagnostics fails AFTER I (hopefully) recover as much data from it as is possible.

I'll be back in a day or two with some results, but maybe you could explain the parts I don't understand about the GetDataBack program meantime.

Thanks
Bill
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
OK guys, here's a status update which looks to be very promising, thanks mainly to your (burrcm) suggested GetDataBack utility, but also for your (FriarTuck) valuable advice re CMOS Settings.

I read up sufficiently in the GDB doc's to ascertain that I could scan what it detected as a 74.7GB FAT16!! drive and choose to recover as FAT32, then halt on steps 2 or 3 and Save the settings to files that could be later reloaded.  I've got to that stage in the Demo version, and a lot (perhaps even all) data has either been presented in the Recovery Tree as full directory hierarchies or as recoverable separate folders named alpha-numerically which I should be able to identify and decide whether the data is crucial enough to copy out.

Using the built-in viewer and/or the associated application on this XP system, most 9if not all) of the content in the "My Documents" folder and all my "E-E" notes seems to be intact and recoverable.  In addition, much (again if not all) of the data in the 3 Logical Drives seems to be accessible and (although split over several recoverable folders in some cases) intact.

Huge relief, but it's not over yet :-)

Dilemma here when I go to the vendor's website and check out the prices to see about buying the registration key.  You can pay in US Dollars or in Euro's, but the payment in Euro's adds 16% Value Added Tax to the total:

http://www.runtime.org/prices.htm

GetDataBack for FAT Paying in US $:
$69 US = GB £36.18 (http://www.xe.com/ucc/)
based on      $1 US = £0.524277 GBP
      £1 GBP = $ 1.90739 US
 
GetDataBack for FAT  Paying in Euro's
80.04 EUR (including 16% Value Added Tax) = £53.57 GBP
based on      1 EUR = £0.669265 GBP (http://www.xe.com/ucc/)
      £1 GBP = 1.49418 EUR

http://www.runtime.org/buy_now.htm

"You can also use PayPal to securely pay for your software. Please note that PayPal payments are in US$ only. There will be a delay in time until you receive the license key. Please email or call us if you wish to initiate a PayPal payment. If you need a license key immediately, please use the credit card order form above".

Pay in US$:
https://www.runtime.org/ccform.htm
Pay in Euro:
https://www.runtime.org/ccform_eu.htm

What I'm not sure about here is whether, as a UK buyer, I am compelled to purchase using the 16% European Tax.  Both purchase forms have the same details, and you can enter any country regardless of form used.

Advice needed.  Do I email them to verify this in advance, or just go for the US Payment and plead ignorance if they come back and state that I need to pay 16% European tax?  Are you both based in the US, or have you any knowledge of this?  I don't see it mentioned in any of their FAQ's on the site.

Regards
Bill
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
OK, just emailed the US email address from a webmail address using an assumed name.  Awaiting a response ;-)
0
 
LVL 28

Expert Comment

by:burrcm
Comment Utility
Don't have these issues in Australia.

Good luck

Chris B
0
 
LVL 14

Assisted Solution

by:FriarTuk
FriarTuk earned 150 total points
Comment Utility
the below are free file recovery programs I use
PCI has the additional recovery methods to : restore from lost/deleted/quick formatted fat tables & to find the drive letter is lost or inaccessible

http://www.snapfiles.com/Freeware/system/fwdatarecovery.html            (restoration2514/pc inspector4)
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Hi guys
Allow me to update you with a cautious smile on my face, but first thanks for that additional link FriarTuck.

Unfortunately PCInspector File Recovery was unable to gain access to the problem hard drive while slaved in a Windows XP Machine, despite the claim that it can do so "even if the boot sector or FAT has been erased or damaged".

The Restoration version 2.5.14 looks like a good one for simple file undeletion.  I'll grab it while the page is open, and it will replace the clunky old "Fast File Undelete" which I normally run from a boot floppy.  Unfortunately it doesn't work when it can't detect the drive.

I ran the demo version of GetDataBack through to the stage where it identified my system partition and 4 logical drives.  The occupied capacity of potential restorable files was a fair approximation of what I remember the capacities to be, so I went to the next stage and chose the one which matched the C: drive and ran it through to the last of the available "Demo" stages where it presents the "recovery tree".

That's where you need to assess whether it is worth buying the program, so (after trying some "shared" versions that didn't work, I decided that it was best to just be honest and buy the program.  Got a reply from them which stated they had no problems with UK residents buying in US$ - which makes you wonder why on earth anyone here would pay £53 UK (including European Union tax) when they can buy it for £36 UK if paying in $ !!

The good news is that I have been able to copy out ALL of the data on the C: Drive, including all the files and folders that had been previousy deleted by me.  Practically all files are intact, although there are some files and videos I can probably live without that are corrupt.  The good news is that I have all my OE *.dbx files, my Favorites, loads of *.ini files containing program settings that I can reinstate, my entire bloated desktop contents (I abuse it by dumping stuff there), the "My Documents" folder, and all my Experts-Exchange notes safely reclaimed and backed up.

I've whittled down the 17GB of rescued data from the C: Drive to 9GB of essentials so far, but there are a few ISO images of installation CD Projects I was working on which I'll go back and restore once I juggle around my 3 spare 40GB hard drives.

Next steps are D: Drive.  Used as the "Install Source" for large applications like MS Office and also for other programs like MS AutoRoute where you can choose a "minimal install" and leave the CD contents on a partition to be used as though there was a CD in place).

E: Drive - All my downloaded and saved program installers and accompanying notes, hacks, *.reg files, etc that make reinstalling them easier.

F: Drive - Used as the Install Source for Win98se and essential prog's like Acrobat reader, WinZip, etc, along with all the downloaded updates and patches for them.  Also used for various projects at various stages, so there's a lot of stuff I need in there.

I'm going to close this question now and thank you both very much for your suggestions and optimism.  The bulk of the points must go to burrcm, as without his optimistic suggestion when faced with an unrecognised "raw" file format, I may not have got to this stage:

>>> "RAW is OK. Run the demo of GetDataBack for FAT. If the drive will spin it will find everything. Buy the license to recover. This is an outstanding prog". <<<

Thank you guys.
Bill
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 28

Expert Comment

by:burrcm
Comment Utility
Great result.

Chris B
0
 
LVL 14

Expert Comment

by:FriarTuk
Comment Utility
hope that catch the awhole that snatched your stuff!
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Thanks for reminding me about that FriarTuck.  Been so busy retrieving all the rescued data and sorting it into logical folders that my thoughts of revenge were on the back-burner there.  Yes, that will be my next quest, I can assure you.

Just for your info, what has made this job quite a lot harder for me is the fact that Scandisk ran in autofix mode and with the option set to save problem areas to all those DIR00001, DIR00002, etc folders.

GetDataBack is an astounding program, and I can't praise it highly enough, but if you run it with all the options set (lost files, deleted files, etc) you can end up reclaiming a whole load of stuff that takes a while to sort out afterwards.  It is very thorough and does match up and present the reclaimed files and folders very much as they were previously, but those folders created by Scandisk can end up creating duplicates (again if you have the option set to allow duplicates rather than taking the first one it finds) of data that the program is able to retrieve from elsewhere.  For the most part, the files retrieved from the Scandisk-created folders are the ones amongst which you get the odd corrupt one.   This means that you have to test just about every filerestored from those dir00001, etc folders to ensure they are sound.

As it happens, the vast majority of the affected areas on my hard drive that were written to these folders by Scandisk were the sub-directories of my C:\Windows folder.  I was hoping to get back a copy of my System.dat and User.dat registry files so I could open them in a registry viewer utility I have which mimics Regedit and allows you to export keys to REGEDIT4 *.reg files.  That way I could have saved a lot of time spent reconfiguring programs and applications once I set up Win98se again on my older computer.  I decided now is the time to install WinXP on the main computer.

I think the secret to using GetDataBack successfully is to run it through to the stage where it presents the partitions that it has identified, and Save the configuration file using the options you chose.  Run it again using different options, and save that as another configuration file with an appropriate name to reflect the options used.  This way you can quickly reload that stage you got to.

When you get to that stage (stage 2), select the first partition to search for data to recover and allow it to continue up to showing the Recovery Tree for that partition.  Save that as a stage 3 configuration file named to reflect the partition and options used.  Repeat this for each partition identified, and save as separate configuration files.  These allow you to reload each of these recovery searches in different sittings without having to let the program run from the start again each time.

Doing it this way allows you to discard data that you don't really need to recover by filtering the search criteria and comparing the results to other searches.

Anyway, I've just about got everything off the drive now, and ready to scan it with the Samsung Drive Diagnostics then zero-fill and re-use the drive if it passes the diagnostics tests.

Regards
Bill
0
 
LVL 32

Expert Comment

by:_
Comment Utility
This will make a nice companion piece to "War Story".  : D
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Hey you, just go back to spearing Red Grouper or kayaking in the mangroves, and stop being so sarcastic.  Even better, go and help Becky  ;-)
0
 
LVL 32

Expert Comment

by:_
Comment Utility
>> and stop being so sarcastic
Who? Me?
I should have know better than to be serious. It's not what I'm known for.  : /

Been to Becky's. Your turn.  : P
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Just been there and done that ;-)
That's me just retrieved the last of my recovered data from the hard drive and low-level formatted it.
What a relief.  I would say that probably 95% of the data has been pulled from the drive intact, and I realise just how much junk I had cluttering up all the essential data.
0
 
LVL 32

Expert Comment

by:_
Comment Utility
>> and I realise just how much junk I had

Yeah. I am scared to even look at mine.  : /
0
 
LVL 28

Expert Comment

by:burrcm
Comment Utility
I just added a 250GB SATA to mine as the existing 2 x 200 IDEs are pretty much full. I don't have a problem (and of course I need it all, you never know when that ??? will come in handy) - there are three more SATA connectors to go... that's another terabyte, easy. WHAT PROBLEM??

Chris B
0
 
LVL 32

Expert Comment

by:_
Comment Utility
: D
0
 
LVL 38

Author Comment

by:Insignificant Volunteer
Comment Utility
Yeah, rub it in Chris.
I've got a spindle of 25 Dual Layer DVD blanks + 100 CD-R's + 1 x 80GB + 3 x 40GB + 5 x 20GB + 6 x 10GB + other odds and sods IDE HDD's + an 80GB external USB HDD here.  Now how much storage is that for those ???'s that may come in handy some day?  I just wish there was a motherboard (and specification) that allowed connection of 15 x IDE drives at once, although FDISK would be a real bugger to navigate :-)

SATA's definitely a bonus.  I've got a Micro-ATX Shuttle M/B with SATA and PATA interfaces still in its anti-stat bag since eBay induced me into buying it for a good price.  I still need a devent AMD CPU for it, and hopefully a SATA Drive when my insurance company pays out (on the top-spec computer that was pinched ;-).  I don't know what I'll do with it.  Maybe set it up in my livingroom for multimedia stuff, when I eventually get around to assembling it.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now