We help IT Professionals succeed at work.

Master Boot Record and Master File Table corruption on external drive with critical data, anyway to rebuild without compromising data?

Manzola
Manzola asked
on
474 Views
Last Modified: 2008-01-09
The only way I can properly begin this question is by first stating how devastated I will be if  I lose ten years worth of photos, music, videos etc. Ironically I was in the process of creating a copy of all the data on to another external drive, in order to have two copies in case of failure. I let it run and came back into the room to find an error message that now I cannot recall, and suddenly Windows gave me the "unable to access drive" error. It is still being recognized by windows as "local disk D" but it will not let me into the drive.  Chkdsk will not run on the drive and i'm afraid of doing anything for fear of ruining the data. I know it is still in there, it has to be because the disk is fully functional. What can I do in this situation to perhaps "rebuild" the MFT and MBR sector by sector or who knows what so that I can see the structure of the drive once again. Thank you in advance for any help!!!

-By the way i am running  Windows XP sp2.
Comment
Watch Question

CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
CERTIFIED EXPERT
Top Expert 2007

Commented:
1) Use an imaging program ( Ghost or Acronis ) to create a direct byte for byte copy of the bad drive, preferably by removing it from it's case and hooking it in directly to a computer.

2) Once you have an image, you can try several recovery methods.

Do not use the drive to install any of this software.

Remove it from your PC and slave it to another machine.  Everytime you write data to the disk you decrease the chance of successfully recovering erased data from it.  By installing Windows you have already overwritten a large chunk of the previous disk contents.

From  war1
1. Data Recovery: GetDataBack is good at recover data from formated drive.

Free:
PC Inspector            http://www.pcinspector.de/file_recovery/UK/welcome.htm
Restoration                  http://www.snapfiles.com/get/restoration.html              
Active Undelete            http://www.snapfiles.com/get/activeundelete.html
Flash Recovery            http://www.snapfiles.com/get/smartrecoverontracky.html
TestDisk & utilities      http://www.cgsecurity.org

Paid:
GetDataBack                  http://www.runtime.org/      
FreeUndelete            http://officerecovery.com/freeundelete/index.htm
Recovery My Files            http://www.recovermyfiles.com/
Stellar                  http://www.stellarinfo.com/            
Restorer 2000            http://www.bitmart.net/
Ontrack                  http://www.ontrack.com/
Easy Recovery            http://www.ontrack.com/easyrecoveryprofessional/
Zero Assumption            http://www.z-a-recovery.com/setup.exe
 
2. You may need to unhide hidden files to see them. Open Windows Explorer folder and select Tools > Folders Options > View. Check "Show hidden files and folders". Click OK.

3. You may need to take ownsership of folders and files to access them.
http://support.microsoft.com/?kbid=308421
-------------

I hope this helps !

Author

Commented:
Thanks for the prompt reply! I should note I have used several programs to attempt to recover data, is this potentially a problem? I have managed to get barely anything out of it, most of it is raw data.  I also have EasyRecovery but that one was the worst at finding anything. I am at the moment running getdataback but it has thus far found 10000 files out of my 90000+. I guess what I am trying to do is find a way of re-building the mft or mbr, if at all possible. What ever it takes. if i have to learn something extremely complex so be it. It would be even better if there was a program that could do it by itself.

Author

Commented:
SysExpert, do these data recovery programs or testing utilities write on to the disk? I have ran several of them that scan the data to figure out what can be recoverable, but I have not done anything that would write onto the drive. I don't have any istallations on that drive, it is purely external and used for backup. So ironically I am trying to backup the backup drive. Would slaving it on my system have the potential to write data onto a NTFS volume that is not recognized by the system ( it shows up on my computer as local disk D) but it will not let me access the files inside (error).  
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
Whast teh error?

Personally, I dont think they write anything, but you are doing more activity in excessive reading, and if there are physical errors, you might escalate how fast they go downhill....

Are there any DISK, ATAPI, or NTFS errors in the event logs>System?
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
"Whast teh error?"

Should have read Whats teh error? Anything besides the Unable To Access Drive?

Author

Commented:
Here are the detailed errors from the event logs, and thanks for mentioning it forgot about this.

The fist error on the log before the crash is:

"An error was detected on device\Device\Harddisk1\D during a paging operation

Then it gives

"The system failed to flush data to the transaction log. Corruption may occur"

It gives about 40 more of that error in the log before it finally gives this one, which is the one I remember that popped up on my screen, right after I clicked ok I could no longer access my drive:


Windows- Delayed Write Failed: Windows was unable to save all the data for the file F:\$mft. The data has been lost.


I hope this helps, I truly do.
CERTIFIED EXPERT
Top Expert 2007
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Drive has passed DFT, I will try the maxtor drive utilities to double check. The I will also make an image copy of the disk because I am running all of these programs without having done so yet
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
Can you upload the .dmp files from c:\windows\minidump to http://www.ee-stuff.com? We might be able to isolate the faulting module....

I dont believe it is a hidden folder.....

But you can always verify if it is even set to minidump...

Contro Panel>System>Advanced>Startup and Recovery, and make sure it is checked to do a small minidump, and note the directory...

Author

Commented:
I have the minidump on my default. I looked for it everywhere (it is supposed to be located on the system root\minidump. I unchecked hide hidden folders and I still can't find it! I even searched for .dmp files in my system and found none? Not sure what is going on here but I know it would help to have it. Any other suggestions?
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
Is your SWAP file on another Drive?

Author

Commented:
No it's on the Main drive
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
Thats odd.....

Thats the only thing I can think of that would prevent it from dumping....

Might try cycling through the dumoing, by disabling it, and rebooting. Then re enable it and even change the location....

Author

Commented:
It is strange. I tried what you told me to do, it still wont show up for some reason.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.