I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management). I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data. They can see the
drive, but are unable to find and files to salvage, suggesting it may be
physically damaged or have damaged sectors.

Can anyone suggest any other software which may have more luck recovering
data from the drive. Would I likely have any more success after low-level
formatting the drive and then scanning for lost files. Reasoning being that
I've already lost the index for what's on the drive, and at least formatting
might work around any damaged sectors. Any ideas?

Thanks.

"]v[etaphoid" <(E-Mail Removed)> wrote:

> I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
> up in BIOS, but not in Windows. It is viewable in Device Manager, but
> there's no sign of it in Disk Management (Administrative Tools -> Computer
> Management). I've tried Easy Recovery Pro and the trial version of
> GetDataBack for NTFS, but neither seem to salvage any data.

Why should they?

> They can see the
> drive, but are unable to find and files to salvage, suggesting it may be
> physically damaged or have damaged sectors.

Why do you think so? Did you run any diagnostics on the drive to reach that
conclusion?

> Can anyone suggest any other software which may have more luck recovering
> data from the drive.

What you need isn't more software, but a clue on what you are doing!

> Would I likely have any more success after low-level
> formatting the drive and then scanning for lost files.

Where from do you take such stupid idea?

> Reasoning being that
> I've already lost the index for what's on the drive, and at least formatting
> might work around any damaged sectors. Any ideas?

NTFS places the MFT mirror right in the middle of the partition. The mirror
copy of the boot sector is at the end of the partition, in its last sector.
Rebuilding the MBR is just ten seconds.

Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
E-mail sent in reply to this post will not be considered private and
will be answered in the newsgroup. Top posting is not appreciated!

"Zvi Netiv" <zvi@my_domain.com> wrote in message
news:(E-Mail Removed)...
> "]v[etaphoid" <(E-Mail Removed)> wrote:
>
> > I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It
shows
> > up in BIOS, but not in Windows. It is viewable in Device Manager, but
> > there's no sign of it in Disk Management (Administrative Tools ->
Computer
> > Management). I've tried Easy Recovery Pro and the trial version of
> > GetDataBack for NTFS, but neither seem to salvage any data.
>
> Why should they?

Call me crazy, but I reasoned that data recovery software might be a good
starting point to recover data.

> > They can see the
> > drive, but are unable to find and files to salvage, suggesting it may be
> > physically damaged or have damaged sectors.
>
> Why do you think so? Did you run any diagnostics on the drive to reach
that
> conclusion?

That was the diagnosis from the aforementioned data recovery software.

> > Can anyone suggest any other software which may have more luck
recovering
> > data from the drive.
>
> What you need isn't more software, but a clue on what you are doing!

And clearly that's unlikely to be provided by someone as angry at the world
as yourself.

> > Would I likely have any more success after low-level
> > formatting the drive and then scanning for lost files.
>
> Where from do you take such stupid idea?

I was theorising that if the MBR had been erased beyond repair, formatting
the drive might at least allow me to search for the orphaned NTFS files,
rather than performing what has thus far been a fruitless RAW search. Of
course, in my haste to seek informed opinions on the subject, I mistakenly
suggested a low-level format may be appropriate. I did of course mean a
high-level or "Quick" format that would preserve the contents if not the
index of my files. Not that it would have likely made any difference to you.

> > Reasoning being that
> > I've already lost the index for what's on the drive, and at least
formatting
> > might work around any damaged sectors. Any ideas?
>
> NTFS places the MFT mirror right in the middle of the partition. The
mirror
> copy of the boot sector is at the end of the partition, in its last
sector.
> Rebuilding the MBR is just ten seconds.

Thank you for this first piece of constructive information. Clearly you do
know something of the nature of harddrive operation. Now if only you could
combine that with an incling of normal human behaviour instead of getting
angry at usenet posts and looking down your crooked nose at those of us who
are more fully conversant with human interaction than the mechanical
operation of our hard-drives, you could form an altogether more valued
member of the species.

Thank you.

"]v[etaphoid" <(E-Mail Removed)> wrote in message
news:3f9b5730$0$23610$(E-Mail Removed)...
> I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It
shows
> up in BIOS, but not in Windows. It is viewable in Device Manager, but
> there's no sign of it in Disk Management (Administrative Tools -> Computer
> Management).

DiskManagement doesn't even see the PHYSICAL drive?

> I've tried Easy Recovery Pro and the trial version of
> GetDataBack for NTFS, but neither seem to salvage any data. They can see
the
> drive, but are unable to find and files to salvage, suggesting it may be
> physically damaged or have damaged sectors.
>

If DiskManagement doesn't see the Physical drive then the Windows versions
of EasyRecovery and GetDataBack won't either as they rely on Windows API
calls to actually access the drive.

> Can anyone suggest any other software which may have more luck recovering
> data from the drive. Would I likely have any more success after low-level
> formatting the drive and then scanning for lost files.

No, no low level formatting please! Low level formatting implies ALL data
will be overwritten!

> Reasoning being that
> I've already lost the index for what's on the drive, and at least
formatting
> might work around any damaged sectors. Any ideas?
>

Well, I still don't get if the Physcical disk isn't detected or that the
partitions/volumes are 'gone'. First step would be to confirm or deny
physical damage - the diagnostic tools from the drive manufacturer are a
good starting point.

* If the physical drive is there but the partitions/volumes aren't: -
Rebuilding the partition table may be all that is required. Our tool
DiskPatch is often able to do so.

* If the physical drive isn't there: - can you 'see' the physical drive from
DOS (for example fdisk/status)?

If you find evidence for physical damage you may try to clone the drive to a
good one and attempt to repair damage on the clone or use EasyRecovery /
GetDataBack to recover data from the clone. Our tool DiskPatch can be used
to clone a disk, DiskPatch can deal with unreadable sectors on the source
drive.

Kind regards,
Joep
--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.

"]v[etaphoid" <(E-Mail Removed)> wrote in message
news:3f9b86c0$0$23611$(E-Mail Removed)...
> > NTFS places the MFT mirror right in the middle of the partition. The
> mirror

Hmm ... there always seem to be quite some confusion and rumours about NTFS
placing *something* in the middle, I have examined this and found the
following:

NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
the middle of the partition. For newer NTFS versions formatted with WinNT 4
and up (including 2000 and XP) I have never been able to find any default
behavior that writes anything holding 'meta information' including the MFT,
the MFT mirror, backup boot sector etc., to the middle of the partition.

> > copy of the boot sector is at the end of the partition, in its last
> sector.
> > Rebuilding the MBR is just ten seconds.
>
> Thank you for this first piece of constructive information. Clearly you do
> know something of the nature of harddrive operation. Now if only you could
> combine that with an incling of normal human behaviour instead of getting
> angry at usenet posts and looking down your crooked nose at those of us
who
> are more fully conversant with human interaction than the mechanical
> operation of our hard-drives, you could form an altogether more valued
> member of the species.
>

Well, to be honest, I felt some frustration as well because of your post, as
you make some *stupid* suggestions yourself. 'Low level formatting' being
the one that got my adrenaline going ... ;-) ... indeed this is more
something that I need 'working on'.

Kind regards,
Joep

"Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
news:5ced6$3f9b9f77$3eddca68$(E-Mail Removed)...
> "]v[etaphoid" <(E-Mail Removed)> wrote in message
> news:3f9b5730$0$23610$(E-Mail Removed)...
> > I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It
> shows
> > up in BIOS, but not in Windows. It is viewable in Device Manager, but
> > there's no sign of it in Disk Management (Administrative Tools ->
Computer
> > Management).
>
> DiskManagement doesn't even see the PHYSICAL drive?

Nope. Lists Disk 0 and then Disk 2, in addition to the optical drives.

> > I've tried Easy Recovery Pro and the trial version of
> > GetDataBack for NTFS, but neither seem to salvage any data. They can see
> the
> > drive, but are unable to find and files to salvage, suggesting it may be
> > physically damaged or have damaged sectors.
> >
>
> If DiskManagement doesn't see the Physical drive then the Windows versions
> of EasyRecovery and GetDataBack won't either as they rely on Windows API
> calls to actually access the drive.

Both claim to be able to retrieve data from drives which Windows doesn't
recognise, and both did at least manage to see the drive, if not the
partition on it. That said, as you suggest I've found little success with
either actually retrieving any data.

> > Can anyone suggest any other software which may have more luck
recovering
> > data from the drive. Would I likely have any more success after
low-level
> > formatting the drive and then scanning for lost files.
>
> No, no low level formatting please! Low level formatting implies ALL data
> will be overwritten!

Sorry, I realised that mistake after I posted it. As I mentioned in an
earlier post, what I meant was to say was a Quick format - basically the
exact opposite of a low-level format!

> > Reasoning being that
> > I've already lost the index for what's on the drive, and at least
> formatting
> > might work around any damaged sectors. Any ideas?
> >
>
> Well, I still don't get if the Physcical disk isn't detected or that the
> partitions/volumes are 'gone'. First step would be to confirm or deny
> physical damage - the diagnostic tools from the drive manufacturer are a
> good starting point.
>
> * If the physical drive is there but the partitions/volumes aren't: -
> Rebuilding the partition table may be all that is required. Our tool
> DiskPatch is often able to do so.

Seems like the most likely scenario, although I haven't confirmed this via
any WD diagnostics. But the fact that is recognised in BIOS and during POST,
but not Windows gives some hope, as does it's appearance as an
"Unrecognised" drive on EasyRecovery Pro.

> * If the physical drive isn't there: - can you 'see' the physical drive
from
> DOS (for example fdisk/status)?
>
> If you find evidence for physical damage you may try to clone the drive to
a
> good one and attempt to repair damage on the clone or use EasyRecovery /
> GetDataBack to recover data from the clone. Our tool DiskPatch can be used
> to clone a disk, DiskPatch can deal with unreadable sectors on the source
> drive.
>
> Kind regards,
> Joep

Thanks for all the advice, it is much appreciated. I'm just about to run a
couple of checks using the Recovery Console (still foolishly hoping it's
just a damaged boot sector or MBR), and depending on how that turns out, I
might try some of your suggestions.

Cheers.

> --
> D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools
>
> http://www.diydatarecovery.nl
> http://www.diydatarecovery.com
>
> Please include previous correspondence!
>
> DiskPatch - MBR, Partition, boot sector repair and recovery.
> iRecover - FAT, FAT32 and NTFS data recovery.
> MBRtool - Freeware MBR backup and restore.

"Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
news:c4e36$3f9ba1f6$3eddca68$(E-Mail Removed)...
> "]v[etaphoid" <(E-Mail Removed)> wrote in message
> news:3f9b86c0$0$23611$(E-Mail Removed)...
> > > NTFS places the MFT mirror right in the middle of the partition. The
> > mirror
>
> Hmm ... there always seem to be quite some confusion and rumours about
NTFS
> placing *something* in the middle, I have examined this and found the
> following:
>
> NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
> the middle of the partition. For newer NTFS versions formatted with WinNT
4
> and up (including 2000 and XP) I have never been able to find any default
> behavior that writes anything holding 'meta information' including the
MFT,
> the MFT mirror, backup boot sector etc., to the middle of the partition.
>
> > > copy of the boot sector is at the end of the partition, in its last
> > sector.
> > > Rebuilding the MBR is just ten seconds.
> >
> > Thank you for this first piece of constructive information. Clearly you
do
> > know something of the nature of harddrive operation. Now if only you
could
> > combine that with an incling of normal human behaviour instead of
getting
> > angry at usenet posts and looking down your crooked nose at those of us
> who
> > are more fully conversant with human interaction than the mechanical
> > operation of our hard-drives, you could form an altogether more valued
> > member of the species.
> >
>
> Well, to be honest, I felt some frustration as well because of your post,
as
> you make some *stupid* suggestions yourself. 'Low level formatting' being
> the one that got my adrenaline going ... ;-) ... indeed this is more
> something that I need 'working on'.

I don't claim to be an expert on the subject, and save for the "low-level
format" error which I've already explained twice, I don't know what else
would constitute a stupid suggestion. I'm open to any suggestions and was
just trying to offer as much information and observations as possible.

Thanks to all who've helped out so far.

"Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
news:5ced6$3f9b9f77$3eddca68$(E-Mail Removed)...
> * If the physical drive is there but the partitions/volumes aren't: -
> Rebuilding the partition table may be all that is required. Our tool
> DiskPatch is often able to do so.
>
> * If the physical drive isn't there: - can you 'see' the physical drive
from
> DOS (for example fdisk/status)?
>
> If you find evidence for physical damage you may try to clone the drive to
a
> good one and attempt to repair damage on the clone or use EasyRecovery /
> GetDataBack to recover data from the clone. Our tool DiskPatch can be used
> to clone a disk, DiskPatch can deal with unreadable sectors on the source
> drive.

Joep,

I downloaded the trial version of DiskPatch and gave it a try. Here were the
results:

If I ran it with the faulty drive attached as the only drive as master on
IDE0, the program would get as far as the welcome screen. Hitting any key
kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"

When the faulty drive was attached as the slave drive on IDE0, the program
booted fine, initially set to view the master drive at drive0. After
changing the selected drive to drive1, I started to get a few errors,
although it did manage to read the MBR. However, it warned me that it was
unable to go any further as it would be risking further physical damage, and
recommended I do a surface scan. The surface scan quickly yielded over 255
errors, at which point it ceased the scan.

At one stage, the error was reported: Int13h_error_trap: extended int13h
error @ dskpatch.pcb.

I could not attempt to repair the MBR, as I was only using your trial
version.

I am willing to purchase the full version if it will either let me repair
the MBR so that I can extract as many files as possible from the faulty
drive, or create an image of it on another drive, from which I could copy
salvaged files. In your opinion, does it sound like this would be possible
using your software?

Any other advice you can offer is appreciated.

Thanks.

Microsoft claims WinXP puts the MFT at the 3GB mark. Did you test with large
partitions?

"Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
news:c4e36$3f9ba1f6$3eddca68$(E-Mail Removed)...
|
| NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
| the middle of the partition. For newer NTFS versions formatted with WinNT 4
| and up (including 2000 and XP) I have never been able to find any default
| behavior that writes anything holding 'meta information' including the MFT,
| the MFT mirror, backup boot sector etc., to the middle of the partition.
|

"]v[etaphoid" <(E-Mail Removed)> wrote in message
news:3f9bbae7$0$23594$(E-Mail Removed)...
>
> I downloaded the trial version of DiskPatch and gave it a try. Here were
the
> results:
>
> If I ran it with the faulty drive attached as the only drive as master on
> IDE0, the program would get as far as the welcome screen. Hitting any key
> kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"
>

That's a bad sign ... :-(

> When the faulty drive was attached as the slave drive on IDE0, the program
> booted fine, initially set to view the master drive at drive0. After
> changing the selected drive to drive1, I started to get a few errors,
> although it did manage to read the MBR. However, it warned me that it was
> unable to go any further as it would be risking further physical damage,
and
> recommended I do a surface scan. The surface scan quickly yielded over 255
> errors, at which point it ceased the scan.
>

Again, a bad sign. For whatever reason it's not able to read sectors.

> I could not attempt to repair the MBR, as I was only using your trial
> version.

Yes, but I'm afraid that it is going to be difficult anyway, it seems
there's trouble reading the disk, writing to it it very unlikely.

>
> I am willing to purchase the full version if it will either let me repair
> the MBR so that I can extract as many files as possible from the faulty
> drive, or create an image of it on another drive, from which I could copy
> salvaged files. In your opinion, does it sound like this would be possible
> using your software?
>
> Any other advice you can offer is appreciated.
>

I'd now really try the drive manufacturers diagnostic utility to see what it
has to say about that drive first.


--
Joep - http://www.diydatarecovery.nl