NTFS partition disappeared. gone. vanished.

K

KC

And no, it's *not* because I booted into Windows 98.

The drive in question is a 200 gig WD hard drive, second physical
drive in system, with 3 partitions. After trying to format the 2nd
partition in Windows 2000 disk manager and having it say "format
failed" two times in a row, I decided to reboot and try again. On
reboot, the THIRD partition (containing all the data I now seek to
recover) has vanished, and the entire extended partition is now empty
and unallocated. So, I know the data is there, probably a corrupt
partition table?

The details...

The 200 gig is a brand new drive. It came with a Promise Ultra 100 TX2
ATA100 controller. I originally set it up with that, using a 5 gig
partition for the system and 2 equally sized partitions of about 90
gigs for storage. After running it awhile, I found that Winamp
playback would often cutout and ismietermined it was the Promise card
(and perhaps the fact that this is only a Pentium II 400 system with
256 megs ram). Decided I just wanted this drive for mass storage
anyway, I took out the promise card, put my old harddrive in to run
the system and set the 200 gigger as slave.

Problems begin: Several directories show up as ASCII gibberish. I
attribute it to the fact that I was using FAT32 for the 2 90 gig
partitions (I eventually wanted them to be accessible by Linux). I
move all data to partition 2, format partition 3 as NTFS, move all the
data onto that, then try to format partition 2. Then the error,
something along the lines of "unable to complete format" or whatever.
Then the reboot, then... no more partition 2 or 3. Also, the old
system files on partition 1 have all but vanished, all that remains is
a folder with .chk files (though I never ran scandisk on it). The
volume label is the same though.

Partition Magic indicated that the end of the last partition exceeded
the end of the physical disk, making me think that this problem may
have begun when switching from the Promise controller back to my
motherboard's IDE controller? Comments?

Reading newsgroup posts I came across some from Joep of
(www.DIYDataRecovery.NL). I ran his DiskPatch software and it
indicated that the original NTFS partition table and the backup are
identical.

At no point did I run any disk utilities and write any changes to
disk, so unless Windows 2000 has automatically made some severe
changes, I'm thinking things should be recoverable. I've dealt with
data recovery before, but never with NTFS. Any suggestions greatly
appreciated.

-Kent
 
J

Joep

Hi,

KC said:
Partition Magic indicated that the end of the last partition exceeded
the end of the physical disk, making me think that this problem may
have begun when switching from the Promise controller back to my
motherboard's IDE controller? Comments?

What last partition, if I read your post correctly, you the extended now
appears as 'unallocated'. Is it the extended that overlaps the end of disk
then? Does this error disappera when the disk is attached to the Promise
controller again?
Reading newsgroup posts I came across some from Joep of
(www.DIYDataRecovery.NL). I ran his DiskPatch software and it
indicated that the original NTFS partition table and the backup are
identical.

There is not such thing as an NTFS partition table backup, however, an NTFS
partition keeps a backup of the boot sector (the first sector of the actual
partition). When DiskPatch was able to compare the 2 (the boot sector with
the backup), then the partition it did this for is actually defined in the
partition table.

So this is where I become confused, as I also read that the extended is
empty and unallocated ... So what NTFS partition did DiskPatch compare those
sectors for?

Use the diagnostic tool partinfo from the PartitionMagic rescue diskette:

partinfo>filename.txt [enter] ... the report will show current state of
partition tables for all your disks.

Also, I'd suggest to move the drive back to the controller that it was
attached to when it was originally partitioned.

Joep
 
K

KC

Since the original post I discovered the problem was likely caused by
putting the 200 gig disk on my motherboard's IDE interface and not
having 48-bit LBA enabled in Windows 2000 (SP4). On trying to write
past the 137 gig barrier, corruption began.

Anyway, the real issue for me now is getting back any lost data,
mostly large .wav files. I had been recording my vinyl collection to
disk, so I can always re-record everything but it's not exactly a fast
and easy process.

I have put the drive back on the Promise controller card. Here's the
partition info from Partition Magic:


===============================================================================
Disk Geometry Information for Disk 2:
24321 Cylinders, 255 Heads, 63 Sectors/Track
Warning: Logical drive chain points to sector without partition table.
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect
NumSects
================================================================================
0 0 80 0 1 1 07 638 254 63 63
10,265,472
0 1 00 639 0 1 0F 768 254 63 10,265,535
380,451,330
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 1 00 639 0 1 0F 24320 254 63 10265535
380451330


=====================================================================
Partition Information for Disk 2: 190,779.7 Megabytes
Volume PartType Status Size MB PartSect # StartSect
TotalSects
=====================================================================
D: NTFS Pri,Boot 5,012.4 0 0 63
10,265,472
ExtendedX Pri 185,767.3 0 1 10,265,535
380,451,330
EPBR Log 0.0 None -- 10,265,535
63
Unallocated Log 185,767.2 None -- 10,265,598
380,451,267


======================================================================
Boot Record for drive D: (Drive: 2, Starting sector: 63, Type: NTFS)
======================================================================
1. Jump: EB 52 90
2. OEM Name: NTFS
3. Bytes per Sector: 512
4. Sectors per Cluster: 8
5. Reserved Sectors: 0
6. Number of FATs: 0
7. Root Dir Entries: 0
8. Total Sectors: 0
9. Media Descriptor: 0xF8
10. Sectors per FAT: 0
11. Sectors per Track: 63 (0x3F)
12. Number of Heads: 255 (0xFF)
13. Hidden Sectors: 63 (0x3F)
14. Total Sectors (>32MB): 0 (0x0)
15. Unused: 0x80008000
16. Total NTFS Sectors: 10265471
17. MFT Start Cluster: 4
18. MFT Mirror Start Clust: 641591
19. Clusters per FRS: 246
20. Clusters per Index Blk: 1
21. Serial Number: 0xD054094054092B34
22. Checksum: 0 (0x0)
23. Boot Signature: 0xAA55

(end of info)

In Windows 2000 disk manager, the space beyond the primary partition
shows as 181.41 GB Free Space and is not color coded as an extended
partition.
 
A

Alexander Grigoriev

You should not have done that. You needed 48 bit address support in OS to
access 200 GB disk. Promise controller and its driver supported that, but
your Win2K didn't. As a result, the disk structure is screwed up now. You're
lucky your boot partition didn't get overwritten (but nobody can be so
sure).
 
P

Plato

KC said:
Anyway, the real issue for me now is getting back any lost data,
mostly large .wav files. I had been recording my vinyl collection to

Just use your backups you've made on two different types of media. No
problem.
 
J

Joep

Okay. The extended is there but, the first sector of the extended which is
again a partition table contains no entried for:

- the first logical
- a pointer to the next partition table where the next logical is defined in

With DiskPatch do:

Repair MBR > FixMBR tables ... Select SKIP for any partitions it finds. Are
the other 2 NTFS partitions detected? If so we can rebuild the partition
tables (please post the logfile (dskpatch.log)) in our support forum and
we'll get back with directions.

If they're not detected then recovering the complete partitions is probably
more difficult. For recovering individual files and folder our tool iRecover
could be tried (first try demo!), of course there's tools from other vendors
as well that could be tried instead. The iRecover demo allows contents of
one folder to be recovered each time you run it so you can actually verify
if files are recovered intact.

Joep
 
K

KC

Partitions were detected! Here's the log:

PQStuffDetect=TRUE
Ext13hInstalled function: -1 BIOS drive 81h
(Succes.)

Version: EDD-3.0
Support:
- Extended disk access functions
- Enhanced disk drive functions
Ext13hDriveParams function: -1
Flags:
- DMA boundary errors handled transparently
Cylinders: 65535
Heads: 16
Sectors: 63

Total sectors: 390721968
Sector size: 512
------------------------------------------
logical heads 255
logical sects/track 63

dumping sector @ 0 as hex:
000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C ³ 3ÀŽÐ¼.|ûP.P.ü¾.|
016 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ³ ¿..PW¹å.ó¤Ë¾¾.±.
032 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B ³ 8,|.u.ƒÆ.âõÍ.‹.‹
048 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC ³ îƒÆ.It.8,tö¾..N¬
064 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25 ³ <.tú»..´.Í.ëò‰F%
080 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05 ³ –ŠF.´.<.t.´.<.t.
096 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4 ³ :Äu+@ÆF%.u$»ªUP´
112 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74 ³ AÍ.Xr.ûUªu.öÁ.t
128 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF ³ .ŠàˆV$Ç.¡.ë.ˆf.¿
144 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E ³ ..¸..‹Ü3Ƀÿ..‹N
160 25 03 4E 02 CD 13 72 29 BE 75 07 81 3E FE 7D 55 ³ %.N.Í.r)¾u.>þ}U
176 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 3F 07 EB ³ ªtZƒï.Ú…öuƒ¾?.ë
192 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB ³ Š˜‘R™.F..V.è..Zë
208 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 81 27 32 00 ³ ÕOtä3ÀÍ.ë¸..'2.
224 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4 ³ V3öVVRP.SQ¾..V‹ô
240 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72 ³ PR¸.BŠV$Í.ZXd.r
256 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49 ³ (e-mail address removed)€Ç.â÷ø^ÃëtI
272 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E ³ nvalid partition
288 20 74 61 62 6C 65 2E 20 53 65 74 75 70 20 63 61 ³ table. Setup ca
304 6E 6E 6F 74 20 63 6F 6E 74 69 6E 75 65 2E 00 45 ³ nnot continue..E
320 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 ³ rror loading ope
336 72 61 74 69 6E 67 20 73 79 73 74 65 6D 2E 20 53 ³ rating system. S
352 65 74 75 70 20 63 61 6E 6E 6F 74 20 63 6F 6E 74 ³ etup cannot cont
368 69 6E 75 65 2E 00 00 00 00 00 00 00 00 00 00 00 ³ inue............
384 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00 ³ ...‹ü.W‹õË......
400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
416 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
432 00 00 00 00 00 00 00 00 0F 01 89 3A 00 00 80 01 ³ ..........‰:..€.
448 01 00 07 FE BF 7E 3F 00 00 00 80 A3 9C 00 00 00 ³ ...þ¿~?...€£œ...
464 81 7F 0F FE FF 00 BF A3 9C 00 02 3A AD 16 00 00 ³ .þÿ.¿£œ..:­...
480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
496 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ³ ..............Uª

PQStuffDetect=FALSE

390721967
======================================================================
-> probable partition found at cyl 0 head 1 sect 1
bootsector information :
hidden sectors : N/A
total sectors : 10265472
volume label : N/A
file system descriptor : NTFS
0 1 1 07 638 254 63 63 10265472
======================================================================
-> probable partition found at cyl 639 head 1 sect 1
bootsector information :
hidden sectors : N/A
total sectors : 190225602
volume label : N/A
file system descriptor : NTFS
639 1 1 07 1023 254 63 10265598 190225602
======================================================================
-> probable partition found at cyl 12480 head 1 sect 1
bootsector information :
hidden sectors : N/A
total sectors : 190225602
volume label : N/A
file system descriptor : NTFS
1023 1 1 07 1023 254 63 200491263 190225602
Scan complete.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top