Recovering Lost Data From A Corrupted HDD - findpart

[David]

Hi all, & Svend Olaf if you are out there...

/STARTINTRO - Non technical background dribble paragraph here...
I am trying to recover some data from a corrupted Western Digital
120GB HDD that I have been using with my "trusty" old Abit BP6
motherboard. For those of you that aren't aware this 8+ year old
machine uses the Highpoint HPT366 chipset that brings & enables the
"amazingly fast" (well it was for its time) ATA-66 technology.
However, apparently, there have been may reports of these disk
controllers failing. I suppose after 8 years of service, many
computer components will fail. :-(

After 8 years of faithful service, my HDD controller decided to "join
the team" & along the way it also very quickly managed to corrupt a
large amount of data on my HDD. Yes, I do backups, but unfortunately,
not regularly enough.
After failing to boot, I decided to see what was wrong... here follows
the techical bit...
/ENDINTRO

I ran Svend Olaf's findpart utility first on my corrupted NTFS 120GB
dynamic disk - drive (number 2)
-- findpart 2

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS
CHS
0 - 07 63234420417114463 0 1 1 14591 254 63 B
OK

No FATs found.
There were sectors, which could not be read.
First read error in this search CHS: 5432 0 33
Last read error in this search CHS: 5432 0 33

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS
CHS
0 1*42 63234420417114463 0 1 1 14591*254 63
OK
0 2 42234420480 16065 7 14592* 0 1 14592*254 63
OK

****************************************************************************

I didn't like the look of the message above telling me that there were
"sectors that could not be read", so I thought I would try to see how
much (MB) of files could be by running the following both in DOS mode
& in Windows - to be sure there was not any Windows driver issues
-- findntfs 2 summary


FindNTFS, version 1.54.
Copyright Svend Olaf Mikkelsen, 2005.

OS: DOS 8.00

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114471

CHS 0/1/1 LBA: 63

Directories: 3114
Files: 37651
Trees: 84
Exe/dll files: 2357
Exe/dll files signature: 2354
Not referenced files: 350
Cluster KB: 4
MFT cluster no: 786432
MFT size: 199704576
MFT cluster bytes: 4096
Listed files MB: 12647
Code page used: 437
****************************************************************************

This was also not good to see. Only 12647 MB of listed files, when I
know that my 120GB drive was around 80% full, it should be closer to
around 100000 MB.

So, my questions:
- Is the corruption on this drive so bad that I can only see 12% of
what is there?
- Is there something else I can do to find the remainder of these
files?
- Being a Dynamic Windows Disk, is there something unusual with the
MFT records that I need to adjust for to find the remaining data on
the disk?

I have run a findpart findfile 2 0 14591 fp-a.txt, but I am not sure
on how to interpret these results & how I get findntfs to recover more
than just the original 12647 MB & what I should try next. I am happy
to compress this file & send it.

Can anyone out there help me.
Many Thanks.
David.

 

[Svend Olaf Mikkelsen]

I have run a findpart findfile 2 0 14591 fp-a.txt, but I am not sure
on how to interpret these results & how I get findntfs to recover more
than just the original 12647 MB & what I should try next. I am happy
to compress this file & send it.

Can anyone out there help me.
Many Thanks.
David.

Mail me that file. The question is if file records are lost, or just
not found by the default FindNTFS search.

One situation that FindNTFS does not handle is fragmented Master File
Table with no MFT file record or mirror record found.

A fragmented Master File Table has its locations defined in the file
record for the Master File Table and the mirror of that file record.
There is no mirror from the entire Master File Table.

 

[Svend Olaf Mikkelsen]

FindNTFS, version 1.54.
Copyright Svend Olaf Mikkelsen, 2005.

OS: DOS 8.00

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114471

CHS 0/1/1 LBA: 63

You also can try the Windows version (if there is no risk that Windows
will access the partition and make further damage), and you can try:

findntfs 2 0 1 1 alt summary fp-a.txt

The "alt" option will make some alternative choices during the search.

 

[David]

Mail me that file. The question is if file records are lost, or just
not found by the default FindNTFS search.

One situation that FindNTFS does not handle is fragmented Master File
Table with no MFT file record or mirror record found.

A fragmented Master File Table has its locations defined in the file
record for the Master File Table and the mirror of that file record.
There is no mirror from the entire Master File Table.

I have e-mailed the compressed fp-a.txt output file... I will try
running a findntfs 2 0 1 1 alt summary fp-a.txt & seeing if it is any
different....

Thank you very much for all your help, I really appreciate it.
Kind Regards,
David.

 

[Svend Olaf Mikkelsen]

I have e-mailed the compressed fp-a.txt output file... I will try
running a findntfs 2 0 1 1 alt summary fp-a.txt & seeing if it is any
different....

Thank you very much for all your help, I really appreciate it.
Kind Regards,
David.

From FindNTFS Findfile:


391 160 25 6291519 F 0 786432 $MFT
Size: 199704576
Allocated: 199704576
Fragments: 1
Clusters: 48756
Cluster KB: 4
Boot CHS: 0 1 1
Offset MB: 3072
Time: 2003-03-14 00:27:16
Access: 2005-01-29 08:24:27


415 230 55 6681519 F 195000 22889596
415 230 57 6681521 F 195001 28701423
415 230 59 6681523 F 195002 19391093
415 230 61 6681525 F 195003 19391098
415 230 63 6681527 F 195004 19391103
415 231 2 6681529 F 195005 610126
415 231 4 6681531 F 195006 610131
415 231 6 6681533 F 195007 610136
415 231 8 6681535 F 195008 565651
415 231 10 6681537 F 195009 565656
415 231 12 6681539 F 195010 565661
415 231 14 6681541 D 195011
415 231 16 6681543 F 195012 Small
415 231 18 6681545 F 195013 303458

The Master File Table has one fragment, and it seems as 195013 files
are defined without any large gaps. So although nothing is certain
until the work is finished, it seems as it may be possible to recover
more files than shown in the FindNTFS for DOS output.

Example:

415 230 61 6681525 F 195003 19391098

At cylinder 415, head 230, sector 61 (LBA 6681525) there is a 1024
bytes file record for a file with cluster 19391098 as first cluster.
The number 195013 is the file record number, which is seen in
partitions created by Windows XP. For Windows 2000 and earlier NT
versions the file records does not contain the file record number.

 

[David]

You also can try the Windows version (if there is no risk that Windows
will access the partition and make further damage), and you can try:

findntfs 2 0 1 1 alt summary fp-a.txt

The "alt" option will make some alternative choices during the search.

*************************************************************************

OK, After running a "findntfs 2 0 1 1 alt summary fp-b.txt" it looks
like I still get the same number of files as I did previously. Here
is what I get in the output:

FindNTFS, version FP 4.63 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 0/1/1 LBA: 63

Options: Alt

Directories: 3114
Files: 37651
Trees: 84
Exe/dll files: 2397
Exe/dll files signature: 2394
Not referenced files: 350
Cluster KB: 4
MFT cluster no: 786432
MFT size: 199704576
MFT cluster bytes: 4096
Listed files MB: 12647

So it still isn't finding around 80GB of files. What does this mean?
Could the Hard Disk Controller failure have caused a scenario where I
have a fragmented Master File Table with no MFT file record or mirror
record found?

Did the log file I sent you provide any extra clues?
Any help you could give me on what I could try next or any other
advice you could give me would be greatly apprecaited.
Many Thanks,
David.

 

[Svend Olaf Mikkelsen]

FindNTFS, version FP 4.63 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 0/1/1 LBA: 63

Options: Alt

Directories: 3114
Files: 37651
Trees: 84
Exe/dll files: 2397
Exe/dll files signature: 2394
Not referenced files: 350
Cluster KB: 4
MFT cluster no: 786432
MFT size: 199704576
MFT cluster bytes: 4096
Listed files MB: 12647

So it still isn't finding around 80GB of files. What does this mean?
Could the Hard Disk Controller failure have caused a scenario where I
have a fragmented Master File Table with no MFT file record or mirror
record found?

Did the log file I sent you provide any extra clues?
Any help you could give me on what I could try next or any other
advice you could give me would be greatly apprecaited.
Many Thanks,
David.

From the FindNTFS Findfile output I now see:

"There were about 1312 sectors, which could not be read."

I cannot right now see the significance of that. If this was a case i
had here, and there was no time pressure, I guess I initially would
set this disk and a new disk in a system, and then copy the disk
sector by sector using a program I have for that. It can be done in
mail too, but will take some time.

But it is still possible that I can figure out what is wrong, or that
you can copy more files using another recovery program in this case.

 

[David]

From the FindNTFS Findfile output I now see:

"There were about 1312 sectors, which could not be read."

I cannot right now see the significance of that. If this was a case i
had here, and there was no time pressure, I guess I initially would
set this disk and a new disk in a system, and then copy the disk
sector by sector using a program I have for that. It can be done in
mail too, but will take some time.

But it is still possible that I can figure out what is wrong, or that
you can copy more files using another recovery program in this case.

Hi Svend, thank you for all your help so far.

I am not under any time pressure & I currently have the failed disk &
a new disk in my system & I am ready to copy the disk, sector by
sector. The new disk is not as large as the old disk, so I would need
to recover files in batches, if that is possible.

Where can I get your program that can do this? Or are there any other
programs out there that you could recommend to recover these files?

Do you have any other ideas of what I can try next?

Kind Regards,
David.

 

[Svend Olaf Mikkelsen]

Hi Svend, thank you for all your help so far.

I am not under any time pressure & I currently have the failed disk &
a new disk in my system & I am ready to copy the disk, sector by
sector. The new disk is not as large as the old disk, so I would need
to recover files in batches, if that is possible.

Where can I get your program that can do this? Or are there any other
programs out there that you could recommend to recover these files?

Do you have any other ideas of what I can try next?

Kind Regards,
David.

To make a sector by sector copy, you will need a disk larger than the
problem partition. I did not get to considering other possibilities
yet.

Other recovery programs may very well be able to copy the files, but I
do not know them and cannot recommend anything specific.

 

[David]

To make a sector by sector copy, you will need a disk larger than the
problem partition. I did not get to considering other possibilities
yet.

Other recovery programs may very well be able to copy the files, but I
do not know them and cannot recommend anything specific.

Hi Svend,

I have obtained a larger disk drive to copy the data, but I am not
sure on what program you mentioned I could use to do a sector by
sector copy from the damaged disk to the new disk.

Can you tell me which program I can use to do this? Do you have any
other ideas?
Thanks for all your help.

 

[Svend Olaf Mikkelsen]

Hi Svend,

I have obtained a larger disk drive to copy the data, but I am not
sure on what program you mentioned I could use to do a sector by
sector copy from the damaged disk to the new disk.

Can you tell me which program I can use to do this? Do you have any
other ideas?
Thanks for all your help.

Previously: "There were about 1312 sectors, which could not be read."

OK. I still cannot tell the significance of that for the NTFS file
recovery, but it is worth an attempt to copy the disk sector by
sector.

We need a system with the problem disk and the new larger disk, which
is only used for this until the sector by sector copying is finished,
and which is only booted to a DOS floppy.

Set up that system, boot to a DOS floppy, do using Findpart for DOS:

findpart tables fp-b.txt

and mail me the file fp-b.txt.

If you only have one PC, it is possible to still have Windows
installed on disk 1, and the problem disk and the new disk as disk 2
and 3, as long as it is certain that Windows will not access the
problem disk.

 

[David]

Previously: "There were about 1312 sectors, which could not be read."

OK. I still cannot tell the significance of that for the NTFS file
recovery, but it is worth an attempt to copy the disk sector by
sector.

We need a system with the problem disk and the new larger disk, which
is only used for this until the sector by sector copying is finished,
and which is only booted to a DOS floppy.

Set up that system, boot to a DOS floppy, do using Findpart for DOS:

findpart tables fp-b.txt

and mail me the file fp-b.txt.

If you only have one PC, it is possible to still have Windows
installed on disk 1, and the problem disk and the new disk as disk 2
and 3, as long as it is certain that Windows will not access the
problem disk.

Hi Svend,
I have sent you a copy of the fp-b.txt file.
For reference, the drive I am tyring to recover the information from
is disk 2... the output from the findpart tables fp-b.txt looked like
this...

Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 8.00 Partition tables:

Disk: 1 Cylinders: 2246 Heads: 255 Sectors: 63 MB: 17618

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63 36065862 17610 0 1 1 2244*254 63 OK OK

Disk: 2 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114471

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1*42 63234420417114463 0 1 1 14591*254 63 OK
0 2 42234420480 16065 7 14592* 0 1 14592*254 63 OK

Disk: 3 Cylinders: 3467 Heads: 255 Sectors: 63 MB: 27196

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1 42 63 6152832 3004 0 1 1 382 254 63 OK
0 2*42 6152895 49544460 24191 383 0 1 3466*254 63 OK

The drive I am planning to recover the files to is currently being
used in another machine, I will install it when required.

I have recovered around 10% of what was on the drive, but can you
please tell me what utility I should use to recover these "1312
sectors, which could not be read."

Are there any other things I could try?

Many thanks for all your help. I greatly appreciate it.
Kind Regards,

David.

 

[zscreen]

I use dd to do sector by sector copies. What I do on a windows machine
is boot the machine using a linux live cd, like knoppix. Open up a
terminal window and type in something like dd if=/dev/hda
of=/path/to/file.img. The mount can be accross a network so you don't
have to have a huge disk in the system.

I've been having a similar experience where findntfs reports a portion
of the files that were there. It's probably the first gig of files
that were written to the partition. The partition is about 80 gigs.
The partition table was corrupted. I restored it using editpart. I'm
using findntfs in windows.

 

[David]

I use dd to do sector by sector copies. What I do on a windows machine
is boot the machine using a linux live cd, like knoppix. Open up a
terminal window and type in something like dd if=/dev/hda
of=/path/to/file.img. The mount can be accross a network so you don't
have to have a huge disk in the system.

I've been having a similar experience where findntfs reports a portion
of the files that were there. It's probably the first gig of files
that were written to the partition. The partition is about 80 gigs.
The partition table was corrupted. I restored it using editpart. I'm
using findntfs in windows.

I just got back from a work trip to Asia & now have some time to
continue my file recovery..

Thanks for the tip zscreen.

I am currently in the middle of the dd if/dev/hda of=/machine/file.img
across the network to my larger drive. Just a tip for anyone else
attempting this, make sure when you mount the network drive that you
use large file support, or you will get to 2GB & get an error. I
ended up using a -t cifs & lfs in the options to mount it.

The only question I have now is, what do I do with my .img file once
it has finally finished copying across?
Can I just use something like Nero's image drive to read inside the
file, or do I need to use something else?
Thanks for all your help.

 

[Arno Wagner]

I just got back from a work trip to Asia & now have some time to
continue my file recovery..

Thanks for the tip zscreen.

I am currently in the middle of the dd if=/dev/hda of=/machine/file.img
across the network to my larger drive. Just a tip for anyone else
attempting this, make sure when you mount the network drive that you
use large file support, or you will get to 2GB & get an error.

Yes, I have been hit by that too in the pats ;-)

I ended up using a -t cifs & lfs in the options to mount it.

The only question I have now is, what do I do with my .img file once
it has finally finished copying across?
Can I just use something like Nero's image drive to read inside the
file, or do I need to use something else?

I think you need something else, NERO might need an iso9660
filesystem. With Linux you can mount the image via the loop-device
('man losetup' and related), just like a partition.

Arno