Singing the Partition Blues

[Matt Johnson]

2nd HD in a WinXP installation is misbehaving, CHKDSK /p /r from the
recovery console says certain errors unrecoverable. I found and ran Svend
Mikkelsen's FindPart and FindNTFS; both were able to access the drive, and
the latter was able to see the contents of the drive. Is this simply a
corrupt partition table? Or something more insidious? Any assistance would
be most appreciated!

Matt Johnson


FindPart output:

C:\Downloads\Utilities\FindPart>findpart 2 -fat baddisk.txt

Findpart, version 4.41 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600 Service Pack 1

Disk: 2 Cylinders: 7943 Heads: 240 Sectors: 63 MB: 58642

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63120085812 58635 0 1 1 7942 44 63 B OK

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63120085812 58635 0 1 1 7942* 44 63 OK OK
Output logged to BADDISK.TXT

=====================================================

FindNTFS summary:

FindNTFS, version 1.42 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2003.

OS: Windows 5.1

Disk: 2 Cylinders: 7943 Heads: 240 Sectors: 63 MB: 58642

CHS 0/1/1 LBA: 63

Directories: 6640
Files: 99868
Trees: 107
Exe/dll files: 7941
Exe/dll files signature: 7766
Not referenced files: 90
Cluster KB: 4
MFT cluster no: 786432
MFT size: 135196672
MFT cluster bytes: 4096
Listed files MB: 26831

=====================================================

And just for fun, what it found on the good drive:

C:\Downloads\Utilities\FindPart>findpart 1 -fat gooddisk.txt

Findpart, version 4.41 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600 Service Pack 1

Disk: 1 Cylinders: 7943 Heads: 240 Sectors: 63 MB: 58642

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63102407697 50003 0 1 1 6772 239 63 B OK
0 - 07102407760 17690400 8637 6773 0 1 7942 239 63 B OK

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63102407697 50003 0 1 1 6772*239 63 OK OK
0 2 07102407760 17690400 8637 6773* 0 1 7942*239 63 OK OK
Output logged to GOODDISK.TXT


[the end]

 

[Svend Olaf Mikkelsen]

Findpart, version 4.41 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600 Service Pack 1

Disk: 2 Cylinders: 7943 Heads: 240 Sectors: 63 MB: 58642

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63120085812 58635 0 1 1 7942 44 63 B OK

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63120085812 58635 0 1 1 7942* 44 63 OK OK

FindNTFS, version 1.42 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2003.

OS: Windows 5.1

Disk: 2 Cylinders: 7943 Heads: 240 Sectors: 63 MB: 58642

CHS 0/1/1 LBA: 63

Directories: 6640
Files: 99868
Trees: 107
Exe/dll files: 7941
Exe/dll files signature: 7766
Not referenced files: 90
Cluster KB: 4
MFT cluster no: 786432
MFT size: 135196672
MFT cluster bytes: 4096
Listed files MB: 26831

The partition table on disk 2 is OK. You see the 58635 MB NTFS
partition (ID hex 07) listed, and the OK in the BS (boot sector) field
indicates that the boot sector information match the partition table
information.

The partition internals are damaged, seen by the fact that there are
107 trees, which should be 1 (the root).

If you have somewhat more than 26831 MB free space in a partition on
another disk, you can create a new directory in the root of that
partition, and in that directory run:

findntfs 2 0 1 1 copy

For other copy options, see my utilities page, and the FindNTFS txt
file. One option is to only copy as example txt files:

findntfs 2 0 1 1 copy *txt

For exe and dll files, FindNTFS examines if the files have the
expected MZ signature. A difference of 7941-7766 can be normal, but
there can be another problem than damaged directory structure.

 

[Timothy Daniels]

Hej Svend,

Where do you get such good information about MS's
low-level system formatting? I've never seen their stuff
documented, even in their own publications (that I know of).
Have you considered writing and selling a book about it?

Tack för informationen.

*Timmi*

 

[Matt Johnson]

Thanks for the quick response as well as your superb utilities!

Matt

 

[Svend Olaf Mikkelsen]

Hej Svend,

Where do you get such good information about MS's
low-level system formatting? I've never seen their stuff
documented, even in their own publications (that I know of).
Have you considered writing and selling a book about it?

Tack för informationen.

*Timmi*

For FAT a Microsoft document "fatgen103.pdf" exists. For NTFS third
party documentation is available at

http://linux-ntfs.sourceforge.net/ntfs/index.html

 

[Matt Johnson]

Any reason you can think of why this would work 10 days ago but not now? I
just got another clean drive hooked up to transfer stuff to, but now
findntfs isn't finding anything on the drive and chkdsk reports a corrupt
master file table! How did that happen? (And more importantly, what can be
done about it?) I used it to copy some vital stuff back on the 21st, but now
I'd like to copy over the rest.

 

[Svend Olaf Mikkelsen]

Any reason you can think of why this would work 10 days ago but not now? I
just got another clean drive hooked up to transfer stuff to, but now
findntfs isn't finding anything on the drive and chkdsk reports a corrupt
master file table! How did that happen? (And more importantly, what can be
done about it?) I used it to copy some vital stuff back on the 21st, but now
I'd like to copy over the rest.

The most obvious possible explanation is that disk numbers changed
when you inserted another disk. The first FindNTFS parameter is the
disk number.

It of course is possible that something other happened. Ideally the
partition should have been hidden, so the operating system could not
cause further damage.

I suggest you do:

findpart tables fp-a.txt

and mail me the file fp-a.txt.