Comparison of NTFS/MFT recovery software?

[Jan van Wijk]

Hi Odie,

Top man - you could never know what it means to be able to test software
properly.

Oh, I surely do.
I have been doing that professionally for over a decade

Programs that supposedly let you "see" what they could deliver with the
full version suck.

I agree, so the DFSee evaluation version delivers everything the full
version will.

The evaluation version for my software is EXACTLY the same as the
'full" version.
The only difference is the right to use it for anything else than
evaluation ...

There is a timeout on un-registred versions (60 days from release),
but if you need further evaluation, simply download the latest ...
There is a new (minor) release almost once a month ...

The registration you pay for DFSee is NOT really for the software
itself,
it is simply for the right to use it legally and even more important
to receive support and help on using it ...

Regards, JvW

 

[Al Dykes]

Under normal circumstances. Which it does quite well, better than FAT32
ever did, so there's no violation.


As well there should be.

If what's on your disk is valuable to you, you'll back it it and keep
a copy at another location, and never overwrite your most-recent
backup media. There are any number of ways you can lose the contents
of your disk dive that dtaa recovery can't fix. Theft and lightning
are obvious ones.

And, if you're protected against fire, flood, theft, etc, you are, by
definition, protected against a file system failure (whatever that
means.)

It's not clear to me that the OP has an NTFS problem, because two file
systems became unavailable at the same time. To me that sounds like
losing partition information or a hardware failure. I'd like to know,
when the dust settles if the disk formats correctly and works OK.

It's also not clear what the OP was doing when the problem happened.

NTFS is better than any non-journalling FS I've ever worked with, from
a reliability standpoint. Performance is a different question and not
revevant unless you have a million files, or so,

IMO NTFS is more reliable that the disks it runs on.

IMO NTFS is amazingly tolerant of failing hardware that the disk is
connected to.

 

[Folkert Rienstra]

Hi Odie,



Oh, I surely do.
I have been doing that professionally for over a decade

Wow, you tested evaluation versions 'professionally' (whatever that means)
for over a decade. You must be quite an expert.

Yet simply setting up your newsreader properly you can't manage.

I agree, so the DFSee evaluation version delivers everything the full
version will.

The evaluation version for my software is EXACTLY the same as the
'full" version.
The only difference is the right to use it for anything else than
evaluation ...

So if by accident you actually manage to salvage anything you have
to reverse the situation again (which it probably won't do for
you, now what?) and make a registration so you can 'legally' use it .......

There is a timeout on un-registred versions (60 days from release),
but if you need further evaluation, simply download the latest ...

Or if you're not downright stupid you just set your clock back
and save you the 1.5 MB download that may not even be different.

 

[Jan van Wijk]

Wow, you tested evaluation versions 'professionally' (whatever that means)

Picky picky ...
Testing system software has been part of my job for many years ...

Yet simply setting up your newsreader properly you can't manage.

I notice you mention that a lot to anyone who's posts you don't seem
to
like for some reason, yet you never tell anyone WHAT is wrong.
I am not to old to learn ...

I don't understand your behaviour at times, i KNOW you are a
knowledgable
person from many valuable posts I have seen from you, yet you seem
to enjoy pissing everybody off most of the time.

Or if you're not downright stupid you just set your clock back
and save you the 1.5 MB download that may not even be different.

Of course, if you feel happy with it, that will work too

Regards, JvW

(not offended, just amused)

 

[cquirke (MVP Win9x)]

Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).

Ah, Bart'sPE - I must have another look at that, once it's SP2-ready
(current change log mentions changes to accomodate an SP2 RC, but
dunno if that makes it OK for RTM SP2).

I've tried Bart's PE before, and liked it, except without a full av
that I could run from it (and a way to update that av from USB camera
or flash drive) it wasn't that useful to me at the time.

For every data recovery, I usually need to do 10-20 formal av scans,
and for a while it looked as if Bit Defender Live would be better
there. But so far that's been too unstable to complete a full scan.

If you can still download recovery software, then it may be assumed you have
access to an additional PC anyway.

Yes, but I'd still rather not run NT if I can avoid it - too much risk
of it fiddling with the at-risk HD I dropped in (SR, AutoChk, etc.)

Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
tell you much about the tool itself. The tool itself probably doesn't boot,
it needs to be started once the OS (DOS/Linux) runs.

Like MemTest86+ and several HD vendor's diags, it was an .EXE download
that writes a self-booting diskette when "installed". This diskette
may well be Linux-based, as MemTest86+ is, or it may use a FreeDOS as
some similar utilities do. Whatever the details, it didn't boot.

--------------- ------- ----- ---- --- -- - - - -

Sucess-proof your business! Tip #37
When given an NDA to sign, post it on your web site

 

[cquirke (MVP Win9x)]

In that case you might want to check out my DFSee tool:

That will display many filestructures (including most NTFS stuff)
has lots of specific 'fix' commands to repair 'common' problems
It also has file copy/recover commands for undeleting
and saving data from damaged filesystems.

The program is NOT free, but it is not that expensive either.
You can download the evaluation version and play with that
for a month or so to see what it can do.

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)

-------------- ---- --- -- - - - -

"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'

 

[Folkert Rienstra]

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)

"There is a timeout on un-registred versions (60 days from release),"

Maybe you should read first before you snip?

 

[J. S. Pack]

Ah, Bart'sPE - I must have another look at that, once it's SP2-ready
(current change log mentions changes to accomodate an SP2 RC, but
dunno if that makes it OK for RTM SP2).

Yes, it makes it OK.

URL http://65.108.230.150/downloads/mybootdisks_com/nu2/pebuilder3032.zip

I've tried Bart's PE before, and liked it, except without a full av
that I could run from it (and a way to update that av from USB camera
or flash drive) it wasn't that useful to me at the time.

This has *exactly* what you need:

http://www.windowsubcd.com/index.htm

Get Bart's first.

 

[cquirke (MVP Win9x)]

On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"

The current state of NTFS recovery software (I.E. supplied with the O.S.)
appears to me to violate "The Goal of Trustworthy Computing", Reliability:
The customer can depend on the product to fulfill its functions.

Breaks the safe hex principle that the system should not initiate
potentially destructive system changes.

If CHKDSK will run, it does its work and repairs the file system with
minimal reporting. The decision apparently has been made to have it do its
work now behind a blank screen during the boot process.

This is the bad news.

If CHKDSK will not run, then there is no path to recover.
That is the violation.

No, that's not the violation.

ChkDsk is inadequate and IMO is unfit for use, period. Users in the
21st century deserve better than a tool dating from DOS 5 or older.

If it is not allowed to "fix" automatically, it is known to return
spurious errors when checking a volume that is in use. Most PCs are
setup as one big C: that is always in use. Join the dots.

If you allow the thing to "fix" automatically, it will discard
conflicting data when it "fixes", thus breaking the ability to use
that data to really "fix" if ChkDsk guesses wrong. After ChkDsk
"fixes", the "fixed" data is likely to be broken, the info needed to
really fix is thrown away, and it can no longer be detected as a
damaged file because the "fix" has rubbed off the sharp edges.

What you want is the ability to *interactively* check the file system,
as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
such-and-such an error and (more info) I plan to "fix" this by doing
X, Y, Z. Continue, or abort?" but it's too brain-dead for that.

AutoChk (that runs after bad exits) is even worse; it can only run in
"fix" mode. The point about "fix" mode is that this does NOT have an
interest in preserving user data; it is only concerned with keeping
the file system sane. If you read the fine print in MS's NTFS
documentation, they are quite clear on this, e.g. transaction rollback
may preserve sane metatdata but it does NOT preserve user data.

When it comes to management of physical disk errors, it gets worse.
As it is, the HD's firmware attempts to paper over failing sectors on
the fly, by copying material from a failing sector to a spare and then
doing an address switcheroo. Now the OS (on NTFS volumes) tries to do
exactly the same thing. Too many cooks? You bet! Hide information
you urgently need to be aware of? You bet!

So I choose to avoid NTFS altogether, and use DOS mode Scandisk for
elective and controlled file system repair.

To those who say that the only method of repair if CHKDSK will not run is to
hire a person who has many years of experience and makes a living doing data
recovery just adds to the dichotomy. CHKDSK is trusted (and Norton) to
repair the file system all by its self for the second case.

ChkDsk is NOT a data recovery tool, and has no right to presume to be
one. Automating data-destructive "fixes" may help MS cut down on
support calls, but it is detremental to data safety as it robs the
user of the option to manually repair.

And yes, a compitent tech (or an end-user recovery tool) can do better
than autofixing logic to manually repair, even if only because it can
pull data based on both items of conflicting data.

Repair in place I have stated is the only viable solution for gargantuan
sized external hard drives that cannot be backed up currently.

Backup, by definition, loses data. So a need for data recovery is not
going to go away, no matter how much you backup.

The perfect backup contains all content except unwanted changes.
Ponder on how you separate unwanted changes (loss) from all data you
saved right up to the present moment, and see the problem.

The argument that confusing and intimidating information must not be shown
to the users is an strong argument towards eliminating the dichotomy and
doing the job without the user being involved.

That's lazyware, i.e. "let's cut support costs, and if that breaks
user's stuff, who cares; we aren't liable for that".

Furthermore, keeping information from all persons because some may not
understand is elitist and should not be condoned.
Absolutely!

The recording of what CHKDSK has done behind the blank screen when booting
is being done is perhaps a model of presenting the information to persons
who can understand it and not showing it to others.

Well, burying it the depths of Event Viewer under "Logon" on something
seemingly unrelated is pretty opaque and user-hostile.

-------------- ---- --- -- - - - -

"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'

 

[cquirke (MVP Win9x)]

URL http://65.108.230.150/downloads/mybootdisks_com/nu2/pebuilder3032.zip

This has *exactly* what you need:

http://www.windowsubcd.com/index.htm

I get a 404 on that link...

-------------- ---- --- -- - - - -

"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'

 

[Eric Gisin]

Time to read the Win 2K/XP resource kits, if you want to be a MVP.

Chkdsk is not based on DOS. Everything in NT is written in C, not ASM, for one
thing.

ChkDsk is inadequate and IMO is unfit for use, period. Users in the
21st century deserve better than a tool dating from DOS 5 or older.

If it is not allowed to "fix" automatically, it is known to return
spurious errors when checking a volume that is in use. Most PCs are
setup as one big C: that is always in use. Join the dots.

Of course there is a tool to override autochk defaults.

 

[Jan van Wijk]

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)

That will not really help

The period is 62 days starting from release-date of that
particular version. Best to download just before you
want to test it ...

Regards, JvW

 

[J. S. Pack]

I get a 404 on that link...

I don't.

Maybe better go just directly to the downloads page:

http://www.windowsubcd.com/downloads.htm

 

[J. S. Pack]

On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"

What you want is the ability to *interactively* check the file system,
as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
such-and-such an error and (more info) I plan to "fix" this by doing
X, Y, Z. Continue, or abort?" but it's too brain-dead for that.

This is all well and good for techies who can use disk editors and know
their way around the file system.

It's meaningless in the real world where the vast majority of users don't
even know what a file system is. Most of them have used the ol' scandisk
and that little question of "Continue or abort" did them no good at all.
They wouldn't know which answer to choose. If they aborted, their disk
still had errors and their data was lost. If they continued, their data was
lost as well in .chk files. Not uncommonly their disk was still trashed and
they ended up reformatting and reinstalling. That sort of thing happens a
lot less under NTFS and the vast majority of users would therefore benefit
from using it.

Anybody who's used scandisk doesn't trust it, either. And plenty of
professionals did well fixing FAT32 disks.

ChkDsk is NOT a data recovery tool, and has no right to presume to be
one. Automating data-destructive "fixes" may help MS cut down on
support calls, but it is detremental to data safety as it robs the
user of the option to manually repair.

Well, better tools are always welcomed. I wonder why Norton hasn't cashed
in on the shortcomings of CHKDSK?

And yes, a compitent tech (or an end-user recovery tool) can do better
than autofixing logic to manually repair, even if only because it can
pull data based on both items of conflicting data.

Yes, no matter which filesystem is chosen.

That's lazyware, i.e. "let's cut support costs, and if that breaks
user's stuff, who cares; we aren't liable for that".

It's really not that simple. Otherwise, as I said, Norton would be cashing
in. Where there's such a need, the market responds.

Absolutely!

But nobody's really hiding information.

Well, burying it the depths of Event Viewer under "Logon" on something
seemingly unrelated is pretty opaque and user-hostile.

Not to the vast majority of users. Take a look at the headers in this
newsgroup!

 

[Al Dykes]

This is all well and good for techies who can use disk editors and know
their way around the file system.

It's meaningless in the real world where the vast majority of users don't
even know what a file system is. Most of them have used the ol' scandisk
and that little question of "Continue or abort" did them no good at all.
They wouldn't know which answer to choose. If they aborted, their disk
still had errors and their data was lost. If they continued, their data was
lost as well in .chk files. Not uncommonly their disk was still trashed and
they ended up reformatting and reinstalling. That sort of thing happens a
lot less under NTFS and the vast majority of users would therefore benefit
from using it.


Anybody who's used scandisk doesn't trust it, either. And plenty of
professionals did well fixing FAT32 disks.


Well, better tools are always welcomed. I wonder why Norton hasn't cashed
in on the shortcomings of CHKDSK?

Maybe all the conditions that chkdsk /F can't fix are things that are
impossible to fix ?

FWIW;

I recently had an XP laptop that passed chkdsk /F with no messages,
but Partition Magic's check-file-system command gave an error status
and refused to repartition. I re-imaged the system. I was able to do a
full backup, first, so no data was lost. This is an existance proof
that chkdsk /f isn't perfect.

In the thousands of chkdsk passes I've watched I've seen a "fixing up"
message where no data was lost, a couple of times. I assume this was
a journal roll-forward. The most recent was at least 5 years ago. One
of these sessions resulted in me opening a case with Microsoft, and
posts to Usenet asking if there was a document that listed every
possible messages from chkdsk, similar to the documententation for
fsck on any unix system, and the answer was no, why do I want one ?

I had a system running NTFS that would not run a commercial (ie
paid for) defrag tool, it crapped out with an error message saying there
was something about the $MFT that defrag couldn't deal with. chkdsk /f
ran clean on this system. This could have been 8 years ago.

That's about it for about 10,000 system-years of ntfs experience.
Compare that to every windows98 laptop I every saw that had CHK files
in the C root because if incorrect shutdown.

 

[J. S. Pack]

Backup, by definition, loses data.

Um, by your definition, perhaps. That's just a little too facile to be a
general definition.

A bitwise mirror image of your disk saves whatever data you have saved on
the disk you're mirroring. That's entirely expected and reasonable.

So a need for data recovery is not
going to go away, no matter how much you backup.

Indeed not. You can reasonably expect to have saved only what data you've
saved in your backup before your head crashed or the cosmic ray hit and an
ailing DIMM dribbled all over your files.

With a good backup regimen, you shouldn't lose much. If your data is that
real-time critical, you should be computing in a failsafe, redundant,
transaction rollback environment anyway, not in Windows XP.

If my filesystem or disk crashes (and any disk can crash at any time,
leaving moot the question of running chkdsk), I count myself lucky if I can
save *anything*. That's why I often backup.

The perfect backup contains all content except unwanted changes.
Ponder on how you separate unwanted changes (loss) from all data you
saved right up to the present moment, and see the problem.

Well, the unwanted changes mean that it will be more difficult to retain
the wanted changes that didn't make into the last backup set. I fail see
how this point moves us further down the road towards solving the problem
of *how* a naive user may recover data from a crashed disk or severely
damaged filesystem.

I would note FWIW that the winubcd http://www.windowsubcd.com/index.htm I
noted earlier in this thread does have some free file/disk tools that can
be run from the boot CD itself. Again, average users would not know about,
or be able to build, such a CD.

 

[Al Dykes]

Backup, by definition, loses data.

[/QUOTE]


Huh ? If it lost data it wouldn't be called a backup.

ntbackup, the MS-provided backup/restore tool, does a fine job of full
backup of running NT/w2k/XP/home/pro systems. I've rebuilt servers
from bare iron with netbackup-produced tapes.

As for simple full backup-recovery tools, there are a couple of
home-user oriented packages that burn a full-image onto bootable DVDs
that will restore to bare iron. These are one-click-full-backup
tools, if you set them up that way. These were practical until the
arrival of home-digital video.

The computer user has to make a realistic assesment of the value of
his data and buy enough big disks to keep a couple generations of
backups. It's called a risk assesment and businesses have been doing
this for years.

Anyone that depends on recovery tools is clueless.

 

[Jon]

Anyone that depends on recovery tools is clueless.

There are instances where a little bit of knowledge in recovery can go a
long way. Not in replacing the essential need for backups, but in removing
the necessity of having to do a full scale restore.

The example I'll quote is a recent example when one problematic corrupted /
damaged file on my NTFS system, was causing all sorts of havoc. All the
usual tricks, like closing down explorer to delete via command prompt, or
deletion via recovery console / safe mode had failed. Chkdsk was also unable
to deal with it (it aborted unceremoniously halfway through its operations )
and it also prevented any defragmentation of the drive. The fragmentation
level of files on the drive was rising by the minute. A simple manual
blanking out of its entry in the MFT, followed by a quick chkdsk, solved the
problem and the drive was completely back to normal. Would have been a right
pain to have had to go through a complete restore for the sake of one tiny
file.

Jon

 

[cquirke (MVP Win9x)]

"cquirke (MVP Win9x)" <[email protected]>

Chkdsk is not based on DOS.

I didn't say ChkDsk was "based on DOS". It dates from DOS;
specifically, the pathetic UI dates from DOS's ChkDsk.

And by UI, I'm not saying "make it prettier". I'm saying "put the
user back in control over what it does".

The code itself is obviously different, given that it works on a
completely different file system ;-)

Of course there is a tool to override autochk defaults.

The only control I know of will suppress AutoChk for particular HD
letters. There is no way to get AutoChk to run like ChkDsk (with no
/F or /R parameter) and, like ChkDsk, AutoChk has no interactive mode.

Compare that to the fine-grained control Scandisk.ini gives you over
the implicit /Custom mode that automatic Scandisk uses in Win95/98.

-------------------- ----- ---- --- -- - - - -

Tip Of The Day:
To disable the 'Tip of the Day' feature...

 

[cquirke (MVP Win9x)]

This is all well and good for techies who can use disk editors and know
their way around the file system.

Yes it is; and it should be there for that reason alone, if nothing
else. It's easier to understand what Scandisk says about what it
finds than, say, a raw register dump you get in Stop errors ;-)

It's meaningless in the real world where the vast majority of users don't
even know what a file system is. Most of them have used the ol' scandisk
and that little question of "Continue or abort" did them no good at all.

Now you are saying that becausae most folks lack clue, we should
declare darkness as the standard? The "ChkDsk Knows Best, even if it
kills your data to the point that it can no longer be recovered" is
high-handed nonsense, geared to the convenience of "support" at the
expense of the client. We'd like a lot less of that, please.

Anybody who's used scandisk doesn't trust it, either. And plenty of
professionals did well fixing FAT32 disks.

Sure; that's a given - it's a one-pass automated tool with no
"big-picture" awareness, how smart can you really expect it to be?

If I show you a FAT1 that has 512 bytes of ReadMe.txt in it, and FAT2
that has sane-looking values in it, your guess at what to do would be
correct. If a few sectors further in, you found the same thing, but
the other way round, you'd guess how to fix that too.

You would not just splat the whole of FAT1 over FAT2 because it
"looked better", on the ASSumption that every part of FAT1 is as
correct or otherwise as every other part of FAT1.

You'd also not be so dumb as to chop the Windows directory in half,
just because at that point a dir entry started with a null, and throw
the rest of it away. In fact, even if there were 512 bytes of zeros
or ReadMe.txt content in the middle of a dir, you would recognise that
as a sector splat and append the distant part of the same dir,
excising the garbaged sector's contents.

That's not rocket science to a tech with an interest in such matters,
even if "your average user" couldn't do that themselves.

What a number of "average" users can (and do) do is call up and say:

"I had a bad exit, and Scandisk ran as usual, but this
time it wanted to delete half the Windows directory.
So I switched off the PC and I'm bringing it in for file
system repair and data recovery."

With NTFS, AutoChk robs them of that chance.

-------------- ---- --- -- - - - -

"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'