Data Recovery from lost NTFS. Help!

[Gregg OBanion]

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this. Thanks Gregg

 

[Rod Speed]

I need some advice. I was transferring info from a 160 gig IDE Western Digital
hard drive and forgot the drive was in use when I renamed it in Drive
properties. The drive instantly lost its file system asks if I want to format
it when I click on the drive letter.

I like Easy Recovery Pro, but it aint free.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this.

This one is as good as any for that.

 

[Zvi Netiv]

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the file
system. If it wasn't legit then the operating system would have blocked it.
From the little info provided above, I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file
system).

Other possible causes to the disappearing of the file system of your drive could
be a modified partition table, in its MBR, or changed settings for that drive,
in the CMOS. Yet given the symptoms described, I would think that a damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

File recovery such as GetDataBack and EasyRecovery are appropriate when there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi

 

[Robert Green]

On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv

Hi, Zvi

There is no reason why the renaming of a volume would cause loss of the file
system. If it wasn't legit then the operating system would have blocked it.
From the little info provided above, I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file
system).

With NTFS the volume label is not written to the boot sector but only
to the metadata file $Volume.

Other possible causes to the disappearing of the file system of your drive could
be a modified partition table, in its MBR, or changed settings for that drive,
in the CMOS. Yet given the symptoms described, I would think that a damaged
boot sector is the most likely.

You need a tool that can do a raw mode recovery. I've never used
GetDataBack, so don't know if it can do that. I think that File
Scavenger can and it is reasonably priced.

File recovery such as GetDataBack and EasyRecovery are appropriate when there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

May or may not help - probably not IMO. A missing boot sector can lead
drive manager to ask for a format, but so can a damaged MFT. This
really needs some diagnostic help.

This one is.

Regards, Zvi

Bob

 

[Gregg OBanion]

Thank You for the advice. It makes sense to me.

I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name
(the
volume name is written to the boot sector, in addition to the entry in the
file
system).
For starters, NTFS partitions keep a backup of the boot sector in the very
last
sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg

 

[Gregg OBanion]

Thanks Robert. I will try File Scavenger and report back here.

 

[Zvi Netiv]

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
to format the volume).

Could you please describe the drive configuration: What order is the problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
MBR, boot sector).

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

Regards, Zvi

 

[Zvi Netiv]

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.



As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
to format the volume).

Could you please describe the drive configuration: What order is the problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as the
controller will set the drive in the BIOS list (not the same as CMOS!) with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

Regards

 

[Gregg OBanion]

Sorry for the inexperience with my post. It's been a while.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

Thanks Zvi.

 

[Zvi Netiv]

Sorry for the inexperience with my post. It's been a while.

I meant that top-posting isn't appreciated here. What alienates me in top-post
follow-ups is the liberty that some take in abusing the product of others' time
and efforts and transforming them into senseless babble. You aren't the only
one to seek help through newsgroups, many use their archives to look for
solutions to problems they have. Hence, top-posting is ungrateful to
contributors, it doesn't encourage them in helping you, and is unfair to
readers.

The same goes for trimming previous text and not fragmenting the lines of quoted
text, but the latter are more a matter of experience in newsgroups, while
top-posting is a conscious and selfish choice.

I realize that not all contributors do mind about top-posting, yet I am sure
that I reflect the feeling of the majority. Witness their posts.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

The above doesn't exclude the possibility that either the MBR and/or the boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will write
its findings into a text file report named RESQDISK.RPT, in A:\. Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up), and
avoid top-posting!

Regards, Zvi

[...]

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as the
controller will set the drive in the BIOS list (not the same as CMOS!) with a
best fit to what's found in the MBR.

 

[Rod Speed]

I meant that top-posting isn't appreciated here.

You dont get to rule on that any time soon.

What alienates me in top-post follow-ups is the liberty
that some take in abusing the product of others' time
and efforts and transforming them into senseless babble.

Mindless rant.

You aren't the only one to seek help through newsgroups, many
use their archives to look for solutions to problems they have.

And many can manage to read and comprehend top posted posts.

Hence, top-posting is ungrateful to contributors, it doesn't
encourage them in helping you, and is unfair to readers.

Mindless prejudiced bullshit.

The same goes for trimming previous text and not fragmenting the
lines of quoted text, but the latter are more a matter of experience
in newsgroups, while top-posting is a conscious and selfish choice.

Mindless prejudiced bullshit.

I realize that not all contributors do mind about top-posting,
yet I am sure that I reflect the feeling of the majority.

You dont.

Witness their posts.

Got sweet **** all to do with the MUCH greater number of those who just
READ posts, who you have absolutely NO idea about what style they prefer.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

The above doesn't exclude the possibility that either the MBR and/or the boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed
in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS
To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make
the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite
files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will write
its findings into a text file report named RESQDISK.RPT, in A:\. Press
'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up), and
avoid top-posting!

Regards, Zvi

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the
previous
posts to the top (only a "half" top-poster), then why moving anything at
all?
Your follow-up would have made more sense if it was all in-line.

[...]

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
on a Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect
(offer to format the volume).

Could you please describe the drive configuration: What order is the
problem drive (first, second, ... fourth?), and how was it partitioned
(one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the
CMOS, MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as
the
controller will set the drive in the BIOS list (not the same as CMOS!) with
a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

 

[Gregg OBanion]

I do appreciate the help! I expect to use Newsgroups often so I will
make a conscience effort to get better in my posts. I'm getting
ready to read my PC Repair book about the problem I'm having.
Believe me I've put a lot of work into it so far and still know very
little but I'm determined.

My next step. Read the Hard drive section of my new Repair book. Use
the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
also looking into File Scavenger.

I think that even if these tools don't work the will help me learn
the structure of the RAW/Failed disk.

Anything else you can offer (Rod and Zvi) is appreciated. Maybe also
a document on how to post to Newsgroups. I'm using Outlook Express.
Is there a better one? I seem to have trouble with breaking the text
or maybe word wrap.

Thanks Again, Gregg

I meant that top-posting isn't appreciated here.

You dont get to rule on that any time soon.

What alienates me in top-post follow-ups is the liberty
that some take in abusing the product of others' time
and efforts and transforming them into senseless babble.

Mindless rant.

You aren't the only one to seek help through newsgroups, many
use their archives to look for solutions to problems they have.

And many can manage to read and comprehend top posted posts.

Hence, top-posting is ungrateful to contributors, it doesn't
encourage them in helping you, and is unfair to readers.

Mindless prejudiced bullshit.

The same goes for trimming previous text and not fragmenting the
lines of quoted text, but the latter are more a matter of
experience
in newsgroups, while top-posting is a conscious and selfish
choice.

Mindless prejudiced bullshit.

I realize that not all contributors do mind about top-posting,
yet I am sure that I reflect the feeling of the majority.

You dont.

Witness their posts.

Got sweet **** all to do with the MUCH greater number of those who
just
READ posts, who you have absolutely NO idea about what style they
prefer.

The drive is one big partition. The Info in Disk Management
reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the
Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical
drives on the PCI
card.

The above doesn't exclude the possibility that either the MBR
and/or the boot
sector were altered.

To further investigate, you can download RESQ from
www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
instructed in
the ResQ welcome message). If Win 98 is not available to you,
then download
also the FreeDOS boot floppy maker from
www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager)
with the
command FORMAT A: /U Open the FreeDOS self-extract archive and
let it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from
the one you
want to assess, boot from the RESQ floppy just made (leave the
diskette
write-enabled in the drive) and when at the A: prompt, run
RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive
and will write
its findings into a text file report named RESQDISK.RPT, in A:\.
Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the
program
terminates and exits.

Post here the report file (just paste the text file into your
follow-up), and
avoid top-posting!

Regards, Zvi

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part
of the previous
posts to the top (only a "half" top-poster), then why moving
anything at all?
Your follow-up would have made more sense if it was all
in-line.
[...]
Can you tell me how to begin to check this problem. I've
left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM.
The drive is
on a Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the
same effect
(offer to format the volume).

Could you please describe the drive configuration: What
order is the
problem drive (first, second, ... fourth?), and how was it
partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it
that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive
settings in the
CMOS, MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the
Ultra-100
controller. Yet a corrupted partition table could have a
similar effect as the
controller will set the drive in the BIOS list (not the same
as CMOS!) with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or
professional
recovery, if you can afford it and the data is worth the
expense.

--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il
(Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery
Utilities

 

[Rod Speed]

I do appreciate the help! I expect to use Newsgroups often so I will make a
conscience effort to get better in my posts.

Zvi is gunna chuck a tantrum about this post |-)

I'm getting ready to read my PC Repair book about the problem I'm having.
Believe me I've put a lot of work into it so far and still know very little
but I'm determined.

That last is what matters.

My next step. Read the Hard drive section of my new Repair book.

You dont really need to do that in this situation.

Use the tools I've purchased, Easy Recovery Pro and GetDataBack.

ERP should do what you want.

I'm also looking into File Scavenger.

I think that even if these tools don't work the will help me learn the
structure of the RAW/Failed disk.

Anything else you can offer (Rod and Zvi) is appreciated.

I'd just carefully use ERP and worry about what
to do next if it doesnt see what files you need.

Maybe also a document on how to post to Newsgroups.

Not practical, essentially because there are a number
of quite viable approaches to posting and you'll never
get general agreement on what is best.

Some are mindlessly obsessive about hating top posting,
even tho, when you just want to make general comments
about an entire post, it has some real advantages.

I'm using Outlook Express. Is there a better one?

Its perfectly adequate for your ocassional use.

I seem to have trouble with breaking the text or maybe word wrap.

Its automatic in OE now, your post is fine on that stuff.

Gregg OBanion <[email protected]> wrote

Sorry for the inexperience with my post. It's been a while.

I meant that top-posting isn't appreciated here.

You dont get to rule on that any time soon.

What alienates me in top-post follow-ups is the liberty
that some take in abusing the product of others' time
and efforts and transforming them into senseless babble.

Mindless rant.

You aren't the only one to seek help through newsgroups, many
use their archives to look for solutions to problems they have.

And many can manage to read and comprehend top posted posts.

Hence, top-posting is ungrateful to contributors, it doesn't
encourage them in helping you, and is unfair to readers.

Mindless prejudiced bullshit.

The same goes for trimming previous text and not fragmenting the
lines of quoted text, but the latter are more a matter of experience
in newsgroups, while top-posting is a conscious and selfish choice.

Mindless prejudiced bullshit.

I realize that not all contributors do mind about top-posting,
yet I am sure that I reflect the feeling of the majority.

You dont.

Witness their posts.

Got sweet **** all to do with the MUCH greater number of those who just
READ posts, who you have absolutely NO idea about what style they prefer.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the
PCI
card.

The above doesn't exclude the possibility that either the MBR and/or the
boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php
and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed
in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS
To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make
the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite
files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one
you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will
write
its findings into a text file report named RESQDISK.RPT, in A:\. Press
'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up),
and
avoid top-posting!

Regards, Zvi


Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the
previous
posts to the top (only a "half" top-poster), then why moving anything at
all?
Your follow-up would have made more sense if it was all in-line.

[...]
Can you tell me how to begin to check this problem. I've left the
drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive
is
on a Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect
(offer to format the volume).

Could you please describe the drive configuration: What order is the
problem drive (first, second, ... fourth?), and how was it partitioned
(one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the
CMOS, MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect
as the
controller will set the drive in the BIOS list (not the same as CMOS!)
with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or
professional
recovery, if you can afford it and the data is worth the expense.

 

[Folkert Rienstra]

Zvi is gunna chuck a tantrum about this post |-)

Yup, he is laying perfect bait.

That last is what matters.


You dont really need to do that in this situation.


ERP should do what you want.

Obviously not.

I'd just carefully use ERP and worry about what
to do next if it doesnt see what files you need.


Not practical, essentially because there are a number
of quite viable approaches to posting and you'll never
get general agreement on what is best.

Some are mindlessly obsessive about hating top posting,
even tho, when you just want to make general comments
about an entire post, it has some real advantages.


Its perfectly adequate for your ocassional use.

*If* you set it up right.

Its automatic in OE now,

And obviously defective as everyone can see from the second half of the post
starting with :

It makes it even worse now that OE-QuoteFix is unable to detect and fix it.

your post is fine on that stuff.
Bullshit.

The above doesn't exclude the possibility that either the MBR and/or the
boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php
and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed
in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS
To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make
the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite
files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one
you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will
write
its findings into a text file report named RESQDISK.RPT, in A:\. Press
'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up),
and
avoid top-posting!

Regards, Zvi


Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the
previous
posts to the top (only a "half" top-poster), then why moving anything at
all?
Your follow-up would have made more sense if it was all in-line.

[...]
Can you tell me how to begin to check this problem. I've left the
drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive
is
on a Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect
(offer to format the volume).

Could you please describe the drive configuration: What order is the
problem drive (first, second, ... fourth?), and how was it partitioned
(one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the
CMOS, MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect
as the
controller will set the drive in the BIOS list (not the same as CMOS!)
with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or
professional
recovery, if you can afford it and the data is worth the expense.

 

[Zvi Netiv]

[snip]

My next step. Read the Hard drive section of my new Repair book. Use
the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
also looking into File Scavenger.

What I have been trying to suggest to you, with no success as it seems, is that
before purchasing data recovery software and trying to recover your stuff, file
by file, it would make more sense (and be cheaper too) to first try regaining
access to the drive / partition and the data on it, if possible.

In case the purchased SW doesn't yield the expected results: Make sure to not
write to the problem drive if you wish to maintain the option of switching back
to the above approach.

Good luck, Zvi

 

[Gregg OBanion]

Hello Zvi and Robert.

Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
post. (Below)

To further investigate, you can download RESQ from
www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
instructed in
the ResQ welcome message). If Win 98 is not available to you, then
download
also the FreeDOS boot floppy maker from
www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager)
with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let
it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files,
Hello Zvi and Robert.

Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
post. (Below)

To further investigate, you can download RESQ from
www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
instructed in
the ResQ welcome message). If Win 98 is not available to you, then
download
also the FreeDOS boot floppy maker from
www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager)
with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let
it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks
(overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from
the one you
want to assess, boot from the RESQ floppy just made (leave the
diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK
/ASSESS

The program will initiate an assessment cycle of the hard drive and
will write
its findings into a text file report named RESQDISK.RPT, in A:\.
Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the
program
terminates and exits.

Post here the report file (just paste the text file into your
follow-up), and
avoid top-posting!

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.

Thanks Zvi.

What I have been trying to suggest to you, is that
before purchasing data recovery software and trying to recover
your stuff, file
by file, it would make more sense (and be cheaper too) to first
try regaining
access to the drive / partition and the data on it, if possible.

Yes Zvi. I have understood what you are telling me. The ultimate fix
here is to have the drive operate as before. Problem is, where do I
begin?

Zvi Said:
From the little info provided above, I would guess that something
went wrong
when the OS tried to rewrite the boot sector with the modified
volume name (the
volume name is written to the boot sector, in addition to the entry
in the file
system).

Robert Said:
With NTFS the volume label is not written to the boot sector but
only
to the metadata file $Volume.

Zvi Said:
Other possible causes to the disappearing of the file system of your
drive could
be a modified partition table, in its MBR, or changed settings for
that drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

For starters, NTFS partitions keep a backup of the boot sector in
the very last
sector of every partition, respectively.

Robert Said:
A missing boot sector can lead drive manager to ask for a format,
but so can a damaged MFT. This
really needs some diagnostic help.

Zvi Said:
Could you please describe the drive configuration: What order is
the problem
drive (first, second, ... fourth?), and how was it partitioned (one
big
partition, several, what types?).

Gregg Said:
I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. The drive is one big partition. The Info
in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise
Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
the PCI card.

Zvi Said:
If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in
the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the
Ultra-100
controller. Yet a corrupted partition table could have a similar
effect as the
controller will set the drive in the BIOS list (not the same as
CMOS!) with a
best fit to what's found in the MBR.

The above doesn't exclude the possibility that either the MBR and/or
the boot
sector were altered.

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The MFT?
How do I look at the corrupted partition table? What info do I need
to provide you to further assist me?

Zvi Said:
In case the purchased SW doesn't yield the expected results: Make
sure to not
write to the problem drive if you wish to maintain the option of
switching back
to the above approach.

My Response: (Gregg)

I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

I can tell you I won't be satisfied with the recovery method because
although it may recover the files, I still want the File structure
(Tree) in tact. So I want to continue to work on this problem and
see if I can solve it. Of course I won't be able to do it without
some help. Please continue to help me. I do appreciate it!

Thanks again, Gregg

and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from
the one you
want to assess, boot from the RESQ floppy just made (leave the
diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK
/ASSESS

The program will initiate an assessment cycle of the hard drive and
will write
its findings into a text file report named RESQDISK.RPT, in A:\.
Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the
program
terminates and exits.

Post here the report file (just paste the text file into your
follow-up), and
avoid top-posting!

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.

Thanks Zvi.

What I have been trying to suggest to you, is that
before purchasing data recovery software and trying to recover
your stuff, file
by file, it would make more sense (and be cheaper too) to first
try regaining
access to the drive / partition and the data on it, if possible.

Yes Zvi. I have understood what you are telling me. The ultimate fix
here is to have the drive operate as before. Problem is, where do I
begin?

Zvi Said:
From the little info provided above, I would guess that something
went wrong
when the OS tried to rewrite the boot sector with the modified
volume name (the
volume name is written to the boot sector, in addition to the entry
in the file
system).

Robert Said:
With NTFS the volume label is not written to the boot sector but
only
to the metadata file $Volume.

Zvi Said:
Other possible causes to the disappearing of the file system of your
drive could
be a modified partition table, in its MBR, or changed settings for
that drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

For starters, NTFS partitions keep a backup of the boot sector in
the very last
sector of every partition, respectively.

Robert Said:
A missing boot sector can lead drive manager to ask for a format,
but so can a damaged MFT. This
really needs some diagnostic help.

Zvi Said:
Could you please describe the drive configuration: What order is
the problem
drive (first, second, ... fourth?), and how was it partitioned (one
big
partition, several, what types?).

Gregg Said:
I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. The drive is one big partition. The Info
in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise
Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
the PCI card.

Zvi Said:
If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in
the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the
Ultra-100
controller. Yet a corrupted partition table could have a similar
effect as the
controller will set the drive in the BIOS list (not the same as
CMOS!) with a
best fit to what's found in the MBR.

The above doesn't exclude the possibility that either the MBR and/or
the boot
sector were altered.

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The MFT?
How do I look at the corrupted partition table? What info do I need
to provide you to further assist me?

Zvi Said:
In case the purchased SW doesn't yield the expected results: Make
sure to not
write to the problem drive if you wish to maintain the option of
switching back
to the above approach.

My Response: (Gregg)

I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

I can tell you I won't be satisfied with the recovery method because
although it may recover the files, I still want the File structure
(Tree) in tact. So I want to continue to work on this problem and
see if I can solve it. Of course I won't be able to do it without
some help. Please continue to help me. I do appreciate it!

Thanks again, Gregg

 

[wemaole]

I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions: Fix boot sector

Run the program and right click the partition and choose fixboot.


see more: http://www.ptdd.com/fixboot.htm

 

[Alexander Grigoriev]

I suppose the drive is properly detected as Big ATA?

 

[Zvi Netiv]

Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
post. (Below)
[snipped]

Post here the report file (just paste the text file into your
follow-up), and avoid top-posting!

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.
Thanks Zvi.

Took you long until the coin dropped ...

[snip]

Yes Zvi. I have understood what you are telling me. The ultimate fix
here is to have the drive operate as before. Problem is, where do I
begin?

With post <[email protected]> of this thread, before
having been sidetracked (if you use Forte Agent, select the post link,
right-click it and select "jump to message URL").

[big snip]

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The MFT?
How do I look at the corrupted partition table? What info do I need
to provide you to further assist me?

The RESQDISK assessment report should have answered these questions, if you had
followed the instructions in my above post. I could then interpret the findings
and guide you to complete the recovery. Others in this newsgroup could assist
you just as well, based on the RESQDISK report.

My Response: (Gregg)
I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

Since you already started the ER session, then let it complete what it started.
Bear in mind that not all files that data recovery SW does "see" will recover
properly. If OTOH, file recovery SW shows all your files and directories in its
preview pane, then this is an indication that the damage is minor and you may
have regained access to the file system without too much effort (and spare the
expense on SW that you could have purchased later on, if full drive recovery
didn't work for you). ;-(

I can tell you I won't be satisfied with the recovery method because
although it may recover the files, I still want the File structure
(Tree) in tact. So I want to continue to work on this problem and
see if I can solve it. Of course I won't be able to do it without
some help. Please continue to help me. I do appreciate it!

No problem here. Yet I see now that your posting problem might be caused by
Outlook Express as your default newsreader (OE is a classic Jack of all trades
and master of none)! Many prefer Forte Agent as their newsreader (I do) and
there is a free version available.

Regards, Zvi

 

[Gregg OBanion]

Zvi. Somehow I overlooked your instructions from your 5-26 5:40
am
post. (Below)
[snipped]

Post here the report file (just paste the text file into your
follow-up), and avoid top-posting!

Hello Zvi
I don't think I used ResQ correctly. Why was it trying to detect
FAT? Came home a half hour later and it was still detecting fat so I
made it finish. Here are the results. Is this what you wanted or do
I need to run the program again.

27 May 2005 21:01
Evaluation Copy *************************************** CHS
mode W9x
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *
Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:FAT-16*
CHS address: Cyl 0 Head 0 Sector 1
*********
*********************** Setup Diagnostics
************************
* Disk Type: WDC WD1600JB-00HUA0
*
* BIOS/CHS IDE/LBA
data *
* Number of Heads: 255 16
*
* Number of Cylinders: 1024 266305
*
* Sectors per Track: 63 63
*
* Disk Capacity in Mbytes: 8032 131071
*
* IDE Access Time: 44 msec
*
* Total sectors on drive: 268435455
*
******* Use Space to toggle between IDE and Ext.BIOS mode
********
Disk 1, Master Partition Sector, F6 for Layout



27 May 2005 21:01
Evaluation Copy *************************************** CHS
mode W9x
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *
Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:FAT-16*
CHS address: Cyl 0 Head 0 Sector 1
******************** Partition Table Layout
**********************
*
*
* Partition Starting Ending Reserved Total
*
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors
Sectors *
* 7 1 0 1 254 1023 63 63
312576642*
* 0 0 0 0 0 0 0 0 0
*
* 0 0 0 0 0 0 0 0 0
*
* 0 0 0 0 0 0 0 0 0
*
*
*
******* Press Alt+B to see as boot sector, Alt+M to edit
*********
Disk 1, Master Partition Sector, F6 for Layout

My Response: (Gregg)
Excellent info above.
Sorry for overlooking this. What you'll see written below was
written before I discovered your instructions (above).
Wow do I feel dumb! Please read below as it may provide a
valuable
summary. I will follow your instructions right away.
Yes I do have a Windows 98 machine.
Thanks Zvi.

Took you long until the coin dropped ...

[snip]

Yes Zvi. I have understood what you are telling me. The ultimate
fix
here is to have the drive operate as before. Problem is, where do
I
begin?

With post <[email protected]> of this
thread, before
having been sidetracked (if you use Forte Agent, select the post
link,
right-click it and select "jump to message URL").

[big snip]

My Response: (Gregg)
The last two paragraphs are confusing to me. How do I look at the
boot sector or MBR and what do I look for? How do I look at The
MFT?
How do I look at the corrupted partition table? What info do I
need
to provide you to further assist me?

The RESQDISK assessment report should have answered these
questions, if you had
followed the instructions in my above post. I could then
interpret the findings
and guide you to complete the recovery. Others in this newsgroup
could assist
you just as well, based on the RESQDISK report.

My Response: (Gregg)
I just used EasyRecovery Pro and recovered 100 GB of the RAW
disk.
ERP does have a RAW disk recovery tool. It is now writing to a
different drive. Not the problem drive. It will take 20 hours to
write that info to disk. Then I will report back to you.

Since you already started the ER session, then let it complete
what it started.
Bear in mind that not all files that data recovery SW does "see"
will recover
properly. If OTOH, file recovery SW shows all your files and
directories in its
preview pane, then this is an indication that the damage is minor
and you may
have regained access to the file system without too much effort
(and spare the
expense on SW that you could have purchased later on, if full
drive recovery
didn't work for you). ;-(

I had to stop the data recovery from EasyRecovery Pro. It was taking
to long to write to the recovery drive/folder. (about 25 hrs was the
estimate). The files I looked at had lost all structure even file
names were changed. Of course I only used ERP's RAW recovery tool.
GetDataBack left most file names in tact but didn't near the info
back that ERP recovered. Very little was recovered with GetDataBack.

No problem here. Yet I see now that your posting problem might be
caused by
Outlook Express as your default newsreader (OE is a classic Jack
of all trades
and master of none)! Many prefer Forte Agent as their newsreader
(I do) and
there is a free version available.

I will look at Forte Agent then soon. Yes I think Outlook Express
does some strange things to text, breaking sentenances apart. Just
bad formating. It's probably just me though. Thanks for the info. I
will try Forte Agent.

Regards, Gregg