Drive not recognized anymore - please help!

[JohnnyB]

I am in need of some serious help before I go any further...
(technical outputs from PowerQuest Partition Info and
Svend Mikkelsen's Findpart are inthe end of this message).

This is dual boot system with Win98 and 2K booting of two
different logical partitions on a primary physical drive
(2Gb Win98 + 2 Gb Win2K + 6 Gb Apps). Another drive, 20Gb,
was partitioned in two: ~ 17Gb for data and ~ 3 Gb used for
storing images of partitions with OS.

One day Win2K complained about the 17Gb partition problems
- I let it, scadisk "fixed" something and I did not notice
anything unusual. Next time, after reboot, I am noticing two
directories I can no longer access (garbage names). I boot
to Win98 - same thing. Back in Win2K I run scandisk again.
Now it says there are serious problems and offers deleting
files to remedy them. I decline and think that now is the
time to dump everything on CDs. That takes time and I
manage to make to backup only 1Gb before I go to bed and
turn the computer off. Next boot - NOTHING. Disk is
recognized but partitions and their corresponding drive
letter GONE.

Naturally, I need some of the data on that disk really badly!

So I am thinking there are many recovery/repiar utils.
A search suggests there are way too many and while it is not
even clear where to start, all of them have a potential to
make things much worse. I am afraid (bot not yet to the point
of paying mucho $$$ to data recovery company). To begin with,
I do not understand what I have at hands...

Please. help me to understand the problem and suggest the
best way of addressing it. DIY is much preferable.

Thank you!

Johnny

P.S.
Partition Info says this:
===========================================================================================================
Disk Geometry Information for Disk 2: 2482 Cylinders, 255 Heads, 63
Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect
StartSect NumSects
===========================================================================================================
0 1 00 1 0 1 41 1023 62 63
16,065 11,377
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 1 00 1 0 1 41 1 180 37 16065 11377
Info: Partition didn't end on cylinder boundary.
ucEndHead expected to be 254, not 180.
Info: Partition didn't end on cylinder boundary.
ucEndSector expected to be 63, not 37.

===========================================================================================================
Partition Information for Disk 2: 19469.4 Megabytes
Volume PartType Status Size MB PartSect # StartSect
TotalSects UsedSects FreeSects
===========================================================================================================
Type 41 Pri 5.6 0 1 16,065
11,377 11,377 0

--------------------------------------
(Partition Magic shows as BAD, for "partition" is says "error" and for its
type there is an "#108)

Findpart outputs the following:
***************************************************************************
Disk: 2 Cylinders: 2482 Heads: 255 Sectors: 63 MB: 19469

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 19374327 9460 0 1 1 1205 254 63 B OK
1 1 0B 63 33575787 16394 1 1 1 2090*254 63 NB OK
1 2 05 33575850 6281415 3067 2091* 0 1 2481*254 63 1 OK
-2087+- 0B 33554495 16128 7 1 1 1 2 1 63 B OK
2091 1 0B 63 6281352 3067 2091* 1 1 2481*254 63 NB OK
0 - 0B 33591978 6281352 3067 2091 1 1 2481 254 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 9457 8* 37* 6606 0 5 2846 1
1 1 33 Second FAT not found.
1982 0 2 Second FAT not found.
2091 1 33 Second FAT not found.

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 2 41 16065 11377 5 1 0 1 1023 62 63 NB
1 0 1 1 180 37 Actual
*****************************************************************************

 

[Svend Olaf Mikkelsen]

Disk: 2 Cylinders: 2482 Heads: 255 Sectors: 63 MB: 19469

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 19374327 9460 0 1 1 1205 254 63 B OK
1 1 0B 63 33575787 16394 1 1 1 2090*254 63 NB OK
1 2 05 33575850 6281415 3067 2091* 0 1 2481*254 63 1 OK
-2087+- 0B 33554495 16128 7 1 1 1 2 1 63 B OK
2091 1 0B 63 6281352 3067 2091* 1 1 2481*254 63 NB OK
0 - 0B 33591978 6281352 3067 2091 1 1 2481 254 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 9457 8* 37* 6606 0 5 2846 1
1 1 33 Second FAT not found.
1982 0 2 Second FAT not found.
2091 1 33 Second FAT not found.

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 2 41 16065 11377 5 1 0 1 1023 62 63 NB
1 0 1 1 180 37 Actual

There has been, or is a hardware issue.

The number of sectors in the extended partition is 2481 * 255 * 63,
which is hexadecimal 2602C71.

According to the MBR partition table the number of sectors is 11377,
which is hexadecimal 2C71, meaning that some bits were returned wrong.

We do not know if the bit problem is current, or if sectors read wrong
were previously written back to the disk.

Some sectors are read correctly.

Well. Change the IDE cable, check the power connections. Get a new
disk for copying data to, and insert that disk in the system. Then we
can proceed from that.

I would be possible to proceed without a new disk, and it would be
possible to move the disk and new disk to another system, and proceed
there. Also you could move the disk to another port.

I will wait for your comments.

 

[JohnnyB]

There has been, or is a hardware issue.

The number of sectors in the extended partition is 2481 * 255 * 63,
which is hexadecimal 2602C71.

According to the MBR partition table the number of sectors is 11377,
which is hexadecimal 2C71, meaning that some bits were returned wrong.

We do not know if the bit problem is current, or if sectors read wrong
were previously written back to the disk.

Some sectors are read correctly.

Well. Change the IDE cable, check the power connections. Get a new
disk for copying data to, and insert that disk in the system. Then we
can proceed from that.

I would be possible to proceed without a new disk, and it would be
possible to move the disk and new disk to another system, and proceed
there. Also you could move the disk to another port.

Thanks for the reply! Unfortunately, I don't have neither another
system nor another hard drive. I did check power connection,
moved the disk to its own IDE channel (it used to be slave on
the same IDE as the primary HD). The exact same problem remains.

The really funny thing is that, even though the drive is
"invisible" to the OS, I can hear an occasional spin/access to
it! (I don't know how to explain it better - the two drives "sound"
quite differently; that 20Gb failed drive is made by IMB, by the way).

All I want is to get back about 4 Gb out of the ~ 17 Gb
filled on that drive...

Thank you,

Johnny

 

[Svend Olaf Mikkelsen]

Thanks for the reply! Unfortunately, I don't have neither another
system nor another hard drive. I did check power connection,
moved the disk to its own IDE channel (it used to be slave on
the same IDE as the primary HD). The exact same problem remains.

The really funny thing is that, even though the drive is
"invisible" to the OS, I can hear an occasional spin/access to
it! (I don't know how to explain it better - the two drives "sound"
quite differently; that 20Gb failed drive is made by IMB, by the way).

All I want is to get back about 4 Gb out of the ~ 17 Gb
filled on that drive...

Reply no. 2. From mail I have in part:

Finddir, version FP 4.36.
Copyright Svend Olaf Mikkelsen, 2003.

Searches for subdirectories and calculates cluster two
location. 'Cluster' is cluster number or cluster 2 CHS.
'KB' is cluster KB. May also say something about FAT location.

OS: DOS 7.10 WINDOWS 4.10

Disk: 2 Cylinders: 2482 Heads: 255 Sectors: 63 MB: 19469

Start cylinder: 0 End cylinder: 2481

--------- CHS ----- LBA -- Cluster (2) ----- LBA -KB YYMMDD
0 0 1 0 searched
3 11 43 48930 2 000513
18 221 46 303138 3 11 43 48930 8 000513
18 222 15 303170 3 11 43 48930 8 001223
30 4 41 482242 3 11 43 48930 8 020803
30 112 53 489058 3 11 43 48930 8 010908
30 113 6 489074 3 11 43 48930 8 000520
30 200 29 494578 3 11 43 48930 8 020118
30 200 45 494594 3 11 43 48930 8 020118
30 206 51 494978 3 11 43 48930 8 000520
30 207 52 495042 3 11 43 48930 8 020118
30 210 39 495218 3 11 43 48930 8 020118
33 221 31 544098 3 11 43 48930 8 010617
34 143 48 555266 3 11 43 48930 8 000513
34 168 17 556810 possible root
100 0 1 1606500 searched
107 223 56 1733059 possible root
162 129 26 2610682 possible root
200 0 1 3213000 searched
236 176 9 3802436 possible root
279 179 47 4493458 3 11 43 48930 8 020118

2054 247 20 33013090 3 11 43 48930 8 030518
2054 247 36 33013106 3 11 43 48930 8 030518
2092 134 33 33616454 possible root
2092 134 37 33616458 3 020227
2092 134 57 33616478 2092 134 33 33616454 2 021011

2386 68 1 38335374 2092 134 33 33616454 2 030603
2391 43 15 38414138 33609 000425
2400 0 1 38556000 searched
2402 143 52 38597190 1245186 030706

------FAT CHS ------LBA Confidence Distance Type Sig
1 1 33 16160 15170 32 OK
2 6 38 32545 15179 16385 32 OK
2091 1 33 33592010 4558 33559465 32 OK
2091 195 33 33604232 4558 12222 32 OK

In this output there is no sign of bit read errors.

Then for further examination, you can do in Windows using Findpart for
Windows:

findpart chsdir 2 1 1 33 16385 8 105260 summary fp-b.txt fat2

This is disk 2, FAT CHS 1/1/33, fatsize per copy 16385 sectors,
cluster size 8 KB, root cluster 105260.

The root cluster number however is a wild guess, so you can also do:

findpart findfat 2 1 1 33 16385 fp-c.txt comprehensive

to see if that can find the root cluster number. In order to repair
the partition we will need to know the root cluster number, asuming
the root directory was not damaged. If that cannot be found, you will
have to copy files in stead.


To prepare copying files using Findpart, you can do:

findpart cyldir 2 1 1 33 16385 8 105260 cdir.txt fp-d.txt fat2

The file cdir.txt is for your own use.


If you do not want to boot to Windows, you can do in DOS:

chsdir 2 1 1 33 16385 8 105260 summary fp-b.txt fat2
findfat 2 1 1 33 16385 fp-c.txt comprehensive
cyldir 2 1 1 33 16385 8 105260 cdir.txt fp-d.txt fat2

The file cdir.txt (for your own use) however probably will not fit a
floppy.

If you want to make a backup copy of the FAT, you can do in Windows:

findpart getsect 2 2 6 38 16385 fatback.bin noheader

 

[Svend Olaf Mikkelsen]

Sorry, I do not understand where 105260 comes from. In the
output from "findpart finddir 2 fp-a.txt" there is no "105260"
to be found, so I can't try anything else. Anyway, here is

The 105260 was the result of a calculation based on one of the
"possible root" lines. (Difference in address of cluster 2 and root
cluster divided by the number of sectors per cluster + plus 2).

Findfat, version FP 4.37.
Copyright Svend Olaf Mikkelsen, 2003.

OS: Windows 4.10 Comprehensive

Disk: 2 Cylinders: 2482 Heads: 255 Sectors: 63 MB: 19469

Only 1 location and FAT size examined.

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
1 1 33 16385 8# 3# 662 0 0 15723 15694

-----FAT1 -----FAT2
Signature: OK OK
Looks like FAT32: 16385 16385
Last used FAT sector: 16198 16198
Confidence: 15691 15694

Search root cluster: 3

Here we have another suggestion for the root cluster number: 3.

The "Bad" field is the number of sectors that do not match between
first and second FAT copy. It is difficult to interpret, but it could
be some sectors with bit errors that were written back to the disk.

No of maybe OK files in these directories: 24492

This line shows that 24492 files with matching FAT were found.

So, does it all mean that any hope to repair whatever
damage is done and be able to access the drive directly
is gone? Restoring files one by one and doing it for
few gigabytes would be total pain... (but better than
nothing).

So, what's next? Please advice.

You could try:

findpart chsdir 2 1 1 33 16385 8 3 summary fp-e.txt fat2

findpart chsdir 2 1 1 33 16385 8 3 summary fp-f.txt fat1

findpart chsdir 2 1 1 33 16385 8 3 summary fp-g.txt

Just stop the searches if many invalid entries are shown.


If files are copied using Findpart, it will be one directory, or one
tree at a time.

 

[JohnnyB]

You could try:

findpart chsdir 2 1 1 33 16385 8 3 summary fp-e.txt fat2

findpart chsdir 2 1 1 33 16385 8 3 summary fp-f.txt fat1

findpart chsdir 2 1 1 33 16385 8 3 summary fp-g.txt

Just stop the searches if many invalid entries are shown.

OK, I ran all three above. Run F (second of your commands,
off FAT1) was by far more "successful" than others - it listed
quite a number of actual files that existed on that drive.
Eventually it too "crapped out" and started showing files'
content as being files/directoroes names. The other two
started identically (first couple pages of screen dump were
identical to the output in "F"), but then crapped out
much, much sooner that did run "F".

I suppose that means we still don't have "real" root cluster
number? What else is there to try?

If files are copied using Findpart, it will be one directory, or one
tree at a time.

How does one do that? I'd like to give it a try and report back
how it goes.

Thanks a lot,

Johnny