HDD down-Data Recovery Question

[Guest]

Inital Problem

When you try to start or restart your Windows XP-based computer, you may
receive one of the following error messages:
Windows XP could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

These are my notes: sorry I don't use proper punctuation
-started with recovery console and ran a chkdsk /r
CHKDSK found and fixed one or more errors on the volume
Attempted to recover system registry by following details in q307545
-each time a boot was attempted it just shut itself off-including in safe
mode-no messages
-will need to take it to office to get it slaved over to another HDD to
offload the data
-hooked up HDD to another computer and attempted to explore the
drive-Windows detected the drive as unformatted-RAW partition-
-booted into recovery mode again and attempted to browse files using dir
command-Message-An error occured during directory enumeration
-attempted a chkdsk /r -Message -The volume appears to contain one or more
unrecoverable problems. Message o' death!
-same thing at 50% each time

This is my client's main business computer and of course the files are not
backed up since my last visit. Wish they would listen. Anyone know of any
utility or further t-shooting that I can attempt? I'm not hopeful and have
already advised my client of the bad news (felt like being a doctor and
telling them their family member died).

 

[Guest]

Data recovery is an expensive proposition. Here's a tool that will tell you
if anything can be recovered - then you'll have to pay to get the program
(around $70 I believe).
http://www.runtime.org/gdb.htm


Here's a freeware program:
http://www.pcinspector.de/file_recovery/uk/welcome.htm

 

[Guest]

Thanks for the links usasma. I tried the free one first with no luck. On
sectors it could not recover it required me to hit ignore, retry, or abort.
This didn't work with over 5000 bad sectors. I tried the demo of the
GetDataBack from runtimre.org and it worked great. Cost on it was $79 for
the license which enabled the copy feature (which I will pass on to a very
grateful client). All files copied off perfectly. This will come in handy
in the future. Thanks again.

 

[cquirke (MVP Windows shell/user)]

On Fri, 12 Aug 2005 18:07:01 -0700, "MidwestTech"

When you try to start or restart your Windows XP-based computer, you may
receive one of the following error messages:
Windows XP could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

That means the more important chunk of the registry's gone.

-started with recovery console and ran a chkdsk /r

Bad idea. ChkDsk is lethal in a data crisis, as it will irreversibly
"fix" whatever if finds "wrong" without asking you for permission
first. It's fundamentally incompatible with data safety.

By "fix", it will resolve conflicting file structure information in
favor of one or other alternative. No conflict, no problem, right?
Nope; no conflict, no *detectable* problem - you've just thrown the
needles back in the haystack, by destroying the cues that highlighted
that file as possibly damaged. You've also destroyed the information
you might have used to repair the damage, if ChkDsk guessed wrong.

CHKDSK found and fixed one or more errors on the volume

Details? Or was ChkDsk too useless to privide any, beyond a glib
"ChkDsk found errors, but fixed them all!"?

Attempted to recover system registry by following details in q307545

If a file system or hard drive is at risk, Windows is no loger fit for
use. Windows can't boot without writing to the hard drive, and runs
services that gratuitously write to every hard drive volume it sees
(AutoChk, System Restore, .PF management, thumbnails, indexing, file
access date stamps...). So you are taking a chance even when you drop
an at-risk HD into another PC to salvage data from it.

-each time a boot was attempted it just shut itself off-including in safe
mode-no messages

That you saw the turn-off to Safe Mode, means you get as far as
loading and running C:\NTLDR. The reason the PC restarts instead of
stopping with an error, may be because the duhfault "Automatica;lly
restart on system errors" setting is in effect. Kill that at birth.

-will need to take it to office to get it slaved over to another HDD to
offload the data

See above.

-hooked up HDD to another computer and attempted to explore the
drive-Windows detected the drive as unformatted-RAW partition-

That's interesting, as it implies an invalid partition table or
partition boot record, which would have precluded getting as far as
C:\NTLDR when you tried to boot it as a "live" HD.

Unless the new host PC was older than XP SP1, and the hard drive is
over 137G? In any event, get that HD out of that host PC **fast**.

-booted into recovery mode again and attempted to browse files using dir
command-Message-An error occured during directory enumeration
-attempted a chkdsk /r -Message -The volume appears to contain one or more
unrecoverable problems. Message o' death!
-same thing at 50% each time

Step one: Turn off the flamethrower (ChkDsk). If you want to destroy
the HD, just crush it with a hammer; much faster than ChkDsk.

This is my client's main business computer and of course the files are not
backed up since my last visit. Wish they would listen. Anyone know of any
utility or further t-shooting that I can attempt? I'm not hopeful and have
already advised my client of the bad news (felt like being a doctor and
telling them their family member died).

If it's FATxx, it's comparitively easy:
- DOS mode boot
- use Norton Disk Edit or similar if file system needs repair
- else use LCopy from Odi's LFN Tools to copy off data with LFNs
- else forego LFNs and copy via DOS mode
(or you can use approaches that follow, or access via Linux boot)

If it's NTFS, it's a gloomier picture; either...
- DOS mode boot
- if file system barfed, give up
- forego LFNs, using ReadNTFS to copy subtrees one at a time
....or...
- Bart PE CDR mode boot
- if file system barfed, try a few "automagical" repair tools
- if those fail, give up; there's no manual repair tools for NTFS
- else if OK, copy off data using A43, Cmd.exe, etc.
....or...
- boot the XP CD, choose Recovery Console
- if the Set commands work, use them to facilitate copy off HD
- else give up, as unless you'd facilitated Set earlier, you're dead
- copy files one at a time, by name, because that's all RC can do
....or if you feel like taking a chance...
- drop HD into an XP system
- press Esc if AutoChk tries to "fix" the HD
- immediately in XP, kill SR for the dropped-in HD
- try copying stuff off the HD now
- accept some collateral damage as inevitable with this approach
- accept secondary damage to host XP if lock-ups force bad exits

See http://cquirke.mvps.org/whatmos.htm

------------ ----- ---- --- -- - - - -

The most accurate diagnostic instrument
in medicine is the Retrospectoscope

 

[Guest]

Thanks for all the info. FYI the $79 GetDataBack worked really well-I could
see all the problems that chkdsk created once I was able to explore the drive
(lots of extra directories with HexDec labels). Also after reading your
linked site this might be helpful to you. http://www.runtime.org/peb.htm

Chkdsk utility should obviously come with a better notification of what it
is doing. At least the KB article should. Chkdsk /r has saved me in the past
and I obviously was becoming too reliant on it.

Thx for all the info.

 

[cquirke (MVP Windows shell/user)]

On Sun, 14 Aug 2005 11:17:01 -0700, "MidwestTech"

Thanks for all the info. FYI the $79 GetDataBack worked really well-I could
see all the problems that chkdsk created once I was able to explore the drive
(lots of extra directories with HexDec labels). Also after reading your
linked site this might be helpful to you. http://www.runtime.org/peb.htm

Ahhhh... is this the GetDataBack program you were referring to?

RunTime's stuff looks really promising, but it keeps expiring before I
get a chance to really play with it. I downloaded a trial of it
before, and it looked good, but by the time I could look again, it had
expired; now I've downloaded it again, but am not installing it until
I have time, and I've basically forgotten all about it until now.

I've used a few NTFS-aware "magic" data fixers, and they *all* fallen
over in a dead faint as soon as I wave a genuine barfed NTFS volume at
them. They either find nothing, or list 200 possible "recovered
partitions" without a single file in any of them, etc. Hopeless.

Let's see... US$ 79 times 7 for our bananas is R 560, or around 3
hour's labour by my current billing rate. It's not too bad, as long
as it's effective, and if I can sort out the payment mechanics.

Chkdsk utility should obviously come with a better notification of what it
is doing. At least the KB article should. Chkdsk /r has saved me in the past
and I obviously was becoming too reliant on it.

ChkDsk /R is just hiding the problem.

I much prefer ye olde DOS mode Scandisk. That would stop and tell you
what it was about to do, so that you could back out. ChkDsk just
"does stuff" and then glibly tells you "there were problems, but I
fixed them all". Trying to look up what ChkDsk or AutoChk did in
previous runs is a black art, and there's no Undo.

When it comes to surface scanning, DOS mode Scandisk clobbers ChkDsk
/R as well - it shows a map of what it's doing, shows existing bad
clusters, shows a fine-grained cluster counter which visibly falters
when the process stalls in retry loops, is running in a
non-multitasking OS so nothing else can cause spurious slowdowns
(except processor thermal protection perhaps), and once again it stops
and asks before "fixing" things.

Bad sectors being what they are, ChkDsk (and other software tools) can
only "fix" in the same way that a clean-up crew "fixes" dead
casualties by draping a blanket over their faces. It's nice that the
system won't try to use those now-known dead sectors again, but it's
far more important that the user be informed of their significance.

Claiming to have "fixed" the problem does exactly the opposite.

-------------------- ----- ---- --- -- - - - -

Reality is that which, when you stop believing
in it, does not go away (PKD)