Recovering data from NTFS - My Experience

[Atlas]

I had a working PC when I've decided to manually copy an XP installation
from one disk to another.
As it wasn't booting stating some files were missing (but not damaged), I
thought that booting to the XP recovery console and refreshing the MBR and
the boot sector could help.
Suddenly and with no apparent reason the partition wasn't usable anymore.
The geometry seemed correct to the mainstream utilities like Partition
Magic, Large Drive Tools, Ranish, but when booting the system from another
install the partition was visible but not accessible (RAW).
Apart from trying to understand how and why the FIXMBR, FIXBOOT and BOOTCFG
screwed the MFT I'd like with this post to underline how excellent the
R-Studio NTFS utility is.
In the beginning I thought Easyrecovery could help, but it was already past
more than two ours (to scan the partition) when I've discovered that it
didn't find all my files....the EFS files where missing! And the filenames
where all converted to a 8.3 notation!
So I've decided to put a go onto R-Studio and.......WOW!!!!!
It found flawlessly ALL my files, long filenames, EFS, everything in half
the time, straight from Windows (could do something else while waiting),
with no glitch or crash (EasyRecovery did, fortunatelly it had finished the
scan and before crashing I saved the report).
I can warmly and happily advise everyone to buy it, a great piece of
software.
What the r-studio is missing is the capability to rebuild the MFT from the
scan. Apparently in my case the system found everything, so why not letting
the user copy the rescued files somewhere else and then give it a try to
rebuild the MFT?

Bye

 

[Timothy Daniels]

"Atlas" shrugged:

So I've decided to put a go onto R-Studio and.......WOW!!!!!
It found flawlessly ALL my files, long filenames, EFS, everything in half
the time, straight from Windows (could do something else while waiting),
with no glitch or crash (EasyRecovery did, fortunatelly it had finished the
scan and before crashing I saved the report).
I can warmly and happily advise everyone to buy it, a great piece of
software.
What the r-studio is missing is the capability to rebuild the MFT from the
scan. Apparently in my case the system found everything, so why not letting
the user copy the rescued files somewhere else and then give it a try to
rebuild the MFT?

Info and download sites:

http://www.r-tt.com/RStudio.shtml
<http://www.freedownloadscenter.com/Utilities/Disk_Maintenance_and_Repair_Utilit
ies/R_Studio.html>
http://www.tucows.com/preview/213685.html
http://www.pcworld.com/downloads/file_description/0,fid,22764,00.asp
http://download.com.com/3302-2094-8134556.html



*TimDaniels*

 

[Svend Olaf Mikkelsen]

I had a working PC when I've decided to manually copy an XP installation
from one disk to another.
As it wasn't booting stating some files were missing (but not damaged), I
thought that booting to the XP recovery console and refreshing the MBR and
the boot sector could help.
Suddenly and with no apparent reason the partition wasn't usable anymore.
The geometry seemed correct to the mainstream utilities like Partition
Magic, Large Drive Tools, Ranish, but when booting the system from another
install the partition was visible but not accessible (RAW).
Apart from trying to understand how and why the FIXMBR, FIXBOOT and BOOTCFG
screwed the MFT I'd like with this post to underline how excellent the
R-Studio NTFS utility is.
In the beginning I thought Easyrecovery could help, but it was already past
more than two ours (to scan the partition) when I've discovered that it
didn't find all my files....the EFS files where missing! And the filenames
where all converted to a 8.3 notation!
So I've decided to put a go onto R-Studio and.......WOW!!!!!
It found flawlessly ALL my files, long filenames, EFS, everything in half
the time, straight from Windows (could do something else while waiting),
with no glitch or crash (EasyRecovery did, fortunatelly it had finished the
scan and before crashing I saved the report).
I can warmly and happily advise everyone to buy it, a great piece of
software.
What the r-studio is missing is the capability to rebuild the MFT from the
scan. Apparently in my case the system found everything, so why not letting
the user copy the rescued files somewhere else and then give it a try to
rebuild the MFT?

Bye

The conclusion that really can be made is that if one recovery tool
does not work, it may be worth the effort to try another.

Partitions can be damaged in different ways, and a tool that does not
work in one case, may be the only one that works in another.

I do not know Easy Recovery, but it may have different search options,
and another may have worked.

The MFT cannot be rebuild.

 

[Joep]

The geometry seemed correct to the mainstream utilities like Partition
Magic, Large Drive Tools, Ranish, but when booting the system from another
install the partition was visible but not accessible (RAW).

Can be something as simple as the boot sector, and if it that, you do NOT
want to use the tools: FIXMBR, FIXBOOT and BOOTCFG ... How much value, do
recommendations made by someone who makes silly mistakes like that, have?
(No need to answer, is rethorical)

Apart from trying to understand how and why the FIXMBR, FIXBOOT and BOOTCFG
screwed the MFT

How did you determine that?

What the r-studio is missing is the capability to rebuild the MFT from the
scan.

R-Studio like any other commercially available tool is missing that. Now why
is that you think?

 

[Atlas]

Can be something as simple as the boot sector, and if it that, you do NOT

want to use the tools: FIXMBR, FIXBOOT and BOOTCFG ... How much value, do
recommendations made by someone who makes silly mistakes like that, have?
(No need to answer, is rethorical)

Dear friend, it may seem rethorical to someone like you in the business of
data recovery, not for a manager looking for an immediate solution to the
problem.
When you're stuck at 3AM, with your job to be finished for 9AM you have to
do something, so make an effort for the community and stop being bossy!!!

By the way, I can tell you that I've applied the mix of the 3 command lines
above many, many times and they NEVER screwed up my disks. To be hones they
did perfectly the jobe they were intended to do, as far as I'm concerned.

How did you determine that?

Well this is what I've done:
The partition, a 26gigs primary NTFS5, had an XP install in it. As I wanted
to rollback the system files and not the user files to a previuos config, it
may be strange to you, (but I did it many times with no problems) I did a
boot from another disk with XP (to gain full access to ordinary protectd
files like registries etc), and manually moved the directories %systemroot%
and "program files" into a new dir named "old", then copied (xcopy with the
proper attributes) the "rollback" older %systemroot" and "program files".
Rebooted, NTLDR stopped stating couldn' find sime files. So before booting
from the XP cd and start a repair install to freshen the system (long) I
thought to have a go with the 3 command line tools above, as I though the
the boot sector was pointing to a wrong location on the disk.
So I booted from the CD, went into the recovery console, launched the 3
commands, and rebooted
Afterwards the partion was unaccessible as I said in my previous message.

 

[Atlas]

In the future do the wise thing: *go to bed*. In general, the jobs that

people feel they 'must' finish hardly ever involve life and death, an angry
boss (who still 'loves' you anyway), pride and stuff like that at most.

Our customer couldn't wait one minute. Anyway I was lucky.

regarding the RAW partition, I also suspect that *at least* the boot sector
was damaged. If it is just a damaged bootsector, this can be fixed 95 out
100 times using the backup boot sector. I still don't see why you think the
MFT was damaged.

I've run Large Drive Tools, I've used it many times to rebuild bootsectors,
among many other options.
This time it stated a correct boot sector, correct partition table, correct
MBR....

Apart from that since I use computers (24yrs now) I had many troubles,
particularly with FAT partions (remember PC Tools, spinRite and Norton
Utilities?) less with FAT32, none, since two days ago, with NTFS (apart
from physically and mechanically damaged disks).

Bye

 

[Timothy Daniels]

"Atlas" held up the world to say:

I read about your job, are you looking for consultants/writers?
If so I'll post you a message.
bye

What? <puzzlement furrows Timmy's brow as he takes another
swig of Negra Modelo>


*TimDaniels*

 

[Joep]

Dear friend, it may seem rethorical to someone like you in the business of
data recovery, not for a manager looking for an immediate solution to the
problem.

Being in a hurry in this type of situations is bad ... But at the same time,
you don't pick the moment for thise things to happen.

When you're stuck at 3AM, with your job to be finished for 9AM you have to
do something

In the future do the wise thing: *go to bed*. In general, the jobs that
people feel they 'must' finish hardly ever involve life and death, an angry
boss (who still 'loves' you anyway), pride and stuff like that at most.

, so make an effort for the community and stop being bossy!!!

I am not being bossy, or, it wasn't my intention anyway.

By the way, I can tell you that I've applied the mix of the 3 command lines
above many, many times and they NEVER screwed up my disks. To be hones they
did perfectly the jobe they were intended to do, as far as I'm concerned.

Okay, fair enough, but then let me tell you, that we see several cases
*every week*, where it was actually one of the above commands that caused
the dataloss (FixBoot being on top of the list when it comes to those 3
commands).

Well this is what I've done:
The partition, a 26gigs primary NTFS5, had an XP install in it. As I wanted
to rollback the system files and not the user files to a previuos config, it
may be strange to you, (but I did it many times with no problems) I did a
boot from another disk with XP (to gain full access to ordinary protectd
files like registries etc), and manually moved the directories %systemroot%
and "program files" into a new dir named "old", then copied (xcopy with the
proper attributes) the "rollback" older %systemroot" and "program files".
Rebooted, NTLDR stopped stating couldn' find sime files.

Well, to be honest ... On some of my PC's I do have system restore actually
running, and that did sometimes save some effrot in correcting minor driver
etc. problems. I then used System Restore, using the normal interface. So no
manually copying files/folders back.

For fixing problems as you describe, I use a program that is intended to fix
those problems; an imaging program, V2i protector in my case.

So before booting
from the XP cd and start a repair install to freshen the system (long) I
thought to have a go with the 3 command line tools above, as I though the
the boot sector was pointing to a wrong location on the disk.
So I booted from the CD, went into the recovery console, launched the 3
commands, and rebooted
Afterwards the partion was unaccessible as I said in my previous message.

regarding the RAW partition, I also suspect that *at least* the boot sector
was damaged. If it is just a damaged bootsector, this can be fixed 95 out
100 times using the backup boot sector. I still don't see why you think the
MFT was damaged.

????

Okay, fair enough. In general data recovery is about avoiding doing anything
to the 'bad' disk. However, sometimes fixing something seems/is so simple
(seems sometimes, afterwards you may discover it wasn't really that simple)
that repairs can be made with a minimum if risk. Examples are MBR, partition
table and boot sector problems. Also, in case of FAT and FAT32 FAT problems
may be fixable if one of the 2 FAT copies is still intact. (partially)
Rebuilding a damaged root directory is do-able as well. Even when repairs
may seem simple, make sure you can undo your modifications or work on a
clone of the bad disk.

Fixing and MFT or FAT by rebuilding it from scratch isn't simple, a lot of
assumptions have to be made. Assumptions that may be do-able for a human
recovery engineer, but are hard to catch in program code. There are tools
available for FAT and FAT32 that will try to (like Norton's Unformat), in
reality the results are most often poor. Problem with that is, that those
tools do not offer an option to 'undo' their repairs. You then have a drive
in a condition that makes it even more complicated for read-only tools like
R-Studio to recover data.

The fact that only a few tools exist that 'unformat' FAT disks, and none (as
far as I know) for NTFS speaks for itself. You may argue that, like in your
case, once you have recovered the data, an attempt to repair for example an
MFT is without risk. Still, the amount of effort that this would cost to
implement a feature like that, is too much compared to the added value that.

 

[Joep]

Our customer couldn't wait one minute.

Otherwise he would have died?

Anyway I was lucky.

Good! Next time you may not be, so goto bed.

I've run Large Drive Tools, I've used it many times to rebuild bootsectors,
among many other options.

I know that one ...

This time it stated a correct boot sector, correct partition table, correct
MBR....

If LDT does repair boot sectors where it concerns the boot code. It does
*not* fill out BPB fields from scratch in case they are damaged, fields
required to actually access a drive (leaving to boot or not to boot
completely out of the picture). So when LDT mentions a boot sector is okay,
it refers to the bootcode only.

Apart from that since I use computers (24yrs now) I had many troubles,
particularly with FAT partions (remember PC Tools, spinRite and Norton
Utilities?)

Yep. I even mentioned NU in previous message ...

less with FAT32

Although FAT32 hardly differs that much from FAT

, none, since two days ago, with NTFS (apart
from physically and mechanically damaged disks).

Well, it happens, especially when you use Fixboot in the wrong situation

Bye

Bye, bye ...