Recovery an NTFS partition

[Ian St. John]

I have three large partitions on my hard drive. I was using one FAT32
partition as a legacy MS WinME OS with many applications and many years of
work. A second was an NTFS WinXP partition that I used more frequently. The
nice thing about partitions is that it gives you a degree of protection from
the devastation of viruses. I was using either the WinXP multiboot loader or
Partition Magic's multiboot program. I also have a small (78 MB) DOS
partition for DOS Partition Magic.

Recently the NTFS WinXP partition file system has become corrupted and
inconsistent. I've been unable to boot WinXP from that partition. Partition
Magic can see the partition but it tells me the partition has errors. Only
WinXP can fix the file system. I've installed a new version of WinXP on my
spare partition in a valiant effort to recovery some important legal
documents that reside on that partition. During installation of new WinXP
from CD the install program told me that the lost partition was an OS/2 file
system; it could identify it as NTFS because it was corrupted. Under my new
WinXP, the utility 'Disk Management' can see the lost partition file system,
it says the file system's healthy NTFS, but otherwise unknown and with no
drive letter. Using 'Command Prompt', I am see a partition for which I am
told 'The device is not ready'. Under 'Command Prompt' CHKDSK says it is
'Incorrect MS-DOS version'.

Can anyone suggest some approaches that I can take to recover the important
legal documents (scanned image files) that I have on the lost NTFS
partition?

Thanks.

Ian St. John

 

[Ken Blake]

In

The nice thing about partitions is that it gives you a
degree of protection from the devastation of viruses.

A very small degree of protection. Most viruses would have no
trouble transcending partition boundaries.

 

[Ian St. John]

The nice thing about partitions is that it gives you a

A very small degree of protection. Most viruses would have no trouble
transcending partition boundaries.

What you say may be true in some instances. But I doubt any virus that
infected a FAT32 partition could climb up into an NTFS partition. Many nasty
viruses came before good anti-virus programs became cheap enough for my
scholarly budget. In my experience with PC viral infection, there have been
times when the capacity of a dual boot system has made virus removal quite
simple and saved me from catastrophe. I have file continuity that goes back
to 1995. Many people have lost everything due to a virus (or stupidity or
hardware failure).

There are other reasons to partition a disk, though. You really can't get
the most out of a big disk unless it is partitioned. If you have a big disk
and it is not partitioned, you might as well have a smaller disk. You would
never know the difference.

Having several partitions for different flavors of MS Windows may seem
excessive. But some of us also need to be able to boot and use Linux. I have
WinXP and Linux Fedora Core on separate partitions on my laptop and three
partitions and two types of MS Windows on my home brew computer, currently.
I could if I wished, access the WinXP NTFS file system from Linux but not
vice versa.

Not to be distracted, does anyone have any ideas related to my original
query.

 

[Bill Blanton]

I have three large partitions on my hard drive. I was using one FAT32 partition as a legacy MS WinME OS with many applications and
many years of work. A second was an NTFS WinXP partition that I used more frequently.

Recently the NTFS WinXP partition file system has become corrupted and inconsistent. I've been unable to boot WinXP from that
partition. Partition Magic can see the partition but it tells me the partition has errors. Only WinXP can fix the file system.
I've installed a new version of WinXP on my spare partition in a valiant effort to recovery some important legal documents that
reside on that partition. During installation of new WinXP from CD the install program told me that the lost partition was an
OS/2 file system; it could identify it as NTFS because it was corrupted.

Can anyone suggest some approaches that I can take to recover the important legal documents (scanned image files) that I have on
the lost NTFS partition?

I've had good luck with FindNTFS.
http://www.partitionsupport.com/utilities.htm

The basic steps are to first determine the starting Cylinder/Head/Sector
of the volume, then with that information direct FindNTFS to make a listing
of directories it finds. From there you can plug in the numbers (from the
listing) of the dirs you want to recover.

Definetly not user friendly, but if can can figure it out, it works wonders.
If you need help, post back.

Get the Win version and run it from the ME DOS prompt to retain long filenames.


If you want to be reckless you could try fixboot.. but I would save that
until after you retrieve your data.

 

[Mike Hall \(MS-MVP\)]

Ian

If you can access the NTFS partition with Linux, why don't you?.. the link
below is to a free file recovery program that works..

http://www.pcinspector.de/file_recovery/UK/welcome.htm

--
Mike Hall
MVP - Windows Shell/User

"If hard work were such a wonderful thing, surely the rich would have kept
it all to themselves." - Lane Kirkland

 

[Richard Urban]

You can have any number of partitions of any type. If the partitions are
accessible from the operating system a virus can/may/will infect all
partitions. If you get a virus that corrupts say .jpg files, pictures on all
your partitions will be infected. Same with music files etc.

Now, I have three operating systems on my computer - each in it's own
primary DOS partition. Only one primary DOS partition is active at any given
time. A virus, in my experience, can not jump this type of partition! Each
O/S is safe from whatever may happen on another.

--
Regards,

Richard Urban

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Ken Blake]

In

What you say may be true in some instances. But I doubt any
virus that
infected a FAT32 partition could climb up into an NTFS
partition.

I don't agree at all.

There are other reasons to partition a disk, though.

Yes, of course. My comment wasn't arguing for or against having
multiple partitions. It was arguing only against the thought that
having multiple partitions provided any significant protection
against viruses.

You really can't
get the most out of a big disk unless it is partitioned. If you
have
a big disk and it is not partitioned, you might as well have a
smaller disk. You would never know the difference.

You're saying that having a 250GB drive in a single partition is
no better than having a 40GB drive, and you can't tell the
difference between them? That's complete nonsense.

 

[cquirke (MVP Windows shell/user)]

In Ian St. John <[email protected]> typed:

A very small degree of protection. Most viruses would have no
trouble transcending partition boundaries.

Some malware's written to act on "their" volume, and others always
attack C:, but many do cruise drive letters, including those mapped to
LAN shares. Ironically this is often easier when attacking from
high-level scripting languages, which are easier to write in, travel
in editable form, and thus get mutated easily.

However, separate volumes protect against some other scenarios quite
well - physical HD failure not being a good example, of course.
ChkDsk and Defrag can be done separately, different file systems can
be used, different SR settings, and when one volume gets barfed (as
seems to be the case with this NTFS volume), other volumes are likely
to be OK, as long as low-level HD addressing stays sane.

It's also MUCH easier to do data recovery on, say, a 2G FAT16 volume
with fat 32k clusters than find an arbitrary 2G stuff in a solid NTFS
200G slab that's too big to image onto a spare 120G HD, etc.

The question is; after so many years of NT, and even XP, what
interactive file system repair tools are available for NTFS? That's
not a rhetorical question, I'd love an equivalent to Norton Diskedit
for NTFS, or even a Scandisk (interactive prompt-first repair) for
that matter. ChkDsk can hardly be considered a data recovery tool.

I found two that may help, if the problem's easy enough, here:

http://www.pcinspector.de/file_recovery/uk/welcome.htm

It didn't help in the case I downloaded them for, which was a USB
stick with barfed FATxx file system that the OS sees as unformatted.
The irony here is that I can't bring Diskedit to bear, even though I
could eat this job with it, because Windows that sees the drive won't
let it operate, and DOS mode that lets it operate won't show the
drive. If I could only image the thing onto a UIDE HD... :-(

------------------------ ---- --- -- - - - -

Forget http://cquirke.blogspot.com and check out a
better one at http://topicdrift.blogspot.com instead!

 

[Richard Urban]

Try ptedit (must be run from pure DOS) on the USB stick. I have never done
so, but I have had great success, under similar circumstances, on USB
external drives that have lost their formatting.

--
Regards,

Richard Urban

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[cquirke (MVP Windows shell/user)]

On Sun, 19 Jun 2005 21:48:49 -0400, "Richard Urban"

Try ptedit (must be run from pure DOS) on the USB stick.

If I'm in pure DOS, I can't see the USB stick.

If I could see the USB stick from pure DOS, I'd be able to bring
DiskEdit to bear on it, and I'd be home and dry.

Do you know of anything that would confer such low-level visibility
for the USB stick to pure DOS?

-------------------- ----- ---- --- -- - - - -

"If I'd known it was harmless, I'd have
killed it myself" (PKD)

 

[Richard Urban]

Try this one (even better) (-:

Boot up the computer using the Ghost 9.01 CD. This installs, I believe, a
version of Linux as the environment. It also loads USB drivers.

Once you are at the initial screen (about 3 minutes), go to advanced tools |
utilities | Edit Partition Table. It looks very much the same as ptedit but
with more options. You can view/change the partition type from here.

Choose your drive (careful now). Click in the first box in the lower pane
for the drive/partition. This will "turn on" the option for "edit partition
table".

For my external Seagate USB drives it should be code 07 (fat32x). I have had
an occasion, or two, where the drive is not seen by anything. When checking
the partition type it was indicated as Type 00 (no partition). I don't know
why the change occurs. If the drive comes up as RAW in Windows it will also
be shown as Type 00. By just changing the partition type to what I know it
to be, saving and rebooting, the drives have been usable once again (with no
loss of information).


--
Regards,

Richard Urban

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Bill Blanton]

Try this one (even better) (-:

Boot up the computer using the Ghost 9.01 CD. This installs, I believe, a version of Linux as the environment. It also loads USB
drivers.

Once you are at the initial screen (about 3 minutes), go to advanced tools | utilities | Edit Partition Table. It looks very much
the same as ptedit but with more options. You can view/change the partition type from here.

Or, you could use ptedit32 from within Windows.
ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/

Choose your drive (careful now). Click in the first box in the lower pane for the drive/partition. This will "turn on" the option
for "edit partition table".

For my external Seagate USB drives it should be code 07 (fat32x). I have had an occasion, or two, where the drive is not seen by
anything. When checking the partition type it was indicated as Type 00 (no partition). I don't know why the change occurs. If the
drive comes up as RAW in Windows it will also be shown as Type 00. By just changing the partition type to what I know it to be,
saving and rebooting, the drives have been usable once again (with no loss of information).

AFAIK, most usb stick/flash drives don't have partition tables, but are set
up like floppies with the volume boot sector in the first sector. That's how
my 256mb/FAT16 memorex came formatted. The driver is presenting it that
way anyway.. No telling what's really "on the drive".



I've never tried, but you might want to experiment with these drivers.
http://www.bootdisk.com/usb.htm

As an alternative to diskedit, you could use WinHex (disk editor). The trial
version is read only, but you could at least determine the problem and if
it's fixable.

 

[Russ \(Oracle DBA\)]

I completely ruined a USB memory stick one time by accidentally partitioning
it into an NTFS volume using the WindowsXP installation media. I have never
been able to use it since.

 

[Guest]

Ok, here is something that may be of use. I have done it this way before,
but you may have a different case. Do a search for a free utility called
NTFS4DOS. With it, you can make a floppy disk that will boot to a command
prompt and be able to read/write NTFS partitions. I needed to use this to
wipe some NTFS RAID disks without installing an OS. Sorry I can't provide a
link to that, I don't remeber the site off the top of my head and it's about
time for me to leave anyways, so I don't have time to find it for you. Good
luck.

 

[Bill Blanton]

I'm surprised that could happen. I suppose you tried to format it.
If it does ahve a table structure in the first sector, you might
have luck zeroing out the first sector, and then format.

 

[Russ \(Oracle DBA\)]

Yep, I was surprised that it could be done. The scenario went something
like this.

1. Booted Windows disc for fresh install on system.
2. On the existing drive partitions screen, noticed 256MB partition that
didn't belong.
3. (Did not realize USB stick was connected.)
4. Thinking this was an OEM scratch area, deleted partition.
5. Partition deleted successfully but did not merge space with that of main
drive.
6. Oh shit. Realized that I had just trashed memory stick.
7. Tried creating new partition.
8. Seemed to work.
9. Tried formatting.
10. Unreacognized or damaged partition.
11. Tried deleting partition.
12. What partition?
13. Etc. Etc. Etc.

I was stunned that it was possible for me to do this. I was just as stunned
that I could find no way to correct the problem. I had won this memory
stick as a door prize at last year's company picnic/zoo outing, so it was no
financial loss. I was ticked, however, because there was some stuff on it
that took me a long time to replace.

 

[Bill Blanton]

I was able to reproduce the same, just now, short of partitioning the
stick.

I still think it's only a logical structure problem in the first
sector and is probably fixable. Maybe even file recoverable if you
paste in a boot sector that matches the volume's parameters.

As far as getting the drive to just work and not worry about the data,
you probably only need to delete the ending signature word in the sector.
But just clearing out the partition tables might work.

On the latter, ptedit32 will do if it recognizes the drive. As far as
clearing or rebuilding the sector, Findpart [getsect | putsect] will
work (again if it recognizes the drive. (that's mostly up to
whatever driver)) Fwiw, both those programs recognize my stick as
"fixed disk" with XP-Sp2 (default Win drivers), and will read/write
to the stick.

Here's the link to findpart
http://www.partitionsupport.com/utilities.htm

Or maybe you tossed it already?

 

[Caseblade]

Try This

I actually had a similar issue reciently. I was able to recover my files so I'll list the steps right here. This will only work if the computer that needs recovering is connected to a network with another computer that can backup the files. You'll also need a blank CD to create a live disk with.

1. Burn a Knoppix 3.9 live CD. You should be able to fine an ISO image if you search for Knoppix through google.

2. Boot with the Knoppix CD. The CD detected my partition as an OS/2 partition however it let me see everything on the partition so this didn't seem to be an issue.

3. Start the Samba server under Programs Menu -> Knoppix -> Start Samba Server. After doing this, set a password for the server and set the hard drives as remotely viewable.

4. Using the Remote machine, go to the address \\knoppix\. When prompted for the username and password, use the username knoppix and the password you picked when starting up Samba.

After backing up your files, it's as simple as reinstalling the OS to fix the issue.

 

[lukeles]

I have three large partitions on my hard drive. I was using one FAT32
partition as a legacy MS WinME OS with many applications and many years of
work. A second was an NTFS WinXP partition that I used more frequently. The
nice thing about partitions is that it gives you a degree of protection from
the devastation of viruses. I was using either the WinXP multiboot loader or
Partition Magic's multiboot program. I also have a small (78 MB) DOS
partition for DOS Partition Magic.

Recently the NTFS WinXP partition file system has become corrupted and
inconsistent. I've been unable to boot WinXP from that partition. Partition
Magic can see the partition but it tells me the partition has errors. Only
WinXP can fix the file system. I've installed a new version of WinXP on my
spare partition in a valiant effort to recovery some important legal
documents that reside on that partition. During installation of new WinXP
from CD the install program told me that the lost partition was an OS/2 file
system; it could identify it as NTFS because it was corrupted. Under my new
WinXP, the utility 'Disk Management' can see the lost partition file system,
it says the file system's healthy NTFS, but otherwise unknown and with no
drive letter. Using 'Command Prompt', I am see a partition for which I am
told 'The device is not ready'. Under 'Command Prompt' CHKDSK says it is
'Incorrect MS-DOS version'.

Can anyone suggest some approaches that I can take to recover the important
legal documents (scanned image files) that I have on the lost NTFS
partition?

Thanks.

Ian St. John

May be the boot sector or FAT/ MFT are corrupt.
You can use some tool to fix it.

I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions:
Backup partition table, Restore partition table, Rebuild
partition table, undelete partition, Fix boot sector,
rebuild mbr,etc.

First thing I recommend you download the demo version of
Partition Table Doctor.( http://www.ptdd.com/download.htm )

Run the program and right click the partition and choose fixboot.

For more detail:
http://www.ptdd.com/fixboot.htm

See more: http://www.ptdd.com/recoverylostpartition.htm
http://www.ptdd.com/recoverdeletedpartition.htm
http://www.ptdd.com/partition-recovery.htm
http://www.ptdd.com