NTFS partition disappeared. gone. vanished.

Discussion in 'Computer Support' started by KC, Oct 1, 2003.

  1. KC

    KC Guest

    And no, it's *not* because I booted into Windows 98.

    The drive in question is a 200 gig WD hard drive, second physical
    drive in system, with 3 partitions. After trying to format the 2nd
    partition in Windows 2000 disk manager and having it say "format
    failed" two times in a row, I decided to reboot and try again. On
    reboot, the THIRD partition (containing all the data I now seek to
    recover) has vanished, and the entire extended partition is now empty
    and unallocated. So, I know the data is there, probably a corrupt
    partition table?

    The details...

    The 200 gig is a brand new drive. It came with a Promise Ultra 100 TX2
    ATA100 controller. I originally set it up with that, using a 5 gig
    partition for the system and 2 equally sized partitions of about 90
    gigs for storage. After running it awhile, I found that Winamp
    playback would often cutout and ismietermined it was the Promise card
    (and perhaps the fact that this is only a Pentium II 400 system with
    256 megs ram). Decided I just wanted this drive for mass storage
    anyway, I took out the promise card, put my old harddrive in to run
    the system and set the 200 gigger as slave.

    Problems begin: Several directories show up as ASCII gibberish. I
    attribute it to the fact that I was using FAT32 for the 2 90 gig
    partitions (I eventually wanted them to be accessible by Linux). I
    move all data to partition 2, format partition 3 as NTFS, move all the
    data onto that, then try to format partition 2. Then the error,
    something along the lines of "unable to complete format" or whatever.
    Then the reboot, then... no more partition 2 or 3. Also, the old
    system files on partition 1 have all but vanished, all that remains is
    a folder with .chk files (though I never ran scandisk on it). The
    volume label is the same though.

    Partition Magic indicated that the end of the last partition exceeded
    the end of the physical disk, making me think that this problem may
    have begun when switching from the Promise controller back to my
    motherboard's IDE controller? Comments?

    Reading newsgroup posts I came across some from Joep of
    (www.DIYDataRecovery.NL). I ran his DiskPatch software and it
    indicated that the original NTFS partition table and the backup are
    identical.

    At no point did I run any disk utilities and write any changes to
    disk, so unless Windows 2000 has automatically made some severe
    changes, I'm thinking things should be recoverable. I've dealt with
    data recovery before, but never with NTFS. Any suggestions greatly
    appreciated.

    -Kent
     
    KC, Oct 1, 2003
    #1
    1. Advertising

  2. KC

    Billy Guest

    Have you tried placing it back on the promise card and running Partition
    Magic?

    "KC" <> wrote in message
    news:...
    > And no, it's *not* because I booted into Windows 98.
    >
    > The drive in question is a 200 gig WD hard drive, second physical
    > drive in system, with 3 partitions. After trying to format the 2nd
    > partition in Windows 2000 disk manager and having it say "format
    > failed" two times in a row, I decided to reboot and try again. On
    > reboot, the THIRD partition (containing all the data I now seek to
    > recover) has vanished, and the entire extended partition is now empty
    > and unallocated. So, I know the data is there, probably a corrupt
    > partition table?
    >
    > The details...
    >
    > The 200 gig is a brand new drive. It came with a Promise Ultra 100 TX2
    > ATA100 controller. I originally set it up with that, using a 5 gig
    > partition for the system and 2 equally sized partitions of about 90
    > gigs for storage. After running it awhile, I found that Winamp
    > playback would often cutout and ismietermined it was the Promise card
    > (and perhaps the fact that this is only a Pentium II 400 system with
    > 256 megs ram). Decided I just wanted this drive for mass storage
    > anyway, I took out the promise card, put my old harddrive in to run
    > the system and set the 200 gigger as slave.
    >
    > Problems begin: Several directories show up as ASCII gibberish. I
    > attribute it to the fact that I was using FAT32 for the 2 90 gig
    > partitions (I eventually wanted them to be accessible by Linux). I
    > move all data to partition 2, format partition 3 as NTFS, move all the
    > data onto that, then try to format partition 2. Then the error,
    > something along the lines of "unable to complete format" or whatever.
    > Then the reboot, then... no more partition 2 or 3. Also, the old
    > system files on partition 1 have all but vanished, all that remains is
    > a folder with .chk files (though I never ran scandisk on it). The
    > volume label is the same though.
    >
    > Partition Magic indicated that the end of the last partition exceeded
    > the end of the physical disk, making me think that this problem may
    > have begun when switching from the Promise controller back to my
    > motherboard's IDE controller? Comments?
    >
    > Reading newsgroup posts I came across some from Joep of
    > (www.DIYDataRecovery.NL). I ran his DiskPatch software and it
    > indicated that the original NTFS partition table and the backup are
    > identical.
    >
    > At no point did I run any disk utilities and write any changes to
    > disk, so unless Windows 2000 has automatically made some severe
    > changes, I'm thinking things should be recoverable. I've dealt with
    > data recovery before, but never with NTFS. Any suggestions greatly
    > appreciated.
    >
    > -Kent
     
    Billy, Oct 1, 2003
    #2
    1. Advertising

  3. KC

    Joep Guest

    Hi,

    "KC" <> wrote in message
    news:...
    >
    > Partition Magic indicated that the end of the last partition exceeded
    > the end of the physical disk, making me think that this problem may
    > have begun when switching from the Promise controller back to my
    > motherboard's IDE controller? Comments?
    >


    What last partition, if I read your post correctly, you the extended now
    appears as 'unallocated'. Is it the extended that overlaps the end of disk
    then? Does this error disappera when the disk is attached to the Promise
    controller again?

    > Reading newsgroup posts I came across some from Joep of
    > (www.DIYDataRecovery.NL). I ran his DiskPatch software and it
    > indicated that the original NTFS partition table and the backup are
    > identical.


    There is not such thing as an NTFS partition table backup, however, an NTFS
    partition keeps a backup of the boot sector (the first sector of the actual
    partition). When DiskPatch was able to compare the 2 (the boot sector with
    the backup), then the partition it did this for is actually defined in the
    partition table.

    So this is where I become confused, as I also read that the extended is
    empty and unallocated ... So what NTFS partition did DiskPatch compare those
    sectors for?

    Use the diagnostic tool partinfo from the PartitionMagic rescue diskette:

    partinfo>filename.txt [enter] ... the report will show current state of
    partition tables for all your disks.

    Also, I'd suggest to move the drive back to the controller that it was
    attached to when it was originally partitioned.

    Joep
     
    Joep, Oct 1, 2003
    #3
  4. KC

    KC Guest

    Since the original post I discovered the problem was likely caused by
    putting the 200 gig disk on my motherboard's IDE interface and not
    having 48-bit LBA enabled in Windows 2000 (SP4). On trying to write
    past the 137 gig barrier, corruption began.

    Anyway, the real issue for me now is getting back any lost data,
    mostly large .wav files. I had been recording my vinyl collection to
    disk, so I can always re-record everything but it's not exactly a fast
    and easy process.

    I have put the drive back on the Promise controller card. Here's the
    partition info from Partition Magic:


    ===============================================================================
    Disk Geometry Information for Disk 2:
    24321 Cylinders, 255 Heads, 63 Sectors/Track
    Warning: Logical drive chain points to sector without partition table.
    System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect
    NumSects
    ================================================================================
    0 0 80 0 1 1 07 638 254 63 63
    10,265,472
    0 1 00 639 0 1 0F 768 254 63 10,265,535
    380,451,330
    Info: Begin C,H,S values were large drive placeholders.
    Info: End C,H,S values were large drive placeholders.
    Actual values are:
    0 1 00 639 0 1 0F 24320 254 63 10265535
    380451330


    =====================================================================
    Partition Information for Disk 2: 190,779.7 Megabytes
    Volume PartType Status Size MB PartSect # StartSect
    TotalSects
    =====================================================================
    D: NTFS Pri,Boot 5,012.4 0 0 63
    10,265,472
    ExtendedX Pri 185,767.3 0 1 10,265,535
    380,451,330
    EPBR Log 0.0 None -- 10,265,535
    63
    Unallocated Log 185,767.2 None -- 10,265,598
    380,451,267


    ======================================================================
    Boot Record for drive D: (Drive: 2, Starting sector: 63, Type: NTFS)
    ======================================================================
    1. Jump: EB 52 90
    2. OEM Name: NTFS
    3. Bytes per Sector: 512
    4. Sectors per Cluster: 8
    5. Reserved Sectors: 0
    6. Number of FATs: 0
    7. Root Dir Entries: 0
    8. Total Sectors: 0
    9. Media Descriptor: 0xF8
    10. Sectors per FAT: 0
    11. Sectors per Track: 63 (0x3F)
    12. Number of Heads: 255 (0xFF)
    13. Hidden Sectors: 63 (0x3F)
    14. Total Sectors (>32MB): 0 (0x0)
    15. Unused: 0x80008000
    16. Total NTFS Sectors: 10265471
    17. MFT Start Cluster: 4
    18. MFT Mirror Start Clust: 641591
    19. Clusters per FRS: 246
    20. Clusters per Index Blk: 1
    21. Serial Number: 0xD054094054092B34
    22. Checksum: 0 (0x0)
    23. Boot Signature: 0xAA55

    (end of info)

    In Windows 2000 disk manager, the space beyond the primary partition
    shows as 181.41 GB Free Space and is not color coded as an extended
    partition.
     
    KC, Oct 2, 2003
    #4
  5. You should not have done that. You needed 48 bit address support in OS to
    access 200 GB disk. Promise controller and its driver supported that, but
    your Win2K didn't. As a result, the disk structure is screwed up now. You're
    lucky your boot partition didn't get overwritten (but nobody can be so
    sure).

    "KC" <> wrote in message
    news:...
    > And no, it's *not* because I booted into Windows 98.
    >
    > The drive in question is a 200 gig WD hard drive, second physical
    > drive in system, with 3 partitions. After trying to format the 2nd
    > partition in Windows 2000 disk manager and having it say "format
    > failed" two times in a row, I decided to reboot and try again. On
    > reboot, the THIRD partition (containing all the data I now seek to
    > recover) has vanished, and the entire extended partition is now empty
    > and unallocated. So, I know the data is there, probably a corrupt
    > partition table?
    >
    > The details...
    >
    > The 200 gig is a brand new drive. It came with a Promise Ultra 100 TX2
    > ATA100 controller. I originally set it up with that, using a 5 gig
    > partition for the system and 2 equally sized partitions of about 90
    > gigs for storage. After running it awhile, I found that Winamp
    > playback would often cutout and ismietermined it was the Promise card
    > (and perhaps the fact that this is only a Pentium II 400 system with
    > 256 megs ram). Decided I just wanted this drive for mass storage
    > anyway, I took out the promise card, put my old harddrive in to run
    > the system and set the 200 gigger as slave.
    >
    > Problems begin: Several directories show up as ASCII gibberish. I
    > attribute it to the fact that I was using FAT32 for the 2 90 gig
    > partitions (I eventually wanted them to be accessible by Linux). I
    > move all data to partition 2, format partition 3 as NTFS, move all the
    > data onto that, then try to format partition 2. Then the error,
    > something along the lines of "unable to complete format" or whatever.
    > Then the reboot, then... no more partition 2 or 3. Also, the old
    > system files on partition 1 have all but vanished, all that remains is
    > a folder with .chk files (though I never ran scandisk on it). The
    > volume label is the same though.
    >
    > Partition Magic indicated that the end of the last partition exceeded
    > the end of the physical disk, making me think that this problem may
    > have begun when switching from the Promise controller back to my
    > motherboard's IDE controller? Comments?
    >
    > Reading newsgroup posts I came across some from Joep of
    > (www.DIYDataRecovery.NL). I ran his DiskPatch software and it
    > indicated that the original NTFS partition table and the backup are
    > identical.
    >
    > At no point did I run any disk utilities and write any changes to
    > disk, so unless Windows 2000 has automatically made some severe
    > changes, I'm thinking things should be recoverable. I've dealt with
    > data recovery before, but never with NTFS. Any suggestions greatly
    > appreciated.
    >
    > -Kent
     
    Alexander Grigoriev, Oct 2, 2003
    #5
  6. KC

    Plato Guest

    KC wrote:
    >
    > Anyway, the real issue for me now is getting back any lost data,
    > mostly large .wav files. I had been recording my vinyl collection to


    Just use your backups you've made on two different types of media. No
    problem.


    --
    http://www.bootdisk.com/
     
    Plato, Oct 2, 2003
    #6
  7. KC

    Joep Guest

    Okay. The extended is there but, the first sector of the extended which is
    again a partition table contains no entried for:

    - the first logical
    - a pointer to the next partition table where the next logical is defined in

    With DiskPatch do:

    Repair MBR > FixMBR tables ... Select SKIP for any partitions it finds. Are
    the other 2 NTFS partitions detected? If so we can rebuild the partition
    tables (please post the logfile (dskpatch.log)) in our support forum and
    we'll get back with directions.

    If they're not detected then recovering the complete partitions is probably
    more difficult. For recovering individual files and folder our tool iRecover
    could be tried (first try demo!), of course there's tools from other vendors
    as well that could be tried instead. The iRecover demo allows contents of
    one folder to be recovered each time you run it so you can actually verify
    if files are recovered intact.

    Joep
     
    Joep, Oct 2, 2003
    #7
  8. KC

    KC Guest

    Partitions were detected! Here's the log:

    PQStuffDetect=TRUE
    Ext13hInstalled function: -1 BIOS drive 81h
    (Succes.)

    Version: EDD-3.0
    Support:
    - Extended disk access functions
    - Enhanced disk drive functions
    Ext13hDriveParams function: -1
    Flags:
    - DMA boundary errors handled transparently
    Cylinders: 65535
    Heads: 16
    Sectors: 63

    Total sectors: 390721968
    Sector size: 512
    ------------------------------------------
    logical heads 255
    logical sects/track 63

    dumping sector @ 0 as hex:
    000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C ³ 3ÀŽÐ¼.|ûP.P.ü¾.|
    016 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ³ ¿..PW¹å.ó¤Ë¾¾.±.
    032 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B ³ 8,|.u.ƒÆ.âõÍ.‹.‹
    048 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC ³ îƒÆ.It.8,tö¾..N¬
    064 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25 ³ <.tú»..´.Í.ëò‰F%
    080 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05 ³ –ŠF.´.<.t.´.<.t.
    096 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4 ³ :Äu+@ÆF%.u$»ªUP´
    112 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74 ³ AÍ.Xr.ûUªu.öÁ.t
    128 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF ³ .ŠàˆV$Ç.¡.ë.ˆf.¿
    144 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E ³ ..¸..‹Ü3Ƀÿ..‹N
    160 25 03 4E 02 CD 13 72 29 BE 75 07 81 3E FE 7D 55 ³ %.N.Í.r)¾u.>þ}U
    176 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 3F 07 EB ³ ªtZƒï.Ú…öuƒ¾?.ë
    192 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB ³ Š˜‘R™.F..V.è..Zë
    208 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 81 27 32 00 ³ ÕOtä3ÀÍ.ë¸..'2.
    224 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4 ³ V3öVVRP.SQ¾..V‹ô
    240 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72 ³ PR¸.BŠV$Í.ZXd.r
    256 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49 ³ €Ç.â÷ø^ÃëtI
    272 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E ³ nvalid partition
    288 20 74 61 62 6C 65 2E 20 53 65 74 75 70 20 63 61 ³ table. Setup ca
    304 6E 6E 6F 74 20 63 6F 6E 74 69 6E 75 65 2E 00 45 ³ nnot continue..E
    320 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 ³ rror loading ope
    336 72 61 74 69 6E 67 20 73 79 73 74 65 6D 2E 20 53 ³ rating system. S
    352 65 74 75 70 20 63 61 6E 6E 6F 74 20 63 6F 6E 74 ³ etup cannot cont
    368 69 6E 75 65 2E 00 00 00 00 00 00 00 00 00 00 00 ³ inue............
    384 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00 ³ ...‹ü.W‹õË......
    400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
    416 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
    432 00 00 00 00 00 00 00 00 0F 01 89 3A 00 00 80 01 ³ ..........‰:..€.
    448 01 00 07 FE BF 7E 3F 00 00 00 80 A3 9C 00 00 00 ³ ...þ¿~?...€£œ...
    464 81 7F 0F FE FF 00 BF A3 9C 00 02 3A AD 16 00 00 ³ .þÿ.¿£œ..:­...
    480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ³ ................
    496 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ³ ..............Uª

    PQStuffDetect=FALSE

    390721967
    ======================================================================
    -> probable partition found at cyl 0 head 1 sect 1
    bootsector information :
    hidden sectors : N/A
    total sectors : 10265472
    volume label : N/A
    file system descriptor : NTFS
    0 1 1 07 638 254 63 63 10265472
    ======================================================================
    -> probable partition found at cyl 639 head 1 sect 1
    bootsector information :
    hidden sectors : N/A
    total sectors : 190225602
    volume label : N/A
    file system descriptor : NTFS
    639 1 1 07 1023 254 63 10265598 190225602
    ======================================================================
    -> probable partition found at cyl 12480 head 1 sect 1
    bootsector information :
    hidden sectors : N/A
    total sectors : 190225602
    volume label : N/A
    file system descriptor : NTFS
    1023 1 1 07 1023 254 63 200491263 190225602
    Scan complete.
     
    KC, Oct 3, 2003
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Tech
    Replies:
    3
    Views:
    747
    Plato
    Apr 6, 2004
  2. Dutch Treat
    Replies:
    0
    Views:
    891
    Dutch Treat
    Dec 6, 2004
  3. awhiteford
    Replies:
    3
    Views:
    578
    donnie
    Jan 2, 2005
  4. awhiteford
    Replies:
    3
    Views:
    539
    donnie
    Jan 2, 2005
  5. Help Please! Partition Has Vanished!

    , Dec 3, 2005, in forum: Computer Support
    Replies:
    7
    Views:
    482
    Mitch
    Dec 5, 2005
Loading...

Share This Page