Disappearing harddrive (NTFS)

Discussion in 'Computer Support' started by ]v[etaphoid, Oct 26, 2003.

  1. ]v[etaphoid

    ]v[etaphoid Guest

    I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
    up in BIOS, but not in Windows. It is viewable in Device Manager, but
    there's no sign of it in Disk Management (Administrative Tools -> Computer
    Management). I've tried Easy Recovery Pro and the trial version of
    GetDataBack for NTFS, but neither seem to salvage any data. They can see the
    drive, but are unable to find and files to salvage, suggesting it may be
    physically damaged or have damaged sectors.

    Can anyone suggest any other software which may have more luck recovering
    data from the drive. Would I likely have any more success after low-level
    formatting the drive and then scanning for lost files. Reasoning being that
    I've already lost the index for what's on the drive, and at least formatting
    might work around any damaged sectors. Any ideas?

    Thanks.
     
    ]v[etaphoid, Oct 26, 2003
    #1
    1. Advertisements

  2. ]v[etaphoid

    JabberSmith Guest

    Well... if you only want a few bits you could try Knoppix and email the
    files (or use network share) off the drive. (Knoppix is a boot-from-CD
    operating system based on Linux, it can read NTFS partitions long after
    Windows has taken a dump on them.)

    Also try something called "Ranish Partition Manager" which boots off a
    floppy to inspect MBR and file systems and partitions and so on. You might
    be able to save the MBR to a disk and "correct" it.

    If you format it, you'll make things worse. Dont do that.
     
    JabberSmith, Oct 26, 2003
    #2
    1. Advertisements

  3. ]v[etaphoid

    ]v[etaphoid Guest

    I've got another drive up and running, so I can use it to salvage data from
    the slaved faulty drive if possible. Is Knoppix useful in this situation, or
    only when you need a nootbale OS on CD? Any idea which program it used to
    "read NTFS partitions long after Windows has taken a dump on them"?

    I got an hour or so until the 700Mb Knoppix iso downloads...
    Thanks. I'll give it a try now.
    Couldn't be much worse than present, I'm afraid. So many mp3s and Simpsons
    episodes...gone. All gone...

    Thanks for the help.
     
    ]v[etaphoid, Oct 26, 2003
    #3
  4. ]v[etaphoid

    Zvi Netiv Guest

    Why should they?
    Why do you think so? Did you run any diagnostics on the drive to reach that
    conclusion?
    What you need isn't more software, but a clue on what you are doing!
    Where from do you take such stupid idea?
    NTFS places the MFT mirror right in the middle of the partition. The mirror
    copy of the boot sector is at the end of the partition, in its last sector.
    Rebuilding the MBR is just ten seconds.

    Zvi
     
    Zvi Netiv, Oct 26, 2003
    #4
  5. On Sun, 26 Oct 2003 18:23:56 +1100, B. Al. Zeebub read and pondered :

    http://linux-ntfs.sourceforge.net/

    Knoppix is very useful in situations when your OS goes down the gurgler.
    With the notable exception of RedHat, most recent Linux distributions can
    read NTFS out of the box like this:

    [balzeebub@localhost balzeebub]$ cd /mnt/win_d
    [balzeebub@localhost win_d]$ ls -a
    ../ installs/ My Music/ Scans/
    .../ ISOs/ My Pictures/ System Volume Information/
    Backups/ Jan 2003 Backup/ My Webs/ wallpaper/
    desktop.ini* keyfinder.exe* Paintings/ WinXP-Oct-2003Backup.002*
    document dump/ Manipulations/ Photos/ WinXP-Oct-2003Backup.pqi*
    Documents/ msdownld.tmp/ PHTOGRAPHS/ WUTemp/
    RECYCLER/
    [balzeebub@localhost win_d]$
     
    B. Al. Zeebub, Oct 26, 2003
    #5
  6. ]v[etaphoid

    ]v[etaphoid Guest

    Call me crazy, but I reasoned that data recovery software might be a good
    starting point to recover data.
    That was the diagnosis from the aforementioned data recovery software.
    And clearly that's unlikely to be provided by someone as angry at the world
    as yourself.
    I was theorising that if the MBR had been erased beyond repair, formatting
    the drive might at least allow me to search for the orphaned NTFS files,
    rather than performing what has thus far been a fruitless RAW search. Of
    course, in my haste to seek informed opinions on the subject, I mistakenly
    suggested a low-level format may be appropriate. I did of course mean a
    high-level or "Quick" format that would preserve the contents if not the
    index of my files. Not that it would have likely made any difference to you.
    Thank you for this first piece of constructive information. Clearly you do
    know something of the nature of harddrive operation. Now if only you could
    combine that with an incling of normal human behaviour instead of getting
    angry at usenet posts and looking down your crooked nose at those of us who
    are more fully conversant with human interaction than the mechanical
    operation of our hard-drives, you could form an altogether more valued
    member of the species.

    Thank you.
     
    ]v[etaphoid, Oct 26, 2003
    #6
  7. ]v[etaphoid

    Joep Guest

    DiskManagement doesn't even see the PHYSICAL drive?
    If DiskManagement doesn't see the Physical drive then the Windows versions
    of EasyRecovery and GetDataBack won't either as they rely on Windows API
    calls to actually access the drive.
    No, no low level formatting please! Low level formatting implies ALL data
    will be overwritten!
    Well, I still don't get if the Physcical disk isn't detected or that the
    partitions/volumes are 'gone'. First step would be to confirm or deny
    physical damage - the diagnostic tools from the drive manufacturer are a
    good starting point.

    * If the physical drive is there but the partitions/volumes aren't: -
    Rebuilding the partition table may be all that is required. Our tool
    DiskPatch is often able to do so.

    * If the physical drive isn't there: - can you 'see' the physical drive from
    DOS (for example fdisk/status)?

    If you find evidence for physical damage you may try to clone the drive to a
    good one and attempt to repair damage on the clone or use EasyRecovery /
    GetDataBack to recover data from the clone. Our tool DiskPatch can be used
    to clone a disk, DiskPatch can deal with unreadable sectors on the source
    drive.

    Kind regards,
    Joep
    --
    D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

    http://www.diydatarecovery.nl
    http://www.diydatarecovery.com

    Please include previous correspondence!

    DiskPatch - MBR, Partition, boot sector repair and recovery.
    iRecover - FAT, FAT32 and NTFS data recovery.
    MBRtool - Freeware MBR backup and restore.
     
    Joep, Oct 26, 2003
    #7
  8. ]v[etaphoid

    Joep Guest

    Hmm ... there always seem to be quite some confusion and rumours about NTFS
    placing *something* in the middle, I have examined this and found the
    following:

    NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
    the middle of the partition. For newer NTFS versions formatted with WinNT 4
    and up (including 2000 and XP) I have never been able to find any default
    behavior that writes anything holding 'meta information' including the MFT,
    the MFT mirror, backup boot sector etc., to the middle of the partition.
    Well, to be honest, I felt some frustration as well because of your post, as
    you make some *stupid* suggestions yourself. 'Low level formatting' being
    the one that got my adrenaline going ... ;-) ... indeed this is more
    something that I need 'working on'.

    Kind regards,
    Joep
     
    Joep, Oct 26, 2003
    #8
  9. ]v[etaphoid

    ]v[etaphoid Guest

    Nope. Lists Disk 0 and then Disk 2, in addition to the optical drives.
    Both claim to be able to retrieve data from drives which Windows doesn't
    recognise, and both did at least manage to see the drive, if not the
    partition on it. That said, as you suggest I've found little success with
    either actually retrieving any data.
    Sorry, I realised that mistake after I posted it. As I mentioned in an
    earlier post, what I meant was to say was a Quick format - basically the
    exact opposite of a low-level format!
    Seems like the most likely scenario, although I haven't confirmed this via
    any WD diagnostics. But the fact that is recognised in BIOS and during POST,
    but not Windows gives some hope, as does it's appearance as an
    "Unrecognised" drive on EasyRecovery Pro.
    Thanks for all the advice, it is much appreciated. I'm just about to run a
    couple of checks using the Recovery Console (still foolishly hoping it's
    just a damaged boot sector or MBR), and depending on how that turns out, I
    might try some of your suggestions.

    Cheers.
     
    ]v[etaphoid, Oct 26, 2003
    #9
  10. ]v[etaphoid

    ]v[etaphoid Guest

    I don't claim to be an expert on the subject, and save for the "low-level
    format" error which I've already explained twice, I don't know what else
    would constitute a stupid suggestion. I'm open to any suggestions and was
    just trying to offer as much information and observations as possible.

    Thanks to all who've helped out so far.
     
    ]v[etaphoid, Oct 26, 2003
    #10
  11. ]v[etaphoid

    ]v[etaphoid Guest

    Joep,

    I downloaded the trial version of DiskPatch and gave it a try. Here were the
    results:

    If I ran it with the faulty drive attached as the only drive as master on
    IDE0, the program would get as far as the welcome screen. Hitting any key
    kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"

    When the faulty drive was attached as the slave drive on IDE0, the program
    booted fine, initially set to view the master drive at drive0. After
    changing the selected drive to drive1, I started to get a few errors,
    although it did manage to read the MBR. However, it warned me that it was
    unable to go any further as it would be risking further physical damage, and
    recommended I do a surface scan. The surface scan quickly yielded over 255
    errors, at which point it ceased the scan.

    At one stage, the error was reported: Int13h_error_trap: extended int13h
    error @ dskpatch.pcb.

    I could not attempt to repair the MBR, as I was only using your trial
    version.

    I am willing to purchase the full version if it will either let me repair
    the MBR so that I can extract as many files as possible from the faulty
    drive, or create an image of it on another drive, from which I could copy
    salvaged files. In your opinion, does it sound like this would be possible
    using your software?

    Any other advice you can offer is appreciated.

    Thanks.
     
    ]v[etaphoid, Oct 26, 2003
    #11
  12. ]v[etaphoid

    Eric Gisin Guest

    Microsoft claims WinXP puts the MFT at the 3GB mark. Did you test with large
    partitions?

    |
    | NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
    | the middle of the partition. For newer NTFS versions formatted with WinNT 4
    | and up (including 2000 and XP) I have never been able to find any default
    | behavior that writes anything holding 'meta information' including the MFT,
    | the MFT mirror, backup boot sector etc., to the middle of the partition.
    |
     
    Eric Gisin, Oct 26, 2003
    #12
  13. ]v[etaphoid

    NOYB Guest

    That's a bad sign ... :-(
    Again, a bad sign. For whatever reason it's not able to read sectors.
    Yes, but I'm afraid that it is going to be difficult anyway, it seems
    there's trouble reading the disk, writing to it it very unlikely.
    I'd now really try the drive manufacturers diagnostic utility to see what it
    has to say about that drive first.
     
    NOYB, Oct 26, 2003
    #13
  14. ]v[etaphoid

    NOYB Guest

    Hi, where did you find that? Well, I basically did not test that stupidly
    enough. I was just trying to confirm/deny the rumour that the MFT or it's
    mirror was 'in the middle', and it wasn't.

    .... found it, in case it's of interest to others:
    http://www.microsoft.com/whdc/hwdev/tech/storage/ntfs-preinstall.mspx
     
    NOYB, Oct 26, 2003
    #14
  15. ]v[etaphoid

    ]v[etaphoid Guest

    Sorry, I forgot to mention I'd done that in the interim. It falls down at
    the first hurdle, reporting "Cable Fault". However, the details it sends for
    the online check, report:

    TEST FAILED!
    The Data Lifeguard Diagnostics utility has determined that your hard drive
    is not functioning properly.
    a.. The diagnostic code for this error is 0199. Please make sure to use
    this code to initiate product replacement by using our Product Replacement
    online service.
    b.. Back up your Data files imediately.
     
    ]v[etaphoid, Oct 26, 2003
    #15
  16. ]v[etaphoid

    Shep© Guest

    Is this a system drive or a slave drive?
     
    Shep©, Oct 26, 2003
    #16
  17. ]v[etaphoid

    NOYB Guest

    Still, did you actually exclude the possibilty for a cable failure?!
    I have never used this tool, it appears to be a standard message in case an
    error is encountered, the only variable may be the error number.
    I again suspect this message will appear if an error is reported.

    It has no use seeking advice if you *not* first 'rule out' clear hints given
    by the diagnostic software you used. Please if the software states a cable
    error, check that cable (replace it) and include results of that test in
    your reply!

    Joep - http://www.diydatarecovery.nl
     
    NOYB, Oct 26, 2003
    #17
  18. ]v[etaphoid

    ]v[etaphoid Guest

    Aye, it (0199) was just a generic error code which gave no specific
    information regarding the likely fault.
    Naturally, I removed the possibility of power/IDE cable failure prior to
    embarking on the subsequent laborious diagnostic and salvage operation. I
    can confirm that it is definately not a simple case of a faulty cable. Sorry
    for not making this clear earlier.

    Anyone got any last recommendations before I convert my drive into a door
    stop?
     
    ]v[etaphoid, Oct 27, 2003
    #18
  19. ]v[etaphoid

    ]v[etaphoid Guest

    It was originally a system drive, but I've got it connected at the moment as
    a slave.
     
    ]v[etaphoid, Oct 27, 2003
    #19
  20. If you run a defrag on Win2k/NTFS, on the graphical viewer there is a
    large contiguous chunk of green right in the middle of the partition.
    I'd assumed that was the MFT. Is it? (It can't be the swapfile, as
    that's on another drive.)
     
    Mike Tomlinson, Oct 28, 2003
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.