Jump to content

Hard Drive Partition error


JamesAtTECH

Recommended Posts

First, as a new member to this forum, thank you for reading this topic. I'm sure there are a lot of bright minds that read this topic and know exactly what to do because they have faced this situation before. FYI...I work in the IT Industry, and I'm learning more and more as the years go by.

A friend has tasked me with fixing his hard drive. He isn't technically-oriented, so his explanation as to what happened is a bit foggy. From what he has told me, this happened:

1. While scanning for spyware, he caught & fixed several errors and had to reboot his PC.

2. Upon rebooting, he received the dreaded BSOD. He could not catch the reason for the BSOD (stop command, error code, etc).

3. Upon rebooting a second time, he faces the BSOD again. It's a never-ending cycle.

4. Powered it down for 12 hours. Upon restart, PC tells him "NTLDR is missing. Press CTRL+ALT+DEL to restart." Obviously it's not detecting XP, or any files.

What I did:

1. I took his hard drive out and connected it to mine in a slave configuration. I am running XP with 4 GB RAM.

2. I checked his hard drive first under Disk Management, and at first it seemed that XP is only recognizing 10 MB out of his Western Digital Caviar SE 250 GB hard drive as a simple FAT (or FAT12). Now, it is showing the entire drive "Unallocated."

4. I rebooted my PC and booted it using Norton Ghost 2003. It can be used as a recovery program with a GUI to check a drive's partition, recover files from a broken disk, restore a disk's MBR, etc. Norton Ghost is showing that the disk has two partitions on it. One is listed as an "unallocated' partition that is around 7.8 MB in size. The other is a "QNX, UN*X" partition that is the size of the hard drive (238 GB). Norton Recovery allowed me to save the drive's SME information as well as the partition information in a text file.

5. As a big noob to the Linux world, I attempted to boot using an old version of Knoppix to see if I could mount and view the drive's information. As I said, I'm a big noob, and was not successful at all. I didn't know what I was doing.

6. I downloaded "TestDisk" as recommended by several other topics listed in this forum, and attempted to analyze the drive. Immediately as it begins to analyze the drive, it tells me the following:

"Warning: Incorrect number of heads/cylinder 4 (FAT) != 255 (HD)"

"Warning: Incorrect number of sectors per track 17 (FAT) != 63 (HD)"

Upon doing a "Deeper Search" using TestDisk, it begins to encounter Read Errors while going through the LBA's. I'd rather not waste several hours for it to look at every single LBA on the drive to tell me that it can't read it.

Obviously it's not reflecting the correct information. Do I attempt to restore the MBR? I just don't want to do anything to erase the guy's data. I don't know what to do at this point and in need of assistance. I need to recover this data for him.

Thank you.

Link to comment
Share on other sites


I'm pretty sorry to say this but:

It's dead Jim...

While you might be able to recover the DRIVE itself the data is almost assuredly TOAST.

Actually it's the opposite, while you may recover part of the DATA, it is probable that the corruption started from a hardware problem of the HD.

TESTDISK will most probably be capable of retrieving the original partition data.

Or anyway it can be re-constructed manually.

A BSOD is a BSOD, if the report is accurate, you can leave the drive resting till the end of the world, and when you fire it up again you will have exactly the same BSOD, not a "NTLDR is missing".

BTW, the "NTLDR is missing" is a message that comes from the bootsector, and there is NO way on eartth that the bootsector (which is on LBA 63 normally) can be read if the geometry is set to 17.

With all due respect, you seem to have throwed at it a couple of approaches that might have worsened the situation.

DO NOT CONTINUE fiddling with the hard disk.

If you want to try and recover data, image it. (and start working on the image).

A suitable app to image it is this one:

http://www.boot-land.net/forums/index.php?showtopic=7783

An alternative, that may work partially is using a file based recovery, like PHOTOREC:

http://www.cgsecurity.org/wiki/PhotoRec

results will depend on the amount of fragmentation the filesystem had before and on type of files.

jaclaz

Link to comment
Share on other sites

I'm pretty sorry to say this but:

It's dead Jim...

While you might be able to recover the DRIVE itself the data is almost assuredly TOAST.

Actually it's the opposite, while you may recover part of the DATA, it is probable that the corruption started from a hardware problem of the HD.

TESTDISK will most probably be capable of retrieving the original partition data.

Or anyway it can be re-constructed manually.

A BSOD is a BSOD, if the report is accurate, you can leave the drive resting till the end of the world, and when you fire it up again you will have exactly the same BSOD, not a "NTLDR is missing".

BTW, the "NTLDR is missing" is a message that comes from the bootsector, and there is NO way on eartth that the bootsector (which is on LBA 63 normally) can be read if the geometry is set to 17.

With all due respect, you seem to have throwed at it a couple of approaches that might have worsened the situation.

DO NOT CONTINUE fiddling with the hard disk.

If you want to try and recover data, image it. (and start working on the image).

A suitable app to image it is this one:

http://www.boot-land.net/forums/index.php?showtopic=7783

An alternative, that may work partially is using a file based recovery, like PHOTOREC:

http://www.cgsecurity.org/wiki/PhotoRec

results will depend on the amount of fragmentation the filesystem had before and on type of files.

jaclaz

How did I worsened the issue if I did not make any changes to the drive? I didn't set the geometry to 17, this is what TestDisk is showing.

I used PhotoRec, selected my drive, and selected the Intel/PC partition. It shows me the files under where I have PhotoRec saved on my main HD, and not files that are on the "broken" HD. I hit the left arrow key several times to back out of that file system, selecte the malfunctioning drive, and it shows no files.

After further discussing the issue with my friend, his story is this: He did not scan the hard drive using spyware detection software, but rather used the Windows tool "Check Disk For Errors." This is when he encountered the BSOD, and lost functionality of the drive.

I will try to use the imaging application on the drive and work on the image.

Are there any consumer or professional disk partitioning apps or data recovery programs that have been tested and that work very well that I may be able to purchase to perform additional functions to recover the data? There are a lot of programs, but I would rather go with a popular one rather than a free one.

Thank you.

Link to comment
Share on other sites

Hi Jim,

What jaclaz stated is good stuff. Make an image of the drive and work from the image. As far as recovery software I have used R-Studio for about 5 years and have been able to recover everything from a hard drive. The website for R-Studio is http://www.r-studio.com/

Good Luck

John

Edited by 03GrandAmGT
Link to comment
Share on other sites

It is well possible that the drive has a problem (I mean a physical problem) and that checkdisk is "innocent" (i.e. it is not the cause).

TESTDISK and PHOTOREC are as good as most "professional" tools.

If the drive was NTFS you may also want to try the Freeware SCROUNGENTFS:

http://memberwebs.com/stef/software/scrounge/

Or the Commercial File Scavenger:

http://www.quetek.com/prod02.htm

Read these threads too:

http://www.msfn.org/board/data-recovery-tool-t84345.html

http://www.msfn.org/board/recovering-win2k...on-t115439.html

http://www.msfn.org/board/usb-access-problem-t133933.html

(to get a general idea of the tools and procedures)

Trying to recover the partitioning should be your first aim.

As said TESTDISK can usually do it, but you can do it manually with a hex/disk editor also (if enough data is found).

Knowing, even grossly, how the drive was setup before would greatly help.

However the bootsector is normally on LBA 63 or CHS/0/0/1.

A copy of the bootsector is at the very end of the filesystem (if NTFS) or on sector 6 of the Logical drive (if FAT32), FAT16 has normally no backup of the bootsector.

From the data in the bootsector you can re-build the partition table.

A suitable Hex editor would be Tiny Hexer, optionally with my structure viewers:

http://www.boot-land.net/forums/index.php?showtopic=8734

jaclaz

Link to comment
Share on other sites

I would begin with testing the disk. Provided you don't ask for write tests nor complete zero overwrite, this will let information on the drive untouched, and will give you a clear diagnostic between hardware failure and badly written partition record.

Good disk test software runs outside Windows of course. Seatool makes basic tests for all brands:

http://www.seagate.com/support/seatools

but knowing the brand of your disk, you'd better choose the manufacturer's own programme.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...