NTFS File system recovery

[C0V3R]

I dont quite know what happened by my HDD started throwing me corruption messages yesterday and is completely unreadable in windows today.

Im getting an error saying

"The file or directory is corrupted and unreadable"

Ive tried running chkdsk per MS knowledge base but chkdisk just dies with

"The type of the file system is NTFS.
Unable to determine volume version and state. CHKDSK aborted."

The disk seems to be recognised ok in bios and windows, no clunking noises or anything.

I have run GetDataBack and it has found pretty much all the files but half of the directory structure seems to be FUBAR. As a tool all it is capable of doing is copying off the files, which I will do tomorrow when I go splash out for another disk.

After having done that I'll look at running some other partition modifying s/w to see if the partition can actually be repaired. Anyone have any tool suggestions?

[thingy]

Sounds like the file allocation table got corrupt and is in too bad a state for GDB to repair. I have used it to restore directory structures before, but it sounds like you left it too long in this case.

[C0V3R]

Well, I managed to get all the data back off the disk onto other machines using GDB NTFS, format the disk and put everything back on.

All was well for a few weeks, however on the weekend the same thing has happened again. Does anyone have any ideas what might be causing it? I haven't been able to find a whole lot about the cause of these sorts of things. Could it be a motherboard controller, HDD issue or is a software problem more likely? I ran seagates diagnostics tools and found no problems with the drive itself.

[urban_gorilla]

Does anyone have any ideas what might be causing it?
windows
:smith:

:swear: Oopsie, looks like I didn't read The Posting Guidelines (http://forums.zgeek.com/showthread.php?s=&threadid=16703) :swear: Rep-

[Lurgen]

Well, I managed to get all the data back off the disk onto other machines using GDB NTFS, format the disk and put everything back on.

All was well for a few weeks, however on the weekend the same thing has happened again. Does anyone have any ideas what might be causing it? I haven't been able to find a whole lot about the cause of these sorts of things. Could it be a motherboard controller, HDD issue or is a software problem more likely? I ran seagates diagnostics tools and found no problems with the drive itself.

If a drive corrupts itself and I can't find a definite software culprit, I automatically destroy the hard disk and buy a new one. Drives that fail once almost always fail twice. Recovery tools aren't quite so consistent, working only when they feel like it.

Controllers can be responsible for this sort of thing also, but not generally with an embedded IDA or SATA controller. I've seen bad RAM in RAID controllers cause this sort of problem once or twice, but never on a motherboard-based controller.

My advice to you comes in three parts...

1) Backups. Backups are not optional. They aren't a waste of time. They aren't overkill for home users - if you want to keep your data, back it up. Nero has a decent backup tool built into the Ultra edition that a few people I know use to burn to DVD or CD so maybe that's a starting poit.

2) If you've already turfed that first disk, reinstall your OS and all drivers from a CLEAN source. By clean I mean a source that is guaranteed to be safe, such as the driver CDs, original Windows media (because we all have these, don't we? ;-) ). While I still think it's your hard drive, software is the next most likely culprit. Also make sure you're running current patches, good anti-virus software with the latest signatures, etc. I hear about so many problems caused by people without AV software who think it isn't necessary at home. Even more come from users who can't be stuffed running Windows Update once a week (dumb-asses).

3) Replace the hardware. Start with the hard disk, then move on to the other links in the chain if you have to. Your data is probably worth more than a few hundred bucks to you, so keep it all in perspective eh? I have something like 20GB of critical data on my system - it's all backed up on DVDs stored off-site, but if I started seeing the problems you were seeing I'd be throwing disks away from day 1.

Bear in mind that NTFS is pretty fault tolerant - serious corruption is required to make chkdsk refuse to talk to it.

Lemme know if any of this helps...

[Lurgen]

windows
:smith:

Shouldn't you be posting on Slashdot? :stooge:


:: edit : No need to reply to these. "Report, don't reply" ;)

[minorproblem]

Well, I managed to get all the data back off the disk onto other machines using GDB NTFS, format the disk and put everything back on.

All was well for a few weeks, however on the weekend the same thing has happened again. Does anyone have any ideas what might be causing it? I haven't been able to find a whole lot about the cause of these sorts of things. Could it be a motherboard controller, HDD issue or is a software problem more likely? I ran seagates diagnostics tools and found no problems with the drive itself.


I had this problem once but since i started using ext3 ive never had a problem. It infact happened all at the same time on all 3 of my segate 80 gig drives some ghey windows problem i cant remember how i fixed it at the time but 6 months later when i changed over to ext3 things worked fine.

[Uther Pendragon]

I second Lurgen's motion to drop that hard disk like a bad habit.

Get yourself a new one that will fit even more pr0n on it :)

For future reference, if you lose a disk like this and it has something REALLY important on it that you want to restore, you can get a second hard disk of the same size or larger and use the dd command off a linux boot cd to take a raw copy of the disk partitions across to another disk. This allows you to experiment with different restore programs without causing further damage, also if the disk has a mechanical failure that is getting worse, it will mean you have a snapshot of the damaged partitions. Probably a bit too much effort if you are just restoring mp3's and pr0n, but if you have something REALLY important its not a waste of time.

[minorproblem]

I second Lurgen's motion to drop that hard disk like a bad habit.

Get yourself a new one that will fit even more pr0n on it :)

For future reference, if you lose a disk like this and it has something REALLY important on it that you want to restore, you can get a second hard disk of the same size or larger and use the dd command off a linux boot cd to take a raw copy of the disk partitions across to another disk. This allows you to experiment with different restore programs without causing further damage, also if the disk has a mechanical failure that is getting worse, it will mean you have a snapshot of the damaged partitions. Probably a bit too much effort if you are just restoring mp3's and pr0n, but if you have something REALLY important its not a waste of time.

At my work we have found with mechanical failures if you wrap the disk in a plastic bag and leave it in the fridge overnight we are ussually able to recover most of the data before the disk locks.

[thingy]

Well, I managed to get all the data back off the disk onto other machines using GDB NTFS, format the disk and put everything back on.

All was well for a few weeks, however on the weekend the same thing has happened again. Does anyone have any ideas what might be causing it? I haven't been able to find a whole lot about the cause of these sorts of things. Could it be a motherboard controller, HDD issue or is a software problem more likely? I ran seagates diagnostics tools and found no problems with the drive itself.

If it's the same disk, turf it.

If you really want to save it, find the manufacturers website & look for some diagnostic utils, but I still think it's a hardware fault and you'll never get away from this issue with the current disk.

[MisterBishi]

When you say you formatted the disk, did you just format it or did you delete and recreate all of the partitions?

I managed to screw my partition table the other day whilst trying to recover from a fuckup made by a known bug with the Fedora installer (Go lunix!!), but was able to get everything back ok without any 3rd party stuff.

[urban_gorilla]

Shouldn't you be posting on Slashdot? :stooge:
oh, a wiseguy hey?
;)

:swear: Oopsie, looks like I didn't read The Posting Guidelines (http://forums.zgeek.com/showthread.php?s=&threadid=16703) :swear:

[C0V3R]

When you say you formatted the disk, did you just format it or did you delete and recreate all of the partitions?

I managed to screw my partition table the other day whilst trying to recover from a fuckup made by a known bug with the Fedora installer (Go lunix!!), but was able to get everything back ok without any 3rd party stuff.

I just formatted the disk without changing partition info, though windows couldnt read the original partition anyway so it may have recreated a new one. You think blowing away the partition completely would help?

[MisterBishi]

I do indeed, thats what I had to do. As others have said, it might be wise never to trust the drive again with critical data, but I think this sounds more like a software problem than hardware, especially considering you've ran the manufacturers diags.

Is it under mfr warranty btw?

[Lurgen]

I do indeed, thats what I had to do. As others have said, it might be wise never to trust the drive again with critical data, but I think this sounds more like a software problem than hardware, especially considering you've ran the manufacturers diags.

Is it under mfr warranty btw?

The manufacturer diags are usually pretty basic, and won't reveal a write-related problem (since they are normally non-destructive).

Formatting a partition does nothing useful at all - if you want to try and re-use the disk delete the partitions first. Then do a full format (never a quick-format). Even then, the disk is suspect and you'll lose more time troubleshooting than it's worth. I don't think it's software.

[druid]

Thread moved to the correct subforum.

[MisterBishi]

When I said software I meant partition tables, etc. If the drive geometry has been written back incorrectly it will fuck it up, but it's still not strictly a hardware fault.