HDD bootsector error, need recovery!

[bobthedinosaur]

ok, so i was in winxp fiddling with drive compression on my external 80GB, i basically said 'compress whole drive' and then 1 minute into the process i said cancel cos it was gonna take too long, cancelling started and i went to go make coffee, when i came back windows had crashed, so i rebooted the pc

and wham! missing bootsector came up in black in white, it also sometimes says error reading OS and some other frightening messages

so somehow fiddling with my external HDD's compression corrupted my internal 200GB Seagate SATA drive!

this drive is very important as it has all my stuff on it, now i've had data recovery done off a broken HDD once and it was pretty expensive so i'd rather try do this myself

basically i don't have another HDD to boot from so i can access the 200GB, can anybody point me to a bootable image or program to put on a CD that'll allow me to see the file structure on the disk and move stuff around?

after the error i booted with windows install cd and went into the recovery feature (dos screen thing) and ran chkdsk which said the disk had an unrecoverable error, then i ran bootfix which went and made the drive FAT32 when it was actually NTFS, so the directory structure on the drive is probably gone by now too

i have not done any actual writing on the disk tho, should my files still be there?!

any advice would be much appreciated

please help!!!

[jaclaz]

i have not done any actual writing on the disk tho, should my files still be there?!

Probably, yes.

But you will need another PC with a working OS.

It is possible to make a bootCD but it is NOT advised.

Find another PC with ENOUGH space to hold the data you want to salvage and connect to it your HD as Slave/Secondary.

Read this (and links therein):

http://www.msfn.org/board/index.php?showtopic=65337

if your lucky and just some "pointers" were altered, it's a matter of minutes.

If TESTDISK does not work, you will need some actual data recovery program.

There is the freeware PHOTOREC (included with TESTDISK) for some types of files

and this other one:

http://www.pcinspector.de/file_recovery/UK/welcome.htm

and this one for NTFS:

http://memberwebs.com/nielsen/software/scrounge/

The IDEAL situation is to make a COMPLETE IMAGE of the drive BEFORE attempting recovery so that if something goes bad, you can restart from scrath (and original situation), you will need a drive at least the same size of the "defective" one and a byte-by-byte copy program.

Here are some ideas:

http://www.msfn.org/board/index.php?showtopic=67961

but there are a lot of them, including Roadkil's programs (just google for "Roadkil's")

and quite a few command line only, like the DSFOK tools

or dd for windows

jaclaz

Edited February 20, 2006 by jaclaz

[LLXX]

Is it the MBR or just the partition bootsector?

If it's the MBR, it's going to be easier, but if you understand structure of partition table, you can reconstruct the MBR manually with a disk editor. I've done this several times, when automated recovery just won't work.

If it's the partition bootsector, it'll be slightly more difficult as there are more values to fill in. Normally I'd put in what I think are the correct values, reboot and test, and if the disk is not recognised, change the values and try again.

As suggested above, a sector-by-sector image of the drive is ESSENTIAL. The OS may attempt to write to a partially-recovered filesystem and corrupt it more.

[bobthedinosaur]

LLXX:

i'm not sure what's broken and what's not

basically the drive had two partitions, the first one about 30GB, this is where i ran windows from and the 2nd one about 160GB where i store stuff

after the failure the pc simply wouldn't boot off the first partition as it usually did, but i don't know whether it was the MBR or only that partition, basically my partitions are all gone now after i ran bootfix which went and made a fat32 partition over (not sure yet) the whole drive

i've got active partition recovery running on the drive now scanning for all lost partitions

according to @PR the data is still there on the drive, the partition info is just gone, although, even if i could get the partition info back up, i probably wouldn't be able to boot from the first partition cos i think the error was an OS error

basically i'm gonna go get another 200GB drive, install an OS and recover from the old drive with recovery software or i'm gonna try booting from this @PR disc and recovering unto the new disk from there

can anybody give me any advice on how to overcome a problem like this in the future, like say, a harddrive raid configuration or some backup software or something, basically after i get the new HDD i'll have 2x200GB sata drives and one 80GB external, that's about 200GB space more that i'm using now, any storage and backup tips would help!

thanx guys!

-----

LLXX where can i get the disk editor for redoing the MBR?

Edited February 21, 2006 by bobthedinosaur

[bobthedinosaur]

ok, so another question...

@ctive Partition Recovery can see my original partition information on the drive, it also claims that the paid-for-version will be able to make a backup of the MBR and partition info

will @PR be able to restore my partition information on the drive to the original state without writing over any data on the disk?

cos if it could do that i'd be back to perhaps an easier to handle error where i only have to sort out (maybe) windows not wanting to boot

[jaclaz]

I don't understand, you ask for help, I suggest you a FREEWARE program, and a SAFE method to try recovering your data, you decide to ignore my suggestion, use a demo of another program, that has the same functionality as the suggested one, and you want to know if the full version of it will work directly without damaging your data?

Well, the answer is yes, PROBABLY it will work.

But what if MURPHY's law decides to prove itself right in this particular case?

It's your data, so you will have to decide if it is worth risking it.

Active Partition Recovery is an excellent program, but what if this is the 0.01% in which it fails?

Personally I use other programs, but I do have some experience in this field, so I have a bit more "liberty of action" than that I would suggest to a newbie, nonetheless I would NEVER write ANYTHING to a disk BEFORE being absolutely sure I am able to revert the disk to a previous state.

jaclaz

Edited February 21, 2006 by jaclaz

[bobthedinosaur]

ok jaclaz, relax, i didn't use that program to write anything to the disk, it couldn't get through scanning the 2nd partition (so there might be some physical disk damage)

i haven't gone through the programs you told me about because i've been running around like crazy over here because my city's main power plant shut down this week and we've had chronic power outtages resulting in giant traffic jams and no working petrol pumps, at the same time i'm trying to set up a power generator for my house, varsity just started and i have to move into my apartment, and i only have like 50MB left on my ADSL account cos in south africa we pay for usage (as in per GB) so i don't want to download things i don't definately need

but your help is much appreciated

i've got the drive in my system as a slave now with a friend's 120GB as the master running windows and easy recovery pro, a program i've used with great success before, so if this doesn't work then i'm going to run Testdrive and see if i can fix the partition info first before i try to recover more files

thanks for you help everybody

[jaclaz]

ok jaclaz, relax,

Well, I am already relaxed, no problem.

..and I don't want to put more stress on you that you already have with the problems you are facing, sorry, but I have to recommend you have an Uninterruptable Power Supply when doing this kind of work, and this applies always, let alone if there are known problems on the power line or if you are running on a generator.

jaclaz

[LLXX]

LLXX:

i'm not sure what's broken and what's not

basically the drive had two partitions, the first one about 30GB, this is where i ran windows from and the 2nd one about 160GB where i store stuff

after the failure the pc simply wouldn't boot off the first partition as it usually did, but i don't know whether it was the MBR or only that partition, basically my partitions are all gone now after i ran bootfix which went and made a fat32 partition over (not sure yet) the whole drive

i've got active partition recovery running on the drive now scanning for all lost partitions

according to @PR the data is still there on the drive, the partition info is just gone, although, even if i could get the partition info back up, i probably wouldn't be able to boot from the first partition cos i think the error was an OS error

basically i'm gonna go get another 200GB drive, install an OS and recover from the old drive with recovery software or i'm gonna try booting from this @PR disc and recovering unto the new disk from there

can anybody give me any advice on how to overcome a problem like this in the future, like say, a harddrive raid configuration or some backup software or something, basically after i get the new HDD i'll have 2x200GB sata drives and one 80GB external, that's about 200GB space more that i'm using now, any storage and backup tips would help!

thanx guys!

-----

LLXX where can i get the disk editor for redoing the MBR?

Two partitions are definitely going to be more difficult to recover than just one... but since you know the sizes it'll be much easier. Automated recovery programs like active partition recovery are just trying to get you to pay money for them... they're basically just a simple scanner program that searches every sector for the "boot sector" which marks the start of each partition. A free disk editor with a search feature can do exactly the same thing, and much more. You may find good disk editor by Googling, here's one of the first results: http://www.geocities.com/thestarman3/tool/de/PTS-DE.htm

You should also read about the structure of the MBR and the boot sector before attempting to use a disk editor.

[bobthedinosaur]

AAHHHH!

ok LLXX i ran testdisk and i ended up with a whole lot of info i didn't understand and probably never will

so i tried PC inspector which i got off one of the links u gave me, it's a really nice prog, it scans the drive (1 friggin hour) and finds the old partitions and all my files with their filenames still mostly intact, xcept for the odd directory with a square instead of a normal keyboard character

when i tell it to recover my files it does so very quickly until it gets to those dirs with the square in the folder name at which point i have to click 'OK' to make it continue (minor annoyance)

then it occasionally gets errors reading from the sectors (LBA?) but this i can also simply ignore by clicking 'OK'

after the previous two it came up with a rather serious sounding error about reading from the disk where i had the option of 'abort' 'retry' and 'ignore', clicking on either one just gave me another dialog box with the next sector number or whatever and the same message, i must've clicked like a hundred times and it still hadn't read past the bad bits...

so to avoid the above i just cancelled the recovery process and skipped the directory that was giving the errors (ps. my drive was very thoroughly defragged by diskeeper before the crash)

and then! while recovering the next folders the program decided to crash because it couldn't deal with not reading the disk! so now i have to go through the 1 Hour scanning procedure again before i can attempt to start recovering

at the moment i've got easy recovery pro's Full Diagnostic test running (it's been an hour) to see if the disk has any physical damage to it, which it shouldn't as it's a very new disk and it got error checked regularly

after that i'm gonna try PHOTOREC and see what that's all about

but what i'd really like is a way to get PC Inspector to just not tell me about the errors and just go ahead with what it can recover! i tried easy recovery pro's recovery feature, which also gave me all my files back minus their file or folder names!!! which is just no good!

i'm gonna go look for a disk editor now, any other advice would be cool!!!!

EDIT:

the diagnostic test finished, there's nothing wrong with the physical disk whatsoever

so now i'm running the advanced recovery feature in easy recovery pro, its busy scanning for files over the entire HDD (it couldn't find the two old partitions only one large NTFS partition) and is coming up with file names as well (yay!) i'll check back in an hour when it's done and let you know if it worked or not...

Edited February 22, 2006 by bobthedinosaur