CHKDSK corrupted 140gb partition

I have a problem which has caused me no end of confusion and a lot of sheer frustration. I do not have much hope for any sort of resolution but if there is anyone out there who can help me out I will be very grateful. By the way I apologise for the length of this post...

Right, here goes... (please note - all the forgoing relates to NTFS partitions at all times)

Saturday morning I backed up everything I wanted to a single 140GB partition (the last 140gb) on my IBM Deskstar (180GB - IDE). And yes, normally I would backup to an external device - but alas without the aid of a DVD Writer backing up 120 odd gigs to CD is not very practical. I deleted all the other partitions on the HD - other than 'system' partition. So at the end of the day the HDD looked something like:

<--- OS Partition (10GB)---><---Blank (Unpartitioned, unformatted, etc.. - 30GB)---><--- Backup Partition (140GB)--->

My second HD, also a IBM Deskstar (12.x GB - IDE) looked something like this:

<--- Page File Partition (1GB)---><---Blank (Unpartitioned, unformatted, etc.. - 11.x GB)--->

The reason why I backed everything up was because later in the afternoon I replaced the motherboard and memory and a few other bits and pieces and I wanted to clean install XP. I ran into some problems while clean installing (I am providing this information as background):

1. At the setup stage where one specifies the exact partition where one wants to install XP, I deleted the existing system partition so that I ended up with a contiguous area of 40GBs of free space, followed by the 140GB backup partition. (I also deleted the page file partion on the second hd - so that it was completely blank - all 12.x GB worth).

2. Then I created a 15gb system partition on the first hd - BUT (and this is where the problems began) XP setup created the partition starting after the 8MB boundary?? This was very puzzling to me - and therefore I deleted the 15gb partition and re-created it - same result.

3. I then aborted the setup and used the PM Pro 7 boot disks to have a look at the state of my hard drives. The second hd was fine - because it was all completely blank. The first HD was correctly showing the 140gb partition although somehow it was set to active (although this may be because of a lack of any other partition on the HD - but I can't remember whether I did find any other partition..). Anyway I used PM to create the 15gb partition from the start of the hd and set it to active.

4. The other thing I noticed was that the 140gb partion was set as 'hidden' - I left it because I thought I would unhide later on (and also I wasn't sure the XP would handle that size partition without SP1).

5. So, I then installed XP successfully to the 15gb partition without any visible errors. In XP's Disk Management service it displayed the 140gb partition but its staus was unknown (I presume this was due to the fact that it was 'hidden') and also Windows explorer would only show the 15gb drive and not the 140gb drive. So I re-booted and used the PM Pro 7 boot disks to 'unhide' the 140gb partition.

6. I then exited from PM and re-booted into XP - everything was fine until just before the login screen I was told by XP, that it was going to run chkdsk on the 140gb drive. I thought this was logical (and chkdsk had done similar activity before too - on other partitions, notably removeable drives, etc...). So I let it run (at the time blissfully unaware of what was to come)....

7. It went mad.... it started spewing lost clusters, orphaned files, index problems, directory problems, and it was just scrolling up the screen very fast - and it was also 'fixing' these so-called problems (this is the point I started to get really worried - because I knew there was absolutley nothing wrong with the partition). Anyway I did the three fingered salute - but obviously it would not re-boot. I was worried about doing a hard re-boot due to the potential damage it would do to the partition and therefore I let it run to the end.

8. I logged in and went to explorer and had a look at the partition/drive. Initially all seemed well, but upon closer inspection this is what I noticed:

a. some directories in their entirety were missing

b. many directories were simply empty (which they definately shouldn't have been)

c. most files had mysteriously become corrupt - for example if I opened any word file in wordpad - I would get garbage characters; if I tried to play an mp3 file WM player would refuse; zip files would refuse to open because they are considered corrupt (txt files remained untouched and exe files seem to have remained untouched??)

d. I also had many mpeg-2 files and I discovered that although they retained the correct filenames and dates - they were actually composed of parts of other mpg-2 files glued together!! So if I play any mpeg-2 file (from that partition) in PowerDVD the name of the file does not reflect the contents!!

So, there you have it - 140gigs of worthless rubbish... i feel like crying now..... is there anything I can do to put things right and anyone know why did boot time chkdsk decide to 'play' with my partition?? (boo hoo...)

 

First off - while it may be beyond help at this point, it may not be. So don't mess with it any more for a little while since it would be a shame to go from 'can fix' to 'oops, can't fix now'.

Meanwhile I'll try for some expert eyes to take a look at the thread. It's beyond my ability but I'm only an egg in such matters and we need a full grown set of eyes.

 

The bad news is your data is toast.
The good news is you can relax and let the healing process begin.

If i may soapbox for a moment, and caution that using third party products to manipulate raw file data is inheriently risky, and prone to many problems. If the tools in the box won't do it, its because its not wise to do so, not because its not technically possible.

If i had to guess, in the manipulations of the partition table, something didnt get written correctly and lopped off the end of the partition. Since the MFT is stored front and back, when the OS came up (booting off the forward MFT), it detected the inconsistancy, and flagged the partition for chkdsk. Chkdsk is what actually hosed your data, trying to peice the blocks back together as best it could, trusting the hosed MFT on the tail as the authoritative.

Depending on the value of the data, now is the time to yank the drive and take it to a data recovery service, which will charge between 100-10,000 dollars to recover it. Otherwise, go through and copy the data that you want to try to save off to a new partition. Get only data files, dont try to trust any binaries.

Exit strategy: Get your data off that drive, nuke and pave, start over, and let the XP setup do the parititoning from scratch. You dont want a mystery problem slowly compounding behind the scenes.

I'm sorry you lost data.

 

You just heard it. I'll also echo the 'sorry you lost data'.

 

Thanks for that to both of ye. I suspected as much that the data wouldn't be recoverable....although Joe, you mentioned data recovery services - realistically do you think they could restore that partition to the way it was at the pre-disaster stage??

Also, the comment about third party tools - I have always used PM Pro because I trusted it to know what it was doing (and also because as you said technically it does many things XP doesn't)- after all thats what it was created for - so would u recommend as an expert that it is better not to use these tools at all??

Yep - I planned on nuking the drive after everything was over anyway.

Thanks again folks. Right - I'm gonna get a DVD burner....

 

Technically, your data is still there on the drive, its just linked to the wrong filenames. with enough time and patience, it can be pieced back together. Sometimes the damage isnt so bad, and they can mix and match MFTs to get a good list. Its impossible to tell without looking at it what the extent of the damage is. Most of the services will let you send them the drive and give you a quote on what it costs. Expect the price to vary widely, but generally its not going to be worth the money for a home user.

I have seen literally hundreds of hosed drives as a result of using non microsoft partition utilities. There are so many vectors for things to go horribly wrong, that its difficult to ever justify whatever whizbang feature you are trying to accomplish. Especially nowadays. Like you, i have 180G drive on my machine, and nothing but a CD burner to back it up. I backup my PST from outlook, and a few key XLS sheets, but 99% of my disk is working without a net. There just isnt a cost effective way to back up that much data. All the more reason not to tempt fate with tools that perform high risk manipulation of the lowlevel file system.

 

Just as a general comment; I think having such a single large drive is bad strategy. Having two smaller HD's would go a long way towards giving you a better safety net. Both drives can be used for reciprical backups and this would also leave the burner for the most critical data.

Regards - Charles

 

heh, you probably wouldn't like the 5 spindle 600G spanned volume i use at work then either

 

You got that right!

I came across this thread yesterday:

http://www.windowsbbs.com/showthread.php?t=31893

Every time I read things like this, I wince.

Aside from not using removable media to backup 4.5 yrs. of work, this just as easily could have been because of a hosed HD.

Regards - Charles

 

gonna spin a new thread for discussion. its an interesting problem that i dont think a solution exists for..