Resolved Recover files that CHKDSK deleted?

Mine's is a similar situation to what Kash4U posted here but not exactly, so I am hoping you would bear with me and see if you have ideas I can try.

I have WD2000 disk (186GB) used as a boot disk for Win XP that was exhibiting some probs (Windows boot fails to progress beyond "Verifying DMI Pool .." )

So I took the disk out of that system, re-jumpered it as a slave, and stuck it into a Win2K machine to see if the disk (NTFS) is readable. It was readable, so I thought everything was fine. However, the second time I booted the Win2K machine, that PC proceeded to CHKDSK the WD2000 (I left it unattended and when I came back, CHKDSK had already started).

Not really knowing what to do, but remembering that CHKDSK does NOT work well with disks over 137GB AND because it was starting to delete large numbers of file attributes, I panicked and pulled the plug on the machine.

I then took my son's XP machine (very old), and re-configured it to work with the WD2000. This included installing a Promise Ultra 100TX2 IDE controller etc. This machine also tried to CHKDSK which I decline each time.

With this machine set up, I looked into the hard disk and find that I am left with a disk that is mostly intact. However, there are a few key directories that used to contain data and work, and that which is now missing or corrupted. This amounts to a few 100s of MB of lost data which involve about 3 weeks worth of work that I do not want to repeat.

After searching the web and newsgroups for the last day, I've not seen any definitive description of what happens to data/files when CHKDSK deletes file attributes. And more importantly, none of the fiile recovery tools mentions this as a recoverable case that the tools can deal with. Is there any hope of recovering from this?

At the moment, I am running Active@ File Recovery. It is in "Superscan" mode which I take to mean a deep block by block inventory of what's on the disk. Because of the size of the disk, it'll take some time before it reports back what it sees. Based on progress thus far, I won't know if it sees anything until perhaps tomorrow morning.

By the way, I had also tried Running PC Inspector File Recovery (because it's free), but it didn't see any "lost" files.

I would appreciate any suggestions on either tools or techniques. I am very careful to ensure that I do not write new files/data onto this disk. I am hoping that the tools that I have tried thus far are only reading the disk, but I can't know for sure.

Tim

 

Welcome to the board Tim.
I'm not going to suggest any recovery applications as I'm generally unfamiliar with those. The following site gives some hardware clues that you could check.
http://www.computerhope.com/issues/ch000474.htm

Failing this you may have to try a repair install of XP, once you establish that your BIOS is detecting the drive correctly, as you've probably deleted some critical boot files. Search the XP or W2K forums (repair install) on the site for help on the exact procedure for a repair.
Trying to boot the crook HD on another machine won't work (99% of the time) as all the hardware information stored on the disk will be different.

Make sure your BIOS battery is OK. If the BIOS is remembering saved settings after a power down and power up, then it should be fine.

 

Tim, Your best hope is to get a disk image of that drive before doing anything else. If you use something like Acronis true image, it matters not if the disk is unbootable. You can run TI from a floppy after installing it on another computer and making same. Place the image on CD if you have a burner or onto a second drive if you have one. Even on a USB drive. Then you'll be able to pluck individual files from that image for recovery later when you get another hard drive. (I'm assuming your HD went south).

I know you didn't intentionally select to run chkdsk with the /f switch since XP decided for you and you weren't there to say no. Just for those who don't understand how chkdsk works, just remember this, it doesn't FIX anything. It is very dangerous to run it with the /f switch if you don't have a full backup of your data. It has been known to completely wreck a drive. Normally it wouldn't do that unless there was some drive problem anyway but that's not much consolation when you realize that chkdsk made a bad situation worse. You could have backed up the data prior to running chkdsk and been much safer.

Always do this, when booting up if Windows says it needs to check one of your disks, decline the offer even though it says it is recommended. Then when booted, run the disk check in Windows without checking any repair boxes. If it then completes without giving any indication of any problem, it's probably safe to check the repair box and run it again, letting it reboot and run outside of Windows. If however it does indicate errors when run inside Windows with no boxes checked, you would be wise to get your backups in shape before letting it run and make repairs outside of Windows.

Good luck.

 

I second the advice to 'stop running tools and bit-image the drive first'. The best chance of recovery is to have a pristine, unrepaired volume to work with. Every one of those repair things you run will make it more difficult to recover.

Are you seeing output like this?

Code:

Deleting corrupt attribute record (48, " ")
   from file record segment 286.
   Deleting corrupt attribute record (80, " ")
   from file record segment 286.

As i recommended in the other thread, your first action should be to copy as much of the data as you can see to a new drive or backup medium before it gets worse.


Once that volume is marked 'dirty', its going to keep trying to run chkdsk until the bit is clean. You can control this using this tool

Its impossible for us to know if you are in an unrecoverable state. I would say that it sounds like a lot of your data is in high jepordy, based on what happened when you chkdsk'd. I would expect that many of the files are still intact though.

My experience is with working with the high dollar data recovery services that charge thousands of dollars to recover exchange mailboxes and such. I don't have any recommendations on software to try at the consumer level.

Just for those who don't understand how chkdsk works, just remember this, it doesn't FIX anything.
Just a quick aside- This is a generalization, and accurate enough for JoeConsumer, however chkdsk can repair many common scenarios, in addition to resetting or removing data in a rather troubling way sometimes.

 

I didn't mean to completely condemn chkdsk Joe. I was rather disappointed when I first found that XP couldn't use Scandisk, which had a nice /undo switch to reverse its actions.

For all who are interested in this dry sort of stuff, here's some info on these tools:

http://users.iafrica.com/c/cq/cquirke/scandisk.htm

I don't know this guy personally but I think most of his information is accurate.

 

Thanks folks and thanks for the welcome.

I am a little confused about the disk image idea. Aren't disk images a single really large file? How would one extract individual files from within that image?

Not to dispute the notion of using a disk imaging tool, I don't currently believe that the disk is going bad. Without going into all the details, I believe the original MOBO is going bad. I think that when I moved the disk to the Win2K system, Win2K AND that system's BIOS didn't know how to handle this large disk. So Windows kicked into CHKDSK by default.

I think my pulling the plug to stop CHKDSK created a bunch of loose ends which flipped the "dirty" disk bit. Hence why every Windows systems wants to CHKDSK my disk. Well that's my hunch.

At the end of the day, what I really want to know is if CHKDSK's deletion of file attributes is reversible? i.e. if the content bits are still on the disk, and if there are tools that can reconstruct the attribute bits to reconnect the dots and give me back uncorrupted files.

By the way, just so you can all heap scorn and derision on me: just last week, I returned a 250GB HD and an external HD enclosure (USB 2.0) to the store I bought the items from. I had originally bought these items because they were on sale, and so I could specifically back up this exact disk. But things got busy, and I forgot to send in the rebate coupons. So at the end of the day, I deemed that it was cheaper for me to just return the items.

Arrrrgh. Penny wise. Mega bucks foolish.

Tim

 

Some good tutorials over on norton ghost website on bit imaging
http://www.symantec.com/techsupp/ghost/ghost_2003_info_tutorial.html
http://ghost.radified.com/ghost_2.htm

Short answer is there is software that can take an exact picture of a drive, including the 'internals' of the FAT/MFT. The details arent important, it just works

Let me elaborate on why we are advising this action. Something has gone wrong with the data on the drive. Check out this article for details on the inner guts of an NTFS volume from mark.
http://www.winntmag.com/Articles/Index.cfm?IssueID=27&ArticleID=3455

Chkdsk is detecting that something is not right with the records, maybe broken mft table entry, maybe something with a directory object. All these recovery programs have a lot of knowladge about the file system internals, and they try to rebuild your file structure. Every pass they make will make changes to the disk, obscuring the original structure, making it less likely that future recovery efforts can be undertaken successfully. If you had a bit image of the drive, you'd have unlimited oppertunity to try to recover the data.

re: backup drive, DOH!

 

I have Acronis True Image, Power Quest Drive Image, Norton Ghost, and NovaStore Instant Recovery. With the exception Instant Recovery, all will allow extraction of individual files from the image they create. It's fast and easy. I think they are excellent tools for normal backups. Moreover, they are very useful for imaging a drive that has a hosed system to allow file extraction of critical data.

After using all of these, I migrated to Acronis True Image. I like the fact that it can image the boot drive while it's actively running without rebooting to complete. I also appreciate that it can image the drive while GoBack is enabled. The others seem to stumble on those things.

End of commercial endorsement.

 

You will not believe this

Dude,
Most excellent. Thanks. The ability (or lack thereof) to access indiv files in an image was the key thing I was concerned of. I am on the active hunt for a good deal oin a large drive. Fry's has a Seagate for $54.99. Unfortunately it's only 160GB. BUT it is a sweet deal.

BTW, my most current backup was as of 3 weeks ago. But wouldn't you know it, I was rather productive in the last two weeks and created a bunch of new stuff that I am just cringing at the thought of having to re-do.

BUT LO and behold. This morning, I came back to the system in question which has been running this Active@ File Recovery thingy. It's not yet done so I don't know if the software is any good. But for some miraculous (and probably unrelated) reason, I can now see the files in one of the critical directory that I am trying to recover. Whereas yesterday, the entire directory was empty, nada, zilch. DO NOT ASK ME TO EXPLAIN.

In the back of my mind, I always knew that these so called deterministic state machines are in fact had sentient beings with a capricious Pan-like nature.

I am in the process of copying this stuff over to a good drive and testing the files. Keeping my fingers crossed.

Tim

 

TCY
Well, did it work for you? Post back and let us know how it went, please!
Johanna

 

Johanna,
Yes everything worked out. I managed to recover most of my files. There were a few that were no longer readable, but the actual percentage is very low considering what I could have lost. The key thing is that my really important files were pretty much intact.

Considering that I have a happy ending, I'd hate to end this thread on an off note, but I do NOT know how I managed to save the data. So for those searching the archives, unfortunately there is nothing I can relay to you about how I solved this.

Tim