A disk read error occurred...

I'm getting this message when I boot my system. It also states to press Ctrl-Alt-Delete to restart. Doing that just gives me the same screen.

A little background for you. And no, I have no backups. Big mistake, I know. Please don't beat me up on that one, I feel bad enough.

The system, Dell 2300, worked without a problem until this morning. Yesterday was my "clean up" day for the systems. Done first thing in the morning. No viruses or spyware. All scans and defrag ran without a problem. Everything worked perfectly. I shut down for the night. This morning when I booted the system, I received an error. Something about a reading the OS. Sorry, it only showed once and I can not get the message to reappear. Any other time I start the system, I get the message above. The drive never made any unusual noises or gave me any signs of failing. One day great, the next gone.

I pulled the drive, Maxtor DiamondMax Plus 8 (30GB), and put it in as the master in my other Dell. Same message. I installed as my slave drive and the drive is recognized. The drive properties show there is nothing on the drive. I try to open and it tells me the drive needs to be formatted. This is not a good sign.

How does a drive lose everything and need to be formatted overnight? I know, anything can happen. I keep the AV and spyware programs updated. I know there was no virus on the system. Is there anything I can do to recover this drive? Just long enough to transfer information.

I have installed XP on my slave drive and am running that as my master now. Rebuilding everything is not going to be fun. Would running a repair of XP work? The main thing is not to lose my personal files if at all possible. I can just not understand how this happened.

No new software or hardware installed recently.

Thanks in advance!!

Mike

 

Update, and this gets good. I've been chatting with Dell, but haven't gotten anywhere. I run the IDE Drive Diagnostics and get a "Fail. Reture (that's how they spelled it) Code: 76. Pressing F10 will allow me to run some tests on the hardware. I select the hard drive. I get error code 0F00:0244 on the read test and code 0F00:1A44 on the verify test. I expected the errors. What happens next blew me away.

I restart the system and press F10 again. This time, I get a black screen that says:
Starting Windows 95
Microsoft Winsdows 95
(C) Copyright Microsoft Corp. 1981-1996

C:\>

How the heck do you get Win95 showing up on an XP system? Is this even possible? Never upgraded, direct from the factory with XP.

Now they want me to swap a drive from my other XP system into the system with the bad drive. Can there be anything gained from that? This is getting more weird all the time.

Mike

 

Sorry I don't have anythinmg to offer for the rough time you're having. It does remind me of what we used to call "Gremlins"

Hope something good comes out of this scenario for you soon.

 

I think those gremlins are not going to be very friendly.

Is (was) it formatted as NTFS or FAT32?

The Win95 may be a boot system from the Dell diagnostics. At the C:\> prompt enter:
DIR
What files are listed? It may be a "virtual" RAM drive.

Matt

 

Matt,

Thanks for the post. The drive is NTFS. I have typed in dir at the C: prompt but the files race by to quick to see all of them. I know there is a way to slow them down, but I forgot how. If you could clue me in, I'll be glad to post back with the file names.

Mike

 

try dir/p or dir/w/p

 

Thanks sparrow, just note that there needs to be a space after the dir.

Just check that there is no Windows folder. I think it will be diagnostics files for running in DOS. Since it cannot see the old C: drive, it has created the virtual RAM drive as C:.

There may not be many ways to recover your data. I will post back later, I'm off to work.

Matt

 

Matt,

I have a list of the DIR. I did not put a space after dir and it worked. I see no listing for Windows. Not a good sign I assume. There are three strange entries though. I took pictures of them but don't have the ability to post them right now. I'll try to describe them.

\CSu\(picture of oval happy face) ( =DM
l= IDFN R (picture of a heart)du
ll i< lsi (picture of a brick wall)r : (omega sign)(triangle)

The entry with the smiley face is dated 19-15-02 with a size of 159,815 bytes. The heart one is dated 2-13-66 with a size of 260,158,510 bytes. The last entry is dated 2-4-94 and listed as <DIR> with no size. It does have a strange time of 13:42a. Not sure if they are normal, but they are strange. Any idea what they are? Thanks.

Mike

 

That sounds like software! Think your PC's been zapped by malware. I'd vote for a clean reinstall with preliminary low level format or linux installation followed by DOS fdisk, etc., and if things don't seem to work perfectly, a bios flash (even if it's the same version), all just for cleaning.

 

Hopefully, I can recover some files then I can give that a try.

I do have some pictures posted on this if anyone wants to see what I was talking about.

Mike

 

Sorry MM, but I don't like your chances of recovery.

First stop may be to run the Ontrack recovery program ( www.ontrack.com ). It will tell you if the files are still there. It will also tell you that you will have to pay to do the recovery.

The NTFS format will also make it harder.

Outside possibilities...does your Antivirus make "rescue disks "? They make a copy of your MBR (Master Boot Records). Norton Utilities will also make a record if you use that part of the program.

Run the Maxtor utilities, Maxblast and Powermax. I have had some utilities being able to "repair" the MBR. Check in the MBR Save/Restore section, but I doubt that a save has been made to restore.

Search the Web for recovery programs. I have not come across a freebie that will read NTFS yet, but there are a lot of clever programers out there that are trying hard.

I don't go into recovery much now. I backup all important data on other drives and optical media. I take a "snapshot" of the system after I have installed all the basics, then keep the "data drive" backed up.

When you decide to reformat (hoping you get your data) I agree with sparrow about doing a low-level fomat. If there are "nasties" in the MBR, that will get rid of them.

Matt

 

G'Day All

Just some things to bounce around.
Isn't the funny DIR the DOS way of not being able to handle NTFS??
The space after DIR is probably "Old School" and still a good habbit.
The data may still be complete - wishfull thinking - with only the drive controller being the culprit.
How old is the drive?? Do you have access to a matching one to swap the controller??
Use any other drive (large enough) to make an image of the bad one onto and attempt to recover from that so the original can be re-used if things get messed up on the copy.
Is the drive mounted in a mobile rack - some are prone to intermitent problems.
Did you alter and re-alter jumper settings in swapping machines etc.
Best to use Master or Slave settings accordingly during the salvage.
The Cable Select setting may not be reliable??
Swapping cables may reveal something.
Does the BIOS suggest anything funny like odd characters in the drive model ID.
Could anybody else in the house, trying to be helpful, have found a w95 CD lying around???

That's it - now I'm brain dead.....Pop

 

MinnesotaMike

The reason I prefer a linux install rather than a low level format (only need to make a partition and install the file system) is to check on the HDD, and it's much faster; if linux can't use it, it's toast. And that would seem to be an important question here. Linux will overwrite the system areas as well as the data area. I've only once found it helpful to flash a bios after an attack, but that can't hurt if you know what you're doing - you don't necessarily have to have done a flash before, however.

Another thought: if you have another machine you can try using this drive as a slave to see if any data is recoverable; but that may allow the malware to attack the second machine if you try to run any programs or look at any graphics, and of course you need a program that can see an ntfs partition if that's what you've got. NOTE: See you've done that.

Got around to looking at what you refered to as pictures; those are characters representing non-alphanumeric bytes, indicating damage to the directory being viewed - the root?. You probably have either FAT32 or your disk has been overwritten. It may not be malware, just physical damage. Would still try my previous suggestions, however.

 

G'Day sparrow

Does you last suggest something destructive on the original??
If Linux, maybe a bootCDable version like Knoppix etc.

Pop

 

Pop.Gunna

Any version of linus that can partition the HDD and install the linux file system thus overwriting the entire HDD is appropriate. I happen to have some Mandrake installation CDs.

No. DOS/windows9xx see absolutely nothing on an ntfs drive, as if it doesn't exist.

 

Matt,
I will take a look at the Ontrack and Maxtor sites to see what's available. Unfortunately, no rescue disks are available. Are you thinking the virus is in the MBR? If so, is it possible to restore them from the XP installation CD? Or will that destroy any data on the drive? My main focus is getting the data. After that, I may just take a sledge hammer to the drive instead of taking a chance with it again.

Pop,
No date stamp on the drive. I purchased the system in December of 2002 though. It is the original drive. I don't have another drive to swap controllers with. I left the drive setting on CS. I could try switching that to Slave. I have also tried 3 different cables. Same results on any of them. The information in BIOS shows the correct drive information. No wierd characters. No chance of a Win95 disk being put in. None laying around. Any system disks are kept in a safe place away from the kids. Kids will be kids sometimes.

Sparrow,
Thanks but I'm not ready to overwrite the data on the drive. Once any data is recovered, the drive is gone. I do not plan on taking any chances with it again. I have place the drive as a slave in other systems. They see nothing. When I try to access the drive, I'm ask to format it. I know, not a good sign.

Thanks for all the suggestions!

Mike

 

Thanks sparrow

As you can see, I question everything, especially myself.
Isn't it too early to be destructive if a standalone Boot CD that, as you know, wont write anything over the original can do the checking and maybe even retrieve any crucial data to a secondary device??

The drive is apparently NTFS which makes the DIR somewhat confusing and made me wonder about some outside influence - malware - Kids -

Pop

 

Minnesota

2 cents worth.
When it comes to recovery tools my bacon has been saved many times using Acronis TrueImage. A straight up piece of software. They also have a utility package with a Recovery Tool included, but I cant speak for that - not as yet.

Pop

 

Here is a link that may help you pull files off of that ntfs drive from dos. I believe it needs dos 6 or later. A win 98 startup floppy works just fine.

To save you searching I just stuck it in the background of my site...

NTFS DOS Reader

 

Thanks guys. I'll add those to my list of programs to explore.

Mike