A disk read error occurred...

More somewhat disorganized thoughts:

Looked up the hexadecimal byte values for your 'pictures' and they are:
smiley face = 02
heart = 03
brick wall = B0

There are other non-ASCII characters in your screen shots, and if that's your HDD, it's been overwritten by a non-ASCII, probably code (meaning a program, e.g. malware) or just garbage (tho it seems too organized), file. It can't be ntfs any longer if you get that result by typing dir etc. at a c: prompt (unless c: is a corrupted ramdisk, which is possible if you've booted in dos from a floppy or equivalent and your memory is problematic). I wonder what the F10 boot option actually does; could there be a hidden partition on your HDD?

I don't know how your HDD is organized; I'd like to know what fdisk might show after booting with a win98 startup disk. Fdisk can see ntfs and linux partitions, but can't tell what file system they contain. Just use the 'show info' choice (4, and/or 5 if there's more than one HDD), record what it says, escape out, and post the data.

I've used Norton’s disk editor (which runs in read-only mode by default, so is safe to try) to look at fat, mbrs, and directories and other files. It will even examine a raw HDD no matter the OS. If you have access to it might be instructive, but it's not a way to recover the data on a large HDD, IMO, because it would be too time consuming. Text data are obvious and can theoretically be recovered, but programs not.

 

It does look that the DIR was looking at a RAMDISK. The fact that it went so fast at first and that Window says that it needs Formatting, bares that out to some degree. Did you try a CHKDSK /F when you did the DIR?? And did the size look anything like the 30gig??
Can't be specific but there are some forensic apps that let you recover in dribs + drabs while on trial.

Pop

 

Sparrow,
The first time I used F10 at boot, I was taken to a diagnostic program. I ran the test on the hard drive and returned numerous "Error Code 0F00:0244 Msg: Block xxxxxx: Uncorrectable data error or media is wriute protected" messages. I also received the same error message during the verify test. This time, the code was 0F00:1A44. I was only able to get to that screen once. Since then, I have been getting the Win95 screen and prompt. If I run FDISK, should that be in an XP system or 98 system? I have both.

Pop,
I am sure that I tried CHKDSK at the prompt. I got a message stating it was an invalid command. DIR seemed to be the only thing that would return anything. Anytime I plug in the drive, it is always being recognized at about 30GB. Even right clicking on the drive shows that it is 30GB and working properly. If only they knew!

Would a virus scan be of any help if I can get it to run? Keep in mind, my main concern is not writting over any data.

Mike

 

MinnesotaMike

I'd run fdisk from a 98 boot (startup) floppy. It runs in DOS. Be sure to exit it by the escape key so it doesn't write anything.

It will show if you have more than one partition on the HDD. That could explain the dir findings without invoking the overwriting theory. Possibly the ntfs partition is still intact (hopefully). There has to be some explanation for what you saw with dir.

If you have an XP CD you might also boot it and choose to repair at the first prompt. That will give you a dos-like environment where you can type help to see what commands are available. I think the fixmbr command might be appropriate. You can also look at the system directories/folders, too.

 

Yes, you can put the drive as slave to another XP system with an up-to-date antivirus and run a full scan. Even though it will not be able to read any data on the drive, it will scan the boot sectors. The MBR of that drive is probably corrupted and that's why you cannot access it. The antivirus should be able to remove any viruses, but will not be able to repair the damage. It may not be related to viruses, just a corrupt MBR.

If other Windows systems say that the drive needs to be formatted, then it is unlikely that a repair/reinstall will be able to fix it. Only do a repair/reinstall as a last resort

Matt

 

Just reinstated the brain a bit.

Running FDISK from either a w9x CD or floppy will quickly show what partitions you're looking at, and on what drives in its clumsy way, but if you can get a hold of a copy of TrueImage, which will pay off down the track, it will show exactly how the drive is setup, and allow you to Image/Backup each partition and/or complete HDD/s across a LAN or what ever, no matter the file system or partition type. A most invaluable tool. I have tried GHOST/PQ but much prefer the honesty of ACRONIS.

While a virus is still an assumption, you may not know how far it has spread, re your other machine, but on that machine with the suss drive slaved you could get Trendmicro to do a HouseCall on the effeced drive and the sytsem as well.

Have you tried READNTFS yet ??
Another handy thing to have laying around (on a high shelf) is a Knoppix Boot CD (or similar). ISO is freely available and just fits on a 700MB CD. It runs entirely from the CD (and RAM) installing nothing on any HDD and recognizes virtually all hardware on the system. Naturally it's a bit slow and takes a bit of getting used too, but is better than nothing when things go under.

I am hoping someone who knows about Forensic tools may come forward....

Pop

 

Sorry, brain is one day older.

If an image can be made to another HDD or DVD it can easily be mounted as a virtual drive and the necessary (scanned) files copied off.....IF??

Pop

 

This may be off track but every time I scan through this thread I keep stopping at the ASCII characters on a dir command... The thought that we may be looking too much at the drive itsself keeps bugging me.

Download from the following link, let it make a boot floppy and boot the floppy. It will automatically start a basic set of tests on your memory. Just hit the 't' key to do a more extreme set of tests. If you come up with errors and have more than 1 stick of RAM then redo the tests with one stick in at a time.

Microsoft Memory Diagnostics

 

SUCCESS!!

After all the much appreciated links and suggestions, I opted to try Active@ File Recovery. I ran the demo of the program first and it found 3 deleted partitions, 2 were FAT 12 and one was NTFS. First I've heard of FAT 12. I explored the NTFS partitions to see what was there and everything came up. I needed the full version of the program to recover the files, but the $49 was well worth the price.

I was up until early this morning recovering files and backing them up right away. They are now safe and sound. Backing up these files will quickly become part of my routine. What system files should I back up? Not to mention occasional online scans. I don't want to have to go through that again! I'm still not sure what happened, maybe a missed virus of some kind, but I'm glad to have everything back. Once I'm sure I have everything I need off the drive, it will be destroyed. I don't want to take a chance with it again.

Thanks to all for your suggestions and links. I appreciate them all!!

sparrow,
An explanation for this would be great. Just not sure if I'll ever really know what went wrong. Knowing would help me to prevent it from happening again. Thanks for your help.

Matt,
I did run NAV on the drive and the results came up clean. It scanned 81 files, 2 Mater Boot Records, and 5 Boot Records. No infection found.

Pop,
I'll look into that boot CD, just in case. So how do you reinstate the brain?

jaylach,
If you ever find anything on those characters, I'd be interested to know what they mean. It probably wouldn't hurt to run the memory test any ways. I'll take a look at the link. Thanks.

Mike

 

FAT 12 is the file system on floppy disks. Somehow you must have had a floppy file system placed on the HDD, possibly by DELL.

One of the FAT partitions was read as c: and contained garbage. If we had done dir d: we probably could have seen the other, but who'd 'ave guessed?

Glad you got something that worked. We were sneaking up on it, but with all the different directions folks were going, it would have been a while.

Think DELL is suspect. That's a queer way to set up a HDD, and suggest you avoid their setup. Must have been where F10 got you. Hope you've got an XP disk to install.

Don't discard the HDD. Suggest a low level format and then repartition and format for use as a backup drive. Sounds like it was just zapped by some soft/malware, and should clean up alright.

 

If you wish to make a backup of your MBR (Boot Sector), the Maxtor utilities will do it. You have NAV (Norton Antivirus), see if it makes Rescue Disks, that will also make a record. Norton Utilities will also backup your MBR.
...I'm sure there are others.
The MBR gets written to ocassionally. Keep your MBR backups (somewhat) up to date.

Yes, if you are going to get a new drive, use the old one as backup. You will need to do that low-level format. Mirror/backup everything that is important onto that drive.

Some good methods of backup have been mentioned. Check them out.

Matt

 

Minnesota..

Sparrow is on the button. That HDD could well outlive your kids.
If you're thinking "Backups" it would also be a safe place to store Drive Images. If the drive is bad, the Image can't be made. The Imaging software will "varify" an Image as either Good or Bad, faithfully.
Roughly speaking, an Image is worth a thousand HDD's.

Technically speaking, Dell, and most brand name builders, are increasingly doing devious tricks with HDD's in order to quickly get "them" out of trouble when "we" get into trouble, during the suppot period. Then, the oddness of these tricks combined with further troubles, encourages "us" to buy new hardware, thus increasing "their" turnover.

If you buy off the corner store, and he goes bust, at least any of the cats in the alley could fix it - if it breaks.

Oooooopps.....slipped of the soapbox as well.

Pop.

 

jaylach

If you're interested in those NON-ASCII characters, just download list.com by clicking this link and examine command.com or cmd.exe with it. (select Ignore if you get an error message in windows) Then if you still have questions, let us know. Be sure to read the excellent help and do try alt-h on a text file.

 

mattman

It's necessary to select 'repair' to call up XPs recovery console, which I described.

This is not related to repair/recovery "installation "

 

I guess it might not hurt to try and use it for an additional backup. If I run every virus scan I can think of on it, it should be safe. Thanks.

Mike

 

MinnesotaMike

Not really! You could have been attacked by anything or anyone, even DELLs bad programming ,not necessarily by something like a virus. You need to do the low level format to really clean the drive (if you don't want to use linux or some other non-dos/windows OS). Then it's like it came from the factory in the old days, with nothing at all on it and you have to partition it to make disk(s) on it and format the partition(s) so the OS can be put on it and access it..

 

sparrow,
RE: recovery, thanks for that info. I will have to read up and expand my knowledge in that area. I have only had a little practical experience with it and that failed part way through, resulting in a reinstall. I was worried that a recovery may fail and the data would be even harder to get back.
Also, if there was a destructive program in the "system ", even though Windows was "recovered ", the destructive program would also be recovered (which MinasotaMike is worried about).

If a low-level (zero) format is carried out, zeros are written to every byte on the drive, so I would not know of any way a virus should survive.

Minasota, if you use the Maxtor utilities to do a low-level format. DO NOT install E-Z BIOS from the Maxblast utility disk. You will be back in the same situation again sooner or later (it gets corrupted when you change the drive configuration).
When I did a low-level format using the Maxtor utilities I think the only way for the drive to be patitioned/formatted was to install E-Z BIOS, I then had to "remove" E-Z BIOS and partition/format again.

When you do the low-level format, just have the "bad" drive in the machine alone, to avoid a mistake that formats a good drive.

Matt

 

sparrow,
I forgot to mention that I would format and then run the scans. I just want to make sure that everything I need is off the drive before I format. I'll probably leave it sit for awhile before I do anything with it.

mattman,
I assume that XP's format tool is similiar to Maxtor's program. If so, I will just try that route. And yes, I will be very careful not to format the wrong drive. I don't need any more headaches for awhile!

Mike

 

I'm not all that interested in digging into the ASCII symbols... They just reminded me of a problem that occured on a machine many years ago. The ram could be read fine but when written to it would have errors. This actually made a drive unreachable. It would write to memory that was bad. The write would be garbled. It could read the ram though but it was reading garbled info so when it went to get the file selected of course it couldn't find it as the name didn't really exist. Everything pointed to a drive problem but it was actually ram. Yes, there was a LOT of banging forehead against monitor before I figured that one out!

Just seemed to me that a memory check wouldn't hurt. Man, that whole situation above brings back memories of systems 20 or 25 years ago. I actually miss them.

I'll probabally check out the link anyway. Might be interesting.

 

FORMAT's

There are a number of variables in this area and the deeper one goes the more critical it is to understand what it is all about. The many commonplace tools for doing this are directed mainly to the "High-Level" format that warns us that "ALL" data will be lost if we proceed. However, we know that data can be retrieved from the "accidental" format using specialized procedures, even by the maladjusted.
Therefore, the most sure-fire way to combat this is to do a "Low-Level" format. This is a fairly specialized procedure and not commonly known about in todays world as it's always done in the factory. If you have a confident understanding this would be a primary option.

Alternatively, you could try the following:

1.
Set the drive up as a single master.
2.
Find an early "MS" DOS bootable floppy (v6.2 or earlier). If not, w95 or 98 may do.
3.
Boot the floppy and run FDISK and delete ALL partitions.
4.
Remove floppy and boot from wXP CD and let it do a basic install with NTFS file system. This is just as a Pre-Wash and to see if it performs OK.
5.
If it tests OK, boot again from the old MSDOS floppy, run FDISK and delete ALL partitions. Then create a Primary DOS partition and ESC out.
6.
Re-Boot the floppy and from the prompt type> format c: /U
Pressing ENTER will do an "Unconditional" FAT format.
This is NOT a "Low-Level" format.

If you have got this far without any errors it should be "fairly" safe to install any O/S with any file system, or just use it for Backups or Virtual CD drives.

7.
A HouseCall should point to any nasties that may have defeated your NAV in the first place, but I am inclined to think that all this was due to a "virtual time bomb" courtesy of Dell's crude support mechanism built into the Fat12 partitions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you use a good Imaging tool, it will know about ALL visible and invisible partitions and ALL file systems. The new trend in support mechanisms generally use a "cut down" version of an Image tool which is generally almost useless except to a Help Desk.

Pop