chkdsk destroyed mft

  • Thread starter Thread starter whiskers
  • Start date Start date
W

whiskers

Today I finally attempted a much needed clean reinstall of W2K and in
the process realized that when I replaced the IDE cables on my 4
drives, I connected the current installation disk to the PCI IDE
controller instead of the onboard IDE controller.

I switched the cables and during the reinstallation process windows
remapped the drive letters and ran chkdsk on one of my hard drives
(200Gb Maxtor, the slave drive on the IDE cable on which the primary
drive had the OS)

I watched in terror as chkdsk "recovered" numerous files from MFT
"corruption" and rewrote security descriptors. After the install
completed, with a heavy feeling I opened some of the files and
realized, to my dismay, that yes, chkdsk did in fact cross-link many
files together (it didn't delete anything though, or so it seems). That
meant that I could open an mp3 and start listening to a totally
different mp3 in the middle. Some files seemed to be left untouched
(the most recent ones), however, but quickly fast forwarding through
them. JPG images all got corrupted and video data was OK sometimes and
was composed of completely different segments other times.

So I have two questions:

1. What caused chkdsk to do this to the MFT?
2. Is there ANY way to rebuild the data? I scanned the drive with
Restoration (free tool) but it found only deleted files, not the ones
on the drive. Or is this hopeless? Wipe the 200Gb clean and repopulate?

And no, I did not have backups (some of the stuff WAS backups) since I
dont' have anywhere to backup 200Gb to.

Thanks for all input.
 
different controllers can look at drives slightly differently.
this used to be a big issue in days past but no so much these days.
You just ran into that issue.
Rebuild from scratch.
 
whiskers said:
Today I finally attempted a much needed clean reinstall of W2K and in
the process realized that when I replaced the IDE cables on my 4
drives, I connected the current installation disk to the PCI IDE
controller instead of the onboard IDE controller.

I switched the cables and during the reinstallation process windows
remapped the drive letters and ran chkdsk on one of my hard drives
(200Gb Maxtor, the slave drive on the IDE cable on which the primary
drive had the OS)

I watched in terror as chkdsk "recovered" numerous files from MFT
"corruption" and rewrote security descriptors. After the install
completed, with a heavy feeling I opened some of the files and
realized, to my dismay, that yes, chkdsk did in fact cross-link many
files together (it didn't delete anything though, or so it seems). That
meant that I could open an mp3 and start listening to a totally
different mp3 in the middle. Some files seemed to be left untouched
(the most recent ones), however, but quickly fast forwarding through
them. JPG images all got corrupted and video data was OK sometimes and
was composed of completely different segments other times.

So I have two questions:

1. What caused chkdsk to do this to the MFT?
2. Is there ANY way to rebuild the data? I scanned the drive with
Restoration (free tool) but it found only deleted files, not the ones
on the drive. Or is this hopeless? Wipe the 200Gb clean and repopulate?

And no, I did not have backups (some of the stuff WAS backups) since I
dont' have anywhere to backup 200Gb to.

Thanks for all input.
Click to expand...

I suspect that your data is well and truly lost. To protect yourself
against similar mishaps in future, pay attention to the basic rule of
computing: If your data is important then you must store it on not
less than two independent media. In other words, if you have 200
GBytes of files then you must have a portable 200 GByte storage
medium, e.g. a 200 GByte disk in an external USB case. Anything
less is tempting fate.
 
Today I finally attempted a much needed clean reinstall of W2K and in
the process realized that when I replaced the IDE cables on my 4
drives, I connected the current installation disk to the PCI IDE
controller instead of the onboard IDE controller.

I switched the cables and during the reinstallation process windows
remapped the drive letters and ran chkdsk on one of my hard drives
(200Gb Maxtor, the slave drive on the IDE cable on which the primary
drive had the OS)

I watched in terror as chkdsk "recovered" numerous files from MFT
"corruption" and rewrote security descriptors.
Click to expand...

Instead of just watching, you should have immediately reset the
computer. Then after installing Windows 2000 and configuring it to
support large disks, running chkdsk would have fully repaired the disk
had you not let chkdsk run to completion.
After the install
completed, with a heavy feeling I opened some of the files and
realized, to my dismay, that yes, chkdsk did in fact cross-link many
files together (it didn't delete anything though, or so it seems). That
meant that I could open an mp3 and start listening to a totally
different mp3 in the middle. Some files seemed to be left untouched
(the most recent ones), however, but quickly fast forwarding through
them. JPG images all got corrupted and video data was OK sometimes and
was composed of completely different segments other times.

So I have two questions:

1. What caused chkdsk to do this to the MFT?
Click to expand...

When you install Windows 2000, it does not have the capability to
access beyond the 137 GB boundary on IDE drives connected to the
motherboard. Therefore, you should not let autochk run chkdsk on any
large disk until you have installed SP3 or 4, and put EnableBigLba in
the registry.
 
Instead of just watching, you should have immediately reset the
computer. Then after installing Windows 2000 and configuring it to
support large disks, running chkdsk would have fully repaired the disk
had you not let chkdsk run to completion.
Click to expand...

Ugh, I thought I could screw everything up even worse so I decided not
to touch anything (besides, it was almost done when I came into the
room). Makes me feel rather stupid knowing I could've stopped it.

When you install Windows 2000, it does not have the capability to
access beyond the 137 GB boundary on IDE drives connected to the
motherboard. Therefore, you should not let autochk run chkdsk on any
large disk until you have installed SP3 or 4, and put EnableBigLba in
the registry.
Click to expand...


This was a CD with SP4 already integrated into it.
 
Ugh, I thought I could screw everything up even worse so I decided not
to touch anything (besides, it was almost done when I came into the
room). Makes me feel rather stupid knowing I could've stopped it.
Click to expand...

When installing Windows 2000 on a computer that has large disks, you
have to pay attention to the installation, especially when it's
booting.
This was a CD with SP4 already integrated into it.
Click to expand...

It's not enough.. With Windows 2000, EnableBigLba must be set to 1 in
the registry before it has the ability to see past 137 GB on hard
disks.
 
Back
Top