Corrupt NTFS drive after BIOS flash

  • Thread starter Thread starter BlackEye
  • Start date Start date
B

BlackEye

Greetings,

I have a problem with a corrupt NTFS drive. It all started with a seemingly
successful BIOS flash. I downloaded @BIOS, installed and flashed a new
BIOS. After the flash was complete, I rebooted the system. I went into the
BIOS setup and used the option to load the optimal settings and tweaked
individual settings to my liking. I saved the BIOS and the computer
rebooted. Now this is where the trouble started.

The computer went through POST and started to boot up. It got as far as the
graphical Windows XP startup screen with the blue progress bar. The bar got
about 1 or 2 blocks wide and the screen went blank. A second later a blue
screen with an UNMOUNTABLE_BOOT_VOLUME error appeared. I did some searching
on another computer and found the suggested method of recovery was running
chkdsk /r on the drive. I started chkdsk, went to bed and in the morning it
was complete. There were some errors detected and repaired, but no bad
sectors found. I rebooted the machine again and got into Windows. I had to
reinstall the video drivers for my video card because one or more of the
driver files was corrupted.

Everything else looked fine, until I opened Windows Explorer and realized
that I had 20GB more disk space than I did before my problems started. As I
did some searching on my drive, I realized that there were thousands of
files that had become 0 bytes. These files were all over the drive, not in
any particular folder, but I suppose they could have been at the same
physical location on the drive.

Of course the first thing I did after this was to download some recovery
programs. Most are great at finding deleted files, but they don't find the
remainder of files that had been truncated to 0 bytes. I ran chkdsk with
the /f parameter twice and both times it found errors that it supposedly
fixed. Now, when I run chkdsk just to check the status of the drive, it
still says that there are errors on the drive. Also during one of the
chkdsks I received a message saying the drive contains free space that is
marked as allocated. This leads me to believe that my files are still on
the drive but the MFT is not pointing to them anymore. I should also note
that I have 5 HDDs in the system and the only one that was affected was the
boot drive which is also the only serial ATA drive in the system.

Currently I'm running a scan in a program called "Recover My Files" that is
progressing slowly. My plan after the scan is complete is to do a sector
copy of the drive onto another HDD. I'll probably keep downloading and
trying various recovery programs until I find one that will work.

Most of the files that were corrupted are program files that can be
replaced. There are 4 data files that were damaged that I would really like
to be able to recover. If someone can offer some guidance on how to find
and retrieve these files on the drive, I would appreciate it. Does anyone
have any suggestions on what I should do next? Is there any program that
could help me retrieve my files?

Thanks,
BlackEye
 
Does anyone
have any suggestions on what I should do next? Is there any program that
could help me retrieve my files?
Click to expand...

After a few passes of CHKDSK /F on twekaed but unverified system,
you should restore important files from the backup.

You don't have a backup? Should not experiment with BIOS settings then.
Restore defaults and reinstall your software. Run extensive tests to check
if your system is healthy. Recreate data.
 
BlackEye said:
Greetings,

I have a problem with a corrupt NTFS drive. It all started with a seemingly
successful BIOS flash. I downloaded @BIOS, installed and flashed a new
BIOS. After the flash was complete, I rebooted the system. I went into the
BIOS setup and used the option to load the optimal settings and tweaked
individual settings to my liking. I saved the BIOS and the computer
rebooted. Now this is where the trouble started.
Click to expand...

How was the drive mapped before the flash: large, LBA or what?

That setting likely needs to be set as it was before the flash.
 
BlackEye said:
Of course the first thing I did after this was to download some recovery
programs. Most are great at finding deleted files, but they don't find the
remainder of files that had been truncated to 0 bytes.
Click to expand...

You will need software that instead of 'using' the MFT, scans for file
headers. This type of software often allows you to save files with either:

- generic filenames (filennnn.JPG etc.)
- if the filename can be retrieved from the MFT even with the original
filename

Often files will have a fixed size (determined by you) because the MFT can
not be used to get the correct size (as you already found). For many file
types it is not a problem if the recovered fiels are larget than the
original. Often fragmented files will be corrupt/incomplete

One title that can scan for headers is Davory from www.winhex.com and I
think Recover My Files does as well (that's why it is pretty slow). If those
tools do not work then it is unlikely others will (unless they they have a
larger signature database), so there's not much use in trying even more.
 
BlackEye said:
I have a problem with a corrupt NTFS drive. It all started with a seemingly
successful BIOS flash. I downloaded @BIOS, installed and flashed a new
BIOS. After the flash was complete, I rebooted the system. I went into the
BIOS setup and used the option to load the optimal settings and tweaked
individual settings to my liking. I saved the BIOS and the computer
rebooted. Now this is where the trouble started.

The computer went through POST and started to boot up. It got as far as the
graphical Windows XP startup screen with the blue progress bar. The bar got
about 1 or 2 blocks wide and the screen went blank. A second later a blue
screen with an UNMOUNTABLE_BOOT_VOLUME error appeared. I did some searching
on another computer and found the suggested method of recovery was running
chkdsk /r on the drive. I started chkdsk, went to bed and in the morning it
was complete. There were some errors detected and repaired, but no bad
sectors found. I rebooted the machine again and got into Windows. I had to
reinstall the video drivers for my video card because one or more of the
driver files was corrupted.
Click to expand...

Letting CHKDSK was a big mistake. The first thing to suspect when massive file
system corruption occurs is improper mapping of the drive, caused in most cases
by incorrect settings of the drive in the CMOS (BIOS setup). Since you
reflashed your BIOS, then these settings weren't retained and you had to set
them to the same as before the flashing.

Running CHKDSK in autofix mode on a file system in this state, will perpetuate
the problem, by consolidating the geometry mismatches and converting them into a
"coherent" file system structure. In other words, it's a one way ride.
Everything else looked fine, until I opened Windows Explorer and realized
that I had 20GB more disk space than I did before my problems started. As I
did some searching on my drive, I realized that there were thousands of
files that had become 0 bytes. These files were all over the drive, not in
any particular folder, but I suppose they could have been at the same
physical location on the drive.
Click to expand...

They were, but for a different drive mapping.
Of course the first thing I did after this was to download some recovery
programs. Most are great at finding deleted files, but they don't find the
remainder of files that had been truncated to 0 bytes. I ran chkdsk with
the /f parameter twice and both times it found errors that it supposedly
fixed.
Click to expand...

The first rule of data recovery is to not change anything on a shaky file system
before having assessed the problem. Letting CHKDSK to plough the file system
was the last thing needed.
Now, when I run chkdsk just to check the status of the drive, it
still says that there are errors on the drive. Also during one of the
chkdsks I received a message saying the drive contains free space that is
marked as allocated. This leads me to believe that my files are still on
the drive but the MFT is not pointing to them anymore. I should also note
that I have 5 HDDs in the system and the only one that was affected was the
boot drive which is also the only serial ATA drive in the system.

Currently I'm running a scan in a program called "Recover My Files" that is
progressing slowly. My plan after the scan is complete is to do a sector
copy of the drive onto another HDD. I'll probably keep downloading and
trying various recovery programs until I find one that will work.
Click to expand...

A sector by sector clone was the first thing to do, not last. I doubt that a
clone of drive in its current state will have any value.
Most of the files that were corrupted are program files that can be
replaced. There are 4 data files that were damaged that I would really like
to be able to recover. If someone can offer some guidance on how to find
and retrieve these files on the drive, I would appreciate it. Does anyone
have any suggestions on what I should do next? Is there any program that
could help me retrieve my files?
Click to expand...

As Joep suggested, what you need is recovery software that looks for
recognizable headers. I wrote such program (RESQDATA) but it works on FAT/FAT32
partitions only. If the original cause to the file system corruption was
mapping (drive setting in the CMOS) then the location of your missing files
won't concur with the current pointers to the zero length files, as the current
mapping is different from the original one.

Good luck, Zvi
 
Back
Top