Data Recovery from lost NTFS. Help!

Cox · Mar 2, 2007

My wife's computer has a Maxtor 80 GB PATA Primary (IDE1) Master C: and a
Maxtor 200GB PATA Primary (IDE 1) Slave D:.

It's Using WinXP Pro on an AMD 1.1GHz processor. It's a Gateway Motherboard.

The 80 GB is used only for OS and Program Files. The 200GB has all her
documents and has lost it's NTFS. We only have a backup from four months ago
so all her hard work since then is lost.

Attached is a txt file from Event Viewer with two Critical Event Properties.
One is the Warning and the next is the failure. It gave us no warning. I
wonder what I could do in the future to get a warning before the drive gets
a critical error? Any thoughts on that?

Also attached is a jpg from Computer Management. You'll notice next to Drive
D: there is no NTFS and when I click on it in Windows Explorer it ask's if
we want to format the drive. Of course nothing has been done to it yet.

The only thing happening when this error occurred that I can think of is
that I was downloading many files using my favorite File Sharing program,
WinMX. Does that have anything to do with it?

Will the process be the same as a couple years ago when I lost a drives NTFS.
The group had me do a report with RESQDisk and post the results. I then had to
disconnect all drives except the one to fix.

Next, boot the computer from the XP setup CD, and press R when prompted to start
in repair mode.

From the repair console, run the command FIXBOOT and *nothing* else! This last
comment is aimed to deter those that may advise you to also run FIXMBR. Just
don't!

When done with FIXBOOT, shut down the PC, reconnect the drives, restart Windows,
and check if you can now access your files on the 160 GB drive.

The only problem I had here after doing these instructions if I remember
correctly, is that after the FIXBOOT was finished I think chkdisk started and
renamed all my files. Other than that it worked. How can I avoid renaming the
files or is there a better way?

Thanks
Gregg OBanion

Arno Wagner · Mar 2, 2007

Previously Cox said:
My wife's computer has a Maxtor 80 GB PATA Primary (IDE1) Master C: and a
Maxtor 200GB PATA Primary (IDE 1) Slave D:.

It's Using WinXP Pro on an AMD 1.1GHz processor. It's a Gateway Motherboard.

The 80 GB is used only for OS and Program Files. The 200GB has all her
documents and has lost it's NTFS. We only have a backup from four months ago
so all her hard work since then is lost.

Attached is

Ah, attachements do not work in newsgroups.

a txt file from Event Viewer with two Critical Event Properties.
One is the Warning and the next is the failure. It gave us no warning. I
wonder what I could do in the future to get a warning before the drive gets
a critical error? Any thoughts on that?

Not reliably. SMART monitoring helps, but according to some recent
research by Google, some 30% (or was it 70%) of failing drives
do not advertise the fact via SMART before. Your only reliable
protection is backup.

Also attached is a jpg from Computer Management. You'll notice next to Drive
D: there is no NTFS and when I click on it in Windows Explorer it ask's if
we want to format the drive. Of course nothing has been done to it yet.

The only thing happening when this error occurred that I can think of is
that I was downloading many files using my favorite File Sharing program,
WinMX. Does that have anything to do with it?

Depends on the error.

Will the process be the same as a couple years ago when I lost a
drives NTFS. The group had me do a report with RESQDisk and post
the results. I then had to disconnect all drives except the one to
fix.

Next, boot the computer from the XP setup CD, and press R when
prompted to start in repair mode.

From the repair console, run the command FIXBOOT and *nothing* else!
This last comment is aimed to deter those that may advise you to
also run FIXMBR. Just don't!

When done with FIXBOOT, shut down the PC, reconnect the drives,
restart Windows, and check if you can now access your files on the
160 GB drive.

The only problem I had here after doing these instructions if I
remember correctly, is that after the FIXBOOT was finished I think
chkdisk started and renamed all my files. Other than that it
worked. How can I avoid renaming the files or is there a better way?

If the drive hardware is fine, the first thing you do is make an
image-copy (sector-wise copy) of the whole drive to another one of
equal (careful, drive sizes vray by a few thousand sectors between
manufacturers and soemtime models) or larger size. Then work on
the image only, never on the original data! That way you can go
back and make a new copy in case you make a mistake. Changing data
on the original is strictly amateur level and should be avoided at
all cost! If thd drive is not fine, but you can copy it with some
difficulties make a copy of the first copy and work on that. HDDs
are cheap enough today, that there is no reason to risk everything
by a sloppy approach.

Arno

Rod Speed · Mar 2, 2007

Cox said:
My wife's computer has a Maxtor 80 GB PATA Primary (IDE1) Master C:
and a Maxtor 200GB PATA Primary (IDE 1) Slave D:.

It's Using WinXP Pro on an AMD 1.1GHz processor. It's a Gateway Motherboard.

The 80 GB is used only for OS and Program Files. The 200GB has all her documents and has lost it's
NTFS. We only have a backup from four months ago so all her hard work since then is lost.

Attached is a txt file from Event Viewer with two Critical Event Properties.

No it isnt, many news servers strip attachments from newsgroup posts.

One is the Warning and the next is the failure. It gave us no warning. I wonder what I could do
in the future to get a warning before the
drive gets a critical error? Any thoughts on that?

Only some faults give any warning of failure. So you need to backup.

Also attached is a jpg from Computer Management.

Fraid not.

You'll notice next to Drive D: there is no NTFS and when I click on it in Windows Explorer it
ask's if we want to format the drive. Of course nothing has been done to it yet.

You may well be able to boot a knoppix CD and manually
copy what has been changed since the last backup.

Thats not necessarily that easy if the C: drive is NTFS formatted too
since knoppix can only read NTFS formatted drives, not write to them.

The only thing happening when this error occurred that I can think of is that I was downloading
many files using my favorite File Sharing program, WinMX. Does that have anything to do with it?
Nope.

Will the process be the same as a couple years ago when I lost a
drives NTFS. The group had me do a report with RESQDisk and post the results. I then had to
disconnect all drives except the one to fix.

Next, boot the computer from the XP setup CD, and press R when prompted to start in repair mode.

From the repair console, run the command FIXBOOT and *nothing* else! This last comment is aimed to
deter those that may advise you to also
run FIXMBR. Just don't!

When done with FIXBOOT, shut down the PC, reconnect the drives,
restart Windows, and check if you can now access your files on the
160 GB drive.

Thats only useful if the problem is with the boot
drive. Your problem is with the data drive.

The only problem I had here after doing these instructions if I
remember correctly, is that after the FIXBOOT was finished I think
chkdisk started and renamed all my files. Other than that it worked.
How can I avoid renaming the files or is there a better way?

Yes, with a data drive, you may well be able to use
a knoppix CD to get the data you need off that drive.

One of the recovery programs should work too if the only
problem is that the NTFS files structures have got stomped on.

I like Easy Recovery Pro, but it isnt cheap if you have to pay for it.

Gregg · Mar 3, 2007

Thanks for your responses. It is very helpful and I will try your solutions
tomarrow and report back here. Thanks again, Gregg

My wife's computer has a Maxtor 80 GB PATA Primary (IDE1) Master C:
and a Maxtor 200GB PATA Primary (IDE 1) Slave D:.

It's Using WinXP Pro on an AMD 1.1GHz processor. It's a Gateway
Motherboard.
The 80 GB is used only for OS and Program Files. The 200GB has all her
documents and has lost it's NTFS. We only have a backup from four
months ago so all her hard work since then is lost.

Attached is a txt file from Event Viewer with two Critical Event
Properties. One is the Warning and the next is the failure.

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 2/27/2007
Time: 8:43:38 PM
User: N/A
Computer: AMD1GHZ
Description:
The file system structure on the disk is corrupt and unusable. Please run the
chkdsk utility on the volume D:.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..À
0010: 00 00 00 00 32 00 00 c0 ....2..À
0018: 18 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

----------------------------------------------------------------------

Event Type: Warning
Event Source: Disk
Event Category: None
Event ID: 51
Date: 2/27/2007
Time: 2:26:47 PM
User: N/A
Computer: AMD1GHZ
Description:
An error was detected on device \Device\Harddisk1\D during a paging operation.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 33 00 04 80 ....3..?
0010: 2d 01 00 00 15 00 00 c0 -......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 fe ff ff 1f 00 00 00 .þÿÿ....
0028: d8 ea 73 01 00 00 00 00 Øês.....
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 01 00 @..?....
0040: 00 20 0a 12 80 03 20 40 . ..?. @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 e8 6e b5 82 ....ènµ?
0058: 00 00 00 00 00 97 b5 82 .....?µ?
0060: 02 00 00 00 ff ff ff 0f ....ÿÿÿ.
0068: 2a 00 0f ff ff ff 00 00 *..ÿÿÿ..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 05 00 00 00 00 0b ð.......
0080: 00 00 00 00 21 00 00 00 ....!...
0088: 00 00 00 00 00 00 00 00 ........

Data Recovery from lost NTFS. Help!

Cox

Arno Wagner

Rod Speed

Gregg