Disappearing harddrive (NTFS)

  • Thread starter Thread starter ]v[etaphoid
  • Start date Start date
V

]v[etaphoid

I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management). I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data. They can see the
drive, but are unable to find and files to salvage, suggesting it may be
physically damaged or have damaged sectors.

Can anyone suggest any other software which may have more luck recovering
data from the drive. Would I likely have any more success after low-level
formatting the drive and then scanning for lost files. Reasoning being that
I've already lost the index for what's on the drive, and at least formatting
might work around any damaged sectors. Any ideas?

Thanks.
 
]v[etaphoid said:
I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management). I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data.
Click to expand...

Why should they?
They can see the
drive, but are unable to find and files to salvage, suggesting it may be
physically damaged or have damaged sectors.
Click to expand...

Why do you think so? Did you run any diagnostics on the drive to reach that
conclusion?
Can anyone suggest any other software which may have more luck recovering
data from the drive.
Click to expand...

What you need isn't more software, but a clue on what you are doing!
Would I likely have any more success after low-level
formatting the drive and then scanning for lost files.
Click to expand...

Where from do you take such stupid idea?
Reasoning being that
I've already lost the index for what's on the drive, and at least formatting
might work around any damaged sectors. Any ideas?
Click to expand...

NTFS places the MFT mirror right in the middle of the partition. The mirror
copy of the boot sector is at the end of the partition, in its last sector.
Rebuilding the MBR is just ten seconds.

Zvi
 
Zvi Netiv said:
]v[etaphoid said:
I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management). I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data.
Click to expand...

Why should they?
Click to expand...

Call me crazy, but I reasoned that data recovery software might be a good
starting point to recover data.
Why do you think so? Did you run any diagnostics on the drive to reach that
conclusion?
Click to expand...

That was the diagnosis from the aforementioned data recovery software.
What you need isn't more software, but a clue on what you are doing!
Click to expand...

And clearly that's unlikely to be provided by someone as angry at the world
as yourself.
Where from do you take such stupid idea?
Click to expand...

I was theorising that if the MBR had been erased beyond repair, formatting
the drive might at least allow me to search for the orphaned NTFS files,
rather than performing what has thus far been a fruitless RAW search. Of
course, in my haste to seek informed opinions on the subject, I mistakenly
suggested a low-level format may be appropriate. I did of course mean a
high-level or "Quick" format that would preserve the contents if not the
index of my files. Not that it would have likely made any difference to you.
NTFS places the MFT mirror right in the middle of the partition. The mirror
copy of the boot sector is at the end of the partition, in its last sector.
Rebuilding the MBR is just ten seconds.
Click to expand...

Thank you for this first piece of constructive information. Clearly you do
know something of the nature of harddrive operation. Now if only you could
combine that with an incling of normal human behaviour instead of getting
angry at usenet posts and looking down your crooked nose at those of us who
are more fully conversant with human interaction than the mechanical
operation of our hard-drives, you could form an altogether more valued
member of the species.

Thank you.
 
]v[etaphoid said:
I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management).
Click to expand...

DiskManagement doesn't even see the PHYSICAL drive?
I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data. They can see the
drive, but are unable to find and files to salvage, suggesting it may be
physically damaged or have damaged sectors.
Click to expand...

If DiskManagement doesn't see the Physical drive then the Windows versions
of EasyRecovery and GetDataBack won't either as they rely on Windows API
calls to actually access the drive.
Can anyone suggest any other software which may have more luck recovering
data from the drive. Would I likely have any more success after low-level
formatting the drive and then scanning for lost files.
Click to expand...

No, no low level formatting please! Low level formatting implies ALL data
will be overwritten!
Reasoning being that
I've already lost the index for what's on the drive, and at least formatting
might work around any damaged sectors. Any ideas?
Click to expand...

Well, I still don't get if the Physcical disk isn't detected or that the
partitions/volumes are 'gone'. First step would be to confirm or deny
physical damage - the diagnostic tools from the drive manufacturer are a
good starting point.

* If the physical drive is there but the partitions/volumes aren't: -
Rebuilding the partition table may be all that is required. Our tool
DiskPatch is often able to do so.

* If the physical drive isn't there: - can you 'see' the physical drive from
DOS (for example fdisk/status)?

If you find evidence for physical damage you may try to clone the drive to a
good one and attempt to repair damage on the clone or use EasyRecovery /
GetDataBack to recover data from the clone. Our tool DiskPatch can be used
to clone a disk, DiskPatch can deal with unreadable sectors on the source
drive.

Kind regards,
Joep
--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
 
]v[etaphoid said:
NTFS places the MFT mirror right in the middle of the partition. The
Click to expand...
mirror
Click to expand...

Hmm ... there always seem to be quite some confusion and rumours about NTFS
placing *something* in the middle, I have examined this and found the
following:

NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
the middle of the partition. For newer NTFS versions formatted with WinNT 4
and up (including 2000 and XP) I have never been able to find any default
behavior that writes anything holding 'meta information' including the MFT,
the MFT mirror, backup boot sector etc., to the middle of the partition.
Thank you for this first piece of constructive information. Clearly you do
know something of the nature of harddrive operation. Now if only you could
combine that with an incling of normal human behaviour instead of getting
angry at usenet posts and looking down your crooked nose at those of us who
are more fully conversant with human interaction than the mechanical
operation of our hard-drives, you could form an altogether more valued
member of the species.
Click to expand...

Well, to be honest, I felt some frustration as well because of your post, as
you make some *stupid* suggestions yourself. 'Low level formatting' being
the one that got my adrenaline going ... ;-) ... indeed this is more
something that I need 'working on'.

Kind regards,
Joep
 
Joep said:
]v[etaphoid said:
I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management).
Click to expand...

DiskManagement doesn't even see the PHYSICAL drive?
Click to expand...

Nope. Lists Disk 0 and then Disk 2, in addition to the optical drives.
If DiskManagement doesn't see the Physical drive then the Windows versions
of EasyRecovery and GetDataBack won't either as they rely on Windows API
calls to actually access the drive.
Click to expand...

Both claim to be able to retrieve data from drives which Windows doesn't
recognise, and both did at least manage to see the drive, if not the
partition on it. That said, as you suggest I've found little success with
either actually retrieving any data.
No, no low level formatting please! Low level formatting implies ALL data
will be overwritten!
Click to expand...

Sorry, I realised that mistake after I posted it. As I mentioned in an
earlier post, what I meant was to say was a Quick format - basically the
exact opposite of a low-level format!
Well, I still don't get if the Physcical disk isn't detected or that the
partitions/volumes are 'gone'. First step would be to confirm or deny
physical damage - the diagnostic tools from the drive manufacturer are a
good starting point.

* If the physical drive is there but the partitions/volumes aren't: -
Rebuilding the partition table may be all that is required. Our tool
DiskPatch is often able to do so.
Click to expand...

Seems like the most likely scenario, although I haven't confirmed this via
any WD diagnostics. But the fact that is recognised in BIOS and during POST,
but not Windows gives some hope, as does it's appearance as an
"Unrecognised" drive on EasyRecovery Pro.
* If the physical drive isn't there: - can you 'see' the physical drive from
DOS (for example fdisk/status)?

If you find evidence for physical damage you may try to clone the drive to a
good one and attempt to repair damage on the clone or use EasyRecovery /
GetDataBack to recover data from the clone. Our tool DiskPatch can be used
to clone a disk, DiskPatch can deal with unreadable sectors on the source
drive.

Kind regards,
Joep
Click to expand...

Thanks for all the advice, it is much appreciated. I'm just about to run a
couple of checks using the Recovery Console (still foolishly hoping it's
just a damaged boot sector or MBR), and depending on how that turns out, I
might try some of your suggestions.

Cheers.
 
Joep said:
]v[etaphoid said:
NTFS places the MFT mirror right in the middle of the partition. The
Click to expand...
mirror
Click to expand...

Hmm ... there always seem to be quite some confusion and rumours about NTFS
placing *something* in the middle, I have examined this and found the
following:

NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
the middle of the partition. For newer NTFS versions formatted with WinNT 4
and up (including 2000 and XP) I have never been able to find any default
behavior that writes anything holding 'meta information' including the MFT,
the MFT mirror, backup boot sector etc., to the middle of the partition.
Thank you for this first piece of constructive information. Clearly you do
know something of the nature of harddrive operation. Now if only you could
combine that with an incling of normal human behaviour instead of getting
angry at usenet posts and looking down your crooked nose at those of us who
are more fully conversant with human interaction than the mechanical
operation of our hard-drives, you could form an altogether more valued
member of the species.
Click to expand...

Well, to be honest, I felt some frustration as well because of your post, as
you make some *stupid* suggestions yourself. 'Low level formatting' being
the one that got my adrenaline going ... ;-) ... indeed this is more
something that I need 'working on'.
Click to expand...

I don't claim to be an expert on the subject, and save for the "low-level
format" error which I've already explained twice, I don't know what else
would constitute a stupid suggestion. I'm open to any suggestions and was
just trying to offer as much information and observations as possible.

Thanks to all who've helped out so far.
 
Joep said:
* If the physical drive is there but the partitions/volumes aren't: -
Rebuilding the partition table may be all that is required. Our tool
DiskPatch is often able to do so.

* If the physical drive isn't there: - can you 'see' the physical drive from
DOS (for example fdisk/status)?

If you find evidence for physical damage you may try to clone the drive to a
good one and attempt to repair damage on the clone or use EasyRecovery /
GetDataBack to recover data from the clone. Our tool DiskPatch can be used
to clone a disk, DiskPatch can deal with unreadable sectors on the source
drive.
Click to expand...

Joep,

I downloaded the trial version of DiskPatch and gave it a try. Here were the
results:

If I ran it with the faulty drive attached as the only drive as master on
IDE0, the program would get as far as the welcome screen. Hitting any key
kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"

When the faulty drive was attached as the slave drive on IDE0, the program
booted fine, initially set to view the master drive at drive0. After
changing the selected drive to drive1, I started to get a few errors,
although it did manage to read the MBR. However, it warned me that it was
unable to go any further as it would be risking further physical damage, and
recommended I do a surface scan. The surface scan quickly yielded over 255
errors, at which point it ceased the scan.

At one stage, the error was reported: Int13h_error_trap: extended int13h
error @ dskpatch.pcb.

I could not attempt to repair the MBR, as I was only using your trial
version.

I am willing to purchase the full version if it will either let me repair
the MBR so that I can extract as many files as possible from the faulty
drive, or create an image of it on another drive, from which I could copy
salvaged files. In your opinion, does it sound like this would be possible
using your software?

Any other advice you can offer is appreciated.

Thanks.
 
Microsoft claims WinXP puts the MFT at the 3GB mark. Did you test with large
partitions?

|
| NTFS partitions formatted with WinNT 3.x do keep the backup boot sector in
| the middle of the partition. For newer NTFS versions formatted with WinNT 4
| and up (including 2000 and XP) I have never been able to find any default
| behavior that writes anything holding 'meta information' including the MFT,
| the MFT mirror, backup boot sector etc., to the middle of the partition.
|
 
]v[etaphoid said:
I downloaded the trial version of DiskPatch and gave it a try. Here were the
results:

If I ran it with the faulty drive attached as the only drive as master on
IDE0, the program would get as far as the welcome screen. Hitting any key
kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"
Click to expand...

That's a bad sign ... :-(
When the faulty drive was attached as the slave drive on IDE0, the program
booted fine, initially set to view the master drive at drive0. After
changing the selected drive to drive1, I started to get a few errors,
although it did manage to read the MBR. However, it warned me that it was
unable to go any further as it would be risking further physical damage, and
recommended I do a surface scan. The surface scan quickly yielded over 255
errors, at which point it ceased the scan.
Click to expand...

Again, a bad sign. For whatever reason it's not able to read sectors.
I could not attempt to repair the MBR, as I was only using your trial
version.
Click to expand...

Yes, but I'm afraid that it is going to be difficult anyway, it seems
there's trouble reading the disk, writing to it it very unlikely.
I am willing to purchase the full version if it will either let me repair
the MBR so that I can extract as many files as possible from the faulty
drive, or create an image of it on another drive, from which I could copy
salvaged files. In your opinion, does it sound like this would be possible
using your software?

Any other advice you can offer is appreciated.
Click to expand...

I'd now really try the drive manufacturers diagnostic utility to see what it
has to say about that drive first.
 
NOYB said:
]v[etaphoid said:
I downloaded the trial version of DiskPatch and gave it a try. Here were the
results:

If I ran it with the faulty drive attached as the only drive as master on
IDE0, the program would get as far as the welcome screen. Hitting any key
kicked me to DOS, with the error: "Error 5 at pgm.ctr: 278351"
Click to expand...

That's a bad sign ... :-(
When the faulty drive was attached as the slave drive on IDE0, the program
booted fine, initially set to view the master drive at drive0. After
changing the selected drive to drive1, I started to get a few errors,
although it did manage to read the MBR. However, it warned me that it was
unable to go any further as it would be risking further physical damage, and
recommended I do a surface scan. The surface scan quickly yielded over 255
errors, at which point it ceased the scan.
Click to expand...

Again, a bad sign. For whatever reason it's not able to read sectors.
I could not attempt to repair the MBR, as I was only using your trial
version.
Click to expand...

Yes, but I'm afraid that it is going to be difficult anyway, it seems
there's trouble reading the disk, writing to it it very unlikely.
I am willing to purchase the full version if it will either let me repair
the MBR so that I can extract as many files as possible from the faulty
drive, or create an image of it on another drive, from which I could copy
salvaged files. In your opinion, does it sound like this would be possible
using your software?

Any other advice you can offer is appreciated.
Click to expand...

I'd now really try the drive manufacturers diagnostic utility to see what it
has to say about that drive first.
Click to expand...

Sorry, I forgot to mention I'd done that in the interim. It falls down at
the first hurdle, reporting "Cable Fault". However, the details it sends for
the online check, report:

TEST FAILED!
The Data Lifeguard Diagnostics utility has determined that your hard drive
is not functioning properly.
a.. The diagnostic code for this error is 0199. Please make sure to use
this code to initiate product replacement by using our Product Replacement
online service.
b.. Back up your Data files imediately.
 
I've got a 80Gb WD Harddrive which has disappeared from Windows XP. It shows
up in BIOS, but not in Windows. It is viewable in Device Manager, but
there's no sign of it in Disk Management (Administrative Tools -> Computer
Management). I've tried Easy Recovery Pro and the trial version of
GetDataBack for NTFS, but neither seem to salvage any data. They can see the
drive, but are unable to find and files to salvage, suggesting it may be
physically damaged or have damaged sectors.

Can anyone suggest any other software which may have more luck recovering
data from the drive. Would I likely have any more success after low-level
formatting the drive and then scanning for lost files. Reasoning being that
I've already lost the index for what's on the drive, and at least formatting
might work around any damaged sectors. Any ideas?

Thanks.
Click to expand...

Is this a system drive or a slave drive?
 
]v[etaphoid said:
Sorry, I forgot to mention I'd done that in the interim. It falls down at
the first hurdle, reporting "Cable Fault". However, the details it sends for
the online check, report:
Click to expand...

Still, did you actually exclude the possibilty for a cable failure?!
TEST FAILED!
The Data Lifeguard Diagnostics utility has determined that your hard drive
is not functioning properly.
a.. The diagnostic code for this error is 0199. Please make sure to use
this code to initiate product replacement by using our Product Replacement
online service.
Click to expand...

I have never used this tool, it appears to be a standard message in case an
error is encountered, the only variable may be the error number.
b.. Back up your Data files imediately.
Click to expand...

I again suspect this message will appear if an error is reported.

It has no use seeking advice if you *not* first 'rule out' clear hints given
by the diagnostic software you used. Please if the software states a cable
error, check that cable (replace it) and include results of that test in
your reply!

Joep - http://www.diydatarecovery.nl
 
NOYB said:
I have never used this tool, it appears to be a standard message in case an
error is encountered, the only variable may be the error number.
Click to expand...

Aye, it (0199) was just a generic error code which gave no specific
information regarding the likely fault.
I again suspect this message will appear if an error is reported.

It has no use seeking advice if you *not* first 'rule out' clear hints given
by the diagnostic software you used. Please if the software states a cable
error, check that cable (replace it) and include results of that test in
your reply!
Click to expand...

Naturally, I removed the possibility of power/IDE cable failure prior to
embarking on the subsequent laborious diagnostic and salvage operation. I
can confirm that it is definately not a simple case of a faulty cable. Sorry
for not making this clear earlier.

Anyone got any last recommendations before I convert my drive into a door
stop?
 
Joep said:
For newer NTFS versions formatted with WinNT 4
and up (including 2000 and XP) I have never been able to find any default
behavior that writes anything holding 'meta information' including the MFT,
the MFT mirror, backup boot sector etc., to the middle of the partition.
Click to expand...

If you run a defrag on Win2k/NTFS, on the graphical viewer there is a
large contiguous chunk of green right in the middle of the partition.
I'd assumed that was the MFT. Is it? (It can't be the swapfile, as
that's on another drive.)
 
Mike Tomlinson said:
If you run a defrag on Win2k/NTFS, on the graphical viewer there is a
large contiguous chunk of green right in the middle of the partition.
I'd assumed that was the MFT. Is it? (It can't be the swapfile, as
that's on another drive.)
Click to expand...

Dunno? How large is the partition? Can it be related to the 3 Gb mark Eric
mentioned?

Is a system drive or data drive? I have a couple of NTFS data partitions on
this machine, and there I don't see this. When getting some more details
with O&O defrag, I can even clearly see that the MFT (reserved area) is not
in the middle.

Without having to rely on graphical scales, partinfo from powerquest gets
the posittion (in clusters) of the MFT by reading the boot sector.

 
Back
Top