my C drive on DELL winXP seems to be hosed

  • Thread starter Thread starter sid
  • Start date Start date
S

sid

my C drive on DELL WinXP machine went belly up. It won't boot with
error message "corrupt hal.dll" or some such thing. Went to windows
repair recovery console - can't even get directory listing of drive.
"error in directory enumeration". Tried chkdsk -p, it gave up 30% in
with unrecoverable errors.


Downloaded knoppix and inserted that cd and booted up. I can see all my
folders but "my documents" is locked up (I must have accidentally
protected it in windows). This folder is listed as ?----- in 'ls -l'
while others appear as 'drwxrwxrwx'. I can see other users' "my
documents". Also I see that this drive is full - don't know how this
happened as I had a good chunk of the 30GB drive as unused. I couldn't
mount this drive read/write in linux and hence I tried another
strategy.

I downloaded Ultimate Boot CD for windows and booted off of it. It can
see my second driver as valid NTFS but for C: it says (unrecognized). I
then used testDisk utility and it saw the two partitions on primary
drive. a 30Mb FAT16 that has DELL utilities and the remaining ~28Gb
NTFS. I then used the "Write" option to write what it found to back to
disk. I then restarted UBCD. Now it finds the FAT16 and assigns letter
C to it and then the second NTFS partition appears as F:(unrecognized).
This has all my files. I tried the testDisk repair a couple of more
times - no luck. While in testDisk I can list the files in several
folders and they all look fine and when it came to "my documents" it
hangs on those protected files. I would appreciate any help copying
those files to the second NTFS drive.

thanks
SS
 
I downloaded resqdisk and ran resqdisk /NTFS /ASSESS. I am enclosing
the results. Perhaps Mr Zvi Netiv or someone else can advice on how to
proceed. This drive is supposed to have a 30MB FAT16 and ~28GB NTFS
which used to be my C: drive. Can I now do a resqdisk /REBUILD?
thanks
SS

3 June 2005 21:05
Evaluation Copy *************************************** CHS mode
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
CHS address: Cyl 0 Head 0 Sector 1
*********
*********************** Setup Diagnostics
************************
* Disk Type: WDC WD300BB-75DEA0
*
* BIOS/CHS IDE/LBA data
*
* Number of Heads: 255 16
*
* Number of Cylinders: 1024 58128
*
* Sectors per Track: 63 63
*
* Disk Capacity in Mbytes: 8032 28610
*
* IDE Access Time: 14 msec
*
* Total sectors on drive: 58593750
*
******* Use Space to toggle between IDE and Ext.BIOS mode
********
Disk 1, Master Partition Sector, F6 for Layout






3 June 2005 21:05
Evaluation Copy *************************************** CHS mode
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
CHS address: Cyl 0 Head 0 Sector 1

******************** Partition Table Layout
**********************
*
*
* Partition Starting Ending Reserved Total
*
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors Sectors
*
* 222 1 0 1 254 3 63 63 64197
*
* Yes 7 0 4 1 254 1023 63 64260 58508730
*
* 0 0 0 0 0 0 0 0 0
*
* 0 0 0 0 0 0 0 0 0
*
*
*
******* Press Alt+B to see as boot sector, Alt+M to edit
*********
Disk 1, Master Partition Sector, F6 for Layout






3 June 2005 21:05
Evaluation Copy *************************************** CHS mode
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
CHS address: Cyl 0 Head 1 Sector 1

******************** Boot Sector Data FAT-16
*********************
*
*
* Sectors per Cluster: 4
*
* Number of Heads: 255
*
* Sectors in Partition: 64197
*
* Sectors per FAT Copy: 63
*
* Hidden Sectors: 63
*
* Capacity in Kilobytes: 32868
*
*
*
********** Press Alt+P to analyze as partition sector
************
Disk 1, Master Partition Sector, F6 for Layout






3 June 2005 21:05
Evaluation Copy *************************************** CHS mode
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
CHS address: Cyl 4 Head 0 Sector 1

******************** Partition Table Layout
**********************
*
*
* Partition Starting Ending Reserved Total
*
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors Sectors
*
* 114 111 368 45 101 371 51 218129509
1701990410
* 116 115 67 32 114 299 44 729050177
543974724*
* 101 111 114 32 115 353 52 168653938 0
*
* 0 0 0 0 0 0 0 -16020275251635
*
*
*

******************************************************************

Disk 1, Master Partition Sector, F6 for Layout






3 June 2005 21:05
Evaluation Copy *************************************** Extended
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * OFF
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
Checking cylinder 0 for FAT pair


******************************************************************

* Press Space to pause, Esc to stop searching
*
* --------------------------------------------------------------
*
* First FAT-16 copy starts on sector 64, Cyl 0
*
* Second FAT-16 copy starts on sector 127, Cyl 0
*
* Sectors per FAT copy: 63
*
*
*
*
*
*
*

******************************************************************

Searching for existing FAT partitions on drive 1






3 June 2005 21:05
Evaluation Copy *************************************** Extended
NTFS
******************* * R e s Q d i s k 576 *
********************
* Hard Disk Rescue and Recovery *

Disk 1 * * Copyright (c) '90-04 NetZ Computing *
SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * OFF
F9 *
********* ***************************************
*********
* Drive *
AltHelp *
*********
*********
^2:
NTFS *
CHS address: Cyl 4 Head 0 Sector 1

******************* NTFS Boot Sector Analysis
********************
*
*
* Sectors per Cluster: 8
*
* Number of Heads: 255
*
* Total Sectors in Partition: 58508729
*
* MFT Relative Cluster: 786432
*
* MFT mirror Relative Cluster: 3656795
*
* Kilobytes in NTFS partition: 29956096
*
*
*

******************************************************************
 
sid said:
I downloaded resqdisk and ran resqdisk /NTFS /ASSESS. I am enclosing
the results. Perhaps Mr Zvi Netiv or someone else can advice on how to
proceed. This drive is supposed to have a 30MB FAT16 and ~28GB NTFS
which used to be my C: drive. Can I now do a resqdisk /REBUILD?

I wouldn't, because the problem doesn't seem to be in the MBR. BTW, it would
have been nice if you edited your post by either not using word wrap on the
report pasted section, or by weeding out the broken lines, like I did below.
3 June 2005 21:05
Evaluation Copy *************************************** CHS mode NTFS
******************* * R e s Q d i s k 576 *
* Hard Disk Rescue and Recovery *
Disk 1 * * Copyright (c) '90-04 NetZ Computing * SeeThru *
ExtBIOS * * Virus Control, Disk & Data Recovery * ON F9 *
********* ***************************************
CHS address: Cyl 0 Head 0 Sector 1
*********************** Setup Diagnostics
* Disk Type: WDC WD300BB-75DEA0
* Number of Heads: 255 16
* Number of Cylinders: 1024 58128
* Sectors per Track: 63 63
* Disk Capacity in Mbytes: 8032 28610
* IDE Access Time: 14 msec
* Total sectors on drive: 58593750
******* Use Space to toggle between IDE and Ext.BIOS mode
Disk 1, Master Partition Sector, F6 for Layout

From the above, the IDE channel works OK and the drive settings in the BIOS seem
alright.
CHS address: Cyl 0 Head 0 Sector 1
******************** Partition Table Layout
* Partition Starting Ending Reserved Total
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors Sectors
* 222 1 0 1 254 3 63 63 64197
* Yes 7 0 4 1 254 1023 63 64260 58508730
* 0 0 0 0 0 0 0 0 0
* 0 0 0 0 0 0 0 0 0
*
******* Press Alt+B to see as boot sector, Alt+M to edit

The partition table seems to be OK and conforms the two partitions mentioned
above. I don't know what is a type 222 partition, but I suppose it's a Dell
proprietary type, that contains their setup tools, diagnostics and utilities.
Similar to the type 18 partition that Compaq used on theirs.
CHS address: Cyl 0 Head 1 Sector 1
******************** Boot Sector Data FAT-16
* Sectors per Cluster: 4
* Number of Heads: 255
* Sectors in Partition: 64197
* Sectors per FAT Copy: 63
* Hidden Sectors: 63
* Capacity in Kilobytes: 32868
*
********** Press Alt+P to analyze as partition sector
Disk 1, Master Partition Sector, F6 for Layout

It's good.
CHS address: Cyl 4 Head 0 Sector 1
******************** Partition Table Layout
* Partition Starting Ending Reserved Total
* Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors Sectors
* 114 111 368 45 101 371 51 218129509 1701990410
* 116 115 67 32 114 299 44 729050177 543974724*
* 101 111 114 32 115 353 52 168653938 0
* 0 0 0 0 0 0 0 -16020275251635
****************************************************************

That's crap, because it's actually a boot sector and shouldn't be analyzed as a
partition one. Corrected in the next snapshot.
CHS address: Cyl 4 Head 0 Sector 1
******************* NTFS Boot Sector Analysis
* Sectors per Cluster: 8
* Number of Heads: 255
* Total Sectors in Partition: 58508729
* MFT Relative Cluster: 786432
* MFT mirror Relative Cluster: 3656795
* Kilobytes in NTFS partition: 29956096
******************************************************************
Good.

Checking cylinder 0 for FAT pair
******************************************************************
* Press Space to pause, Esc to stop searching
* --------------------------------------------------------------
* First FAT-16 copy starts on sector 64, Cyl 0
* Second FAT-16 copy starts on sector 127, Cyl 0
* Sectors per FAT copy: 63
******************************************************************
Searching for existing FAT partitions on drive 1

Good as well.

Apparently your problem is file system corruption, that was worsened by running
CHKDSK. Your best shot now is data recovery software.

Regards, Zvi
 
would you reccommened one for me? Will such a recovery software
preserve folder hierarchy so I know which ones I want to recover? thanks
 
sid said:
would you reccommened one for me? Will such a recovery software
preserve folder hierarchy so I know which ones I want to recover? thanks

There are a few available on the web. Run the free demo version first, of the
product of your choice, to get an idea what the product is capable of.

Note that not every file that shows in the recovery preview pane can really be
recovered.

Regards, Zvi
 
I don't understand why windows isn't able to see logical drives on this
disk when utilities like the above and testDisk can see the two
partitions clearly. File system corruption can lead to not being able
tgo access some files but I don't understand how it led to logical
drive info being lost to windows. In fact the only way I can see folder
info (so far) has been in linux. I am wondering if I could something
like dd to image the drive in linux (except for those pesky protected
files).
 
sid said:
I don't understand why windows isn't able to see logical drives on this
disk when utilities like the above and testDisk can see the two
partitions clearly. File system corruption can lead to not being able
tgo access some files but I don't understand how it led to logical
drive info being lost to windows. In fact the only way I can see folder
info (so far) has been in linux. I am wondering if I could something
like dd to image the drive in linux (except for those pesky protected
files).

Take a look at www.winternals.com, maybe one of their tools can help you. They
are far from being cheap, but cost less than professional data recovery.

Regards, Zvi
 
I don't understand why windows isn't able to see logical drives on this
disk when utilities like the above and testDisk can see the two
partitions clearly. File system corruption can lead to not being able
tgo access some files but I don't understand how it led to logical
drive info being lost to windows.

The point of not mounting a corrupt volume is to protect the file
system from further damage.
In fact the only way I can see folder
info (so far) has been in linux. I am wondering if I could something
like dd to image the drive in linux (except for those pesky protected
files).

You might try this: http://ntfs/filerecovery.biz

Try the free demo (license is $19.95) and see if it is able to read
the file system (depends on just how corrupt it actually is). It it
can, it probably will be able to see and recover your "protected"
files. Limitation: being a DOS app it requires a FAT partition for a
file copying destination.

Bob
 
thanks. One of the blurbs in user guide reads
"Failing hard drives on which disk read errors are occurring must be
cloned to good media before using NTFS Browser For DOS". This puts me
back to square one. Is there a cloning program that operates on
protected files. If I can accomplsh that, why would I need something
like this tool?
 
thanks. One of the blurbs in user guide reads
"Failing hard drives on which disk read errors are occurring must be
cloned to good media before using NTFS Browser For DOS". This puts me
back to square one. Is there a cloning program that operates on
protected files. If I can accomplsh that, why would I need something
like this tool?

I didn't notice in the thread that this drive was failing, or did I
miss a post? "Read errors" means physical errors not logical ones.

Bob
 
While generating report under resqdisk it spent a lot of time in some
sectors of disk. In testDisk, it is spending increasingly more and more
time looking for logical drives - hence my feeling is that this disk is
failing. The more I probe it (even in read only mode) the slower it is
getting.
 
While generating report under resqdisk it spent a lot of time in some
sectors of disk. In testDisk, it is spending increasingly more and more
time looking for logical drives - hence my feeling is that this disk is
failing. The more I probe it (even in read only mode) the slower it is
getting.

Make sure drive does not run too long/hot.
Otherwise you will kill it for good.
 
While generating report under resqdisk it spent a lot of time in some
sectors of disk. In testDisk, it is spending increasingly more and more
time looking for logical drives - hence my feeling is that this disk is
failing. The more I probe it (even in read only mode) the slower it is
getting.

OK. I would recommend cloning the disk, then, to prevent further
damage. Clonedisk is a good DOS-based cloner available from Zvi at
http://www.invircible.com. $25.00, IIRC.

Then you can try recovering your files from the clone copy.

Bob
 
I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions:
Backup partition table, Restore partition table, Rebuild
partition table, undelete partition, Fix boot sector,
rebuild mbr,etc.

First thing I recommend you download the demo version of
Partition Table Doctor.( http://www.ptdd.com/download.htm )

Run the program and right click the partition and choose fixboot.
http://www.ptdd.com/fixboot.htm
 
sid said:
While generating report under resqdisk it spent a lot of time in some
sectors of disk. In testDisk, it is spending increasingly more and more
time looking for logical drives - hence my feeling is that this disk is
failing. The more I probe it (even in read only mode) the slower it is
getting.

The symptoms you describe are clear sign that the drive is dying and extensive
testing of such drive is a bad idea as you are running out of time and may end
with a dead drive and no data at all. The first thing you should have done is
to clone the drive, and work on the clone.

When done immediately, on the appearance of the first signs as described, then
cloning could be all that was needed to solve the problem!

The important thing now is to power down the drive and not use it until ready
for cloning. The next time you power it up should be for the actual cloning!

The CloneDisk application is available from http://resq.co.il/resq.php. As Bob
stated, the registration is $25.

Regards, Zvi
 
thanks
Jus saw your reply. Is there a documentation link for this product so I
can read up on it. (in terms of how I preopare the floppy and how I use
it - unfortunately the only floppy drive I have is on this failed
desktop). I have a second much larger hard drive on this PC where I
have restored some folders and it contains some other data as well. If
I use this cloner, will it try to format that disk so it looks like the
C drive before continuing with cloning - in which case I need to find a
way to burn its contents onto DVD/CD.
 
sid said:
thanks
Jus saw your reply. Is there a documentation link for this product so I
can read up on it. (in terms of how I preopare the floppy and how I use
it - unfortunately the only floppy drive I have is on this failed
desktop).

Read clonedsk.txt contained in www.resq.co.il/download/clonedsk.exe (today's
upload).
I have a second much larger hard drive on this PC where I
have restored some folders and it contains some other data as well. If
I use this cloner, will it try to format that disk so it looks like the
C drive before continuing with cloning - in which case I need to find a
way to burn its contents onto DVD/CD.

Maybe you didn't understand what Bob told you: "Then you can try recovering
your files from the clone copy". Unlike imaging applications with which you
seem to be familiar, CloneDisk is a forensics quality cloner that duplicates
every bit of the source drive on the destination drive, including erased and
lost data. You'll need an entire drive to clone onto, of equal or larger size
than the bad one, and in perfect condition (no single bad sector is allowed on
the destination drive). You are still a long way from burning DVD/CDs, as you
first need recovering data from the CLONE. You'll be lucky if you didn't
already miss the opportunity to recover your data, with the excessive testing.

Regards, Zvi
 
Back
Top