Recovering data from NTFS HD with lost partion table/info

  • Thread starter Thread starter Ken1
  • Start date Start date
K

Ken1

I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.

I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
to copy/recover the data to a new disk. With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
The program also says Filesystem type is: Not known so far
during that time, even it it earlier found the partion info
when scanning.

When using OnTrack EasyRecovery the program starts and displaying
the filenames/directory it finds and increases the block
count but after a couple of minutes it stops at the same block number
every time I run it (#3840) and the disk sound stops which was
was heard up till this block number. And it does not continue to
even if I wait a very long time.

Is there any possibly to copy the information over to a new
hard drive in any way, which ignore corrupt block, so I can
revover most of the files?

/Kenneth
 
Run your disk's diagnostics first, to see how damaged the disk is.
Click to expand...


Download and burn a Knoppix CD (www.linuxiso.org). Boot it.
It tries to mount all your NTFS/FAT32 partitions, by default.

If it does mount your disk you stand a chance of copying the files to
another disk if you put one in the system. Probably best if you
pre-format the disk (fat32. Linux can't write to NTFS, yet.) (you
have to screw around a little to mount the new disk as writable. Ask
in one of the Linux groups.)

I've used Knoppix to recover data from crashed systems several times.
 
Ken1 said:
I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.

I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
to copy/recover the data to a new disk. With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
The program also says Filesystem type is: Not known so far
during that time, even it it earlier found the partion info
when scanning.

When using OnTrack EasyRecovery the program starts and displaying
the filenames/directory it finds and increases the block
count but after a couple of minutes it stops at the same block number
every time I run it (#3840) and the disk sound stops which was
was heard up till this block number. And it does not continue to
even if I wait a very long time.

Is there any possibly to copy the information over to a new
hard drive in any way, which ignore corrupt block, so I can
revover most of the files?

/Kenneth
Click to expand...

If it's already known there are bad blocks I'd clone the drive first to a
'known to be good' drive. If damage is indeed limited to the partition
tables (which I doubt), those can be rebuild on the new drive. Even if
partition tables can't be rebuild iRecover or EasyRecovery will probably
perform better.

Our DiskPatch program can used to clone disks that have bad sectors. I am
sure there are other as well, just make sure that they offer a mechanism to
deal with unreadable sectors.

Kind regards,
Joep

--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
CHK-Mate - automated CHK file analysis & recovery
 
I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.
Click to expand...

Is the 'corrupt sector' in the partitiontable itself, or in the NTFS
partition ?
I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
to copy/recover the data to a new disk. With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
Click to expand...

Perhaps it stops at (or keeps retrying) the bad sector ...
The program also says Filesystem type is: Not known so far
during that time, even it it earlier found the partion info
when scanning.

When using OnTrack EasyRecovery
Click to expand...

Does the disk use Ontrack disk-manager to use the full capacity ?
(meaning a special MBR is used, making recovery more difficult)
the program starts and displaying
the filenames/directory it finds and increases the block
count but after a couple of minutes it stops at the same block number
every time I run it (#3840) and the disk sound stops which was
was heard up till this block number. And it does not continue to
even if I wait a very long time.
Click to expand...

Probably an area with bad-sectors ...

You can find bad-sectors using DFSee as well (see below), but if
the bad-sectors are the result of physical damage to the disk
(head crash) you should avoid reading and writing as much
as possibble since that might create MORE bad sectors.

Just try to read them just ONCE, to copy them to
a new undamaged disk ...
Is there any possibly to copy the information over to a new
hard drive in any way, which ignore corrupt block, so I can
revover most of the files?
Click to expand...

Yes, you can with my DFSee utility.

If you have a new disk available (of same or larger size) you can
instruct it to CLONE the old disk to the new one, and ignore any
bad-sectors while copying.

For a description of that procedure, read about it in item 51 of
DFSHOWTO.TXT that comes with the download, or read it here:

http://www.dfsee.com/dfsee/dfshowto.txt

(you have to scroll down to item 51 :-)

Note the description of the "-b:1" parameter, which will make the
CLONE
quite slow (many hours) but will result in the minimum number of
sectors
being skipped as bad-sectors.

Once you have a copy on a working disk, you can use the DFSUNFD
procedure to find tha partition layout, and then use some CREATE
commands to recreate that on the new disk.

If the NTFS partition itself is not damaged, this should bring back
all your data.


The DFSee download includes a DOS, Windows and OS2 version,
and the DOS version is probably the best one to use here, started
from a bootable DOS diskette. You can even download a self-extracting
image of such a bootable diskette including DFSDOS.EXE from:

http://www.dfsee.com/dfsee/dfsee6xx_dsk.zip

After unzipping, running the enclosed EXE will create a diskette in A:


All DFSee programs will function without registration, but will
remind you of the need to register at startup.

Real use and support do require a registration though, see:

http://www.dfse.com/dfsee.htm#register

Regards, JvW
 
Don't you worry, help is more affordable than you think! Especially
when you consider what your time is worth to you, and how much importance
you place on your valuable data.

My company specializes in computer forensic data recovery services and
data recovery software development. We develop and employ the latest
data recovery software on the market so we can often recover deleted
files pretty quickly! We serve individuals, small businesses, and
corporations worldwide.

We can:
- recover lost files
- recover deleted files
- recover deleted e-mail messages
- rebuild and recover entire physical disk partitions
- recover raid data
- recover pictures
- discover evidence related to investigations (e.g., Internet
activity)

In your case, it is very likely that we could recover most, if not
all, of your data. Because you know the name of the folder or files that
were deleted, it would be pretty quick for us to do. We can also search
for specific filenames you need recovered and even recover partially
overwritten data (e.g., an important MS Word document).

Once you delete your data and empty the recycle bin, your data ends up
in unallocated space. So essentially, you can try using third party
freeby software and cross your fingers, or you can leave it up to the
experts.

By the way, we serve both individuals and corporations. Our rates are
very reasonable and you only pay if we recover your data. No data, no
charge. What we would need is your hard drive shipped to us or a "dd"
image (through Unix) on DVD or CD.

For simple jobs, we'll usually send you your data on CD or DVD usually
within 48 hours! We charge by the hour, but with every job you get a
full up-front estimate BEFORE we begin any work. You get a complete
forensic report (if required), and your data recovered on CD or DVD.

If you would like more information, you can visit my company's website
at http://www.armordata.com and you can even fill out a free online
request for quotation. We're a small but reputable company and we
pride ourselves (above all else) on customer satisfaction, more so
than making a quick buck.

Regards,

John Bradley
Armor Data Inc.
"Specialists in computer forensic data recovery services"
"The quality is in our name"
 
John said:
Don't you worry, help is more affordable than you think! Especially
when you consider what your time is worth to you, and how much importance
you place on your valuable data.

My company specializes in computer forensic data recovery services and
data recovery software development. We develop and employ the latest
data recovery software on the market so we can often recover deleted
files pretty quickly! We serve individuals, small businesses, and
corporations worldwide.

We can:
- recover lost files
- recover deleted files
- recover deleted e-mail messages
- rebuild and recover entire physical disk partitions
- recover raid data
- recover pictures
- discover evidence related to investigations (e.g., Internet
activity)

In your case, it is very likely that we could recover most, if not
all, of your data. Because you know the name of the folder or files that
were deleted, it would be pretty quick for us to do. We can also search
for specific filenames you need recovered and even recover partially
overwritten data (e.g., an important MS Word document).

Once you delete your data and empty the recycle bin, your data ends up
in unallocated space. So essentially, you can try using third party
freeby software and cross your fingers, or you can leave it up to the
experts.

By the way, we serve both individuals and corporations. Our rates are
very reasonable and you only pay if we recover your data. No data, no
charge. What we would need is your hard drive shipped to us or a "dd"
image (through Unix) on DVD or CD.

For simple jobs, we'll usually send you your data on CD or DVD usually
within 48 hours! We charge by the hour, but with every job you get a
full up-front estimate BEFORE we begin any work. You get a complete
forensic report (if required), and your data recovered on CD or DVD.

If you would like more information, you can visit my company's website
at http://www.armordata.com and you can even fill out a free online
request for quotation. We're a small but reputable company and we
pride ourselves (above all else) on customer satisfaction, more so
than making a quick buck.

Regards,

John Bradley
Armor Data Inc.
"Specialists in computer forensic data recovery services"
"The quality is in our name"
Click to expand...

...... and I'll do the job from £45.00.

Odie
--

RetroData
The Data Recovery Experts
Efficient, effective and experienced.
www.retrodata.co.uk
 
I wouldn't trust someone's software much when that person can't even setup
his newsclient correctly to make a proper post.

Jan van Wijk said:
I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.
Click to expand...

[snip]


Note the description of the "-b:1" parameter, which will make the
CLONE
quite slow (many hours) but will result in the minimum number of
sectors
being skipped as bad-sectors.

[snip]

Regards, JvW
Click to expand...
 
Ken1 said:
I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.

I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
to copy/recover the data to a new disk. With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
The program also says Filesystem type is: Not known so far during
that time, even it it earlier found the partion info when scanning.
Click to expand...

There is a utility on Svend's website that can overwrite the bad sectors.
You may then be able to use the utilities to copy the data, including Svends.
When using OnTrack EasyRecovery the program starts and display-
ing the filenames/directory it finds and increases the block count
but after a couple of minutes it stops at the same block number
every time I run it (#3840) and the disk sound stops which was
was heard up till this block number. And it does not continue to
even if I wait a very long time.

Is there any possibly to copy the information over to a new
hard drive in any way, which ignore corrupt block, so I can
revover most of the files?
Click to expand...

Or take care of the bad blocks first.
 
Ken1 said:
With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
The program also says Filesystem type is: Not known so far during
that time, even it it earlier found the partion info when scanning.
Click to expand...

iRecover doesn't rely on the file system type that was recorded in the
partition table, after all it may concern a FAT32 partition that was
accidentally formatted NTFS.

Joep

--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
HD Workbench - Disk Diagnostics & Cloning
 
Joep said:
iRecover doesn't rely on the file system type that was recorded in the
partition table, after all it may concern a FAT32 partition that was
accidentally formatted NTFS.
Click to expand...

That still doesn't explain the conflicting info.
It would then be a NTFS partition and not a Fat32 partition.
 
It's not conflicting info, it's a conflicting situation:

In the partition table it would say NTFS, however the file system you want
to recover from would be FAT32. As iRecover scan the partition it will find
more and more evidence that the data actually present corresponds with a FAT
type partition (assuming the partition was formatted in error and no data
was written to it yet).

As long as iRecover hasn't decided on the file system yet, it will say the
file system is unknown EVEN when it says NTFS in the partition table. For
this part of the analysis it's irrelevant what the file system is as
iRecover will collect all possible components regardless if they're FAT or
NTFS type components.

Then when it has decided on the file system, and for arguments sake, this is
FAT32, it will say so, again EVEN when the partition table says NTFS.

If the situation is too conflicting the user can specify in advance that the
file system is FAT/NTFS. This may be required for example if data was
written to the partition formatted in error, or when a tool like
PartitionMagic is frequently used to move and convert partitions (PM doesn't
"clean up" when for example moving a partition). But even then, during the
collection phase the file system is 'unknown'. In the end, although the user
selected FAT, there may not be enough data found to allow recovery from the
F.U.B.A.R. FAT partition

Joep

--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
CHK-Mate - automated CHK file analysis & recovery
 
More fool you.

Folkert Rienstra said:
I wouldn't trust someone's software much when that person can't even setup
his newsclient correctly to make a proper post.

Jan van Wijk said:
I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.
Click to expand...

[snip]


Note the description of the "-b:1" parameter, which will make the
CLONE
quite slow (many hours) but will result in the minimum number of
sectors
being skipped as bad-sectors.

[snip]

Regards, JvW
Click to expand...
Click to expand...
 
So how does the FATxx designation get itself in the partition table,
if not by the formatting operation?
 
- Situation: FAT32 drive, all's well.

- Accident: FAT32 drive is formatted NTFS

- Problem: File system is now NTFS according to partition table
HOWEVER the file system more interesting for analysis is FAT32;
iRecover should treat this as a FAT32 drive rather than an NTFS one.

The conflicting info is, that while the partition table says NTFS,
we're not interested in NTFS data structures, we're interested IN FAT
data structures.
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So how does the FATxx designation get itself in the partition table,
if not by the formatting operation?
Click to expand...

Info on what type of filesystem is (supposedly) in a given partition is
stored in the partition table. Some partitioning tools (such as Linux's
fdisk) let you change this information without resizing partitions or
writing new filesystems to those partitions. You could start from a Linux
boot floppy or CD, change the ID for a partition from FAT32 to NTFS (or any
of the 92 partition types fdisk knows about), and end up with a situation
where the type of filesystem in a partition doesn't match what the partition
table says it should have.

Partitioning and formatting are separate operations, even under DOS, so it
would be unwise to blindly assume that what the partition table says is
correct.

_/_
/ v \ Scott Alfter (remove the obvious to send mail)
(IIGS( http://alfter.us/ Top-posting!
\_^_/ rm -rf /bin/laden >What's the most annoying thing on Usenet?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Linux)

iD8DBQFAY3pyVgTKos01OwkRAjsMAJ9x84UjmLQwX+mc5v9X131Iek7awQCgug5N
EkurMT9ekWxriGTK0OYQYUw=
=+wL3
-----END PGP SIGNATURE-----
 
DIY DataRecovery said:
- Situation: FAT32 drive, all's well.

- Accident: FAT32 drive is formatted NTFS

- Problem: File system is now NTFS according to partition table
Click to expand...

And in actual fact.
HOWEVER the file system more interesting for analysis is FAT32;
iRecover should treat this as a FAT32 drive rather than an NTFS one.
Click to expand...

But since it now is a valid NTFS partition it should at least mention that.
The conflicting info is, that while the partition table says NTFS, we're not
interested in NTFS data structures, we're interested IN FAT data structures.
Click to expand...

Apparently that was not clear to OP. Perhaps that should be made clearer.
 
Scott Alfter said:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Which I consider a minute offense compared to posting
someone's <reply address> instead of the <sender address>.

(huge grr)

I retract the question because -after reread- it didn't make any sense.
Apparently I misinterpreted Joep's answer.

[snip]
Click to expand...
 
Back
Top