something of a horror story / Computer Science / Forums

Forums

4hv.org :: Forums :: Computer Science

« Previous topic | Next topic »

something of a horror story

Move Thread

LAN_403

keith

Tue Feb 21 2006, 09:41PM

Registered Member #148 Joined: Sun Feb 12 2006, 08:21AM
Location:
Posts: 8

Yesterday I used partition magic to resize the primary NTFS partition on my 250gb seagate drive, in order to make space for a 40mb FAT partition in front of the NTFS partition. The resizing process froze at 93% completed, and I had to turn off the computer (after waiting for five hours to see if it would get past 93%). This left the drive in an unreadable state of confused, half resized/restructured partitions. I paid $50 for a data recovery program called R-Studio, which seemed like the cheapest decent product I could find. It has recovered the entire original directory structure, and has restored all of the files (250,000 of them). Unfortunately over half of them are unreadable.

I emailed the makers of R-Studio about this and they replied promptly if in somewhat poor english:

We are afraid, but it looks like what you have so far in your disk.
Maybe partition magic resizing did not commit all transaction correctly
back to MFT table. The explanation of your results is simple.

1) R-Studio have found MFT tabel (NTFS) and based on its data tried to
restore files.

2) The original places where your data was (cluster) for some files
where changed or/and overwritten by some other data. R-Studio relies
on info that it has found in MFT only. Let's say that your original
file had 10 clusters. ( of them are still in sync with info from MFT
but 10 was moved and it was reflected in MFT.

I'm not sure if this means what's unreadable is just gone, or if there is something more that can be done.
Anyone have any ideas?

Many of the unreadable files I did not have backed up anywhere, including 8,000 digital pictures from the last four years. It was incredibly stupid to resize without backing up first.

Carbon_Rod

Wed Feb 22 2006, 12:00AM

Registered Member #65 Joined: Thu Feb 09 2006, 06:43AM
Location:
Posts: 1155

Do not use "partition magic" as even when it works its boot loader may do silly things to your system. IIRC, it makes a backup, unformats, resizes, and then reformats. Perhaps partition magic may have an undo option that may work (if the files were not lost.) If the disk has been written to after the program lost its place the backup may be invalid. Also note NTFS stores small files in the file system index area, and not the data area. Additionally, NTFS can compress/encrypt the file data area too in that case if the OS has overwritten these areas then the entire archive may be lost.

1.) Recovery programs almost always make a disk image file for data recovery on another disk.
2.) Recovery programs almost always have an undo disk backup.
3.) Knoppix STD does all sorts of recovery tricks
4.) r-tt is an OK option for raid 0/1 drives.
5.)

is a good option for encrypted systems

The safe way to format/backup (IDE) from MSDOS:
1.) Run blank drive for 1/2 hour to warm up
2.) Create a fixed size bootable FAT32 partition with the FDISK 2002 or newer.
3.) Reboot
4.) Format /s/u/c C:
5.) If you install win9x it will roast the MBR so do it as your first OS.
6.) Reboot(s)
7.) Load a linux (knoppix etc. cheat code) terminal, but do not load a disk cache.
8.) run the GNU FDISK to make 3 other real partions (IDE disks have a max of 4.)
9.) Install linux and cache file systems onto 2 partition (JFS is not this easy.)
10.) Reboot.
11.) Install WinXP on the remaining partition (use NT boot-loader)
12.) Install the ext3fs IFS driver for XP to read your linux files.
13.) Install your updates and applications.
14.) Reboot
15.) In MSDOS run Ghost -fnf and make a compressed 650MB spanned dump of your OS (under 5 GB) to a second physical drive.
16.) Burn CD backups of your OS image for ghost.

...

Wed Feb 22 2006, 01:53AM

Registered Member #56 Joined: Thu Feb 09 2006, 05:02AM
Location: Southern Califorina, USA
Posts: 2445

If you have another hdd install any version of windows on it and make it the master. If you run the os from the broken drive you may eliminate all chances of recovery.

One you are running on a separate drive, try pc inspector file recovery; it is free and says it can recover files others can't...

Conundrum

Wed Feb 22 2006, 01:26PM

Registered Member #96 Joined: Thu Feb 09 2006, 05:37PM
Location: CI, Earth
Posts: 4059

Hi,

Its also possible that there was a failure of the drive that didn't show up as the area was unused but formatted.

I once tried to copy a damaged drive to an apparently good drive which formatted OK, but on using Ghost it failed. When it was scanned it revealed that there were hidden bad sectors on the drive (thank Spinrite for showing this)

-A

Tetrafluoroethane

Wed Feb 22 2006, 03:12PM

Registered Member #127 Joined: Fri Feb 10 2006, 03:36PM
Location: Cincinnati, OH - USA
Posts: 44

Given my experience with Partition Magic, you are probably done for. Chances are when you shut the system down it had not comitted all the new MFT changes. When you ran R-Studio, it rebuilt the file system on part new, part old MFT data. So basically you have files that consist of pieces from all over the hard drive. At this point there probably isn't much that could recover the files since Partition Magic moved most of the stuff from its original location. I've been right where you are.

Avalanche

Wed Feb 22 2006, 03:44PM

Registered Member #103 Joined: Thu Feb 09 2006, 08:16PM
Location: Derby, UK
Posts: 845

If I were you, at this stage I would just take that hard drive out and keep it - fit a new one. Instead of going slowly crazy in your attempt to recover the data now, you might come across someone or something in the future that will make it worth having another go at restoring it. That's my theory!

FastMHz

Wed Feb 22 2006, 06:40PM

Registered Member #179 Joined: Thu Feb 16 2006, 02:08AM
Location: Hagerstown, Maryland - Close to Prime Outlets
Posts: 287

Partition Magic has successfully destroyed 90% of the drives I ever tried it on...Therefore I now re-partition by using a second drive to store my data while I use good 'ol FDISK to make new partitions.

The data on your drive may or may not be recoverable...I'd do as Avalanche says and hold on to it, get your system running on a new drive, and try to extract data from it when a better solution comes along.

keith

Wed Feb 22 2006, 06:59PM

Registered Member #148 Joined: Sun Feb 12 2006, 08:21AM
Location:
Posts: 8

Thanks for all the replies. I'm not running windows from the drive - it's my storage drive, while i have windows installed on a raptor.
Anyway, I have done more research about this and Tetrafluoroethane seems to have gotten it right. I am looking into using a program called DiskPatch, although I am not sure if it can fix the MFT.

I am actually leaning towards Avalanche's idea of buying a new drive, and keeping this one until I can afford to have a professional company recover the data. I'm pretty sure a company like OnTrack could recover everything, but it would probably cost thousands of dollars. Between what I had backed up and what I've successfully recovered so far, I've got most of the really important files anyway.

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob