Corrupted MFT or Partion Table? not sure which... 2

[AlHanke]

So, weekend before last I get this idea that I should run Norton Speed Disk on my primary hard drive since it had been a long time since I'd defragged. Figured it would take a couple of hours (maybe three) on a 60 GB Maxtor drive. I sat down to watch some TV about 9 AM Saturday morning.

Saturday evening rolls around and it is still not finished. I cook supper and eat and drink a beer and wait.

The thing finally finishes late that evening. I run an analysis on the drive and it tells me it is 57% fragmented.
I am puzzled at this and wonder what the heck Norton has been doing all day long. BTW, I also had another drive - three partiions in all (2 on drive 1 and one on drive 2) and the other two partions were de-fragged and looked fine.

I decided to run Speed Disk on the drive again, since by now it was evening, and check it in the morning. Sunday morning it shows to be about 37% complete. I am really annoyed but let the process continue. Around noon it shows 50% complete. I am not happy with this at all.

I decide to cancel the de-frag and complete it later. So I hit the cancel button. At this point my system is still operating fine. I get the idea that maybe I have too many TSR's running and that I should boot into safe mode and try the de-frag.

So I re-boot the machine. That's when my world turned black...

Upon re-booting the machine I received a Disk Boot Failure message. I tried to re-boot several times and received the same message.

A little history on the drive - I had received this message a couple of times on re-boot in the past couple of months but on continued attempts was able to boot the drive. Also it seemed that the system wanted to run check disk on the partion on about seventy-five percent of my re-boots. It occured to me that I should do a back up of the partion since it had been a long time since I'd backed up but I had not taken the time to do it.

I have already kicked my self in the ass several time for my neglect so I don't need anyone else to help me in this area now.

At this point I re-boot into my parallel OS. I keep a copy of XP on another partion so I can access my files if my primary goes down. When I get into my fail safe OS the bios sees the drive but I can not read it. I decide to see if Norton can read it and perhaps I can complete the de-frag operation from this parallel OS. I install Norton System Works on the OS and when I re-boot I get a log in problem... something about Ghost Log In failure... I don't recall now exactly what it said. It just kept me in a login loop. It gave me a screen, I'd log in, and it would take me back to my login screen. I'd never seen this one before.

By now it is Monday morning and I have work to do. I do landscape design and I work in AutoCAD. I have all of the software and another 60GB drive to put it on but it is a long process. Plus I was in the middle of a drawing when the problem occured. Also all of my landscape blocks and symbols, title blocks, font style plus ten years of work - are on the in-accessable partion.

Next I make what may have been a fatal mistake. I decide to take the drive out and put in in another machine. My thinking is that the machine will run checkdisk on the drive and it will correct all the errors that are making it un-readable.

I was right in part - the machine immediately runs checkdisk on the partion and - in the blink of an eye - I watch as the computer tells me it is "resetting index entry" about a million times in the span of a few seconds.

Great! Now I'm in the OS and not only can the bios see the drive but I can read it too. Problem is - all of the data is gone...

I figure that the data is there but the MFT is changed. I used iRecover by DIY DataRecovery (eval version) and I can see some of the data but it is a very slow process. The original directory tree is gone. I've found some music files and a couple of my accounting files and drawing files. But the bulk of my drawing files plus job and family photos going back years are not to be seen.

I did find the folloing files - $AttrDef, $BadClus, $Bitmap, $Boot, $Logfile, $Logfile(1), $MFT, $MFT(1), $MFTMirr, $MFTMirr(1), $Secure, $UpCase, $Volume, $volume(1), 12.12.04.IRS, bootex.log, certreg.txt, ExchangerServerSetupProgress.log and temp.log.

Can anyone offer any insight on the best way to recover my data or perhaps point me to the best site and/or software to help me with this? Is there a way to restore the original MFT (assuming that there is a copy of the original on the disk)? Are any of the above listed files usefull? It looks to me like there is a copy of the Master File Table and a mirror of it (320 KB each) plus a copy of the logfile and a backup of it (65,536 KB each) but I don't know what exactly to do with these.

Any help is appreciated.

Thanks In Advance

 

[eyec]

if you have it use Norton undelete. the files you need are there (the $ is a delete tag).

lacking Norton Undelete go to undelete.com and download theri program, forget the demo/free version it will not let you recover your files.

good luck

 

[FUBAR911]

I have used the following application before and it helped me out of a tight spot.

http://www.active-undelete.com/products.htm

hope this helps.

 

[linney]

Don't do anything with those $xxx files, they are absoloutely necessary, super hidden system files, required by Windows to have any chance of reading the drive.

http://www.restorer2000.com

http://www.runtime.org/hints.htm

Try here too.

-General Data Recovery discussion Forum (4103 members)
Forum528


NTFS partition loss
thread779-503449

Another option to try would be the self booting CD's that contain an operating system that runs just from the CD.

http://www.nu2.nu/pebuilder

Users recycle bin
thread779-744465


HOW TO: Take Ownership of a File or Folder in Windows XP (Q308421)

http://support.microsoft.com/support/kb/articles/q308/4/21.asp

 

[eyec]

linney,

for as long as i can remember the $ was a tag MS used to identify a deleted file, now they are using this for critical OS files?

thanks for the links. i read the on about the system files and am glad you posted up.

 

[bcastner]

eyec,

Have you checked your %windir% directly after a Hotfix or service pack?

I think linney overstates the case, and the files are from Norton Cleansweep. But I agree that you should leave them alone. They can matter quite a bit if you sent the drive out to a competent data recovery service.

 

[eyec]

man, i am still in a muddle.

i use data recovery/forensic software and even they key on the $ tag.

now i will have to spend most of the next week learning what i thought i knew

<expletive deleted>

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;329260&Product=winxp

 

[linney]

MetaData files are super critical system files that is why they are such deeply hidden.

http://www.windowsnetworking.com/nt/atips/atips164.shtml

http://linux-ntfs.sourceforge.net/ntfs/help/layout.html