Lost 114GB after CHKDSK 2

[GranvilleX]

Help!

There's probably no way I can recover this data, but before giving up all hope and format the drive, I'll give it a try here among all you knowledgable and helpful people.

HDD1: IBM 75GXP - 46 GB
HDD2: Maxtor D540X-G4 - 160 GB
OS: W2K SP3

After having formatted HDD1 and reinstalled W2K, HDD2 which was connected to a PCI adapeter ATA133 card was not found. I then connected it directly to the motherboard and managed to get in touch with it, but after first having changed the jumper to cable select. It looked great. The second time I booted the computer, some files (doc, mp3) could not be read, so I rebooted, resulting in BSOD: STOP xxxx Inaccessible_Boot_Device.

Rebooting again resulted in CHKDSK automatically starting to run, deleting files, index entries, and replacing invalid security Ids, and then rebooting. It looked nice for a while… until I checked my HDD2 where I found that only 7GB out of my previous 114GB was to be found. I know I should have made a back-up, but 114GB… Norton Utilities said the disk is fine, but couldn’t retrieve anything with Unerase.

Does anyone have a possible solution? Is this data lost forever, or is there a way I can retrieve it?

Thankyou!

 

[pbxman]

Are those toasted files you speak of all in .chk format now? pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[GranvilleX]

Hi pbxman! Unfortunately not. There's a directory called "found.000" and under that 6 sub directories "dir0000.chk - dir0006.chk" with some 20 files + 5 files "file0000.chk - file0005.chk" ranging from 2-4000kB. Besides this, some original directories are still there but with nothing much in them.

Am I toast?

The CHKDSK started by itself and just deleted my files. A suspected it could had been a boot sector virus, but I've been running Norton AV and checked again after the disaster and nothing found.

 

[pbxman]

Here's the only solution out there. It can take a LONG time to recover, but it WILL recover the files and restore them.
Here's a link:

http://www.ericphelps.com/uncheck/

The unchk program is the most accurate. The FileChk is faster, but might not recover everything. I usually run FileCHK first, then unchk for the rest, but have corrupted files doing so. If you're not in a time crunch - run Unchk. If you are, go with filechk.

*note - on a dual athlon 1400 system with 1GB RAM it took 14 hours to recover 1.8GB of picture files. If you have mostly data, it should go faster.

Everybody who reads this post..get these 2 programs before the site goes down, and save them in your "mojo bags"!! These are the best programs for recovering from bunk chkdsk operations.

Oh yeah - when you're done recovering...disable chkdsk! It does NO good whatsoever because it corrupts any files it doesn't know what to do with.

*****To run ANY chkdsk-type program, DONT use norton either. ALWAYS use Powerquest Lost & Found first!! Why? Because Powerquest is read-only. It will NOT change any files. Use that first to recover your *good* files, then use Norton to fix the ones that are corrupted. Norton has write capabilities, and will attempt to change the corrupted files.*****

Keep these 4 toold in your bag of recovery tools, and you're ready for all but the worst of failures. Lost & Found will work on any drive as long as it spins and can still read.

Good luck GranvilleX. Aside from the link i posted, you have no hope other than BIG $$$ at a professional recovery shop.
cheers pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[GranvilleX]

Thanks a thousand pbxman for taking your time with me!

I'll download and try this program. However, it seems to me - after reading the info - that it only deals with chk-files? Like I mentioned, these are just but a few and they total a couple of MB. I lost more than 100GB/15000 files - could they be recovered this way???

While searching newsgroups, I came across some good links for software that recover data from formatted disks. Maybe these links will be useful for someone else, if not for me:

http://www.winternals.com/products/repairandrecovery/diskcommander.asp

Disk Commander can recover deleted directory structures, files lost from formatting a partition, a corrupted drive, or a system that fails to boot.

http://www.diydatarecovery.nl/

http://www.hddrecovery.com.au/r-studio.htm

http://www.bitmart.net/r2k.shtml

 

[pbxman]

You may have more files that are still there, but aren't displayed. This is where the other programs like Lost & Found come in. The unchk program will fix the bad files and "uncorrupt" your chkdsk operation. The other tools should work just fine. I dunno what kind of budget you have to work with, but DiskCommander is $300. That would be the preferred tool. Winternals makes the best software for this type of problem, but i've never had a problem using Lost & Found, and it's cheap. Come to think of it - im not sure it's made anymore.?

Your plan of attack should be:
1) Backup/save any working files you can find 1st, and save them to a good drive.
2) Run Unchk/Filechk to fix your .chk files and then save those to another drive.
3) Run a read-only recovery tool such as lost & found. Depending on what it finds, copy or save that stuff.
4) run a b*lls-out recovery program that attempts to FIX the bad/corrupt files that lost & found may find, but can't repair, or doesn't know what to do with.
(you may run into a situation where a file is an .xls document, but when it's repaired it becomes a .doc file - this is because the headers are the same for these types of files, and are often restored incorrectly).
5) save anything else that gets fixed, never let this happen again, take steps to make sure it doesn't in the future.
6) disable chkdsk on all systems for the rest of your life!
pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[GranvilleX]

You're being helpful here pbxman, really appreciate you taking this time!

The unchks and filechk programs corrected 6 files. I then ran a demo version of R-Studio on the large disk - after 12 hours scanning it had found:

NTFS MFT File Entries: 179
NTFS Directories Entries: 1935
NTFS Boot Sectors: 2
FAT FAT Entries: 17066
FAT Directories Entries: 29
FAT Boot Sectors: 9

Looks like I've got a chance! What I do not understand is why it found FAT... Have never had the disk formatted this way, pretty sure as I already was running W2K when I bought it. Have never had an OS on this drive though, so could be true.

 

[pbxman]

No sweat about the help - thats what we're here for.
That is good news..looks like your data is still there! All you need is to find yourself a program to read it all back and go from there.
You're on the home-stretch now It's just gonna take time for the software to do it's thing, let you access the files, and save them elsewhere. pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[GranvilleX]

Yep, it sure looked that way!

When I look closer, not more than about 100 files seem to be recoverable.

Now gonna get Winternals Disk Commander and give it a try, but not really confident it will find more.

Da*n chkdsk! How do you disable it??