File recovery broken XP NTFS Partition

I have a 5-year-old Dell Dimension E310 running XP Media Center edition. The box has twin WD 160 GB SATA drives and Intel Matrix is managing RAID1 across them. I have screwed up my system (long story short is one two many hard power downs while using Kaspersky Rescue Disk 10 for the first time) and at this point am just trying to move as many files off of the drive(s) to an external HDD before reformating and installing Windows 7. I am unable to boot up in XP, I also am unable to successfully use the Repair option using the XP set up disk (that procedure will not find any installed copies of windows). After many different approaches, I am now booting up Puppy Linux off of a CD and am able to mount my drives to see what is there and copy files to my HDD.

Here is my specific problem. My HDD (both, as they are mirrored through RAID1) has two partitions. On the primary partition, I am able to see my files and have successfully moved files out of my Documents and Settings folder. However, the secondary partition (where additional files are) doesn't look good. I am able to mount the drive and see that it is a 37.2GB NTFS partition with 11.6GB free. However, the only folder I see is "System Volume Information" and the only visible file in the folder is a 0 B file called "MountPointManagerRemoteDatabase". That is it. Given the "free" space relative to the allocated space, I am hopeful that there is some way for me to see the other files that should be there and move them to my external HDD. I have also checked the other physical drive to see if the mirroring was out of sync, but it is behaving exactly the same.

Any thoughts on how I can get my files back? (To the Mods, sorry if this is posted to the wrong forum...if so, could you please move?)

Thanks in advance,

 

That doesn't sound good. If puppy can see the partition and the files but only shows System Volume information folder I don't know where the files could be.

I would try downloading the bootable ISO for Partition Wizard and burning it to CD as an image file. Then boot form that CD, click on the 37GB partition to highlight it and select Explore from the left pane options. See which files it lists. If they are all there then we can consider recovery options.

 

Thanks for the suggestion. I'll try it now.

 

There is also a check files option in PW. It is a form of chkdsk but I'm not sure if it can actually fix errors. It may be worth a run through to see if it finds errors since hard shutdowns can produce file system errors.

 

Was successful in using the disk to boot. Partition Wizard sees the partition and confirms that it has 25.6 GB used and 11.64 GB unused. The status is "None". And the Type is "Primary". Unfortunately "Exploring Partition" shows the same thing that Puppy did.

I don't see an option for "checking files". I do see a "Surface Test" but that sounds more like a hardware check.

What do you think about Rebuilding the MBR?

 

Surface test shows up when you have the disk highlighted rather than a partition.
Try right-clicking on the partition and selecting Check Files. You can run through once without fixing errors to see if errors exist. If they do then you can run through again and go ahead and fix errors.

 

Thanks for the explanation - I will try.

In the meantime, I saw a link to Power Data Recovery from inside the Partition Wizard software. That led me to download the demo bootdisk of the Power Data Recovery. Upon bootup with that disk, I chose to recover files using the "Damaged Partition Recovery" option and AHA!! there are my files. I now simply need to purchase a license to copy the files. Fantastic! Thanks so much for your help.

Now. Can I get a bit greedy? Once I have moved my files, I will be comfortable losing everything if I make a wrong choice. My question is: should I try to repair the partition? Or is it likely that the "damaged partition" is really a symptom of something else. I have been through the NTLDR is missing message (I copied NTLDR and NTDETECT.COM to my system and then got a HAL.DLL missing message which is when I stopped on that path). Trying to use the Windows Recovery Console didn't work (it didn't recognize any Windows installations). Once I copy all of my files and run the scan you suggest here, any other thoughts? Thanks again for your suggestions.

 

Hello,
Power Data Recovery is free for home use.

Edit: You are talking about the bootable version which is paid. Just a thought, but if you have a USB adapter, you might be able to hook it up and use the free version with that.

 

I see that the PDR software is free for home use, but the PDR boot disk did/does not seem to be if you want to save files. Perhaps I simply downloaded the wrong version.

 

You are right. I edited my post. The bootable version unfortunately is paid.

 

First i would run the check files option before dealing with the recovery software. It may be able to easily fix the problem with some index or something to make your files visible.

On the other question, I'm not sure. I don't think the partition is bad, I think the file system has some errors. I'll think about your problem and subsequent steps. I'm curious if among the files that data recovery software shows are the NTDLR and ntdetect files. In other words if all of this isn't related.

 

Hmmmm. I still can't seem to find the option for checking files. I click onto the partition, right mouse click, and don't see an option for checking the files. I get the same menu options when choosing "Partition" from the menu bar at the top of the screen. Perhaps this is something unique to the PW boot disk (vs. the Windows software)? Or I'm simply missing it.

If it is helpful, upon starting the Windows Recovery Console from the startup disk, I tried to run chkdsk with various flags and always got an immediate error message - I believe telling me that there was a problem with the drive. So I am eager to see if checking files works from within PW if I can figure it out.

 

Let me check the bootable disk. It is possible that the bootable is based on Linux and can't perform a chkdsk.

 

PW boot CD doesn't have the chkdsk option because it is running from Linux. That is unfortunate because I think it may be as simple as running chkdsk.

I'm not familiar with how recovery console works if it doesn't find a Windows partition. What type of prompt do you get A:\ or C:\? [I'm wondering if you could do chkdsk /r C: and get a different result] Try it again and let me know the exact error message.

$70 is a good amount of money to pay. There must be a way to do a chkdsk on a NTFS drive from a bootable disc.

 

I think you could try this download and burn it to CD.

It will have a chkdsk utility but it must be able to see you Windows installation and use the autochk.exe found in the System32 folder. Since you were able to get items from your Documents and Settings folder I hope the Windows folder is visible as well.

You must type yes to agree to the NTFS4DOS license for use. Then type chkdsk /f at the prompt and follow the rest of prompts.

I'll look for other solutions to getting a running chkdsk but that should work in your case since the XP files are visible.

 

Tried NTFS for DOS with no luck. After agreeing to the license I get an Out of memory error and am left at the A:\ prompt. I can change to D:\ (C:\ was my external HDD) where the Windows subdirectory is. If I do a DIR I can see the Windows subdirectory but it hangs in the middle of the directory and I have to CTRL-ALT-DEL to restart. Next time in I went to D: and then typed: "chkdsk /f" and Enter. The system responded with "Bad command or filename - "CHKDSK".

I will now go back in through the Windows Recovery Console to get the exact message I got when I tried running chkdsk there.

 

Okay, just booted with Symantec Norton Ghost 10.0 CD. This has a Recovery module which allows me to boot the machine (not to Windows, but to the Norton/Symantec Recovery software). The first message I get is:

D|Mapper.exe - Corrupt File {in title bar of window}
The file or directory D:\$Mft is corrupt and unreadable. Please run the Chkdsk utility.
There is an OK button, but clicking it doesn't remove the window

I am able to slide the window to the side and Accept the Symantec License Agreement. This brings up the Symantec Recovery Disk Norton Ghost 10.0 menu screen. From here I could Recover My Files (except I haven't been using this software, so there are no Recovery points to choose from)or Recover My Computer (I could browse to find a recovery point if there is one on my machine, but I don't know where to browse to). I can also Explore My Computer which allows me to see my disks (though this is where I am unable to see anything else on the partition in question). There are a number of other support utilities here as well (Display SME Disk Information, Edit Partition Table, Restore Master Boot Record, etc.). But I can't get to a prompt to try to run Chkdsk here. On to the RC.iso that I downloaded earlier (allows me to go to Windows Recovery Console):

I get the menu screen from which I choose R to Repair Windows using the Recovery Console. When I type chkdsk /f d: I get a message that "the parameter is not valid. Try /? for help". When I type chkdsk /? I see the parameters to be

[drive:]
/P
/R

so I typed chkdsk d: /p and after a short (1 second?) delay I get the following message:
"The volume appears to contain one or more unrecoverable problems." This is the message I referred to before. I can switch to D:, but DIR returns "There is no floppy disk or CD in the drive." even though I am quite certain that this drive is my hard drive (c: is currently the external HDD which I can see fine by typing DIR at the C: prompt).

 

Corrupt mft is bad. Does recovery console let you run chkdsk with no parameters?

I'm wondering if recovery console is seeing any of your internal hd(s) since they are SATA. The only drive you see is your external USB correct. You don't see either internal partition.

 

I cannot run chkdsk with no parameters. I get the same error message. I can see information on both the USB connected drive as well as the CD drive that the boot disk is on. I am also unable to change to a drive beyond the drives that are on the PC (e.g. K:\). In the case of D: or E: (my guess is that these are the two partitions) I am able to change to those drives by typing D: or E:, but I am unable to see anything on them by typing DIR.

Somewhere in my travels today (perhaps in the Partition Wizard software?) I found a dialog box (Properties?) that showed the physical location for MFT as well as the location for a backup (I think) MFT. Is that useful at all?

I really appreciate all of your help on this...I hope you find the riddle to be interesting...I'm offline for tonight and will check to see if you have any other ideas in the morning. Thanks again.

 

I'll look into it a bit more. It is maddening that running a chkdsk is so elusive.

 

TestDisk might be an option for MFT repair. I'll look into it since I have testdisk on a CD and can see what the options are.

 

Downloaded TestDisk as part of the Ultimate Boot CD. TestDisk also is able to see the files that I was unable to see before. For future people with this problem, I got there by going to Advanced, highlighting the partition in question and then selecting Undelete. There they are! If I hadn't already spent the 70 bucks, I would be able to recover my files for free using this (seems a donation to the TestDisk people would be in order, though).

As for the MFT, still in Advanced with the partition highlighted and selecting the Boot option shows me that Boot Sector status is OK and Backup boot sector is OK. Then choosing Repair MFT gives me a simple question:

Fix MFT mirror using MFT ? (Y/N)

I assume this means that the files are not the same, but I also would imagine that I would rather fix the MFT using the MFT mirror (the other way around) as I was getting a message before that the MFT is corrupted. Unless, of course the reason I was getting the "corrupted" message was simply that the MFT and MFT mirror didn't match and the MFT mirror was indeed bad. Seems less likely to me. In any case, selecting "N" at the prompt above simply returns me to the previous screen - I am never given the opposite question.

Whaddya think? Should I say Y to the question above??

 

I would say No. Only because I prefer to do partition manipulation in separate steps.

When you undeleted the partition did you get a step to write the changes? If you did I would exit test disk and see if you get the same MFT error from ghost or if another program will now see the files.

If nothing has changed then go back and deal with the MFT. I just want to be sure the MFT is indeed messed up before working with it.

 

I wasn't as clear as I should have been on the Undelete point. The partition appears to be fine (I can see its presence using everything), it's just the files don't appear to be there. Using TestDisk, I can select the partition, choose Undelete, and then I have an option to COPY files, but not actually undelete them or write them. I am reluctant to copy them back to the same drive as I don't want to jeopardize the recovery; rather I can copy them to an external drive over USB (though I haven't done this since I already did it using the Power Data Recovery program).

Perhaps I'm missing some other way to undelete the partition (even though I can see its existance fine)?

 

You definitely do not want to copy the files to the same partition. See warning: http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_NTFS.

I'm just reading up on Testdisk and I think normal partition recovery would be advisable. But I have to read it once more.

 

Since you already spent your money, I would suggest retrieving your files with that software and copying them to the external before going any further. That only seems to make sense.
*****

The early part of the step by step up until deeper search should give you a good idea if the partition is available and the files are listed. If you see the partition and p lists all your files then writing the partition table would be OK.

You could see if another program then sees your files. If not you could try the MFT fix.

*****
Although, Testdisk is a very good program and has never messed me up, you could also try in Partition Wizard, Recovering the partition (not hitting Apply) and see if it then lets you Explore the partition and if it sees all the files. If it sees all the files then hitting Apply would be OK and you might reach the same end.

If necessary you could still try the MFT fix in TestDisk.

 

I reread your post. I see you have already backed up your files. I would do the Step by step through the write partition table step. See if another program now sees the files. If not do the MFT fix.

My guess is that you would not have an option to undelete a partition in the Advanced menu unless there was something wrong with ii. I'm going to test this now.

 

Files have been copied.

*****************

Running TestDisk:

1) After choosing the HDD in question, I get a screen that tells me that Hidden sectors are present. The size, user_max and dco are all 312500000 sectors. The native_max is 10510112 sectors. I choose continue.

2) I choose Intel.

3) I choose Analyse. There are 4 partitions listed. 1 is Dell Utility - 80262 sectors; 2 is HPFS - NTFS 224588700 sectors (primary bootable); 3 is HPFS - NTFS 78091965 sectors; 4 is CP/M 9735390 sectors. Between the 3rd and 4th line is a line that says "Bad relative sector".

4) I choose QuickSearch. Structure is OK. I choose partition 3 and hit P to list files. All I see is the System Volume Information directory. I don't see all the other files that I know are there.

5) Based on the fact that I don't see all my files. I did NOT Write the partition.

*******************

I am now moving to Partition Wizard to try that.

 

Repairing the partition in PW didn't lead me anywhere as it doesn't see the partition as damaged.

Back to TestDisk where I selected Y to make MFT Mirror match MFT. I did this for both of the partitions. The routine worked (I got a message that the MFT files now matched). Now, when I look at the directories, I still can't see my files or folders, but I have also changed how much of the partitions are seen as "used". A lot less of the partitions are used. Because I have duplicate drives (RAID) I can confirm that the size is changed and that fewer files can be seen on the primary partition (and the same lone directory on the secondary partition).

 

No change when rebooting to my HDD. I still get the message:

Windows could not start because the following file is missing or corrupt:
<Windows root>\system32\hal.dll
Please re-install a copy of the above file

As a reminder, I first got the NTLDR is missing message and have copied that file and NTDETECT.com to the C: drive.

Perhaps I need to overwrite the Boot information?

 

I'm not sure what that MFT change did. I think your $70 was well spent.

In testdisk go Advanced click on the boot partition the one with the (*). Select [Boot] and then

• . Do you see NTDLR and NTdetect.com? If so scroll down(using down arrow key) to Windows directory <enter> Scroll down to System32 <enter> scroll down and see if you find hal.dll.

 

What is very odd in the listing of files in my last post they were not exactly in alphaberical order. I had to go through the list a-z then I got more files a-z and then more a-z and finally I saw the hal.dll.

I wonder if after the MFT fix that PW might be an easier way to Explore your files assuming it now sees them.

 

Agreed! I'm getting closer and closer to a fresh install.

• 
  
  I do see NTDLR and NTdetect.com. I don't see a Windows directory at all. Perhaps that directory has been missing as long as the files I was after in the other partition were.
  
  Any other thoughts? Or is it time to reformat and install Windows 7....

 

If you have all your data I would just do a reinstall. Make sure you have your external unplugged during reinstall.

Because of the bad sector, if you are sure you have all your data I would delete the partition you are going to install Win7 on and create a new one and do a full format on it.

 

Sach2, thanks for staying with me on this one...I really appreciate it. I now have all the family photos and videos that I was worried I had lost. Thanks again.

 

I'm sorry Testdisk was not more successful but from what I have read a truly corrupt MFT which I think you had is basically not recoverable in 90+ percent of cases. A reformat is usually the only solution.

It is difficult for me to reproduce the error to look for better software but from what I have seen you have as much knowledge of computers as I do and tried all possible solutions.

I'm glad your data is safe and do make sure the external is not plugged in during installation. Make sure you select the option for full format of your partition during installation to overwrite the bad sector.

Good Luck with install. You will like Win7 not easy to lose boot files as a bonus.

 

Sach2 - you still out there??

I have been unsuccessful in wiping my HDD to reinstall Windows XP. You may remember that i saw 4 partitions previously (one FAT and one FAT32 - both Dell ones - and two NTFS ones). I have used Partition Wizard to wipe those out (I have also tried with GParted) and have made several attempts to install Windows XP, but without success. You may also remember that there were hidden sectors on my HDD. So I downloaded Western Digital's Diagnostic software and used it to write 0s to the HDD. When I went to install XP after that, it told me the disk had 131 GB of space on it. This is mighty close to the size of my old partition, so I don't think I've resolved my issue.

Currently, in Partition Wizard, the HDD (WD says it is a 160 GB drive) shows one partition of 149.01 GB, File System Unallocated, Type Logical. What happens when I try to install XP is that I get through the first part of the install and then it tells me to reboot. When I reboot to the HDD, I get NTLDR is missing (that is what started this whole mess!). When I reboot to the install disc, it just starts the install all over again.

My guess is that there is either something still on the HD or something in the BIOS that is screwing me up. One last bit of info - this was originally set up by Dell as a RAID machine. I have changed the BIOS from RAID to AUTOSELECT (the only other choice) and I have "deleted" the RAID setup. I have also physically disconnected my mirror drive so as not to confuse (either me or it).

What I'd like to do is completely wipe this HD clean and install the XP disc I have. That way I can confirm a working system before confounding things by trying a Windows 7 install for the first time. Any suggestions? Thanks in advance for any thoughts.

Here is what is happening. When I

 

Do see this option in BIOS? RAID Auto/ATA

 

I had reset that option in BIOS as directed (RAID Auto/ATA) and that is how BIOS is set currently. The install doesn't complete.

Could there still be some hidden FAT partition that the BIOS is going to for boot instructions?

(Glad to have you back!)

 

How far into the install do you get. You boot from CD it says Windows is inspecting your Hardware. Loading files. It reboots about 3 minutes later. Then it asks you how you want to partition the drive. Do get that far or farther?

 

Incidentally, I am currently running a memory test (just in case) and will be trying to run an external virus test per mcsmc's suggestion here.

 

I've read about a dozen threads and I can't tell if you need sata drivers for an XP install on that computer or not. Most say the autodetect/sata should work. Does that PC have a floppy drive or no? If you have to slipstream sata drivers into an installation disc it may be simpler to just go with Win7 which has all that built in.

 

Okay. Loading Win XP Home on the Dell Dimension E310 with only one HD physically connected and BIOS set for RAID Auto/ATA.

Setup goes through the loading files routine (I see lots scrolling by on the bottom, ending in Setup is starting Windows). Then I get to the Windows XP Home Edition Setup screen. To set up Windows XP now, press Enter. I do. I get the EULA screen and press F8. I get to a menu of drive choices (4 unknown discs that relate to the various SD/CF cards that I could be using (all slots are empty)) and one that lists:

131070 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]
Unpartitioned space 131069 MB [this is the number that doesn't make sense given that Partition Wizard says there is 149.1 GB free]

My choices are Enter=Install C=Create Partition F3= Quit

If I click enter, I get taken to a screen that tells me:

A new partition for Windows XP has been created on

131070 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]

This partition must now be formatted.

Here I have two choices of NTFS formatting (Quick or Unlabeled [Normal]). I choose Normal.

Then I get to a screen which shows:

Please wait while Setup formats the partition

I: Partition1 [New (Raw)] 131062 MB ( 131061 MB free)

on 131070 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]

and the format routine begins (takes 10-20 minutes, I think). That's where I am now. After this, I believe I'll be asked to restart (I don't think there is anything else). When I do, that is where I have been getting the NTLDR is missing message. I'll update when I see that next.

In the meantime, I am about to head out. If I don't get a chance again tonight, have a very Happy New Year!

 

That all sounds correct. Double check there is no card in any reader. Watch the screen during reboot and make sure you are seeing "Press any key to boot from CD..." before you get the ntdlr message. You don't want to press any key but just want to verify that it is reading the CD which it is if you see that message.

I'm not sure what is causing the problem. I'll look around. Bios looks ok and the installer is seeing your HD so I don't think the sata drivers are a problem.

The smaller size of the drive is probably due to a 137gb limit of the XP installer. It installs as if on a 137gb drive but when full XP starts it corrects the information. 137-6gb for formatting overhead=131gb.

I wish you a very Happy New Year! And I will be considering your problem.

 

Happy New Year!

I'm not sure what happened. But I'm pleased. Perhaps it just needed a fresh start and a New Year. In any case, the install that I started last night worked fine. I left as the drive was still being formatted by the install disk and when I checked this morning, I had the GUI of the next step in the install process. The process has been completed and I have successfully shut down and restarted. A couple curious things, though:

1) I wasn't asked for a product key. Where do you suppose it got it from? I am suspicious that there is still a hidden Dell FAT partition on my drive. But this is especially curious as the machine was a Media Edition one (I'm pretty sure that is XP Pro) and I only had an XP Home disc to install from.

2) Why would it have installed to drive I and not C? Strange that it chose to start the card reader drives at C (through F), then the two DVD drives (G and H), before finally giving the HD drive I. By the way, if I wanted to reset the drive ID to C from I, is there an easy way to do that?

3) Thanks for the info on the size limit for the XP installation...I didn't know that. I guess that means I have some dead space on the drive and I should probably add a partition for that space, no?

Thanks again for all of the ideas and help.