Disaster recovery 2

gulfstreme · External Since: Sep 20, 2005 Posts: 6

Today I booted my Win98se machine and got the dos prompt. I powered
down and hooked it up as a slave and there was NOTHING on my C drive
except AUTOEXEC.DOS (1k) COMMAND.COM (92k), FRUN (0k), BOOTLOG.TXT (0k)
and SUHDLOG.DAT (9k). I'd been running this system for a few years
with around 100 or so software programs installed at any one time and
had no significant problems. I've got 3 other partitions on this
physical disk that are intact (my DATA.. thank goodness!) How could
an entire drive disappear like that?

This might be significant:

Some time ago I noticed a bunch of FILE0001.CHK, 2, 3, etc in the root
dir of the C drive partition. I suppose they were left from a previous
scandisk but I hadn't seen scandisk run on boot in quite some time and
I hadn't run it manually either so everything seemed fine and I just
ignored it.

Also, the last time I started the computer I deleted into the bios
setup screen and let it sit there for an hour or so.. Why you ask?
Because this powers the firewire to charge my Ipod and I didn't need to
boot into windows. The night before it booted fine.. just like it
always had for years. So, I'm thinking this was a virus or I should
have started backing up when I saw the .chk files.

My System specs:

Windows 98se
Regular manual MS Windows updates
Regular manual AVG virus scans
Regular manual AdAware spyware scans
Motorola Hardware Router
Cable Modem
Maxtor ATA133 controller card
200GB Maxtor Hard Disk
1 FAT32 primary active boot partition
27GB C:\ drive with windows and programs installed on it
1 extended partition
3 50GB FAT32 data drives D:\, E:\ and F:\

BTW: This is distater recovery 2 because I just recently went through
this with a 250GB "temp" drive that got corrupted when I took it off of
its controller and stuck it in a external enclosure and then tried to
read and write to it.. well it got corrupted and I ended up loosing
all my data. I decided it must have been the controller chip in the
external case was not compatible with the controller I formatted the
drive on originally.

Ron Badour1 · External Since: Apr 15, 2004 Posts: 1754

Determine the brand of the hard drive, go to the maker's web site, download
the diagnostic software and check the health of the drive--it may have
failed. If it shows as being OK, there are software products that you can
use to try to retrieve any missing data that is not backed up. My standard
blurb on this software:

You need to quit using the partition that the files were deleted from in
order to prevent the deleted files from being overwritten. You will
need help trying to retrieve the files:

RepoMan, $50, The demo version gives a fair indication of what
information can be recovered from your hard disk but data is not
recovered. http://www.diydatarecovery.nl/~tkuurstra/index.htm#irecover

Recover4All, $49, demo will retrieve files up to 10 kb and show what
else can be retrieved. Retrieved files are copied to another drive:
http://www.recover4all.com/

Restoration, Freeware, not tried:
http://www.webattack.com/get/restoration.html

--
Regards

Ron Badour, MS MVP for W98
Tips: http://home.satx.rr.com/badour
Knowledge Base Info:
http://support.microsoft.com/default.aspx?pr=kbinfo

"gulfstreme" <gulfstreme5.TakeThisOut@yahoo.com> wrote in message
news:1127278248.013360.118000@g49g2000cwa.googlegroups.com...
> Today I booted my Win98se machine and got the dos prompt. I powered
> down and hooked it up as a slave and there was NOTHING on my C drive
> except AUTOEXEC.DOS (1k) COMMAND.COM (92k), FRUN (0k), BOOTLOG.TXT (0k)
> and SUHDLOG.DAT (9k). I'd been running this system for a few years
> with around 100 or so software programs installed at any one time and
> had no significant problems. I've got 3 other partitions on this
> physical disk that are intact (my DATA.. thank goodness!) How could
> an entire drive disappear like that?
>
>
>
>
> This might be significant:
>
> Some time ago I noticed a bunch of FILE0001.CHK, 2, 3, etc in the root
> dir of the C drive partition. I suppose they were left from a previous
> scandisk but I hadn't seen scandisk run on boot in quite some time and
> I hadn't run it manually either so everything seemed fine and I just
> ignored it.
>
> Also, the last time I started the computer I deleted into the bios
> setup screen and let it sit there for an hour or so.. Why you ask?
> Because this powers the firewire to charge my Ipod and I didn't need to
> boot into windows. The night before it booted fine.. just like it
> always had for years. So, I'm thinking this was a virus or I should
> have started backing up when I saw the .chk files.
>
>
>
> My System specs:
>
> Windows 98se
> Regular manual MS Windows updates
> Regular manual AVG virus scans
> Regular manual AdAware spyware scans
> Motorola Hardware Router
> Cable Modem
> Maxtor ATA133 controller card
> 200GB Maxtor Hard Disk
> 1 FAT32 primary active boot partition
> 27GB C:\ drive with windows and programs installed on it
> 1 extended partition
> 3 50GB FAT32 data drives D:\, E:\ and F:\
>
>
>
> BTW: This is distater recovery 2 because I just recently went through
> this with a 250GB "temp" drive that got corrupted when I took it off of
> its controller and stuck it in a external enclosure and then tried to
> read and write to it.. well it got corrupted and I ended up loosing
> all my data. I decided it must have been the controller chip in the
> external case was not compatible with the controller I formatted the
> drive on originally.
>

gulfstreme · External Since: Sep 20, 2005 Posts: 6

Thanks for the reply.

I'd just like to know what most likely happened. Does this sound
familiar to anyone?

I'll try the Maxtor diagnostic. I've got GetDataBack for FAT, but it
can't recover the disk fully.. It seems the file allocation table is
gone. I'll just have to reinstall Windows and my programs on a new
hard drive. Then copy all my data off the data partitions onto a new
hard drive. Then zero and reformat the old one and use it just for
games or something.

gulfstreme · External Since: Sep 20, 2005 Posts: 6

Heres an update:

Maxtor PowerMax Advanced Test (Full Scan Test)found no problem.

I then tried Ontrack EasyRecovery and ran a "Format Recovery" and it
presented me with a directory structure much like I remembered it
except the Windows directory was missing. I then found it under
\Lostfile\Dir0. I also loooked a little closer at the FILE####.CHK
files. There are 102 of them.. ranging from 16k to one thats 667MB.

One other curious note: There are 5 files at about 100k on there now
but windows reports 13GB used space.

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

The CHK files indicate that you have run CHKDSK at some point after the
failure and it attempted to repair the problem.

If the drive was faulty at that point, the repair simply made the problem
worse as it attempted to use a faulty drive. If it wasn't faulty at that
point then CHKDSK succeeded with the repair, but that means that the files
have been re-named and re-organised as you describe.

The original problem was probably a transient data error that caused the
system to use an invalid directory structure.

An error in used/unused space indicates that there are still errors in the
directory structure.
--
Jeff Richards
MS MVP (Windows - Shell/User)
"gulfstreme" <gulfstreme5 DeleteThis @yahoo.com> wrote in message
news:1127367285.878019.320910@g14g2000cwa.googlegroups.com...
> Heres an update:
>
> Maxtor PowerMax Advanced Test (Full Scan Test)found no problem.
>
> I then tried Ontrack EasyRecovery and ran a "Format Recovery" and it
> presented me with a directory structure much like I remembered it
> except the Windows directory was missing. I then found it under
> \Lostfile\Dir0. I also loooked a little closer at the FILE####.CHK
> files. There are 102 of them.. ranging from 16k to one thats 667MB.
>
> One other curious note: There are 5 files at about 100k on there now
> but windows reports 13GB used space.
>

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

Replace each occurrence of CHKDSK with SCANDISK. I'm thinking one generation
too far back Smile

--
Jeff Richards
MS MVP (Windows - Shell/User)
"Jeff Richards" <JRichards.TakeThisOut@msn.com.au> wrote in message
news:egIl5k1vFHA.596@TK2MSFTNGP12.phx.gbl...
> The CHK files indicate that you have run CHKDSK at some point after the
> failure and it attempted to repair the problem.
>
> If the drive was faulty at that point, the repair simply made the problem
> worse as it attempted to use a faulty drive. If it wasn't faulty at that
> point then CHKDSK succeeded with the repair, but that means that the files
> have been re-named and re-organised as you describe.
>
> The original problem was probably a transient data error that caused the
> system to use an invalid directory structure.
>
> An error in used/unused space indicates that there are still errors in the
> directory structure.
> --
> Jeff Richards
> MS MVP (Windows - Shell/User)
> "gulfstreme" <gulfstreme5.TakeThisOut@yahoo.com> wrote in message
> news:1127367285.878019.320910@g14g2000cwa.googlegroups.com...
>> Heres an update:
>>
>> Maxtor PowerMax Advanced Test (Full Scan Test)found no problem.
>>
>> I then tried Ontrack EasyRecovery and ran a "Format Recovery" and it
>> presented me with a directory structure much like I remembered it
>> except the Windows directory was missing. I then found it under
>> \Lostfile\Dir0. I also loooked a little closer at the FILE####.CHK
>> files. There are 102 of them.. ranging from 16k to one thats 667MB.
>>
>> One other curious note: There are 5 files at about 100k on there now
>> but windows reports 13GB used space.

gulfstreme · External Since: Sep 20, 2005 Posts: 6

Here's the explanation I'm leaning towards at this time. I think
Windows must have caused some software errors and overwritten the
original FAT. Since the OnTrack EasyRecovery can still see most of
what was there, I think it must be using the backup FAT.

Now I'm wondering if I copied the backup FAT into the position of the
original FAT and then ran a scandisk, if I would be able to get it to
boot back into Windows?

gulfstreme · External Since: Sep 20, 2005 Posts: 6

FYI: I've already backed up all the data on the disk AND created a
backup image of the partition.

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

If everything is backed up, why not just let the disk recovery routine try
to recover the disk? If it fails, you can wipe the disk and start over.

However it's more likely that there was a hardware error of some sort than
Windows overwriting the boot area, and in that case it's most likely there
was other damage.

If it was my system and I was confident of the backups, I'd wipe it and
start over.
--
Jeff Richards
MS MVP (Windows - Shell/User)
"gulfstreme" <gulfstreme5.TakeThisOut@yahoo.com> wrote in message
news:1127443388.530717.219730@g43g2000cwa.googlegroups.com...
> FYI: I've already backed up all the data on the disk AND created a
> backup image of the partition.
>

gulfstreme · External Since: Sep 20, 2005 Posts: 6

Well I've formulated another theory.. I'd just unplugged the firewire
card that was physically next to the ATA 133 controller card that the
hard drive was conected to. In doing so I may have jiggled or unseated
the controller card and on boot the loose card caused corruption on the
boot partition.

If that were the case, would it be likely that only the boot partition
got corruption?

> However it's more likely that there was a hardware error of some sort than
> Windows overwriting the boot area, and in that case it's most likely there
> was other damage.

Jeff Richards · External Since: Mar 14, 2004 Posts: 1333

Corruption would occur wherever the disk was written to. It may well be
restricted to the boot partition, but without knowing exactly what happened
when the system was faulty it's not possible to be confident about what got
damaged and what didn't.
--
Jeff Richards
MS MVP (Windows - Shell/User)
"gulfstreme" <gulfstreme5 RemoveThis @yahoo.com> wrote in message
news:1127971113.253526.289110@f14g2000cwb.googlegroups.com...
> Well I've formulated another theory.. I'd just unplugged the firewire
> card that was physically next to the ATA 133 controller card that the
> hard drive was conected to. In doing so I may have jiggled or unseated
> the controller card and on boot the loose card caused corruption on the
> boot partition.
>
> If that were the case, would it be likely that only the boot partition
> got corruption?
>
>
>
>> However it's more likely that there was a hardware error of some sort
>> than
>> Windows overwriting the boot area, and in that case it's most likely
>> there
>> was other damage.
>