Re: Newly created NTFS files deleted during System Hive restore

From: R. C. White (RCWhite_at_msn.com)
Date: 08/19/04 

Date: Thu, 19 Aug 2004 10:29:03 -0500

Hi, Patrick.

(Sorry about that blank reply. I hit Send by mistake.)

My symptoms weren't identical to yours, but the results were about as bad.
One morning about a year ago, I turned on the power and went to get a cup of
coffee while it booted. (Several drives, both SCSI and RAID controllers, so
it took a while to boot.) When I came back, Chkdsk was running on a 25 GB
NTFS volume on my second HD - and not doing well. (My guess is that during
that boot process, a momentary glitch - bad or loose cable - had caused a
mis-read of the system information on the HD, causing Chkdsk to try to fix
something that wasn't broken.) Eventually, Chkdsk gave up and reported that
the volume was not repairable. Dir did no good, neither did further tries
to run Chkdsk or anything else I could think of. Luckily, I had plenty of
unpartitioned space on my third HD, so I created a new volume there, gave it
the "bad" volume's drive letter and worked from there for a few months while
I tried to figure out how to recover my data. I tried some recovery
utilities I already had, plus demo versions of a couple of others, but none
did any good.

Finally, I downloaded R-Studio from www.r-tt.com ($70) and ran that. In a
few hours, it recovered almost all the "lost" files from my bad volume.
When I gave up on getting any more files, I reformatted that volume, put all
my recovered files back and restored its drive letter.

I don't know if R-Studio will fit your situation, but it was worth the $70
in my case.

RC 

-- 
R. C. White, CPA
San Marcos, TX
rc@corridor.net
Microsoft Windows MVP
"Patrick" <Patrick@discussions.microsoft.com> wrote in message 
news:00C4B071-7E45-4618-9105-AE487DDF51EF@microsoft.com...
> Update:  After further investigation, it appears that the MFT was 
> corupted.
> Chkdsk in it's attempt to curtail the coruption, deleted the newly created
> files.  Please, someone tell me there's a way to fix the MFT?  Some of the
> undelete utilities are finding raw files (when they ignore the MFT).  I
> haven't written much if anything to to drive so the files should be mostly
> intact.  Please help before I seriously consider spending $99 on emailing
> Microsoft.
>
> "Patrick" wrote:
>
>> This morning I woke up to find my Win2k Pro PC with a
>> system hive too large error (IE the Systemced not found
>> issue).  I followed the steps of copying the winnt/repair
>> version of system to the system32/config folder and booted
>> into Windows.  I was pressed for time and was on my way
>> out when I rebooted.  I came back to check on the progress
>> and found Windows (I'm assuming checkdsk) deleting files
>> because of some index error or something like that.  I
>> prayed it was nothing and left.  After finishing the
>> restore procedure to get my original system hive working
>> again, I finally got back into Windows propperly.  To my
>> horror, I discovered that indded the files from the last
>> 15 or so days created on my NTFS storage partition had
>> been deleted. I've tried all sorts of undelete programs
>> and nothing can find any traces of them.  In fact, they
>> claim there are no deleted files on that entire drive.  I
>> need these files back.
>>
>> Has anyone encountered this problem before?  Anyone know
>> how I can restore these files?  Please email me.

Relevant Pages

  • Re: Scheduling CHKDSK and DEFRAG for unattended execution
    ... If you are working with Windows XP Home Edition, ... can create an unlimited number of logical drives per disk. ... Description of Enhanced Chkdsk, Autochk, and Chkntfs Tools ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Check disk has been canceled?
    ... In My Computer or Windows Explorer, right-click the drive you want to ... Runs Chkdsk by using the /f parameter. ... the disk checking for the next time you restart your computer. ... The /d switch restores the machine to the default behavior; all drives are ...
    (microsoft.public.windowsxp.general)
  • Re: DOS prompt in W2K? and Safe Mode?
    ... and windows booted up normally. ... How to get to a real DOS prompt to run chkdsk w/o processes? ... you wish to check other drives then you may be able to close ... CheckDisk is a powerful tool for searching and repairing disk errors. ...
    (microsoft.public.win2000.general)
  • Re: CHKDSK went crazy on 200GB HD upon install!
    ... CHKDSK finds lost clusters and saves each cluster with a ... |>Windows XP should be at least 5% of your total hard | drive, ... |>| partition) on a Promise Ultra100TX2 PCI controller | card. ... Apparently |>| though, not only does it not support the drives, it ...
    (microsoft.public.windowsxp.hardware)
  • Re: Check disk has been canceled?
    ... In My Computer or Windows Explorer, right-click the drive you want to ... Runs Chkdsk by using the /f parameter. ... the disk checking for the next time you restart your computer. ... The /d switch restores the machine to the default behavior; all drives are ...
    (microsoft.public.windowsxp.general)
Loading