Re: Newly created NTFS files deleted during System Hive restore
From: R. C. White (RCWhite_at_msn.com)
Date: 08/20/04
- Next message: Brian Wilson: "Offline folders issue"
- Previous message: John: "Re: Mystery file messing with Stealthray"
- In reply to: Patrick: "Re: Newly created NTFS files deleted during System Hive restore"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 20 Aug 2004 09:33:04 -0500
Hi, Patrick.
Aha! We may be back to the basics here: How new is your
mobo/chipset/BIOS/Windows?
HDDs over ~137 GB require updated hardware and supporting software to use
the 48-bit addressing scheme. Older equipment simply can't read the larger
disks because they don't have enough address lines to store addresses that
large.
Is your Win2K up to date? Have you visited Windows Update regularly?
Recently? What is your SP level? The quickest way to check that is with
Win+Break. That is, hold the Windows logo key while you press the
Pause/Break key. The System Properties page will pop up on your screen.
That should tell you, under System, what OS you are running, including which
Service Pack is installed. I've not run Win2K in nearly 4 years, since
WinXP arrived, but I believe Win2K should be up to SP4 now; the original
Win2K did not support 48-bit addressing.
Even if you have SP4, you still might need to check with your computer or
mobo maker to be sure you have a BIOS that supports the "big drives", too.
I've used R-Studio a few times, but I'm far from an expert on what it can
and cannot do. Like most of us, once I got my "lost" files back, I quit
exploring R-Studio. As I recall, it did an excellent job of recovering the
files themselves, but a less-than-excellent job on the directories. Some of
the directory tree was intact, but there were a lot of directory names that
were converted to numbers and moved into the Root so that I had to do some
exploring, renaming and shuffling to get them back into their previous
order. If you have a simple, shallow directory tree, that's not too hard to
do, but if you have many levels of sub-directories, it can be a big project.
RC
-- R. C. White, CPA San Marcos, TX rc@corridor.net Microsoft Windows MVP "Patrick" <Patrick@discussions.microsoft.com> wrote in message news:BC94C8C1-12BA-4F52-BA84-6C3417DD3551@microsoft.com... > Alright, I think I know why most of the file recovery programs aren't > finding > anything. Most of them seem to think the drive is only about 128 gig > (268430084 sectors) when the drive is really 250 gig (488392001 sectors), > thus they aren't even scanning the area where the files were lost. The > true > size is reported by Partition Magic. > > "Patrick" wrote: > >> That's good to hear. I did download R-Studio and gave it a glance over a >> few >> days ago. It's currently scanning my drive. Are there any options I >> should >> be aware of? Were you able to recover the file names and directories or >> were >> they all just raw files? About how much of the drive were you able to >> recover? Any special settings I should choose? >> >> "R. C. White" wrote: >> >> > Hi, Patrick. >> > >> > (Sorry about that blank reply. I hit Send by mistake.) >> > >> > My symptoms weren't identical to yours, but the results were about as >> > bad. >> > One morning about a year ago, I turned on the power and went to get a >> > cup of >> > coffee while it booted. (Several drives, both SCSI and RAID >> > controllers, so >> > it took a while to boot.) When I came back, Chkdsk was running on a 25 >> > GB >> > NTFS volume on my second HD - and not doing well. (My guess is that >> > during >> > that boot process, a momentary glitch - bad or loose cable - had caused >> > a >> > mis-read of the system information on the HD, causing Chkdsk to try to >> > fix >> > something that wasn't broken.) Eventually, Chkdsk gave up and reported >> > that >> > the volume was not repairable. Dir did no good, neither did further >> > tries >> > to run Chkdsk or anything else I could think of. Luckily, I had plenty >> > of >> > unpartitioned space on my third HD, so I created a new volume there, >> > gave it >> > the "bad" volume's drive letter and worked from there for a few months >> > while >> > I tried to figure out how to recover my data. I tried some recovery >> > utilities I already had, plus demo versions of a couple of others, but >> > none >> > did any good. >> > >> > Finally, I downloaded R-Studio from www.r-tt.com ($70) and ran that. >> > In a >> > few hours, it recovered almost all the "lost" files from my bad volume. >> > When I gave up on getting any more files, I reformatted that volume, >> > put all >> > my recovered files back and restored its drive letter. >> > >> > I don't know if R-Studio will fit your situation, but it was worth the >> > $70 >> > in my case. >> > >> > RC >> > >> > "Patrick" <Patrick@discussions.microsoft.com> wrote in message >> > news:00C4B071-7E45-4618-9105-AE487DDF51EF@microsoft.com... >> > > Update: After further investigation, it appears that the MFT was >> > > corupted. >> > > Chkdsk in it's attempt to curtail the coruption, deleted the newly >> > > created >> > > files. Please, someone tell me there's a way to fix the MFT? Some >> > > of the >> > > undelete utilities are finding raw files (when they ignore the MFT). >> > > I >> > > haven't written much if anything to to drive so the files should be >> > > mostly >> > > intact. Please help before I seriously consider spending $99 on >> > > emailing >> > > Microsoft. >> > > >> > > "Patrick" wrote: >> > > >> > >> This morning I woke up to find my Win2k Pro PC with a >> > >> system hive too large error (IE the Systemced not found >> > >> issue). I followed the steps of copying the winnt/repair >> > >> version of system to the system32/config folder and booted >> > >> into Windows. I was pressed for time and was on my way >> > >> out when I rebooted. I came back to check on the progress >> > >> and found Windows (I'm assuming checkdsk) deleting files >> > >> because of some index error or something like that. I >> > >> prayed it was nothing and left. After finishing the >> > >> restore procedure to get my original system hive working >> > >> again, I finally got back into Windows propperly. To my >> > >> horror, I discovered that indded the files from the last >> > >> 15 or so days created on my NTFS storage partition had >> > >> been deleted. I've tried all sorts of undelete programs >> > >> and nothing can find any traces of them. In fact, they >> > >> claim there are no deleted files on that entire drive. I >> > >> need these files back. >> > >> >> > >> Has anyone encountered this problem before? Anyone know >> > >> how I can restore these files? Please email me.
- Next message: Brian Wilson: "Offline folders issue"
- Previous message: John: "Re: Mystery file messing with Stealthray"
- In reply to: Patrick: "Re: Newly created NTFS files deleted during System Hive restore"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
