Data Recovery from lost NTFS. Help!

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this. Thanks Gregg

Gregg OBanion wrote in
message news:eNPke.3700$Xh.1255@fed1read07...

I need some advice. I was transferring info from a 160 gig IDE Western Digital
hard drive and forgot the drive was in use when I renamed it in Drive
properties. The drive instantly lost its file system asks if I want to format
it when I click on the drive letter.

I like Easy Recovery Pro, but it aint free.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this.

This one is as good as any for that.

"Gregg OBanion" wrote:

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the file
system. If it wasn't legit then the operating system would have blocked it.
From the little info provided above, I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file
system).

Other possible causes to the disappearing of the file system of your drive could
be a modified partition table, in its MBR, or changed settings for that drive,
in the CMOS. Yet given the symptoms described, I would think that a damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

File recovery such as GetDataBack and EasyRecovery are appropriate when there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
wrote:

Hi, Zvi

"Gregg OBanion" wrote:

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the file
system. If it wasn't legit then the operating system would have blocked it.
From the little info provided above, I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file
system).

With NTFS the volume label is not written to the boot sector but only
to the metadata file $Volume.

Other possible causes to the disappearing of the file system of your drive could
be a modified partition table, in its MBR, or changed settings for that drive,
in the CMOS. Yet given the symptoms described, I would think that a damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

You need a tool that can do a raw mode recovery. I've never used
GetDataBack, so don't know if it can do that. I think that File
Scavenger can and it is reasonably priced.

File recovery such as GetDataBack and EasyRecovery are appropriate when there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

May or may not help - probably not IMO. A missing boot sector can lead
drive manager to ask for a format, but so can a damaged MFT. This
really needs some diagnostic help.

Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi


Bob

Thank You for the advice. It makes sense to me.

I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name
(the
volume name is written to the boot sector, in addition to the entry in the
file
system).
For starters, NTFS partitions keep a backup of the boot sector in the very
last
sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg


"Zvi Netiv" wrote in message
...
"Gregg OBanion" wrote:

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want
to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the
file
system. If it wasn't legit then the operating system would have blocked
it.
From the little info provided above, I would guess that something went
wrong
when the OS tried to rewrite the boot sector with the modified volume name
(the
volume name is written to the boot sector, in addition to the entry in the
file
system).

Other possible causes to the disappearing of the file system of your drive
could
be a modified partition table, in its MBR, or changed settings for that
drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to
find
much.

File recovery such as GetDataBack and EasyRecovery are appropriate when
there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and
data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very
last
sector of every partition, respectively.

Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

Thanks Robert. I will try File Scavenger and report back here.

"Robert Green" wrote in message
...
On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
wrote:

Hi, Zvi

"Gregg OBanion" wrote:

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I
want to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the
file
system. If it wasn't legit then the operating system would have blocked
it.
From the little info provided above, I would guess that something went
wrong
when the OS tried to rewrite the boot sector with the modified volume name
(the
volume name is written to the boot sector, in addition to the entry in the
file
system).

With NTFS the volume label is not written to the boot sector but only
to the metadata file $Volume.

Other possible causes to the disappearing of the file system of your drive
could
be a modified partition table, in its MBR, or changed settings for that
drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to
find
much.

You need a tool that can do a raw mode recovery. I've never used
GetDataBack, so don't know if it can do that. I think that File
Scavenger can and it is reasonably priced.

File recovery such as GetDataBack and EasyRecovery are appropriate when
there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and
data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very
last
sector of every partition, respectively.

May or may not help - probably not IMO. A missing boot sector can lead
drive manager to ask for a format, but so can a damaged MFT. This
really needs some diagnostic help.

Can someone tell me of a good newsgroup for this. Thanks Gregg

This one is.

Regards, Zvi


Bob

"Gregg OBanion" wrote:

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.

I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file system).
For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
to format the volume).

Could you please describe the drive configuration: What order is the problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
MBR, boot sector).

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

Regards, Zvi

"Zvi Netiv" wrote in message
"Gregg OBanion" wrote:

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want
to
format it when I click on the drive letter.

There is no reason why the renaming of a volume would cause loss of the
file
system. If it wasn't legit then the operating system would have blocked
it.
From the little info provided above, I would guess that something went
wrong
when the OS tried to rewrite the boot sector with the modified volume name
(the
volume name is written to the boot sector, in addition to the entry in the
file
system).

Other possible causes to the disappearing of the file system of your drive
could
be a modified partition table, in its MBR, or changed settings for that
drive,
in the CMOS. Yet given the symptoms described, I would think that a
damaged
boot sector is the most likely.

I've used GetDataBack and recovered some files but it doesn't seem to
find
much.

File recovery such as GetDataBack and EasyRecovery are appropriate when
there is
no better choice. I would first check the above and fix the necessary, if
possible. This would give a better chance to fully recover the drive and
data,
lock, stock and barrel. Yet it requires some skill and low level (DOS)
operation.

For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

Zvi Netiv wrote:
"Gregg OBanion" wrote:

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.

I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume name (the
volume name is written to the boot sector, in addition to the entry in the file system).
For starters, NTFS partitions keep a backup of the boot sector in the very last
sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
to format the volume).

Could you please describe the drive configuration: What order is the problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as the
controller will set the drive in the BIOS list (not the same as CMOS!) with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.

Regards
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

Sorry for the inexperience with my post. It's been a while.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

Thanks Zvi.

"Zvi Netiv" wrote in message
...
Zvi Netiv wrote:
"Gregg OBanion" wrote:

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the
previous
posts to the top (only a "half" top-poster), then why moving anything at
all?
Your follow-up would have made more sense if it was all in-line.

I would guess that something went wrong
when the OS tried to rewrite the boot sector with the modified volume
name (the
volume name is written to the boot sector, in addition to the entry
in the file system).
For starters, NTFS partitions keep a backup of the boot sector in the
very last
sector of every partition, respectively.

Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
on a
Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect
(offer
to format the volume).

Could you please describe the drive configuration: What order is the
problem
drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the
CMOS,
MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect
as the
controller will set the drive in the BIOS list (not the same as CMOS!)
with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or
professional
recovery, if you can afford it and the data is worth the expense.

Regards
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

"Gregg OBanion" wrote:

Sorry for the inexperience with my post. It's been a while.

I meant that top-posting isn't appreciated here. What alienates me in top-post
follow-ups is the liberty that some take in abusing the product of others' time
and efforts and transforming them into senseless babble. You aren't the only
one to seek help through newsgroups, many use their archives to look for
solutions to problems they have. Hence, top-posting is ungrateful to
contributors, it doesn't encourage them in helping you, and is unfair to
readers.

The same goes for trimming previous text and not fragmenting the lines of quoted
text, but the latter are more a matter of experience in newsgroups, while
top-posting is a conscious and selfish choice.

I realize that not all contributors do mind about top-posting, yet I am sure
that I reflect the feeling of the majority. Witness their posts.

The drive is one big partition. The Info in Disk Management reads, Disk 3,
Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
card.

The above doesn't exclude the possibility that either the MBR and/or the boot
sector were altered.

To further investigate, you can download RESQ from www.resq.co.il/resq.php and
prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed in
the ResQ welcome message). If Win 98 is not available to you, then download
also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS To
make a RESQ boot floppy with it, do as follows:

Format a floppy from the CMD shell (NOT with Win's disk manager) with the
command FORMAT A: /U Open the FreeDOS self-extract archive and let it make the
floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite files,
and [don't] execute Makeresq) then press the 'unzip' button.

Disconnect the power and data cables from all drives, except from the one you
want to assess, boot from the RESQ floppy just made (leave the diskette
write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

The program will initiate an assessment cycle of the hard drive and will write
its findings into a text file report named RESQDISK.RPT, in A:\. Press 'enter'
every time RESQDISK pauses and saves a screen snapshot, until the program
terminates and exits.

Post here the report file (just paste the text file into your follow-up), and
avoid top-posting!

Regards, Zvi

"Zvi Netiv" wrote in message
"Gregg OBanion" wrote:

Thank You for the advice. It makes sense to me.

Yet it doesn't to me. Since you already bothered moving part of the previous
posts to the top (only a "half" top-poster), then why moving anything at all?
Your follow-up would have made more sense if it was all in-line.

[...]
Can you tell me how to begin to check this problem. I've left the drive
untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
on a Promise Ultra 100 PCI Card. Thanks Again. Gregg

As Bob Green pointed out, a damaged MFT could also cause the same effect
(offer to format the volume).

Could you please describe the drive configuration: What order is the
problem drive (first, second, ... fourth?), and how was it partitioned (one big
partition, several, what types?).

If the drive is one of the first two (you can always make it that by
disconnecting other drives), then you can use RESQDISK from
www.resq.co.il/resq.php to assess the boot chain (drive settings in the
CMOS, MBR, boot sector).

Correction: Forget the CMOS drive settings, since it uses the Ultra-100
controller. Yet a corrupted partition table could have a similar effect as the
controller will set the drive in the BIOS list (not the same as CMOS!) with a
best fit to what's found in the MBR.

If the above are OK then revert to data recovery software, or professional
recovery, if you can afford it and the data is worth the expense.
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities