Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Are My Files Salvageable?


  • Please log in to reply
9 replies to this topic

#1 Strudles

Strudles

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:20 AM

Posted 11 August 2008 - 09:21 PM

I have a 200 GB Western Digital IDE drive (D:\, NTFS) set up as a slave on my Win2k SP2 system. My main boot drive is a 60 GB Western Digital (C:\, also NTFS). Just last week I reformatted the 60 GB drive (didn't touch the 200 GB) because I was having some serious issues that seemed to be virus related (even tho scans came up negative). My 200 GB drive was fine for a couple of days, then one afternoon when I clicked on the drive in Windows Explorer, I got an error (I'm sorry I don't remember the exact verbiage) something to the effect that the file I was trying to locate was missing or damaged. Well, I rebooted my computer hoping that would clean it up, but when I clicked on my D: drive after restart, it now said something about drive D: not being accessible and that the drive wasn't "formatted, would you like to format now?" "Yes/No." I clicked No.

I did a scan with TestDisk and it said that my boot sector (can't remember if it said MBR or not) was bad or damaged. Then I did a scan with Active@ Partition Recovery for Windows (Demo) and it found 22 partitions and 0 files. I never multiple-partitioned it so I don't know where all of those partitions came from. It initially said that the status of the biggest chunk of hard drive (NTFS), 184.9 GB, was "bad," but later upgraded its status to "not bad." All of the other partitions were Fat 16 (1.869 GB) or Fat32 (3.007 GB) and were listed as status: "poor."

When the scan was finished, I was able to see folders inside of most of the partitions, and the ones in the Local Disk were legible, but there were only a couple of files in them. The folders in the other partitions have alien names, random characters like 2>L7<Q:W.`E`or jV@~.+. Also the creation dates and modification dates are absurd, folders supposedly created in the future and modified sometime in the past. I have an extremely bad feeling that my files are gone, gone, gone, but I thought I would post here in one last ditch effort. I did backup my files, but it's been a few months and there were definitely some things on there that I'd hate to lose! (pics of my kids, documents that I created since my last backup, etc.). I would have backed up sooner, but our backup drive is going thru its own set of troubles and isn't usable at the moment. Most recently when I click on the drive in Win. Exp. it gives me this error:

D:\ is not accessible. The parameter is incorrect.

I still haven't tried hooking it up as a slave in another computer or attempting a CHKDSK on it. Is there anything that any of you could suggest I try or am I best to give my drive a decent burial and mourn my lost files for a bit? Thanks in advance for any help you might offer.

Trudi

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,396 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:20 AM

Posted 11 August 2008 - 09:34 PM

IMO...Station 1 should be BleepingComputer.com - Am I infected What do I do - http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Louis

#3 Strudles

Strudles
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:20 AM

Posted 12 August 2008 - 07:55 AM

I'm not sure what I'm supposed to do with that. I have adequate virus protection on my C:\ drive, and I've tried scanning D:\ but haven't been able to get any programs to scan it. Does this sound like it's virus-caused?

Trudi

#4 pcmaddeanp

pcmaddeanp

  • Members
  • 147 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southampton, UK
  • Local time:04:20 PM

Posted 12 August 2008 - 01:04 PM

How old is the drive?
What AV do you use?
Have you installed any programs that may have caused this to happen?

pcmaddeanp

Server Room Geek - IT Professionals Community


#5 Strudles

Strudles
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:20 AM

Posted 12 August 2008 - 02:12 PM

The drive is 3 1/2 years old, I use McAfee SecurityCenter v.8.1. I'm not sure which programs could cause this sort of thing so not sure how to answer that. I don't have near the programs installed that I did pre-reformat. I scan every program or zip file that I download with McAfee before running it (not sure if that's even necessary, but I do it). I haven't downloaded anything from any non-reputable sites (no warez...).

FWIW: On my last restart of my computer, CHKDSK started on my D:\ drive but it stopped right away and gave me the message: "Corrupt master file table. CHKDSK aborted."

Edited by Strudles, 12 August 2008 - 02:12 PM.


#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,396 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:20 AM

Posted 12 August 2008 - 02:23 PM

Hmmm,,,not good.

http://ntcompatible.com/Corrupt_Master_Fil...x_it_t4999.html

FWIW: When I've had problems with the MFT or NTFS...I've always wound up doing a delete/format/clean install routine. None of those other proposed "fixes" worked for me.

As to your question (previous) whether your troubles could be malware-related...of course they could. I'm not saying that they are...but many of the things which seem to pop up here...turn out to be malware-related and not just the O/S gone bad. Which is why I made my first post...I like to eliminate or confirm root causes and elimination is as good as confirmation in my world.

http://www.ntfs.com/quest14.htm

Louis

Edit: Some follks seem to be under the impression that malware is like dirt...once discovered, you sweep it up and put it in the trash...and all is well. It might help to take a look at http://www.olymug.org/Malware_Spyware_Hoaxes07.pdf for a somewhat better understanding of what might befall a system as a result of malware.

Edited by hamluis, 12 August 2008 - 04:31 PM.


#7 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:03:20 PM

Posted 12 August 2008 - 03:41 PM

I had a similar problem a while back, I used http://www.ptdd.com/ to perform repairs and now it all works. Granted the tool is trialware, but it worked for me.

I would use the trial version to see what errors can be detected and if you can use the 'explore root' function to see if you can see the files.
Regards,

Alan.

#8 Strudles

Strudles
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:20 AM

Posted 12 August 2008 - 09:21 PM

I did a scan with the demo of Restorer2000 and I have been able to retrieve a bunch of files (the ones they'll let me restore for free) so I think there might be hope. I'll let you know when/if I purchase the full program.

Trudi

#9 hamluis

hamluis

    Moderator


  • Moderator
  • 56,396 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:20 AM

Posted 13 August 2008 - 12:32 PM

Be sure to read/follow all directions for a proper recovery of files.

Recover to a different partition, etc...every program has its own set of rules.

Louis

#10 arcman

arcman

  • Members
  • 706 posts
  • OFFLINE
  •  
  • Location:Michigan
  • Local time:11:20 AM

Posted 13 August 2008 - 12:59 PM

If the partition itself is screwed, Testdisk is often the most helpful tool in fixing it.
If you still can't get anything more out of it from testdisk, give the trial version of GetDataBack(NTFS) a try. Easily one of the best data recovery programs I've used. If it recovers actual data you can pay for the license key to actually extract the data from the drive, which you definitely want copied onto a new drive.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users