Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Data Recovery help needed, Win XP CHKDSK errors


  • Please log in to reply
14 replies to this topic

#1 Takshaka

Takshaka

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 03 August 2012 - 03:58 PM

I need some advice on the best way to approach a data recovery operation.

The HD in question is my boot drive, Windows XP, 1 TB.

A few days ago I rebooted my computer and came back to see CHDSK had auto started it ran for a few hours, I left it unattended most of the time, but from what I saw it was reporting/fixing a lot of bad sectors, deleting corrupt attribute records and deleting index entries. There was a LOT of activity.

Please don't ask if I have a recent backup... answering that question will only cause me a great deal of embarrassment and self-loathing :(

On completion it rebooted to the Windows login screen, after logging in I got a windows explorer error message and my desktop was blank and the only thing it was possible to do was open Task Manager (couldn't even open the Start menu). I rebooted into Safe Mode, got the windows explorer error again. I rebooted again and tried starting up using Last Known Good Configuration but this triggered CHDSK again after which it was no longer possible to boot to the Windows Login screen, I get a Blue Screen registry error. I tried using the Win XP disc to attempt a repair installation but this too gave a registry error.

At this point I realised (probably later than I should) that I was doing more harm than good and stopped, the computer has been off since then.

So now I am in data recovery mode and want to make sure I have as much info as possible before doing anything! Priority 1 is to recover as many files as possible. If possible I would also like to get the windows installation bootable again, but that is a secondary goal.

I am waiting for a new computer to be delivered next week and will probably wait for that before doing anything since it will be able to move files faster than with my laptop, I am also awaiting delivery of a HD enclosure to put the damaged drive in.

The first thing I plan on doing is making an image copy of the drive onto a new HD and running the recovery operation on that to leave the old disc in tact in case anything goes wrong. Am I right in thinking that, using the right tools, I can make an exact duplicate of the data on the drive so that working on it for recovery will be exactly the same as working on the original drive?

That is about as far as I have got with my plan since I don't know exactly which tools to use or in what order. Should I use a tool to recover files deleted/changed by CHKDSK first? Or should I use a more general data recovery tool? Or a HD analysis tool?

I also have these specific questions

1. What are the best tools for making an exact clone of all the data on the damaged drive including any deleted file data etc?
2. Does the HD I put the image on need to be the same size or would a larger drive have advantages?
3. Will the fact that the computer I will be using to run any recovery tools will be Win7 whereas the HD to be worked on is a WinXP boot drive?
4. What tools are recommended for this data recovery operation and should they be used in a specific order?


I am in need of a lot of guidance here! I will be very grateful for any help and recommendations you can give me.

Thanks in advance

BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 03 August 2012 - 06:32 PM

Hi

We can make a boot CD that will allow us to take a closer look at the drive. We need to see if there is any damage recorded by the SMART settings and we need to see if it is formatted as a FAT filesystem or NTFS.

Download the PartedMagic ISO for your computer (you probably need the one labeled "Most people will only need this file") ask me if you aren't sure.


Instructions for making a Boot CD
If you don't already have CD Writing software, download and install Infrarecorder
and place a blank CD in your CD writer then run Infrarecorder
Click WRITE IMAGE
Navigate to the PartedMagic ISO that you downloaded and click the OPEN button
Click the OK button and it should burn your CD. When it is done it will automatically eject the CD and you can close Infrarecorder, you can now use this CD to boot your computer.

Instructions For Booting From The CD
If you have any trouble booting from the CD let me know the manufacturer/model of your computer and I'll help.

When you boot the computer that has the bad drive connected to it with the PartedMagic CD that you made a menu will pop up, please select
1. Default Settings (Runs from RAM)

When it finishes booting you will notice that it looks kind of like a Windows desktop. The button in the lower left works like the START button in Windows XP and allows you to select and run various programs or shutdown the computer. To make things easy, I'll just refer to this as the START button.

Check SMART status of drive
After PartedMagic loads, double-click the Disk Health icon on the desktop and then double-click the icon for your hard drive. Click on the PERFORM TESTS tab.
Make sure that the Test Type is set to Short Self-Test and click the EXECUTE button
I will need to know if it passed or not.
Next click the ERROR LOG tab and let me know if there are any entries and if there are let me know what the rows say.
Next select the ATTRIBUTES tab and let me know what the raw values are for the ID's listed there.

Check partitions with fdisk
At the bottom of the screen near the START button you will see a picture of a computer monitor. Click it to open a terminal window. In the terminal window type
fdisk -l
(that is fdisk SPACE DASH l as in Linux) and press ENTER
I want to see the information that it prints out. You can take a picture of the screen or use Firefox in PartedMagic to login here and copy and paste the results into your reply. As long as the text is legible, a picture will be fine.

In your reply I need to see...

  • Did it pass the Short Self-Test?
  • Any entries in the Error Log
  • The Attributes list (at least the RAW VALUES for ID's 1, 5 and 197 if you have to type them by hand in your reply)
  • The output of fdisk

There are more detailed instructions with pictures here

If you have any questions/problems, let me know.

Then we can talk about recovery options.
James

#3 Takshaka

Takshaka
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 07 August 2012 - 07:17 PM

Thank you for your assistance. It has taken me a few days to be able to do this but I now have carried out the tests and have some results to show you.

Short Self Test
Completed with Read Failure - 10% completed
LifetimeHours 29413
LBA of First Error - 7968821

Error Log

5 entries - Uncorrectable error in data

Attributes

Posted Image

fdisk

Posted Image

I hope I have done that correctly and look forward to hearing your advice on where to go from here.

Thanks again.

Jon

#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 07 August 2012 - 07:38 PM

Hi Jon

Good work. That's what I needed to see.

It looks like the drive is going bad and is probably getting worse with use.

I would recommend making a rescue image in this case. We can then mount the image and get the data from it as if it were a hard drive.

To do that, you'll need to connect another drive to the computer that has at least 550GB of free space on it (the 500GB for the drive plus 10% just to be safe).

To make an image, we can use the PartedMagic disk that you already have and run a program on it that is called ddrescue. It is built to make images from drives with the kind of errors that yours has.

Let me know if you have a drive with enough free space to connect to the computer or if you plan on removing the bad drive and connecting it to another computer that has a drive with enough free space.

When I know how you're setting this up, I'll be able to tell you what info I need in order to make the instructions for creating the image.

James


EDIT:
I should take a few moments and answer your questions at this point...

1. What are the best tools for making an exact clone of all the data on the damaged drive including any deleted file data etc?
We'll make an image file called image.dd using ddrescue

2. Does the HD I put the image on need to be the same size or would a larger drive have advantages?

The image will be a file but you will be able to mount it and work with it like a disk. Since it's a file it does not matter how big the drive is as long as it is big enough to hold the file.

3. Will the fact that the computer I will be using to run any recovery tools will be Win7 whereas the HD to be worked on is a WinXP boot drive?
No

4. What tools are recommended for this data recovery operation and should they be used in a specific order?
We'll decide what to use next depending on the results of each step :)

Edited by James Litten, 07 August 2012 - 07:47 PM.


#5 Takshaka

Takshaka
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 14 August 2012 - 03:17 PM

Hi James

Thank you very much again for your patient advice. Sorry that it is taking me a few days between replies, I am having trouble finding time to deal with this and it's really not something I want to handle without being able to give it my full attention.

I am not sure what the best way to proceed is at this point. My new computer arrived last week... there were some issues with it which I thought was going to mean it had to be returned (I am not having good luck with technology lately!), but they are all sorted now. The data drive in the new computer has more than enough space to put an image of the damaged drive on, however, since it is a new computer it only has Sata 2 and 3 ports whereas the damaged drive is Sata 1 - so I would need to remove the damaged drive and put it in an external enclosure for the transfer. I am wondering whether this would not be the best idea since a)It means physically moving the drive which could worsen the problem and b)Data transfer over USB2 is slower than over SATA which means the imaging process will take longer meaning the damaged drive running for longer and possibly degrading - please feel free to tell me that I am wrong about either or both of these theories!

The alternative will be to buy a new Sata 1 drive and do the transfer internally on the old computer and then put the new drive with the image into an enclosure so that the new computer can be used to transfer files and carry out any data recovery and repairs.

Thanks again for your excellent help and advice.

#6 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 14 August 2012 - 05:49 PM

Hi

No problem with delays between posts. I don't mind :)

In addition to deciding how to connect the old drive and the new data drive to the same machine, consider the fact that when you make the image, it may need to run undisturbed for a whole day and if you use your new computer, you'll be without a computer for that whole time. If you can set it up on the old computer,then you can comfortably run it as long as you want. For a 500GB drive, the difference between USB and internal connections is usually something like 10 to 15 hours internally, 15 to 20 hours via USB. So it's not that bad and I can't recall ever having a problem with connecting the data drive via USB (I rarely do this with the source/bad drive connected via USB).

We'll be using ddrescue so it gets all the good data first and keeps a log of the bad data and tries it last. That way it does all it can to avoid making things worse until it absolutely has to and everything that can be recovered is already recovered.

If I were in your situation, I'd connect the data drive to the old computer with a SATA to USB bridge (about $20) and do the imaging on that.

James

#7 suprahumid78

suprahumid78

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 14 August 2012 - 10:02 PM

About driver not installed, is not the case I am also CQ45 is a hardware problem.Posted Image

#8 Takshaka

Takshaka
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 16 August 2012 - 01:50 PM

Hi James

My new harddrive arrived today and I am about to install it internally in the old computer so that I can image the damaged drive. I will wait for your advice on how to do the imaging though before I go any further.

Thanks

Jon

#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 16 August 2012 - 04:05 PM

Hi Jon

I always reread the entire thread before giving the imaging instructions. I have a few final questions :)

In the original post, you said it was a 1TB drive but fdisk shows it as a 500GB drive, I'd like to verify that. Is it 1TB or 500GB?

Do you want to make an image for recovery of data or do you want to attempt cloning the old drive to the new one and try to use it as the new boot drive for the old computer?
That doesn't always work but we would still be able to get the data off of it. If we just make an image, you can get the data from it and delete the image and free up that space.

James

#10 Takshaka

Takshaka
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 16 August 2012 - 04:25 PM

Hi James

I would have sworn it was a 1TB and the fdisk report worried me a little until I opened up and looked at the drive, but it is in fact 500GB, apparently my memory isn't what it was lol

The new drive is definitely 1TB

If possible I would like to be able to boot from the new drive but data recovery is a bigger priority obviously. Would cloning to make the new drive bootable increase the risk of data loss or of the old drive failing before the operation is complete?

Thanks

Jon

#11 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 16 August 2012 - 04:46 PM

No, you would still be able to access the data the same as an image but it might not boot because of the changes chkdsk made.
We'll do that and if it does not boot, we'll get the important data and then try repairing the filesystem to see if we can fix any boot issues.

I'll have the instructions for you in a little bit.

James

EDIT: We're having power issues in my town today so it might be a while. The power keeps going out :(

Edited by James Litten, 16 August 2012 - 04:48 PM.


#12 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 16 August 2012 - 05:59 PM

Stop and let me know if you have any questions, get any errors or things don't look like how I describe them.

You will need a USB flash drive With at least a 100MB of free space on it to maintain a log of the cloning so we can resume it if your power goes out or you need to shutdown the computer before it is finished for some reason.

If the old drive has significant problems , this could take 15+ hours to run. If it is in relatively good shape this will probably take about 8-10 hours to run. Be aware of this and try not to use the computer for other stuff while it does this.

Plug in the USB flash drive.
Make sure that the new drive and old drive are connected.
Boot from the PartedMagic CD again.

Now we need to determine the names of the drives.
Run fdisk like you did before...

Check partitions with fdisk
At the bottom of the screen near the START button you will see a picture of a computer monitor. Click it to open a terminal window. In the terminal window type
fdisk -l
(that is fdisk SPACE DASH l as in Linux) and press ENTER


I expect you to see...

  • Your old 500GB drive as /dev/sda with the partition /dev/sda1 on it
  • Your new drive as /dev/sdb maybe with the partition /dev/sdb1 on it depending on whether it has been formatted before.
  • Your USB flash drive as /dev/sdc with the partition /dev/sdc1 on it

STOP if what you see is different, let me know and I will modify the ddrescue command for your setup.

Mount the USB Flash drive partition (called /media/sdc1) by clicking the 'mount devices' button which is next to the START button (see picture)
http://litten.com/images/mount1.jpg

Click the button that says Mount next the USB Flash drive partition (called /media/sdc1). We only want to mount that one and not any of the others.

Now for the command that takes a long time to run.

Open Terminal again if it is not still open from running fdisk.
Type
ddrescue -r 3 /dev/sda /dev/sdb /media/sdc1/rescuelog.log
and press enter.

That is ddrescueSPACE-rSPACE3SPACE/dev/sdaSPACE/dev/sdbSPACE/media/sdc1/rescuelog.log

If it gives an error that...
Output file exists and is not a regular file
then run fdisk again and double check and make sure that...
  • /dev/sda is the old drive
  • /dev/sdb is the new drive
  • /dev/sdc is the USB flash drive with a partition /dev/sdc1 on it

If that is all correct then add the --force switch to the command
Type
ddrescue -r 3 /dev/sda /dev/sdb /media/sdc1/rescuelog.log --force
and press enter.

That is ddrescueSPACE-rSPACE3SPACE/dev/sdaSPACE/dev/sdbSPACE/media/sdc1/rescuelog.logSPACE--force

If this gives you any other errors, STOP and let me know.

ddrescue tries to make an exact copy of the disk. That way, you can recover deleted files and partitions from the copy just like you can recover them from the original disk.

The ddrescue command looks at each piece of data on the bad drive and copies it to the good drive. If it comes across a bad piece of data it skips it and continues getting all of the good data. After getting all the good data it goes back to the bad pieces and tries to recover them 3 times before giving up and leaving a blank space on the good disk. The log file rescuelog.log keeps track of the process and allows us to start where it has left off if it is interrupted by a crash or power outage. This all allows us to attempt to recover as much as possible from the drive in the most gentle way.

When it is done, write down the values it has for Errsize and Errors so you can post them in your reply to me.

Remove the CD and shutdown the computer START>SHUTDOWN and unplug the bad drive from it. Try booting with just the new drive in it.

So, what I need from you if all goes well is...

1. The values you got from ddrescue for Errsize and Errors

2. Does the computer boot from the new drive?

James

#13 Takshaka

Takshaka
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:08 PM

Posted 23 August 2012 - 04:35 PM

Hi James

I had to wait for a USB flash drive.

I finally got around to following your instructions and there is a problem which I am very worried about. I think the damaged drive may have got a lot worse. The computer hasn't been powered up since I ran Parted Magic to show you the reports. When I booted into Parted Magic today and ran fdisk it was only showing 1 HD and the USB Flash drive - but the HD that it was showing is the new 1TB one, not the old 500MB that needs rescuing. In BIOS only the new HD is showing also. I disconnected the new HD in case I had incorrectly installed it - BIOS shows no HD at all. I took the old HD out and put it in a USB enclosure to see if I can access it, it powers on and I can hear it spinning, but when plugged into the new computer the drive isn't recognised - however this is the first time I have used the enclosure so I should test it with a different HD to see if there is a fault.

Is this kind of failure something you can explain? Is there something I could be doing wrong or has the HD deteriorated beyond recovery now?

Thanks

Jon

#14 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 23 August 2012 - 05:49 PM

Hi Jon

Sometimes when this happens, it will come back to being detected by the BIOS. If it does, you want to be ready to follow my ddrescue instructions right away.

Here is what I would try...
Hook everything up to the old computer so it is ready to run ddrescue.
  • Connect the bad drive directly like it was before.
  • Connect the new drive.
  • Plug in the USB flash drive.
  • Boot with the PartedMagic CD

Open the Terminal and run
fdisk -l
again and verify that the drive is there.
If it is then continue immediately with my instructions (post #12 in this thread) ...

If it is not, shutdown the system completely (do not reboot) and then turn it back on, boot to PartedMagic and see if the drive is there. Try this three times. If it still does not see the drive, boot and leave the computer running for an hour (even though the drive is not detected) and then reboot (instead of shutting down completely choose to reboot the computer).

If all of that does not work, let me know and I will see if there are any other tricks we can try for that model of hard drive.

Two important things.
STOP IF THE DRIVE STARTS TO MAKE A BEEPING SOUND WHILE TRYING TO DETECT IT OR A LOUD CLICKING SOUND, soft clicking is okay (you'll know if it's the loud sound, trust me :) )

FOLLOW THE INSTRUCTIONS FOR MAKING AN IMAGE IMMEDIATELY IF THE DRIVE IS DETECTED (post #12 in this thread)

James

EDIT: Jon, can you look at the label on the bad drive and tell me what it says for the FIRMWARE and if it says "PRODUCT OF THAILAND" on it.

EDIT 2: Also, send me a private message with the serial number from the label of the bad drive. I may have a way to see if it is a known firmware issue.

Edited by James Litten, 23 August 2012 - 08:09 PM.


#15 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:08:08 AM

Posted 28 August 2012 - 08:57 AM

Hi Jon

Haven't heard from you in a few days but I thought it was important to let you know what I think your problem is with not seeing that hard drive.


I haven't ssen this problem in two years and now I've seen it twice in one month.

There is a firmware problem with those drives that affected a batch of Seagate and Maxtor drives. Here's the recent one with a Seagate drive (it is the same problem even though they are different brand names and Seagate will fix the Maxtors like yours too)
http://www.bleepingcomputer.com/forums/topic463878.html/page__p__2794336__hl__seagate+7200__fromsearch__1#entry2794336

Here's some info from when it first started to happen in 2009....
http://forums.seagate.com/t5/Barracuda-XT-Barracuda-Barracuda/Maxtor-DiamondMax-22-Firmware-Issues/td-p/22718

IF YOUR FIRMWARE VERSION IS MX15 as seen on the hard drive's label.
What you need to do is contact Seagate and give them the information from the label on the drive.

Tell them that it was starting to have bad sectors and you were about to make an image of it with ddrescue when it began to not be detected by the BIOS yet spin just like the firmware error describes.

You just want them to fix the firmware issue and not try to get the data off of it (unless they offer to do that for free for you). When you get it back, we can make the ddrescue image.
Be sure to tell them that you want it back whether they fix it or not. Sometimes they will destroy them if they can not fix them if you don't tell them that you want it back.

I don't think that this is related to your bad sector problem but you never know. It probably was going to happen even if you did not start getting bad sectors.

Please let us know what happens.
James




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users