Data Recovery from lost NTFS. Help!

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I need some advice. I was transferring info from a 160 gig IDE Western
Digital hard drive and forgot the drive was in use when I renamed it in
Drive properties. The drive instantly lost its file system asks if I want to
format it when I click on the drive letter.

I've used GetDataBack and recovered some files but it doesn't seem to find
much.

Can someone tell me of a good newsgroup for this. Thanks Gregg
26 answers Last reply
More about data recovery lost ntfs help
  1. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > I need some advice. I was transferring info from a 160 gig IDE Western
    > Digital hard drive and forgot the drive was in use when I renamed it in
    > Drive properties. The drive instantly lost its file system asks if I want to
    > format it when I click on the drive letter.

    There is no reason why the renaming of a volume would cause loss of the file
    system. If it wasn't legit then the operating system would have blocked it.
    From the little info provided above, I would guess that something went wrong
    when the OS tried to rewrite the boot sector with the modified volume name (the
    volume name is written to the boot sector, in addition to the entry in the file
    system).

    Other possible causes to the disappearing of the file system of your drive could
    be a modified partition table, in its MBR, or changed settings for that drive,
    in the CMOS. Yet given the symptoms described, I would think that a damaged
    boot sector is the most likely.

    > I've used GetDataBack and recovered some files but it doesn't seem to find
    > much.

    File recovery such as GetDataBack and EasyRecovery are appropriate when there is
    no better choice. I would first check the above and fix the necessary, if
    possible. This would give a better chance to fully recover the drive and data,
    lock, stock and barrel. Yet it requires some skill and low level (DOS)
    operation.

    For starters, NTFS partitions keep a backup of the boot sector in the very last
    sector of every partition, respectively.

    > Can someone tell me of a good newsgroup for this. Thanks Gregg

    This one is.

    Regards, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  2. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Gregg OBanion <gobanion@msn.com> wrote in
    message news:eNPke.3700$Xh.1255@fed1read07...

    > I need some advice. I was transferring info from a 160 gig IDE Western Digital
    > hard drive and forgot the drive was in use when I renamed it in Drive
    > properties. The drive instantly lost its file system asks if I want to format
    > it when I click on the drive letter.

    I like Easy Recovery Pro, but it aint free.

    > I've used GetDataBack and recovered some files but it doesn't seem to find
    > much.

    > Can someone tell me of a good newsgroup for this.

    This one is as good as any for that.
  3. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Thank You for the advice. It makes sense to me.

    >I would guess that something went wrong
    > when the OS tried to rewrite the boot sector with the modified volume name
    > (the
    > volume name is written to the boot sector, in addition to the entry in the
    > file
    > system).
    >For starters, NTFS partitions keep a backup of the boot sector in the very
    >last
    > sector of every partition, respectively.

    Can you tell me how to begin to check this problem. I've left the drive
    untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
    Promise Ultra 100 PCI Card. Thanks Again. Gregg


    "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    news:b56891pf7qk95ina2e7lidh07dka3dt8qk@4ax.com...
    > "Gregg OBanion" <gobanion@msn.com> wrote:
    >
    >> I need some advice. I was transferring info from a 160 gig IDE Western
    >> Digital hard drive and forgot the drive was in use when I renamed it in
    >> Drive properties. The drive instantly lost its file system asks if I want
    >> to
    >> format it when I click on the drive letter.
    >
    > There is no reason why the renaming of a volume would cause loss of the
    > file
    > system. If it wasn't legit then the operating system would have blocked
    > it.
    > From the little info provided above, I would guess that something went
    > wrong
    > when the OS tried to rewrite the boot sector with the modified volume name
    > (the
    > volume name is written to the boot sector, in addition to the entry in the
    > file
    > system).
    >
    > Other possible causes to the disappearing of the file system of your drive
    > could
    > be a modified partition table, in its MBR, or changed settings for that
    > drive,
    > in the CMOS. Yet given the symptoms described, I would think that a
    > damaged
    > boot sector is the most likely.
    >
    >> I've used GetDataBack and recovered some files but it doesn't seem to
    >> find
    >> much.
    >
    > File recovery such as GetDataBack and EasyRecovery are appropriate when
    > there is
    > no better choice. I would first check the above and fix the necessary, if
    > possible. This would give a better chance to fully recover the drive and
    > data,
    > lock, stock and barrel. Yet it requires some skill and low level (DOS)
    > operation.
    >
    > For starters, NTFS partitions keep a backup of the boot sector in the very
    > last
    > sector of every partition, respectively.
    >
    >> Can someone tell me of a good newsgroup for this. Thanks Gregg
    >
    > This one is.
    >
    > Regards, Zvi
    > --
    > NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    > InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  4. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
    <support@replace_with_domain.com> wrote:

    Hi, Zvi

    >"Gregg OBanion" <gobanion@msn.com> wrote:
    >
    >> I need some advice. I was transferring info from a 160 gig IDE Western
    >> Digital hard drive and forgot the drive was in use when I renamed it in
    >> Drive properties. The drive instantly lost its file system asks if I want to
    >> format it when I click on the drive letter.
    >
    >There is no reason why the renaming of a volume would cause loss of the file
    >system. If it wasn't legit then the operating system would have blocked it.
    >From the little info provided above, I would guess that something went wrong
    >when the OS tried to rewrite the boot sector with the modified volume name (the
    >volume name is written to the boot sector, in addition to the entry in the file
    >system).

    With NTFS the volume label is not written to the boot sector but only
    to the metadata file $Volume.

    >Other possible causes to the disappearing of the file system of your drive could
    >be a modified partition table, in its MBR, or changed settings for that drive,
    >in the CMOS. Yet given the symptoms described, I would think that a damaged
    >boot sector is the most likely.
    >
    >> I've used GetDataBack and recovered some files but it doesn't seem to find
    >> much.

    You need a tool that can do a raw mode recovery. I've never used
    GetDataBack, so don't know if it can do that. I think that File
    Scavenger can and it is reasonably priced.

    >File recovery such as GetDataBack and EasyRecovery are appropriate when there is
    >no better choice. I would first check the above and fix the necessary, if
    >possible. This would give a better chance to fully recover the drive and data,
    >lock, stock and barrel. Yet it requires some skill and low level (DOS)
    >operation.
    >
    >For starters, NTFS partitions keep a backup of the boot sector in the very last
    >sector of every partition, respectively.

    May or may not help - probably not IMO. A missing boot sector can lead
    drive manager to ask for a format, but so can a damaged MFT. This
    really needs some diagnostic help.

    >> Can someone tell me of a good newsgroup for this. Thanks Gregg
    >
    >This one is.
    >
    >Regards, Zvi


    Bob
  5. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Thanks Robert. I will try File Scavenger and report back here.

    "Robert Green" <lasrpro@hotmail.com> wrote in message
    news:rcha91943g0p2758ekk4lv64kqdg5d112l@4ax.com...
    > On Wed, 25 May 2005 10:23:07 +0300, Zvi Netiv
    > <support@replace_with_domain.com> wrote:
    >
    > Hi, Zvi
    >
    >>"Gregg OBanion" <gobanion@msn.com> wrote:
    >>
    >>> I need some advice. I was transferring info from a 160 gig IDE Western
    >>> Digital hard drive and forgot the drive was in use when I renamed it in
    >>> Drive properties. The drive instantly lost its file system asks if I
    >>> want to
    >>> format it when I click on the drive letter.
    >>
    >>There is no reason why the renaming of a volume would cause loss of the
    >>file
    >>system. If it wasn't legit then the operating system would have blocked
    >>it.
    >>From the little info provided above, I would guess that something went
    >>wrong
    >>when the OS tried to rewrite the boot sector with the modified volume name
    >>(the
    >>volume name is written to the boot sector, in addition to the entry in the
    >>file
    >>system).
    >
    > With NTFS the volume label is not written to the boot sector but only
    > to the metadata file $Volume.
    >
    >>Other possible causes to the disappearing of the file system of your drive
    >>could
    >>be a modified partition table, in its MBR, or changed settings for that
    >>drive,
    >>in the CMOS. Yet given the symptoms described, I would think that a
    >>damaged
    >>boot sector is the most likely.
    >>
    >>> I've used GetDataBack and recovered some files but it doesn't seem to
    >>> find
    >>> much.
    >
    > You need a tool that can do a raw mode recovery. I've never used
    > GetDataBack, so don't know if it can do that. I think that File
    > Scavenger can and it is reasonably priced.
    >
    >>File recovery such as GetDataBack and EasyRecovery are appropriate when
    >>there is
    >>no better choice. I would first check the above and fix the necessary, if
    >>possible. This would give a better chance to fully recover the drive and
    >>data,
    >>lock, stock and barrel. Yet it requires some skill and low level (DOS)
    >>operation.
    >>
    >>For starters, NTFS partitions keep a backup of the boot sector in the very
    >>last
    >>sector of every partition, respectively.
    >
    > May or may not help - probably not IMO. A missing boot sector can lead
    > drive manager to ask for a format, but so can a damaged MFT. This
    > really needs some diagnostic help.
    >
    >>> Can someone tell me of a good newsgroup for this. Thanks Gregg
    >>
    >>This one is.
    >>
    >>Regards, Zvi
    >
    >
    > Bob
  6. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > Thank You for the advice. It makes sense to me.

    Yet it doesn't to me. Since you already bothered moving part of the previous
    posts to the top (only a "half" top-poster), then why moving anything at all?
    Your follow-up would have made more sense if it was all in-line.

    > >I would guess that something went wrong
    > > when the OS tried to rewrite the boot sector with the modified volume name (the
    > > volume name is written to the boot sector, in addition to the entry in the file system).
    > >For starters, NTFS partitions keep a backup of the boot sector in the very last
    > > sector of every partition, respectively.

    > Can you tell me how to begin to check this problem. I've left the drive
    > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
    > Promise Ultra 100 PCI Card. Thanks Again. Gregg

    As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
    to format the volume).

    Could you please describe the drive configuration: What order is the problem
    drive (first, second, ... fourth?), and how was it partitioned (one big
    partition, several, what types?).

    If the drive is one of the first two (you can always make it that by
    disconnecting other drives), then you can use RESQDISK from
    www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
    MBR, boot sector).

    If the above are OK then revert to data recovery software, or professional
    recovery, if you can afford it and the data is worth the expense.

    Regards, Zvi

    > "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    > > "Gregg OBanion" <gobanion@msn.com> wrote:
    > >
    > >> I need some advice. I was transferring info from a 160 gig IDE Western
    > >> Digital hard drive and forgot the drive was in use when I renamed it in
    > >> Drive properties. The drive instantly lost its file system asks if I want
    > >> to
    > >> format it when I click on the drive letter.
    > >
    > > There is no reason why the renaming of a volume would cause loss of the
    > > file
    > > system. If it wasn't legit then the operating system would have blocked
    > > it.
    > > From the little info provided above, I would guess that something went
    > > wrong
    > > when the OS tried to rewrite the boot sector with the modified volume name
    > > (the
    > > volume name is written to the boot sector, in addition to the entry in the
    > > file
    > > system).
    > >
    > > Other possible causes to the disappearing of the file system of your drive
    > > could
    > > be a modified partition table, in its MBR, or changed settings for that
    > > drive,
    > > in the CMOS. Yet given the symptoms described, I would think that a
    > > damaged
    > > boot sector is the most likely.
    > >
    > >> I've used GetDataBack and recovered some files but it doesn't seem to
    > >> find
    > >> much.
    > >
    > > File recovery such as GetDataBack and EasyRecovery are appropriate when
    > > there is
    > > no better choice. I would first check the above and fix the necessary, if
    > > possible. This would give a better chance to fully recover the drive and
    > > data,
    > > lock, stock and barrel. Yet it requires some skill and low level (DOS)
    > > operation.
    > >
    > > For starters, NTFS partitions keep a backup of the boot sector in the very last
    > > sector of every partition, respectively.
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  7. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Zvi Netiv <support@replace_with_domain.com> wrote:
    > "Gregg OBanion" <gobanion@msn.com> wrote:
    >
    > > Thank You for the advice. It makes sense to me.
    >
    > Yet it doesn't to me. Since you already bothered moving part of the previous
    > posts to the top (only a "half" top-poster), then why moving anything at all?
    > Your follow-up would have made more sense if it was all in-line.
    >
    > > >I would guess that something went wrong
    > > > when the OS tried to rewrite the boot sector with the modified volume name (the
    > > > volume name is written to the boot sector, in addition to the entry in the file system).
    > > >For starters, NTFS partitions keep a backup of the boot sector in the very last
    > > > sector of every partition, respectively.
    >
    > > Can you tell me how to begin to check this problem. I've left the drive
    > > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is on a
    > > Promise Ultra 100 PCI Card. Thanks Again. Gregg
    >
    > As Bob Green pointed out, a damaged MFT could also cause the same effect (offer
    > to format the volume).
    >
    > Could you please describe the drive configuration: What order is the problem
    > drive (first, second, ... fourth?), and how was it partitioned (one big
    > partition, several, what types?).
    >
    > If the drive is one of the first two (you can always make it that by
    > disconnecting other drives), then you can use RESQDISK from
    > www.resq.co.il/resq.php to assess the boot chain (drive settings in the CMOS,
    > MBR, boot sector).

    Correction: Forget the CMOS drive settings, since it uses the Ultra-100
    controller. Yet a corrupted partition table could have a similar effect as the
    controller will set the drive in the BIOS list (not the same as CMOS!) with a
    best fit to what's found in the MBR.

    > If the above are OK then revert to data recovery software, or professional
    > recovery, if you can afford it and the data is worth the expense.

    Regards
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  8. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Sorry for the inexperience with my post. It's been a while.

    The drive is one big partition. The Info in Disk Management reads, Disk 3,
    Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
    100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
    card.

    Thanks Zvi.

    "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    news:2lta919gfvkraroj67g9fgkhhqu6tm8ac1@4ax.com...
    > Zvi Netiv <support@replace_with_domain.com> wrote:
    >> "Gregg OBanion" <gobanion@msn.com> wrote:
    >>
    >> > Thank You for the advice. It makes sense to me.
    >>
    >> Yet it doesn't to me. Since you already bothered moving part of the
    >> previous
    >> posts to the top (only a "half" top-poster), then why moving anything at
    >> all?
    >> Your follow-up would have made more sense if it was all in-line.
    >>
    >> > >I would guess that something went wrong
    >> > > when the OS tried to rewrite the boot sector with the modified volume
    >> > > name (the
    >> > > volume name is written to the boot sector, in addition to the entry
    >> > > in the file system).
    >> > >For starters, NTFS partitions keep a backup of the boot sector in the
    >> > >very last
    >> > > sector of every partition, respectively.
    >>
    >> > Can you tell me how to begin to check this problem. I've left the drive
    >> > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
    >> > on a
    >> > Promise Ultra 100 PCI Card. Thanks Again. Gregg
    >>
    >> As Bob Green pointed out, a damaged MFT could also cause the same effect
    >> (offer
    >> to format the volume).
    >>
    >> Could you please describe the drive configuration: What order is the
    >> problem
    >> drive (first, second, ... fourth?), and how was it partitioned (one big
    >> partition, several, what types?).
    >>
    >> If the drive is one of the first two (you can always make it that by
    >> disconnecting other drives), then you can use RESQDISK from
    >> www.resq.co.il/resq.php to assess the boot chain (drive settings in the
    >> CMOS,
    >> MBR, boot sector).
    >
    > Correction: Forget the CMOS drive settings, since it uses the Ultra-100
    > controller. Yet a corrupted partition table could have a similar effect
    > as the
    > controller will set the drive in the BIOS list (not the same as CMOS!)
    > with a
    > best fit to what's found in the MBR.
    >
    >> If the above are OK then revert to data recovery software, or
    >> professional
    >> recovery, if you can afford it and the data is worth the expense.
    >
    > Regards
    > --
    > NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    > InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  9. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > Sorry for the inexperience with my post. It's been a while.

    I meant that top-posting isn't appreciated here. What alienates me in top-post
    follow-ups is the liberty that some take in abusing the product of others' time
    and efforts and transforming them into senseless babble. You aren't the only
    one to seek help through newsgroups, many use their archives to look for
    solutions to problems they have. Hence, top-posting is ungrateful to
    contributors, it doesn't encourage them in helping you, and is unfair to
    readers.

    The same goes for trimming previous text and not fragmenting the lines of quoted
    text, but the latter are more a matter of experience in newsgroups, while
    top-posting is a conscious and selfish choice.

    I realize that not all contributors do mind about top-posting, yet I am sure
    that I reflect the feeling of the majority. Witness their posts.

    > The drive is one big partition. The Info in Disk Management reads, Disk 3,
    > Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
    > 100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the PCI
    > card.

    The above doesn't exclude the possibility that either the MBR and/or the boot
    sector were altered.

    To further investigate, you can download RESQ from www.resq.co.il/resq.php and
    prepare a bootable RESQ floppy (should be done on a Win 98 PC, as instructed in
    the ResQ welcome message). If Win 98 is not available to you, then download
    also the FreeDOS boot floppy maker from www.resq.co.il/iv_tools.php#FreeDOS To
    make a RESQ boot floppy with it, do as follows:

    Format a floppy from the CMD shell (NOT with Win's disk manager) with the
    command FORMAT A: /U Open the FreeDOS self-extract archive and let it make the
    floppy bootable. Now open RESQ.EXE, clear the two check marks (overwrite files,
    and [don't] execute Makeresq) then press the 'unzip' button.

    Disconnect the power and data cables from all drives, except from the one you
    want to assess, boot from the RESQ floppy just made (leave the diskette
    write-enabled in the drive) and when at the A: prompt, run RESQDISK /ASSESS

    The program will initiate an assessment cycle of the hard drive and will write
    its findings into a text file report named RESQDISK.RPT, in A:\. Press 'enter'
    every time RESQDISK pauses and saves a screen snapshot, until the program
    terminates and exits.

    Post here the report file (just paste the text file into your follow-up), and
    avoid top-posting!

    Regards, Zvi

    > "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    > >> "Gregg OBanion" <gobanion@msn.com> wrote:
    > >>
    > >> > Thank You for the advice. It makes sense to me.
    > >>
    > >> Yet it doesn't to me. Since you already bothered moving part of the previous
    > >> posts to the top (only a "half" top-poster), then why moving anything at all?
    > >> Your follow-up would have made more sense if it was all in-line.

    [...]
    > >> > Can you tell me how to begin to check this problem. I've left the drive
    > >> > untouched. I'm using WinXP Pro, Pentium III 1 GB, 512 RAM. The drive is
    > >> > on a Promise Ultra 100 PCI Card. Thanks Again. Gregg
    > >>
    > >> As Bob Green pointed out, a damaged MFT could also cause the same effect
    > >> (offer to format the volume).
    > >>
    > >> Could you please describe the drive configuration: What order is the
    > >> problem drive (first, second, ... fourth?), and how was it partitioned (one big
    > >> partition, several, what types?).
    > >>
    > >> If the drive is one of the first two (you can always make it that by
    > >> disconnecting other drives), then you can use RESQDISK from
    > >> www.resq.co.il/resq.php to assess the boot chain (drive settings in the
    > >> CMOS, MBR, boot sector).
    > >
    > > Correction: Forget the CMOS drive settings, since it uses the Ultra-100
    > > controller. Yet a corrupted partition table could have a similar effect as the
    > > controller will set the drive in the BIOS list (not the same as CMOS!) with a
    > > best fit to what's found in the MBR.
    > >
    > >> If the above are OK then revert to data recovery software, or professional
    > >> recovery, if you can afford it and the data is worth the expense.
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  10. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    I suggest you use Partition Table Doctor to resolve your
    problem.The software provides very useful functions: Fix boot sector

    Run the program and right click the partition and choose fixboot.


    see more: http://www.ptdd.com/fixboot.htm
  11. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    [snip]

    > My next step. Read the Hard drive section of my new Repair book. Use
    > the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
    > also looking into File Scavenger.

    What I have been trying to suggest to you, with no success as it seems, is that
    before purchasing data recovery software and trying to recover your stuff, file
    by file, it would make more sense (and be cheaper too) to first try regaining
    access to the drive / partition and the data on it, if possible.

    In case the purchased SW doesn't yield the expected results: Make sure to not
    write to the problem drive if you wish to maintain the option of switching back
    to the above approach.

    Good luck, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  12. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Hello Zvi and Robert.

    Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
    post. (Below)

    To further investigate, you can download RESQ from
    www.resq.co.il/resq.php and
    prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
    instructed in
    the ResQ welcome message). If Win 98 is not available to you, then
    download
    also the FreeDOS boot floppy maker from
    www.resq.co.il/iv_tools.php#FreeDOS To
    make a RESQ boot floppy with it, do as follows:

    Format a floppy from the CMD shell (NOT with Win's disk manager)
    with the
    command FORMAT A: /U Open the FreeDOS self-extract archive and let
    it make the
    floppy bootable. Now open RESQ.EXE, clear the two check marks
    (overwrite files,
    Hello Zvi and Robert.

    Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
    post. (Below)

    To further investigate, you can download RESQ from
    www.resq.co.il/resq.php and
    prepare a bootable RESQ floppy (should be done on a Win 98 PC, as
    instructed in
    the ResQ welcome message). If Win 98 is not available to you, then
    download
    also the FreeDOS boot floppy maker from
    www.resq.co.il/iv_tools.php#FreeDOS To
    make a RESQ boot floppy with it, do as follows:

    Format a floppy from the CMD shell (NOT with Win's disk manager)
    with the
    command FORMAT A: /U Open the FreeDOS self-extract archive and let
    it make the
    floppy bootable. Now open RESQ.EXE, clear the two check marks
    (overwrite files,
    and [don't] execute Makeresq) then press the 'unzip' button.

    Disconnect the power and data cables from all drives, except from
    the one you
    want to assess, boot from the RESQ floppy just made (leave the
    diskette
    write-enabled in the drive) and when at the A: prompt, run RESQDISK
    /ASSESS

    The program will initiate an assessment cycle of the hard drive and
    will write
    its findings into a text file report named RESQDISK.RPT, in A:\.
    Press 'enter'
    every time RESQDISK pauses and saves a screen snapshot, until the
    program
    terminates and exits.

    Post here the report file (just paste the text file into your
    follow-up), and
    avoid top-posting!

    My Response: (Gregg)
    Excellent info above.
    Sorry for overlooking this. What you'll see written below was
    written before I discovered your instructions (above).
    Wow do I feel dumb! Please read below as it may provide a valuable
    summary. I will follow your instructions right away.
    Yes I do have a Windows 98 machine.

    Thanks Zvi.

    >> My next step. Read the Hard drive section of my new Repair book.
    >> Use
    >> the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
    >> also looking into File Scavenger.
    >
    > What I have been trying to suggest to you, is that
    > before purchasing data recovery software and trying to recover
    > your stuff, file
    > by file, it would make more sense (and be cheaper too) to first
    > try regaining
    > access to the drive / partition and the data on it, if possible.

    Yes Zvi. I have understood what you are telling me. The ultimate fix
    here is to have the drive operate as before. Problem is, where do I
    begin?

    Zvi Said:
    From the little info provided above, I would guess that something
    went wrong
    when the OS tried to rewrite the boot sector with the modified
    volume name (the
    volume name is written to the boot sector, in addition to the entry
    in the file
    system).

    Robert Said:
    With NTFS the volume label is not written to the boot sector but
    only
    to the metadata file $Volume.

    Zvi Said:
    Other possible causes to the disappearing of the file system of your
    drive could
    be a modified partition table, in its MBR, or changed settings for
    that drive,
    in the CMOS. Yet given the symptoms described, I would think that a
    damaged
    boot sector is the most likely.

    For starters, NTFS partitions keep a backup of the boot sector in
    the very last
    sector of every partition, respectively.

    Robert Said:
    A missing boot sector can lead drive manager to ask for a format,
    but so can a damaged MFT. This
    really needs some diagnostic help.

    Zvi Said:
    Could you please describe the drive configuration: What order is
    the problem
    drive (first, second, ... fourth?), and how was it partitioned (one
    big
    partition, several, what types?).

    Gregg Said:
    I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
    GB, 512 RAM. The drive is on a
    Promise Ultra 100 PCI Card. The drive is one big partition. The Info
    in Disk Management reads, Disk 3,
    Basic, 149.05 GB, Online. File System RAW. In order on the Promise
    Ultra
    100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
    the PCI card.

    Zvi Said:
    If the drive is one of the first two (you can always make it that by
    disconnecting other drives), then you can use RESQDISK from
    www.resq.co.il/resq.php to assess the boot chain (drive settings in
    the CMOS,
    MBR, boot sector).

    Correction: Forget the CMOS drive settings, since it uses the
    Ultra-100
    controller. Yet a corrupted partition table could have a similar
    effect as the
    controller will set the drive in the BIOS list (not the same as
    CMOS!) with a
    best fit to what's found in the MBR.

    The above doesn't exclude the possibility that either the MBR and/or
    the boot
    sector were altered.

    My Response: (Gregg)
    The last two paragraphs are confusing to me. How do I look at the
    boot sector or MBR and what do I look for? How do I look at The MFT?
    How do I look at the corrupted partition table? What info do I need
    to provide you to further assist me?

    Zvi Said:
    In case the purchased SW doesn't yield the expected results: Make
    sure to not
    write to the problem drive if you wish to maintain the option of
    switching back
    to the above approach.

    My Response: (Gregg)

    I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
    ERP does have a RAW disk recovery tool. It is now writing to a
    different drive. Not the problem drive. It will take 20 hours to
    write that info to disk. Then I will report back to you.

    I can tell you I won't be satisfied with the recovery method because
    although it may recover the files, I still want the File structure
    (Tree) in tact. So I want to continue to work on this problem and
    see if I can solve it. Of course I won't be able to do it without
    some help. Please continue to help me. I do appreciate it!

    Thanks again, Gregg

    and [don't] execute Makeresq) then press the 'unzip' button.

    Disconnect the power and data cables from all drives, except from
    the one you
    want to assess, boot from the RESQ floppy just made (leave the
    diskette
    write-enabled in the drive) and when at the A: prompt, run RESQDISK
    /ASSESS

    The program will initiate an assessment cycle of the hard drive and
    will write
    its findings into a text file report named RESQDISK.RPT, in A:\.
    Press 'enter'
    every time RESQDISK pauses and saves a screen snapshot, until the
    program
    terminates and exits.

    Post here the report file (just paste the text file into your
    follow-up), and
    avoid top-posting!

    My Response: (Gregg)
    Excellent info above.
    Sorry for overlooking this. What you'll see written below was
    written before I discovered your instructions (above).
    Wow do I feel dumb! Please read below as it may provide a valuable
    summary. I will follow your instructions right away.
    Yes I do have a Windows 98 machine.

    Thanks Zvi.

    >> My next step. Read the Hard drive section of my new Repair book.
    >> Use
    >> the tools I've purchased, Easy Recovery Pro and GetDataBack. I'm
    >> also looking into File Scavenger.
    >
    > What I have been trying to suggest to you, is that
    > before purchasing data recovery software and trying to recover
    > your stuff, file
    > by file, it would make more sense (and be cheaper too) to first
    > try regaining
    > access to the drive / partition and the data on it, if possible.

    Yes Zvi. I have understood what you are telling me. The ultimate fix
    here is to have the drive operate as before. Problem is, where do I
    begin?

    Zvi Said:
    From the little info provided above, I would guess that something
    went wrong
    when the OS tried to rewrite the boot sector with the modified
    volume name (the
    volume name is written to the boot sector, in addition to the entry
    in the file
    system).

    Robert Said:
    With NTFS the volume label is not written to the boot sector but
    only
    to the metadata file $Volume.

    Zvi Said:
    Other possible causes to the disappearing of the file system of your
    drive could
    be a modified partition table, in its MBR, or changed settings for
    that drive,
    in the CMOS. Yet given the symptoms described, I would think that a
    damaged
    boot sector is the most likely.

    For starters, NTFS partitions keep a backup of the boot sector in
    the very last
    sector of every partition, respectively.

    Robert Said:
    A missing boot sector can lead drive manager to ask for a format,
    but so can a damaged MFT. This
    really needs some diagnostic help.

    Zvi Said:
    Could you please describe the drive configuration: What order is
    the problem
    drive (first, second, ... fourth?), and how was it partitioned (one
    big
    partition, several, what types?).

    Gregg Said:
    I've left the drive untouched. I'm using WinXP Pro, Pentium III 1
    GB, 512 RAM. The drive is on a
    Promise Ultra 100 PCI Card. The drive is one big partition. The Info
    in Disk Management reads, Disk 3,
    Basic, 149.05 GB, Online. File System RAW. In order on the Promise
    Ultra
    100, It's on IDE 1 as a Slave. There are 3 other Identical drives on
    the PCI card.

    Zvi Said:
    If the drive is one of the first two (you can always make it that by
    disconnecting other drives), then you can use RESQDISK from
    www.resq.co.il/resq.php to assess the boot chain (drive settings in
    the CMOS,
    MBR, boot sector).

    Correction: Forget the CMOS drive settings, since it uses the
    Ultra-100
    controller. Yet a corrupted partition table could have a similar
    effect as the
    controller will set the drive in the BIOS list (not the same as
    CMOS!) with a
    best fit to what's found in the MBR.

    The above doesn't exclude the possibility that either the MBR and/or
    the boot
    sector were altered.

    My Response: (Gregg)
    The last two paragraphs are confusing to me. How do I look at the
    boot sector or MBR and what do I look for? How do I look at The MFT?
    How do I look at the corrupted partition table? What info do I need
    to provide you to further assist me?

    Zvi Said:
    In case the purchased SW doesn't yield the expected results: Make
    sure to not
    write to the problem drive if you wish to maintain the option of
    switching back
    to the above approach.

    My Response: (Gregg)

    I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
    ERP does have a RAW disk recovery tool. It is now writing to a
    different drive. Not the problem drive. It will take 20 hours to
    write that info to disk. Then I will report back to you.

    I can tell you I won't be satisfied with the recovery method because
    although it may recover the files, I still want the File structure
    (Tree) in tact. So I want to continue to work on this problem and
    see if I can solve it. Of course I won't be able to do it without
    some help. Please continue to help me. I do appreciate it!

    Thanks again, Gregg
  13. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    I suppose the drive is properly detected as Big ATA?

    "Gregg OBanion" <gobanion@msn.com> wrote in message
    news:J_fle.7960$tp.4626@fed1read05...
    > Sorry for the inexperience with my post. It's been a while.
    >
    > The drive is one big partition. The Info in Disk Management reads, Disk 3,
    > Basic, 149.05 GB, Online. File System RAW. In order on the Promise Ultra
    > 100, It's on IDE 1 as a Slave. There are 3 other Identical drives on the
    > PCI card.
    >
  14. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > Zvi. Somehow I overlooked your instructions from your 5-26 5:40 am
    > post. (Below)

    [snipped]

    > > Post here the report file (just paste the text file into your
    > > follow-up), and avoid top-posting!
    >
    > My Response: (Gregg)
    > Excellent info above.
    > Sorry for overlooking this. What you'll see written below was
    > written before I discovered your instructions (above).
    > Wow do I feel dumb! Please read below as it may provide a valuable
    > summary. I will follow your instructions right away.
    > Yes I do have a Windows 98 machine.
    > Thanks Zvi.

    Took you long until the coin dropped ...

    [snip]
    > > What I have been trying to suggest to you, is that
    > > before purchasing data recovery software and trying to recover your stuff, file
    > > by file, it would make more sense (and be cheaper too) to first try regaining
    > > access to the drive / partition and the data on it, if possible.
    >
    > Yes Zvi. I have understood what you are telling me. The ultimate fix
    > here is to have the drive operate as before. Problem is, where do I
    > begin?

    With post <aneb919eicftk20p8b08dq0tj5gjoqjh80@4ax.com> of this thread, before
    having been sidetracked (if you use Forte Agent, select the post link,
    right-click it and select "jump to message URL").

    [big snip]

    > > The above doesn't exclude the possibility that either the MBR and/or
    > > the boot sector were altered.
    >
    > My Response: (Gregg)
    > The last two paragraphs are confusing to me. How do I look at the
    > boot sector or MBR and what do I look for? How do I look at The MFT?
    > How do I look at the corrupted partition table? What info do I need
    > to provide you to further assist me?

    The RESQDISK assessment report should have answered these questions, if you had
    followed the instructions in my above post. I could then interpret the findings
    and guide you to complete the recovery. Others in this newsgroup could assist
    you just as well, based on the RESQDISK report.

    > > Zvi Said:
    > > In case the purchased SW doesn't yield the expected results: Make sure to not
    > > write to the problem drive if you wish to maintain the option of switching back
    > > to the above approach.
    >
    > My Response: (Gregg)
    > I just used EasyRecovery Pro and recovered 100 GB of the RAW disk.
    > ERP does have a RAW disk recovery tool. It is now writing to a
    > different drive. Not the problem drive. It will take 20 hours to
    > write that info to disk. Then I will report back to you.

    Since you already started the ER session, then let it complete what it started.
    Bear in mind that not all files that data recovery SW does "see" will recover
    properly. If OTOH, file recovery SW shows all your files and directories in its
    preview pane, then this is an indication that the damage is minor and you may
    have regained access to the file system without too much effort (and spare the
    expense on SW that you could have purchased later on, if full drive recovery
    didn't work for you). ;-(

    > I can tell you I won't be satisfied with the recovery method because
    > although it may recover the files, I still want the File structure
    > (Tree) in tact. So I want to continue to work on this problem and
    > see if I can solve it. Of course I won't be able to do it without
    > some help. Please continue to help me. I do appreciate it!

    No problem here. Yet I see now that your posting problem might be caused by
    Outlook Express as your default newsreader (OE is a classic Jack of all trades
    and master of none)! Many prefer Forte Agent as their newsreader (I do) and
    there is a free version available.

    Regards, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  15. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    news:koag91phiqqlt8cmj3ii13niuvaa878csq@4ax.com...
    > "Gregg OBanion" <gobanion@msn.com> wrote:
    >
    >> Zvi. Somehow I overlooked your instructions from your 5-26 5:40
    >> am
    >> post. (Below)
    >
    > [snipped]
    >
    >> > Post here the report file (just paste the text file into your
    >> > follow-up), and avoid top-posting!

    Hello Zvi
    I don't think I used ResQ correctly. Why was it trying to detect
    FAT? Came home a half hour later and it was still detecting fat so I
    made it finish. Here are the results. Is this what you wanted or do
    I need to run the program again.

    27 May 2005 21:01
    Evaluation Copy *************************************** CHS
    mode W9x
    ******************* * R e s Q d i s k 576 *
    ********************
    * Hard Disk Rescue and Recovery *
    Disk 1 * * Copyright (c) '90-04 NetZ Computing *
    SeeThru *
    ExtBIOS * * Virus Control, Disk & Data Recovery * ON
    F9 *
    ********* ***************************************
    *********
    * Drive *
    AltHelp *
    *********
    *********
    ^2:FAT-16*
    CHS address: Cyl 0 Head 0 Sector 1
    *********
    *********************** Setup Diagnostics
    ************************
    * Disk Type: WDC WD1600JB-00HUA0
    *
    * BIOS/CHS IDE/LBA
    data *
    * Number of Heads: 255 16
    *
    * Number of Cylinders: 1024 266305
    *
    * Sectors per Track: 63 63
    *
    * Disk Capacity in Mbytes: 8032 131071
    *
    * IDE Access Time: 44 msec
    *
    * Total sectors on drive: 268435455
    *
    ******* Use Space to toggle between IDE and Ext.BIOS mode
    ********
    Disk 1, Master Partition Sector, F6 for Layout


    27 May 2005 21:01
    Evaluation Copy *************************************** CHS
    mode W9x
    ******************* * R e s Q d i s k 576 *
    ********************
    * Hard Disk Rescue and Recovery *
    Disk 1 * * Copyright (c) '90-04 NetZ Computing *
    SeeThru *
    ExtBIOS * * Virus Control, Disk & Data Recovery * ON
    F9 *
    ********* ***************************************
    *********
    * Drive *
    AltHelp *
    *********
    *********
    ^2:FAT-16*
    CHS address: Cyl 0 Head 0 Sector 1
    ******************** Partition Table Layout
    **********************
    *
    *
    * Partition Starting Ending Reserved Total
    *
    * Boot Type Head Cyl. Sec. Head Cyl. Sec. Sectors
    Sectors *
    * 7 1 0 1 254 1023 63 63
    312576642*
    * 0 0 0 0 0 0 0 0 0
    *
    * 0 0 0 0 0 0 0 0 0
    *
    * 0 0 0 0 0 0 0 0 0
    *
    *
    *
    ******* Press Alt+B to see as boot sector, Alt+M to edit
    *********
    Disk 1, Master Partition Sector, F6 for Layout

    >>
    >> My Response: (Gregg)
    >> Excellent info above.
    >> Sorry for overlooking this. What you'll see written below was
    >> written before I discovered your instructions (above).
    >> Wow do I feel dumb! Please read below as it may provide a
    >> valuable
    >> summary. I will follow your instructions right away.
    >> Yes I do have a Windows 98 machine.
    >> Thanks Zvi.
    >
    > Took you long until the coin dropped ...
    >
    > [snip]
    >> > What I have been trying to suggest to you, is that
    >> > before purchasing data recovery software and trying to recover
    >> > your stuff, file
    >> > by file, it would make more sense (and be cheaper too) to first
    >> > try regaining
    >> > access to the drive / partition and the data on it, if
    >> > possible.
    >>
    >> Yes Zvi. I have understood what you are telling me. The ultimate
    >> fix
    >> here is to have the drive operate as before. Problem is, where do
    >> I
    >> begin?
    >
    > With post <aneb919eicftk20p8b08dq0tj5gjoqjh80@4ax.com> of this
    > thread, before
    > having been sidetracked (if you use Forte Agent, select the post
    > link,
    > right-click it and select "jump to message URL").
    >
    > [big snip]
    >
    >> > The above doesn't exclude the possibility that either the MBR
    >> > and/or
    >> > the boot sector were altered.
    >>
    >> My Response: (Gregg)
    >> The last two paragraphs are confusing to me. How do I look at the
    >> boot sector or MBR and what do I look for? How do I look at The
    >> MFT?
    >> How do I look at the corrupted partition table? What info do I
    >> need
    >> to provide you to further assist me?
    >
    > The RESQDISK assessment report should have answered these
    > questions, if you had
    > followed the instructions in my above post. I could then
    > interpret the findings
    > and guide you to complete the recovery. Others in this newsgroup
    > could assist
    > you just as well, based on the RESQDISK report.
    >
    >> > Zvi Said:
    >> > In case the purchased SW doesn't yield the expected results:
    >> > Make sure to not
    >> > write to the problem drive if you wish to maintain the option
    >> > of switching back
    >> > to the above approach.
    >>
    >> My Response: (Gregg)
    >> I just used EasyRecovery Pro and recovered 100 GB of the RAW
    >> disk.
    >> ERP does have a RAW disk recovery tool. It is now writing to a
    >> different drive. Not the problem drive. It will take 20 hours to
    >> write that info to disk. Then I will report back to you.
    >
    > Since you already started the ER session, then let it complete
    > what it started.
    > Bear in mind that not all files that data recovery SW does "see"
    > will recover
    > properly. If OTOH, file recovery SW shows all your files and
    > directories in its
    > preview pane, then this is an indication that the damage is minor
    > and you may
    > have regained access to the file system without too much effort
    > (and spare the
    > expense on SW that you could have purchased later on, if full
    > drive recovery
    > didn't work for you). ;-(

    I had to stop the data recovery from EasyRecovery Pro. It was taking
    to long to write to the recovery drive/folder. (about 25 hrs was the
    estimate). The files I looked at had lost all structure even file
    names were changed. Of course I only used ERP's RAW recovery tool.
    GetDataBack left most file names in tact but didn't near the info
    back that ERP recovered. Very little was recovered with GetDataBack.

    >
    >> I can tell you I won't be satisfied with the recovery method
    >> because
    >> although it may recover the files, I still want the File
    >> structure
    >> (Tree) in tact. So I want to continue to work on this problem and
    >> see if I can solve it. Of course I won't be able to do it without
    >> some help. Please continue to help me. I do appreciate it!
    >
    > No problem here. Yet I see now that your posting problem might be
    > caused by
    > Outlook Express as your default newsreader (OE is a classic Jack
    > of all trades
    > and master of none)! Many prefer Forte Agent as their newsreader
    > (I do) and
    > there is a free version available.

    I will look at Forte Agent then soon. Yes I think Outlook Express
    does some strange things to text, breaking sentenances apart. Just
    bad formating. It's probably just me though. Thanks for the info. I
    will try Forte Agent.

    Regards, Gregg

    >
    > Regards, Zvi
    > --
    > NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il
    > (Hebrew)
    > InVircible Virus Defense Solutions, ResQ and Data Recovery
    > Utilities
  16. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Thanks, I will take a look at Partition Table Doctor.

    <wemaole@yahoo.com> wrote in message
    news:1117249889.415209.18820@g47g2000cwa.googlegroups.com...
    >I suggest you use Partition Table Doctor to resolve your
    > problem.The software provides very useful functions: Fix boot
    > sector
    >
    > Run the program and right click the partition and choose fixboot.
    >
    >
    > see more: http://www.ptdd.com/fixboot.htm
    >
  17. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Alexander Grigoriev" <alegr@earthlink.net> wrote in message
    news:hISle.1196$s64.1157@newsread1.news.pas.earthlink.net...
    >I suppose the drive is properly detected as Big ATA?

    Yes. On System boot the Start Up Screen shows the Ultra 100
    controller and the 4 drives as 149.05 GB.

    >
    > "Gregg OBanion" <gobanion@msn.com> wrote in message
    > news:J_fle.7960$tp.4626@fed1read05...
    >> Sorry for the inexperience with my post. It's been a while.
    >>
    >> The drive is one big partition. The Info in Disk Management
    >> reads, Disk 3, Basic, 149.05 GB, Online. File System RAW. In
    >> order on the Promise Ultra 100, It's on IDE 1 as a Slave. There
    >> are 3 other Identical drives on the PCI card.
    >>
    >
    >
  18. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
    > "Gregg OBanion" <gobanion@msn.com> wrote in message news:lB4me.1967$fp.688@fed1read05
    > > "Zvi Netiv" <support@replace_with_domain.com> wrote in message

    Let me tell you a little story about a dog that tried to get accepted by a pack
    of wolves ...

    Attempting to make friends, he went sniffing the butt of his new mates, like
    dogs do. When approaching to sniff one of his new mates, the partner
    unexpectedly said: "look, I am a dog myself, but butt-sniffing among wolves is
    considered vulgar and degrading. This is why they greet each other by rubbing
    noses, instead". The newcomer said thanks for the advice, and happily went on
    rubbing noses with the other wolves in the pack. Then, one day just the two
    dogs met in the woods, with no wolf in sight. As the newcomer was approaching
    for the nose rub greeting, the other dog said to him: "Wait! As we both know
    exactly who you are, then you don't have to pretend with me, and I'll let you
    sniff my butt".

    [snip]

    > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
    > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
    > heads used- for drives bigger than or equal to 8GB.
    > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.
    > The information flag of Int13/ah=48 will say:
    > cylinder/head/sectors-per-track information is valid: 'false' (cleared).

    Clueless. You have been doing this (telling authors how they should write their
    programs) to Svend, Joep and myself. Give it up, Folkert, this is way over your
    league.

    Besides, your trolling contributes nothing constructive to the discussion and
    all it does is to mislead and confuse.

    Regards, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  19. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    news:1a7j91t1vcslod84pvb1vb3kv0e9lbmsfe@4ax.com...
    > "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
    >
    > > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
    > > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the
    number of
    > > heads used- for drives bigger than or equal to 8GB.
    > > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over
    8GB.
    > > The information flag of Int13/ah=48 will say:
    > > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
    >
    > Clueless. You have been doing this (telling authors how they should write
    their
    > programs) to Svend, Joep and myself. Give it up, Folkert, this is way over
    your
    > league.
    >
    > Besides, your trolling contributes nothing constructive to the discussion
    and
    > all it does is to mislead and confuse.
    >
    Here, here.

    Folknuts, you don't have a clue. Especially on CHS in NT.
  20. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > Hello Zvi. Your information was very encouraging. I hope It works
    > but before I try let me give you some more information that may be
    > important. I'm sorry I didn't mention it earlier.
    >
    > The 4 disk array (with the malfunctioning drive) was migrated from a
    > Windows 2000 Pro Server machine and a Promise Ultra 133 PCI card.
    > Remember the array is now on WinXP SP2 with a Promise Ultra 100 PCI
    > card. I meant to tell you this long ago. I hope it doesn't present a
    > problem. I will wait to hear from you before I follow your
    > instructions below.

    [snip]

    > I have now disconnected the CD Rom on Secondary IDE and ran ResQdisk
    > again. Here's the Report.

    ResQdisk reports INT-13 devices, from 80h and up (BIOS notation), i.e. only HARD
    drives. I didn't make it clear, since I thought it was obvious.

    The new report from May 29 still shows the presence of additional HARD drives
    connected in that PC. You should leave the CD drive(s) connected, how else will
    you boot the CD repair console?

    The installed Windows version is irrelevant, as there should be no "installed"
    system at the time you run FIXBOOT. You should be working with a single HARD
    drive connected and boot of a W2K or XP setup CD. Either have FIXBOOT as part
    of their "repair console", and you may use the one or the other.

    Regards, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  21. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Zvi Netiv" <support@replace_with_domain.com> wrote in message news:1a7j91t1vcslod84pvb1vb3kv0e9lbmsfe@4ax.com...
    > "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
    > > "Gregg OBanion" <gobanion@msn.com> wrote in message news:lB4me.1967$fp.688@fed1read05
    > > > "Zvi Netiv" <support@replace_with_domain.com> wrote in message
    >

    Idiotic sidetrack attempt snipped.

    >
    > [snip]
    >
    > > * BIOS/CHS IDE/LBA data *
    > > * Number of Heads: 255 16 *
    > > * Number of Cylinders: 1024 266305 *
    > > * Sectors per Track: 63 63 *
    > > * Disk Capacity in Mbytes: 8032 131071 *

    > Oh look, the 'Number of Cylinders' line has been corrected although there was nothing
    > (supposedly) wrong with it. Yet Resqdisk version is still v576. Naughty, naughty.

    Introductory context restored. Typical how people like Netiv always have to snip that to
    make themself believable, the sure sign that such person obviously has something to hide.

    > > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
    > > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
    > > heads used- for drives bigger than or equal to 8GB.
    > > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.

    > > The information flag of Int 13-AH=48h will say:
    > > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
    (Or in the words of EDD-2: The geometry returned in bytes 4-15 shall be valid)

    >
    > Clueless.

    Your deliberate snipping of the quoted error tells it all Netiv.
    You are just posturing.
    You are the 'clueless' one that obviously didn't check Int 13-AH=48h's
    information buffer result of the word at offset 2, bit one, for the validity
    of the geometry as returned in bytes 4-15: Number of default cylinders,
    Number of default heads and Number of default sectors.

    Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselfs.
    Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
    http://www.t13.org/project/d1484r3.pdf, page 13, 14.

    And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
    Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
    http://www.t13.org/project/d1410r0a.pdf

    > You have been doing this (telling authors how they should write their
    > programs) to Svend, Joep and myself.

    At least one of them drew his conclusions and the other one created his own little
    wolves-den (or is that doghouse?). Perhaps they are the smarter ones, Netiv.

    > Give it up, Folkert, this is way over your league.

    And miss all the fun of the wolves gathering, to tear the messenger apart?
    See the Gisin newbee licking your arse? Nah. Too much fun.

    So btw, if I got it all so very, very wrong, why then did you change the
    BIOS/CHS IDE/LBA data reporting? It's obviously different from the
    last time we 'discussed' this in "Re: mbr for 40G harddrive?"
    news:428aa100$0$59548$892e7fe2@authen.white.readfreenews.net

    That post where resqdisk managed to get the CHS wrong in the MBR
    partition entry that it recreated.


    * Disk Type: Maxtor 34098H4
    * BIOS/CHS IDE/LBA data
    * Number of Heads: 255 16
    * Number of Cylinders: 1025 16383
    * Sectors per Track: 63 63
    * Disk Capacity in Mbytes: 8040 32253

    Like I said before, Netiv, you are just posturing.
    You wouldn't have changed that if I was so very wrong.

    >
    > Besides, your trolling contributes nothing constructive to the discussion and

    I'm not so sure about that when you obviously changed something in RESQDISK.

    > all it does is

    Warn everyone that uses your software that there is a risk in doing so
    since you are such a sloppy programmer that uses unsuspecting users to
    do your testing for you.

    > to mislead and confuse.

    Of which you obviously know all about with your little anecdotes, Netiv.

    Pot kettle black.

    >
    > Regards, Zvi
  22. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    I was away for a couple days. Sorry for the delay. I will complete
    your instructions later today. Thanks Zvi.

    Regards Gregg

    Zvi Netiv wrote:
    > "Gregg OBanion" <gobanion@msn.com> wrote:
    >
    >> Hello Zvi. Your information was very encouraging. I hope It works
    >> but before I try let me give you some more information that may
    >> be
    >> important. I'm sorry I didn't mention it earlier.
    >>
    >> The 4 disk array (with the malfunctioning drive) was migrated
    >> from a
    >> Windows 2000 Pro Server machine and a Promise Ultra 133 PCI card.
    >> Remember the array is now on WinXP SP2 with a Promise Ultra 100
    >> PCI
    >> card. I meant to tell you this long ago. I hope it doesn't
    >> present a
    >> problem. I will wait to hear from you before I follow your
    >> instructions below.
    >
    > [snip]
    >
    >> I have now disconnected the CD Rom on Secondary IDE and ran
    >> ResQdisk
    >> again. Here's the Report
    >
    > ResQdisk reports INT-13 devices, from 80h and up (BIOS notation),
    > i.e. only HARD drives. I didn't make it clear, since I thought it
    > was obvious.

    How on earth do you read all that information from that little
    report? I just don't see it. Amazing! If you have time would you
    break it down for me so I have a clue? Where can I go to learn more
    about hard drives?

    >
    > The new report from May 29 still shows the presence of additional
    > HARD drives connected in that PC. You should leave the CD
    > drive(s)
    > connected, how else will you boot the CD repair console?

    This I don't understand. There is only a floppy connected now and I
    will reconnect the CD Rom as Secondary IDE, Master. Nothing Else is
    connected. The network is connected still to the Router but ResQ
    wouldn't detect that would it?

    >
    > The installed Windows version is irrelevant, as there should be no
    > "installed" system at the time you run FIXBOOT. You should be
    > working with a single HARD drive connected and boot of a W2K or XP
    > setup CD. Either have FIXBOOT as part of their "repair console",
    > and
    > you may use the one or the other.
    >
    > Regards, Zvi
  23. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Gregg OBanion" <gobanion@msn.com> wrote:

    > FIXBOOT Restored the drive although I'm missing most files I was
    > hoping to regain.

    Regaining access to the drive by restoring the boot sector confirms my
    assessment as to what caused to lose it. Apparently, the boot sector wasn't the
    only element that got damaged.

    > It imeadiatly ran chkdisk on system start. Chkdisk said: Deleting
    > orphan file record segment, up to about 60,000 + files. Then it said
    > verifying Indexes, then Inserting index entry, Replacing invalid
    > security ID, Inserting data attribute and correcting errors in boot
    > file. I missed some of them. I wonder if I should have stopped check
    > disk?

    You shouldn't have let CHKDSK to start in the first place, by pressing a key
    during the countdown before it started! You ran a long way to stumble just
    before the finish line.

    Chkdsk in XP's startup runs in auto repair mode and it doesn't let the user
    decide to not repair its findings. It's possible that many of your files could
    be copied of the drive if you didn't let Chkdsk to "fix" the file system.

    > Remember the problem happened when I renamed the Drive and at the
    > same time I was transfering a folder containing all my JPG images.
    > That folder is gone.
    >
    > The Drive also Retained it's Drive letter (F) and I notice that the
    > Drive name change took affect. It now has a new name I choose.
    >
    > It's funny that the one folder I had not yet transfered from the
    > drive remained intact. Although the top folder in the hierarchy
    > seemed to be renamed, (dir0000.chk) etc...the folders inside it
    > retained their complete folder names as well as file names but
    > folders were missing within thoose folders.

    The dir0000x notation are the doing of Chkdsk.

    > Whats my next step? Data recovery software. What is the best?

    Right now, except professional data recovery (expensive), you could try the data
    recovery packages that you already purchased. Having regained access to the
    drive should facilitate the process.

    If what you are after is mostly JPGs, then here is a link to the program that
    Robert Green wrote to recover JPG after having been hit by the LoveLetter worm
    (the problem you face is similar). http://www.claymania.com/zefrjpg.html

    Regards, Zvi
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  24. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Zvi, I want to thank you very much. It looks like I did drop the
    ball at the finish line. I knew I shouldnt haver let CHKDisk run. It
    started in the blink of an I and was well into running before I
    realized the mistake so I just let it finish. I'll bet you if
    Chkdisk hadn't run I would have recovered those files.

    I'll post back here to let you know how the link you gave me below
    works. If that doesn't work I'll try recovery software.

    Zvi Netiv wrote:
    > "Gregg OBanion" <gobanion@msn.com> wrote:
    >
    >> FIXBOOT Restored the drive although I'm missing most files I was
    >> hoping to regain.
    >
    > Regaining access to the drive by restoring the boot sector
    > confirms my
    > assessment as to what caused to lose it. Apparently, the boot
    > sector
    > wasn't the only element that got damaged.
    >
    >> It imeadiatly ran chkdisk on system start. Chkdisk said: Deleting
    >> orphan file record segment, up to about 60,000 + files. Then it
    >> said
    >> verifying Indexes, then Inserting index entry, Replacing invalid
    >> security ID, Inserting data attribute and correcting errors in
    >> boot
    >> file. I missed some of them. I wonder if I should have stopped
    >> check
    >> disk?
    >
    > You shouldn't have let CHKDSK to start in the first place, by
    > pressing a key during the countdown before it started! You ran a
    > long way to stumble just before the finish line.
    >
    > Chkdsk in XP's startup runs in auto repair mode and it doesn't let
    > the user decide to not repair its findings. It's possible that
    > many
    > of your files could be copied of the drive if you didn't let
    > Chkdsk
    > to "fix" the file system.
    >
    >> Remember the problem happened when I renamed the Drive and at the
    >> same time I was transfering a folder containing all my JPG
    >> images.
    >> That folder is gone.
    >>
    >> The Drive also Retained it's Drive letter (F) and I notice that
    >> the
    >> Drive name change took affect. It now has a new name I choose.
    >>
    >> It's funny that the one folder I had not yet transfered from the
    >> drive remained intact. Although the top folder in the hierarchy
    >> seemed to be renamed, (dir0000.chk) etc...the folders inside it
    >> retained their complete folder names as well as file names but
    >> folders were missing within thoose folders.
    >
    > The dir0000x notation are the doing of Chkdsk.
    >
    >> Whats my next step? Data recovery software. What is the best?
    >
    > Right now, except professional data recovery (expensive), you
    > could
    > try the data recovery packages that you already purchased. Having
    > regained access to the drive should facilitate the process.
    >
    > If what you are after is mostly JPGs, then here is a link to the
    > program that Robert Green wrote to recover JPG after having been
    > hit
    > by the LoveLetter worm (the problem you face is similar).
    > http://www.claymania.com/zefrjpg.html
    >
    > Regards, Zvi
  25. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:

    [snip]

    > Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselfs.
    > Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
    > http://www.t13.org/project/d1484r3.pdf, page 13, 14.
    >
    > And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
    > Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
    > http://www.t13.org/project/d1410r0a.pdf

    Blah, blah, blah ...

    In case you haven't noticed, this thread ended when I resolved what caused the
    partition to disappear. To which you contributed absolutely nothing.
    --
    NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
    InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
  26. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    "Zvi Netiv" <support@replace_with_domain.com> wrote in message news:8ap7a1l6jm3qmrj81lajje04lue69q32qr@4ax.com
    > "Folkert Rienstra" <see_reply-to@myweb.nl> wrote:
    >
    > [snip]
    [unsnip]
    > > >
    > > > > * BIOS/CHS IDE/LBA data *
    > > > > * Number of Heads: 255 16 *
    > > > > * Number of Cylinders: 1024 266305 *
    > > > > * Sectors per Track: 63 63 *
    > > > > * Disk Capacity in Mbytes: 8032 131071 *
    > >
    > > > Oh look, the 'Number of Cylinders' line has been corrected although there was nothing
    > > > (supposedly) wrong with it. Yet Resqdisk version is still v576. Naughty, naughty.
    > >
    > > Introductory context restored. Typical how people like Netiv always have to snip that to
    > > make themselves believable, the sure sign that such person obviously has something to hide.
    > >
    > > > > Now it does the BIOS/CHS correct but it does the IDE/LBA wrong.
    > > > > IDE cylinders are limited to 16383, 32767 or 65,535 -depending on the number of
    > > > > heads used- for drives bigger than or equal to 8GB.
    > > > > The CHS of Int13/ah=48 GET DRIVE PARAMETERS is invalid for drives over 8GB.
    > >
    > > > > The information flag of Int 13-AH=48h will say:
    > > > > cylinder/head/sectors-per-track information is valid: 'false' (cleared).
    > > (Or in the words of EDD-2: The geometry returned in bytes 4-15 shall be valid)
    > >
    > > >
    > > > Clueless.
    > >
    > > Your deliberate snipping of the quoted error tells it all Netiv.
    > > You are just posturing.
    > > You are the 'clueless' one that obviously didn't check Int 13-AH=48h's
    > > information buffer result of the word at offset 2, bit one, for the validity
    > > of the geometry as returned in bytes 4-15: Number of default cylinders,
    > > Number of default heads and Number of default sectors.
    > >
    > >
    > > > Anyone can lookup http://www.ctyme.com/intr/rb-0715.htm and see for themselves.
    > > > Or Information Technology - BIOS Enhanced Disk Drive Services – 2 (EDD-2)
    > > > http://www.t13.org/project/d1484r3.pdf, page 13, 14.
    > > >
    > > > And lookup the 16,383 32,767 and 65,535 numbers in: D1410r0a
    > > > Information Technology AT Attachment with Packet Interface - 6 (ATA/ATAPI-6)
    > > > http://www.t13.org/project/d1410r0a.pdf
    > >
    > Blah, blah, blah ...

    Yup, what else can one say if one's nose is rubbed in the facts.

    >
    > In case you haven't noticed, this thread ended when I resolved what caused the
    > partition to disappear.

    Even a broken clock is right on time twice a day, every day of
    the year, year in, year out, Doesn't mean it's actually running.

    > To which you contributed absolutely nothing.

    So what, didn't make the errors in your report any less wrong.
    Or the risk one takes running your apps when you can't get your facts right.
Ask a new question

Read More

Data Recovery Storage