data recovery

[+theblazingangel MVC]

help! i tried to resize the partitions of my external USB hard drive with partition magic but it messed it up.

background info: i was trying to move 30GB of free space from partition #1 to partition #3. when i left my computer it was on the last stage - moving data in partition #3, and it was 96% complete. when i came back i was presented with error #10055. the error apparently means the partition disappeared for some reason...

the partition was using the NTFS fs, and has a lot of data on it that i really don't want to loose. i downloaded a copy of knoppix and i'm able to see the data which is a good sign, but i don't want to copy it elsewhere if possible because it would take a long time, i'd like to just repair the partition if i can.

as far as i understand from my google search, when partition magic started, it changed the fs from NTFS to PqRP (power-quest recoverable partition), when the error occurred partition magic did not change the fs type back in order to prevent windows accessing it and therefore make data recovery possible.

now what should i do? i believe that i can change the fs type from PqRP back to NTFS with a tool called ptedit32.exe. however how should i proceed afterwards (or beforehand) to make sure all data is preserved and correct any problems?

thanks

[Mindovermaster Global Moderator]

Always Backup before doing anything to your hard drive such as switching partitions.

I do not know if that will fully work, but as you cant read the drive right now, you really don't have a choice..

[+theblazingangel MVC]

yeh i know, i would have backed it up if there wasn't so much data.

i do have high hopes of recovery here though, as i mentioned, i can access the data through knoppix (linux live cd), essentially the partition has been quarantined by partition magic to prevent data loss. i need to un-quarantine it by changed the file system type from PqRP back to NTFS which i believe i can do, but before i do so i need to know what else (if anything) i need to do to fix any corrupt data, repair anything like the mbr/partition table, and make sure i don't loose anything while doing this, from someone with experience (i've never done something like this before!)...

[Vlad]

yeh i know, i would have backed it up if there wasn't so much data.

i do have high hopes of recovery here though, as i mentioned, i can access the data through knoppix (linux live cd), essentially the partition has been quarantined by partition magic to prevent data loss. i need to un-quarantine it by changed the file system type from PqRP back to NTFS which i believe i can do, but before i do so i need to know what else (if anything) i need to do to fix any corrupt data, repair anything like the mbr/partition table, and make sure i don't loose anything while doing this, from someone with experience (i've never done something like this before!)...

Changing the partition type can be done from the Knoppix live-cd.

If knoppix has the ntfsfix program, you could try running that on the volume (in read only mode of course). It'll pick up some of the common errors.

Backing up the mbr/partition table is just copying the first 512 bytes from your hard disk (dd if=/dev/hda of=mbr.bin bs=512 count=1).

As for making sure you don't lose anything...that's why you backup the data before you do it. Otherwise, you will /never/ be sure. No one with any real experience is going to tell you to fiddle with your data without backing it up first.

[+theblazingangel MVC]

ok, i used ntfsfix in knoppix, it looked like it attempted to fix something, no idea what it did though...

anyway, i used ptedit.exe and changed the partition file system type back to ntfs and regained access to it which is good however the situation has become much worse, running chkdsk with /f helped a bit however...

1) a lot of data on the partition seems corrupt, HOWEVER...

2) 30GB of disk space (the amount i was moving) is missing from the disk! the reported size of partition #3 in partition magic is the correct size including the 30GB, however the total reported amount of used and un-used disk space is 29996.4MB short...

3) errors when performing actions on partitions on my laptop hard drive, but we can come back to that later if necessary

i don't care about problem #3, if necessary i can reformat the laptop or do what ever is necessary to fix the problems on that, however problem #1 and #2 i really need to solve. i am really hoping that problem #1 will resolve itself after problem #2 is solved.

what do i need to do to get windows to find that missing 30GB of disk space? :cry:

edit: here's some info on the disk in question

Partition   Type   Size (MB)   Used (MB)   Unused (MB)   Status   Pri/Log
===========================================================================
I:		  NTFS   20,002.8	1,034.4	18,968.3	   None	 Primary
J:		  NTFS   49,999.2   31,262.8	18,736.4	   None	 Primary
K:		  NTFS  235,240.9  186,339.3	18,905.2	   None	 Primary

===========================================================================================================
Disk Geometry Information for Disk 2:	38913 Cylinders,  255 Heads,  63 Sectors/Track
System			  PartSect  # Boot BCyl Head Sect  FS	ECyl Head Sect	StartSect	 NumSects
===========================================================================================================
						   0  0  00	 0	1	1  07	1023  254   63		   63   40,965,687
Info: End C,H,S values were large drive placeholders.
  Actual values are:
		0  0  00	  0	1	1  07   2549  254   63		63  40965687
						   0  1  00  1023  254   63  07	1023  254   63   40,965,750  102,398,310
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
  Actual values are:
		0  1  00   2550	0	1  07   8923  254   63  40965750 102398310
						   0  2  00  1023	0	1  07	1023  254   63  143,364,060  481,773,285
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
  Actual values are:
		0  2  00   8924	0	1  07  38912  254   63 143364060 481773285


===========================================================================================================
Partition Information for Disk 2:	305,242.8 Megabytes
Volume		 PartType	Status	Size MB	PartSect  #   StartSect  TotalSects
===========================================================================================================
I:			 NTFS		Pri	  20,002.8		   0  0		  63  40,965,687
J:			 NTFS		Pri	  49,999.2		   0  1  40,965,750 102,398,310
K:			 NTFS		Pri	  235,240.9		   0  2 143,364,060 481,773,285


===========================================================================================================
Boot Record for drive I:   (Drive: 2, Starting sector: 63, Type: NTFS)
===========================================================================================================
 1. Jump:				   EB 52 90
 2. OEM Name:			   NTFS	
 3. Bytes per Sector:	   512
 4. Sectors per Cluster:	8
 5. Reserved Sectors:	   0
 6. Number of FATs:		 0
 7. Root Dir Entries:	   0
 8. Total Sectors:		  0
 9. Media Descriptor:	   0xF8
10. Sectors per FAT:		0
11. Sectors per Track:	  63  (0x3F)
12. Number of Heads:		255  (0xFF)
13. Hidden Sectors:		 63  (0x3F)
14. Total Sectors (>32MB):  0  (0x0)
15. Unused:				 0x80008000
16. Total NTFS Sectors:	 40965686
17. MFT Start Cluster:	  786432
18. MFT Mirror Start Clust: 524445
19. Clusters per FRS:	   246
20. Clusters per Index Blk: 1
21. Serial Number:		  xxxxxxxxxxxxxxxx
22. Checksum:			   0  (0x0)
23. Boot Signature:		 0xAA55

===========================================================================================================
Boot Record for drive J:   (Drive: 2, Starting sector: 40,965,750, Type: NTFS)
===========================================================================================================
 1. Jump:				   EB 52 90
 2. OEM Name:			   NTFS	
 3. Bytes per Sector:	   512
 4. Sectors per Cluster:	8
 5. Reserved Sectors:	   0
 6. Number of FATs:		 0
 7. Root Dir Entries:	   0
 8. Total Sectors:		  0
 9. Media Descriptor:	   0xF8
10. Sectors per FAT:		0
11. Sectors per Track:	  63  (0x3F)
12. Number of Heads:		255  (0xFF)
13. Hidden Sectors:		 40965750  (0x2711676)
14. Total Sectors (>32MB):  0  (0x0)
15. Unused:				 0x80008000
16. Total NTFS Sectors:	 102398309
17. MFT Start Cluster:	  786432
18. MFT Mirror Start Clust: 6399894
19. Clusters per FRS:	   246
20. Clusters per Index Blk: 1
21. Serial Number:		  xxxxxxxxxxxxxxxx
22. Checksum:			   0  (0x0)
23. Boot Signature:		 0xAA55

===========================================================================================================
Boot Record for drive K:   (Drive: 2, Starting sector: 143,364,060, Type: NTFS)
===========================================================================================================
 1. Jump:				   EB 52 90
 2. OEM Name:			   NTFS	
 3. Bytes per Sector:	   512
 4. Sectors per Cluster:	8
 5. Reserved Sectors:	   0
 6. Number of FATs:		 0
 7. Root Dir Entries:	   0
 8. Total Sectors:		  0
 9. Media Descriptor:	   0xF8
10. Sectors per FAT:		0
11. Sectors per Track:	  63  (0x3F)
12. Number of Heads:		255  (0xFF)
13. Hidden Sectors:		 204796620  (0xC34F2CC)
14. Total Sectors (>32MB):  0  (0x0)
15. Unused:				 0x80008000
16. Total NTFS Sectors:	 420340724
17. MFT Start Cluster:	  786432
18. MFT Mirror Start Clust: 26271295
19. Clusters per FRS:	   246
20. Clusters per Index Blk: 1
21. Serial Number:		  xxxxxxxxxxxxxxxx
22. Checksum:			   0  (0x0)
23. Boot Signature:		 0xAA55

Edited April 29, 2007 by theblazingangel

[+theblazingangel MVC]

update (not that anyone seems interested... unless its just that no-one knows how to help...)

problem #2 has been solved after lots of playing around. chkdsk and a program called testdisk 6.6 fixed it.

problem #3, getting errors from partition magic when trying to do some stuff with laptop hard drive. according to chkdsk and one partition magic error the disk has bad sectors, so it looks like i need to get a new one. unfortunately i can't find a receipt or warranty or anything and no mention of it in the purchase history on the website i bought it from (goes back 3yrs, so must have been more than 3yrs ago), but fortunately prices have dropped considerably since then, i believe it cost me ~?120 and now prices are around ~?35. anyone want my old drive when/if i get a new one, 60GB 2.5" toshiba MK6026GAX, 4K of bad sectors somewhere in the last 1.5GB of the disk. or is 4K (8x sectors / 1x cluster) not worth buying a new disk?

problem #1 (corrupt files), file recovery software doesn't seem to work, it just comes up with thousands of odd jpg/xsl/doc/txt files filled with random code and stuff. most files i can get a hold of myself however not all of them. it's annoying because i know the data must be present on the disk somewhere, however i don't think i have anyway of getting at it and repairing the broken file:(:(