Rebuild NTFS File Structure?

[jmak124]

The story goes like this. A Dell system has a dying IDE controller, and instead of getting a replacement motherboard, I decided to switch over to a ECS motherboard, utilizing the same CPU, video card and drives (and added a new Maxtor 300 gb). The main problem is that the Dell system used RDRAM, the ECS board uses DDR. So naturally, windows XP didn't boot up. I tried to do a repair install with XP and it ended up with a BSOD. After rebooting, I tried again only to see that the NTFS drive is now just a (unknown) file system drive. After much debate, I decided to install windows on the Maxtor, and pull the files off from the old HD (IBM Deskstar 60 gb), now with windows running on the Maxtor, the old HD still has no file structure.

Is there a way to rebuild the file structure on the IBM or do I have to use a file recovery program? If I have to go the latter, what program do you guys suggest? Thanks in Advanced.


Jason

[SuperFarStucker]

It depends how it is corrupted. You can mount the drive in linux and the linux ntfs filesystem driver will attempt to recover the bootsector by copying the spare that is written to the last sector of the drive. knoppix should do the trick. just mount the drive with the following options.

mount --type ntfs -o errors=recover /dev/hd[x#]

where x is the controller the drive is on and # is the partition number, probably hda6 or hdb6 but if neither of those work try hda1 hda5 hdb1 hdb5. You can look at the unmounted drive with fdisk to find out the partition structure (fdisk /dev/hda or /dev/hdb). Attempting to mount the wrong drive shouldn't do anything to it as it will have an intact filestructure.

Unfortunately I am unaware of any windows tools that will try to recover from the last sector, which is odd. I know fixboot and fixmbr will not work on a drive that is corrupted in this manner, although you're free to try. Boot up into the windows installer and when it detects existing windows installs hit R to recover.

A word of caution If you have other filesystem types or a non windows bootloader be careful with fixboot/fixmbr because they (or is it mbrfix, bootfix?) don't play nice, although it is unlikely you'll be able to do anything to a drive that isn't detected as having a windows install on it.

[jmak124]

I don't know if this is part of the reason or not, but I recalled seeing a list of files deleted as windows was doing its repair "install", after deleting those files, it started copying new files when the BSOD occurred. Since I don't have a copy of Knoppix handy, I found testdisk, which supposedly is good for these situations.

As for the HD, there's the 55 gb windows partition and a small partition made by Dell for some sort of utility, I don't know if that'll count as a different file system.

[SuperFarStucker]

never heard of it but after reading a bit it sounds like it should definitely do the trick.

[jmak124]

Well, it seems the situation just got worst, the HD is only detected intermittently.

[SuperFarStucker]

it probably wasn't the ide controller going out then. Sounds like bad drive electronics.

[jmak124]

Well, the reason why I said it was a bad IDE controller is that, it'll get past bios but say no boot devices found, Strike F1 to try again or press F2 to go into setup. Once in setup, none of the IDE devices will be shown (CD-RW, DVD-ROM, and the HD).

UPDATE:

Took both HD's out of the case, turns out there's a cable issue, with both HD's out, its running fine. The problem isn't that the HD is dying or anything anymore. Now I'm just trying to get it to fix the file structure. Windows detects the drive as RAW, however, TestDisk sees the HD as NTFS, and the boot sector as normal. Its just that windows won't boot it up. Should I be looking into software that can recover data from a RAW partition?

[aftermath]

http://www.ntfs.com/partition-deleted.htm

^^
Iv been reading this with the aim of restoring 6 years of stuff on a disk set that I transplanted to my server.

I can see all 4 partions as raw so once i figure out how to restore them ill let you know my steps.

I also know that all the files are a-OK its just windows wount beliave it because the partion table is damaged at least thats what I think.

there are some free trial versions of data recovery around the web that you can use to see if the files are still on the computer.

edit:
this looks promising too. http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi?coll=linux&db=HOWTO&fname=/usr/HOWTO/Partition-Rescue.html

[doublejack]

I ran into a situation when I tried to move a 40gb drive from one computer to another. In the first machine the 40gb drive was the only IDE device in the computer. In the second computer I already had two hds, so I added the 40gb as a master on the secondary channel with a DVD-ROM as a slave.

The drive was only recognized some of the time, and when it was recognized it came up as RAW and XP couldn't read any data on the drive. The drive had been set up as one large NTFS partition. I also noticed that the dvd-romceased working too. I would put a disc in and it would not show anything in explorer, as if the drive were still empty.

I traced the problem to both the cable used - this drive preferred the old 40 conductor IDE cables to the 80 conductor ones, and learned the hd and dvd-rom were completely incompatible. No matter which one I set as master or slave the hd would only show up intermittently and would never be readable.

So I junked the dvd drive. Unfortunately I was not able to recover the data, but the 40gb drive has worked great ever since this episode. I did have to delete the partition and start fresh though.

[jmak124]

Thanks for the replies. I have tried putting the HD into a USB enclosure also, and that won't even detect at all when plugged into windows. I guess I'll check out those 2 links and see if I can find them useful.

As far as the cable goes, they were the same ones from the dell (Thinner 80 pin cable). I guess I'll try a 40 also just in case.

[aftermath]

I will let you kwon what I discovered about my missing drives.

1. All the data was ok
2. Partitions were ok including partition tables and the mbr
3. windows did not auto mount the volumes!

solution:
1. right click my computer and select "manage"
2. select "Disk Management"
3. if the drive is visible with the partions shown select a partition and goto 4
4. right click on tyhe partition
5. select "Change drive letters and paths"
6. click add
7. select a drive letter and click ok a few times

hope that solves your problem too.