6GB Drive Help needed

[clpackard3]

I have a 6GB drive that I needed to get data off of. I put it in a portable USB enclosure and hooked it up to a Windows Vista PC and Vista appeared to hang and not read the drive. I tried to move it to an XP PC and XP says that the drive is not formatted. At that point I decided to put it back into a PC as an IDE drive and booted off of a Windows 98 floppy. This drive is a Windows 98 FAT32 system disk. Under Windows 98 DOS if I go to C: the drive is accessible but if I do a dir I do not see any files although it says that there is 2.6gb available on the drive. I believe that the data blocks are valid but something has happened to the file allocation tables or indexes???


.../000:03/LOG> ### LOG START ###
.../000:03/LOG> DISKPATCH 3.5.300
.../000:03/LOG> (C) 2000-2009 DIY DataRecovery
.../000:03/LOG> Contact info: http://HTTP://www.DIYDataRecovery.nl
.../000:03/LOG> MemFree: 74Kb
.../000:03/LOG> CommandLineParms: /sup
.../000:03/LOG> LogDate: 09-04-2010
.../000:03/CFG> FilePath="A:DPFILES\"
.../000:03/CFG> ReadRetries="32"
.../000:03/CFG> WriteRetries="32"
.../000:03/CFG> MaxReadErrors="32"
.../000:03/CFG> MaxWriteErrors="1"
.../000:03/CFG> LogEachReadError="1"
.../000:03/CFG> ReadDelay="0"
.../000:03/CFG> VfyFixedBadSect="1"
.../000:03/CFG> CleanAfterDOD="1"
.../000:03/CFG> DiskReset="1"
.../000:03/CFG> SectorSkip="1024"
.../000:03/CFG> AutoSaveState="1"
.../000:03/CFG> DumpFoundSectors="0"
.../000:03/CFG> FixFats="1"
.../000:03/CFG> MaxFatScan="51200"
.../000:03/CFG> MaxDataColEntries="256"
.../000:03/CFG> IgnoreF8FF="0"
.../000:03/CFG> DownSizeExt="1"
.../000:03/CFG> ScanSignature="55AA"
.../000:03/CFG> Rebuild="00"
.../000:03/13H> Ext13H installed test requested
.../000:03/13H> Disk found at 128
.../000:03/13H> Ext13H version: EDD-3.0
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: Cylinder/head/sector info is valid
.../000:03/13H> Drive Interface Info: ATA
.../000:03/13H> Disk 128 X13H data : 13328/15/63 12594960/512
.../000:03/13H> Ext13H tested ok
.../000:03/FDL> DiskList requested
.../000:03/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB_|__GEO
128 | ..12594960 | 255 | 63 | ..6 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
.../000:03/IAS> AdmiSector found on disk 0 (128)
.../000:03/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:03/WAS> AdmiSectors in use : 0+
.../000:03/KEY> DEMO/1
.../000:03/PFC> PQstuff signature not detected on disk 0 (128)
.../000:03/PFC> UDMA driver not loaded
.../000:04/PFC> Disk health 50-100
.../000:05/PFC> Partition State backup not found on disk 0 (128)
.../000:05/PFC> No Repair date found on disk 0 (128)
.../000:20/CSD> Start CheckDisk for disk 0 (128)
.../000:20/CSD> CheckDisk complete, ReadErrors 0
.../000:20/USD> Disk 0 (128) selected
.../000:20/GSC> No geo change detected for disk 0 (128)
.../000:20/WAS> AdmiSectors in use : 0+
128/000:20/USD> MBR for disk 0 (128)
128/000:20/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3ÀŽÐ¼.|ûP.P.ü¾.|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04  |  ¿..PW¹å.ó¤Ë¾¾.±.
032   38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B  |  8,|.u.ƒÆ.âõÍ.‹.‹
048   EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC  |  îƒÆ.It.8,tö¾..N¬
064   3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25  |  <.tú»..´.Í.ëò‰F%
080   96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05  |  –ŠF.´.<.t.´.<.t.
096   3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4  |  :Äu+@ÆF%.u$»ªUP´
112   41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74  |  AÍ.Xr.�ûUªu.öÁ.t
128   0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF  |  .ŠàˆV$Ç.¡.ë.ˆf.¿
144   0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E  |  ..¸..‹Ü3Ƀ...‹N
160   25 03 4E 02 CD 13 72 29 BE 46 07 81 3E FE 7D 55  |  %.N.Í.r)¾F.�>þ}U
176   AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 27 07 EB  |  ªtZƒï.Ú…öuƒ¾'.ë
192   8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB  |  Š˜‘R™.F..V.è..Zë
208   D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 00 00 00 00  |  ÕOtä3ÀÍ.ë¸......
224   56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4  |  V3öVVRP.SQ¾..V‹ô
240   50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72  |  PR¸.BŠV$Í.ZX�d.r
256   0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49  |  .@u.B€Ç.â÷ø^ÃëtI
272   6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E  |  nvalid partition
288   20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61  |   table.Error loa
304   64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73  |  ding operating s
320   79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70  |  ystem.Missing op
336   65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00  |  erating system..
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00  |  ...‹ü.W‹õË......
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 E6 D0 E6 D0 00 00 80 01  |  ........æÐæÐ..€.
448   01 00 0B FE FF 0F 3F 00 00 00 D1 2E C0 00 00 00  |  ...þ..?...Ñ.À...
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............Uª
###
128/000:22/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:22/VEC> Listing current partitions on disk:
128/000:22/VEC>    FAT32 (P)      NO NAME          63    12594897       (6 Gb)
128/000:22/VEC> Partition Table info for sector 0 (0 0 1)
128/000:22/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..0B | ....0...1...1 | ..783.254..63 | ........63 | ..12594897
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:22/VEC> 55AA sig Ok
128/000:22/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype FAT32
...........Jump Code (hex): EB5890
............OEM Name (txt): MSWIN4.1
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 32
...........FAT count (dec): 2
....Root Entry Count (dec): 0
..Total Sectors (16) (dec): 0
....Media Descriptor (hex): F8
.......FAT Size (16) (dec): 0
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..Total Sectors (32) (dec): 12594897
.......FAT Size (32) (dec): 12288
......Extended Flags (hex): 0000
.............Version (hex): 0000
........Root Cluster (dec): 2
.............FS Info (dec): 1
...........Backup BS (dec): 6
............Reserved (hex): 000000000000000000000000
........Drive Number (hex): 80
............Reserved (hex): 01
......Boot Signature (hex): 29
...........Volume ID (hex): 27590A06
........Volume Label (txt): NO NAME
..Filesystem Type ID (txt): FAT32
....Sector Signature (hex): AA55
1st FAT not found at      : 95 (0 1 33)
2nd FAT not found at      : 12383 (0 196 36)
128/000:22/CF8> FAT sectors are equal
128/000:22/LOG> SectorDump requested at 24671 (1 136 39)
###
     $RECYCLEBIN ..CONFIG  D ..SUHDLOG - ..COMMAND C
     ..MSDOS   - ..WZT1      ..SYSTEM  1 M.WINDOWS   
     ..DETLOG  T ..NETLOG  T ..SUHDLOG D ..MSDOS   S
     ..AP.r.o.g. s.PROGRA~1  ..AUTOEXECD ..SND4DOS E
###
128/000:22/VEC> BS and BBS not equal, dump follows;
128/000:23/LOG> Boot sector dump requested at 69 (0 1 7)
### BootSectorDump for BStype FAT32 (B)
...........Jump Code (hex): EB5890
............OEM Name (txt): MSWIN4.1
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 32
...........FAT count (dec): 2
....Root Entry Count (dec): 0
..Total Sectors (16) (dec): 0
....Media Descriptor (hex): F8
.......FAT Size (16) (dec): 0
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..Total Sectors (32) (dec): 12594897
.......FAT Size (32) (dec): 12288
......Extended Flags (hex): 0000
.............Version (hex): 0000
........Root Cluster (dec): 2
.............FS Info (dec): 1
...........Backup BS (dec): 6
............Reserved (hex): 000000000000000000000000
........Drive Number (hex): 80
............Reserved (hex): 00
......Boot Signature (hex): 29
...........Volume ID (hex): 27590A06
........Volume Label (txt): NO NAME
..Filesystem Type ID (txt): FAT32
....Sector Signature (hex): AA55
128/000:23/VEC> Verify EPBR Chain completed
128/000:23/USD> Select disk completed
128/000:31/SCN> DiskScan requested, ScanType is 3
128/000:31/SCN> from 0 (0 0 1) to 12594959 (783 254 63), 12594960 sectors
128/000:31/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/000:31/SCN> Next QuickScan location at 0 (0 0 1)
128/000:32/SCN> QuickScan finished
128/000:32/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/000:56/SCN> SmartScan finished
128/000:57/SCN> DiskScan completed
128/000:57/SCN> ReadErrors for disk 0 (128): 0
128/001:00/LOG> DataCollection items found: 5 / 2
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | ........63 | ..FAT32 | ..BS | ........63 | ..12594897 | PRI | .
002 | 128 | ........69 | ..FAT32 | .BBS | ........63 | ..12594897 | PRI | .
003 | 128 | .........0 | ..FAT32 | PTE1 | ........63 | ..12594897 | PRI | .
004 | 128 | ........63 | ..FAT32 | ..BS | ........63 | ..12594897 | PRI | I
005 | 128 | ........69 | ..FAT32 | .BBS | ........63 | ..12594897 | PRI | I
128/001:01/LOG> DataCollection items found: 5 / 2
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | ........63 | ..FAT32 | ..BS | ........63 | ..12594897 | PRI
002 | 128 | ........69 | ..FAT32 | .BBS | ........63 | ..12594897 | PRI
003 | 128 | .........0 | ..FAT32 | PTE1 | ........63 | ..12594897 | PRI
128/001:01/LOG> PartList items created: 1
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ..FAT32 | ..3 | ..1 | ..2 | ... | ..3 | ..3 | ..3 | 3 | ..B
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R_|___A
001 | ..FAT32 | ........63 | ..12594897 | ..12594959 | PRI | ..B | ..X
128/001:01/SST> SaveState requested for disk 0 (128)
128/001:06/WAS> AdmiSectors in use : 0+
128/001:06/SST> SaveState completed for disk 0 (128)
128/001:07/EXE> Analysis complete
128/001:12/LOG> RunTime: 001:12
128/001:12/LOG> ### CLOSE LOG ###

[Joep]

Hello,

It appears as if the root directory itself is damaged. FATs appear ok, the boot sector BPB appears ok, but then you then look at the root, all file/foldernames appear to 'shifted' 2 positions:

"..COMMAND C" is probably "COMMAND.COM". Now with the 2 dots it suddenly becomes a directory entry itself. I have never seen that before, weird. We can only hope now that the rest of the directories are ok so you can save the contents of the disk using something like iRecover. If you plan on using iRecover, then I recommend you first see if the trial version comes up with a directory tree.

[clpackard3]

I ran iRecover and this is the result

ROOT (4221 MB, 13586/734/1858 file(s))
        DIR00018 (132 MB, 200/36/66 file(s))
        Fragments (4088 MB, 13386/698/1792 file(s))

Under both of these I see folder some named FRGxxx some DIRxxxx. The entries under them have some that look like file names whereas others look numerical like 2E65CFE697EA. I do not see any valid directory names like Windows, etc. I'm not sure what to do next since it appears as if these is good data there but the directory tables look invalid.

[Joep]

Hello,

First of all, stuff like a Windows installation you should forget about, there is no use in recovering that.

iRecover scan FAT32 drives for structures that are recognized as directories. If directories can be linked to others then it can (partially) recreate 'trees'. Fragments (of dorectories) and unamed directories can not be linked to any other directories but may contain files. The data blocks iRecover displays are structures that may indicate known files, iRecover uses those purely to reconstruct file system parameters such as cluster size.

You should try to find user data by using the find function (right-click directory tree). Once you have located such a file, look in the folder where the file was found, you often find your other files there as well (that were in that particular folder.

If your files can't be found your best shot is to try a different data recovery tool. I for example like FileScavenger from www.quetek.com. if that does not find you data either then the only option left is RAW file recovery. Davory from www.winhex.com is specialized in that; you will *not* get file and folder names, you will end up with lots of files named filexxx.jpg, filexxx.doc etc..