What software, if any, will help recover from chkdsk induced data loss.

[Livin]

A few days ago I booted my computer and chkdsk said it needed to run on one of my drives, I let it run, which was a BIG mistake.  For some reason chkdsk rebuilt the directory structure of the drive to match one of the other drives.  The directories are identical, but none of the files were copied as I can't open any of them.

I think more info might help, the original hardware involved is as follows:

ASUS P5W DH Deluxe mother board, which has 2 IDE connectors, 6 sata and 1 esata connections, and does have raid 0, 1, 5, and 10 capability.
All raid features require being turned on in the BIOS.

There are 3 hard drive controllers, the manual lists them as:
Intel ICH7R   3 sata connectors
ASUS EZ-Backup   2 sata connectors
JMicron JMB363   1 sata
   Not sure what controller the esata is connected to.

1 - 250 GB sata - boot drive, OS (XP) and "must load on boot drive" files only
1 - 500 GB sata
3 - 1TB sata
1 - Lite-on DVD/RW (connected to IDE)

OS is Windows XP media center 2002 with SP3 and all updates, NTFS file system

The issue arose when I removed the 500 GB and installed a fourth 1 TB drive.  I moved the sata cables around so that the drive configured as D:, was on the 2nd sata connector, E: on the 3rd, and so on, with the DVD drive as H:. The new drive was connected to the last connector. Initially the computer booted up, but windows did not show the new drive in Disk Management.  I exited Windows and went into the BIOS, unfortunately, the way the BIOS is set up, it does not show the drives attached to the 3rd controller, so I could not tell if the Mobo was seeing the drive.

I could see that 4 drives were connected, the 3 on the ICH7R, and 1 that was connected to one of the EZ-Backup connecters.  From previous experience I found that the BIOS would not recognize any drive connected to the 2nd EZ-Backup connector, (I thought this might be something to do with the raid setup in BIOS) so the last drive was connected to the JMicron controller, but there is no place to see the JMicron (the 5th drive) in the BIOS.

I thought that maybe I had a bad power connector, or bad sata cable, so I tried swapping them around to no avail, the BIOS would show 4 drives every time, and windows would show 4 drives, but not the 5th no matter what I tried.

At this point it was late so I shut down the system for the night, and left it for the next day.  When I turned the computer on in the morning, chkdsk popped up and said that there was an error on one of the drives.  Not knowing better, I let it run.  It took several hours (it seemed) to go through the first 2 steps, and I left it running and went to work, when I got home (14 hours later) it had finished and windows was up, but when I opened Windows Explorer it showed 3 drives, Disk management showed 4, but 1 (the new one) was not initialized.

I shut down the computer and disconnected the new drive, and then the bios showed 4 drives, Windows showed 3.  Again I shut down the computer and disconnected all but the boot drive and connected 1 data drive at a time, Windows saw 2 drives every time, but 2 of the drives now had the same names (all were different before).  I could access the files on all drives, except the drive which chkdsk had run on, it now showed a mirror image of the directory of one of the other drives. I tried to open 3 of the files on this drive and windows gave a message that said it was not a valid file.  If I connected the boot drive and the 2 drives that had the same directory at the same time, BIOS would show 3 drives, but Windows would only show 2.  At this point I pulled the chkdsk "repaired" drive from the system and started looking for ways to recover the data.

My guess is that the mobo and windows conspired to make a mirror (raid1) of one of the drives.

As there was close to 700GB of data on that drive, I would like to try to retrieve it, if I can undo what chkdsk did.

And before you ask, no, I did not have a back-up of the data.  I had just received a Synology DS1010+ with 5 2TB drives.  Unfortunately 2 of the drives were DOA and I am in the process of getting them replaced.  I should have set it up with the 3 I had...  but the point is moot.

I downloaded and ran DiskPatch to create a Support Analysis log file with only the boot drive and the drive that needs help connected.


.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 3.5.300
.../000:01/LOG> (C) 2000-2009 DIY DataRecovery
.../000:01/LOG> Contact info: http://HTTP://www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 71Kb
.../000:01/LOG> CommandLineParms: /sup
.../000:01/LOG> LogDate: 10-23-2010
.../000:01/CFG> FilePath="A:DPFILES\"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> LogEachReadError="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Drive Interface Info: ATA
.../000:01/13H> Disk 128 X13H data : 16383/16/63 488397168/512
.../000:01/13H> Disk found at 129
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Drive Interface Info: ATA
.../000:01/13H> Disk 129 X13H data : 16383/16/63 1953525168/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
.../000:01/FDL> Disk found at 129
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB_|__GEO
128 | .488397168 | 255 | 63 | 232 | BIOS
129 | 1953525168 | 255 | 63 | 931 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
.../000:01/IAS> AdmiSector found on disk 0 (128)
.../000:01/IAS> AdmiSector found on disk 1 (129)
.../000:01/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:02/EXE> Read/Write pattern test for disk 1 (129) successful
.../000:02/WAS> AdmiSectors in use : 0+ 1+
.../000:02/KEY> DEMO/1
.../000:02/PFC> PQstuff signature not detected on disk 0 (128)
.../000:02/PFC> PQstuff signature not detected on disk 1 (129)
.../000:02/PFC> UDMA driver not loaded
.../000:02/PFC> Disk health 1-50
.../000:04/PFC> Partition State backup not found on disk 0 (128)
.../000:04/PFC> Partition State backup not found on disk 1 (129)
.../000:04/PFC> No Repair date found on disk 0 (128)
.../000:04/PFC> No Repair date found on disk 1 (129)
.../000:16/CSD> Start CheckDisk for disk 1 (129)
.../000:16/CSD> CheckDisk complete, ReadErrors 0
.../000:16/USD> Disk 1 (129) selected
.../000:16/GSC> No geo change detected for disk 1 (129)
.../000:16/WAS> AdmiSectors in use : 0+ 1+
129/000:16/USD> MBR for disk 1 (129)
129/000:16/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3ÀŽÐ¼.|ûP.P.ü¾.|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04  |  ¿..PW¹å.ó¤Ë½¾.±.
032   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5  |  8n.|.u.ƒÅ.âôÍ.‹õ
048   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B  |  ƒÆ.It.8,tö µ.´.‹
064   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88  |  ð¬<.tü»..´.Í.ëòˆ
080   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B  |  N.èF.s*þF.€~..t.
096   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83  |  €~..t. ¶.uÒ€F..ƒ
112   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB  |  F..ƒV..è!.s. ¶.ë
128   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0  |  ¼�>þ}Uªt.€~..tÈ 
144   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56  |  ·.ë©‹ü.W‹õË¿..ŠV
160   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC  |  .´.Í.r#ŠÁ$?˜ŠÞŠü
176   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56  |  C÷ã‹Ñ†Ö±.ÒîB÷â9V
192   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C  |  .w#r.9F.s.¸..».|
208   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A  |  ‹N.‹V.Í.sQOtN2äŠ
224   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD  |  V.Í.ëäŠV.`»ªU´AÍ
240   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60  |  .r6�ûUªu0öÁ.t+a`
256   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A  |  j.j..v..v.j.h.|j
272   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B  |  .j.´B‹ôÍ.aas.Ot.
288   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61  |  2äŠV.Í.ëÖaùÃInva
304   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  |  lid partition ta
320   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E  |  ble.Error loadin
336   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 2C 44 63 FF 71 59 C5 00 00 00 01  |  .....,Dc.qYÅ....
448   01 00 07 FE FF FF 3F 00 00 00 82 59 70 74 00 00  |  ...þ..?...‚Ypt..
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............Uª
###
129/000:16/VEC> Start Verify EPBR Chain for disk 1 (129)
129/000:16/VEC> Listing current partitions on disk:
129/000:17/VEC>     NTFS (P)     Download          63  1953520002     (932 Gb)
129/000:17/VEC> Partition Table info for sector 0 (0 0 1)
129/000:17/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..07 | ....0...1...1 | .1023.254..63 | ........63 | 1953520002
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/000:17/VEC> 55AA sig Ok
129/000:17/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 1953520001
........MFT Location (dec): 786432
.MFT Mirror Location (dec): 122095000
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): B468BF2668BEE670
........Volume Label (txt): Download
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
129/000:17/VEC> BS and BBS equal
129/000:17/VEC> Verify EPBR Chain completed
129/000:17/USD> Select disk completed
129/000:19/SCN> DiskScan requested, ScanType is 3
129/000:19/SCN> from 0 (0 0 1) to 1953525167 (121601 80 63), 1953525168 sectors
129/000:19/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
129/000:19/SCN> Next QuickScan location at 1953520065 (121601 0 1)
129/000:20/SCN> Next QuickScan location at 0 (0 0 1)
129/000:20/SCN> QuickScan finished
129/000:20/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
129/073:55/SCN> SmartScan finished
129/073:55/SCN> DiskScan completed
129/073:55/SCN> ReadErrors for disk 1 (129): 0
129/254:08/LOG> DataCollection items found: 6 / 2
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 129 | ........63 | ...NTFS | ..BS | ........63 | 1953520002 | PRI | .
002 | 129 | 1953520064 | ...NTFS | .BBS | ........63 | 1953520002 | PRI | .
003 | 129 | .........0 | ...NTFS | PTE1 | ........63 | 1953520002 | PRI | .
004 | 129 | ........63 | ...NTFS | ..BS | ........63 | 1953520002 | PRI | I
005 | 129 | 1260700879 | ..FAT32 | PTE4 | 1260702927 | .204816896 | LOG | .
006 | 129 | 1953520064 | ...NTFS | .BBS | ........63 | 1953520002 | PRI | I
129/254:08/LOG> DataCollection items found: 6 / 2
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 129 | ........63 | ...NTFS | ..BS | ........63 | 1953520002 | PRI
002 | 129 | 1953520064 | ...NTFS | .BBS | ........63 | 1953520002 | PRI
003 | 129 | .........0 | ...NTFS | PTE1 | ........63 | 1953520002 | PRI
005 | 129 | 1260700879 | ..FAT32 | PTE4 | 1260702927 | .204816896 | LOG
129/254:08/LOG> PartList items created: 2
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ..3 | ..1 | ..2 | ..0 | ..3 | ..3 | ..3 | 3 | ..A
002 | ..FAT32 | ..5 | ... | ... | ... | ..5 | ..5 | ..5 | 1 | ...
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R_|___A
001 | ...NTFS | ........63 | 1953520002 | 1953520064 | PRI | ..A | ..X
002 | ..FAT32 | 1260702927 | .204816896 | 1465519822 | LOG | ... | ..?
129/254:08/SST> SaveState requested for disk 1 (129)
129/254:09/WAS> AdmiSectors in use : 0+ 1+
129/254:09/SST> SaveState completed for disk 1 (129)
129/254:09/EXE> Analysis complete
129/254:13/LOG> RunTime: 254:13
129/254:13/LOG> ### CLOSE LOG ###


Any help would be appreciated.

[Joep]

Hello,

Best shot is to try with iRecover. DiskPatch is not able to undo this.

[Livin]

Thanks Joep,

 Well, I ran irecover,  no joy, the only data showing is the stuff I know is not there. I  Don't think any of the data is recoverable.

Next noob Question,
   When I ran the SMART check in Diskpatch, it showed that my boot drive has some issues, but I am not seeing any file errors yet, so I need to get the data off before I do.  If I use Diskpatch to make a clone of the drive, to another drive of the exact same make/model, will the clone be bootable?  I.E.  could I just pull the old drive and install the clone?

[Joep]

Hello,

Well, that's not a noob question actually, it's a very good question. Cloning an OS is sometimes not as straight forward as it may seem. Theoretically, yes. But make sure, after the clone finishes, to power down and only *one* of the 2 disks (source/destination) should be attached upon next boot. If the one that is booted from detects Windows on the other disk as well, drive letter assignments are messed up preventing you to boot.

And; before giving up on the files I'd run iUndelete as well.