Need Help with DiskPatch problem

[RecoverMe]

I have a disk that appears to have gone bad that I am trying to recover.  I can't exactly say what led up to it.  I went on vacation the house sitter stated that she was on facebook and the computer simply turned off.  After that, whenever she (or I) tried to turn it on, it would say "Disk Read Error, press ctrl-alt-del to restart".  It is a fairly well-specced Dell XPS running Vista, and the HD is a 500 gig Western Digital.  I've tried the following up to this point.

I tried booting from the reinstallation CD provided by dell.  I've done this with another PC and it let me run the recovery console to repair the disk.  And with another PC I did the same and reinstalled the OS which let me boot up and get to the data files I didn't want to lose, which is of couse the ultimate goal here.  The reinstallation disk would prompt "press any key to boot from CD or DVD" and then would just hang.  The DVD drive would spin up, then stop, and the PC would just sit there, no boot.

I then downloaded Western Digitals (DOS) diagnotics and created a boot CD on another PC.  I used it to try and boot the bad PC and after hanging for a while, it said "No device found".

I then took the HD out of the PC and hooked it up to my laptop, where it currently resides, using a USB 2.0 SATA/IDE HD Adapter.  The Laptop recognizes the disk, actually it recognizes it as two new disks, one is a recovery partition that I can see files and access them in, and the other is the larger OS partition/drive and when I click on it, it says the drive is "not accessible. The disk structure is corrupted and unreadable."

I then downloaded Western Digital's Data Lifeguard Diagnostics for Windows.  It recognized the physical hardware model, capacity etc.  As for the logical drives, it recognizes the file system (NTFS), size and capacity of the recovery partition, but blanks across the board for those on the larger OS partition.  When running the diagnostics both quickscan and extended, both passed. 

Since I could access the drive from the Laptop, I started a command window and ran CHKDSK on it.  Yes, I know this is one of your cardinal rules not to do, but I've done it on previous drives to repair them and it worked, and at this point I had not begun to look at recovery softward and had not purchased or read up on DiskPatch.  When I ran it, it said "Corrupt Master File Table."  Then attempted to recover the MFT, failed, and aborted.

At that point, getting no help from WD's DLD app, I looked into Data Recovery options and purchased and downloaded DiskPatch.  DiskPatch recognized immediately the disk and 3 partitions.  A small partition labeled "DellUtility", another labeled "Recovery", and the largest 435 gig labeled "OS".  Seeing no appparent partition issues, I ran repairs on the boot sectors.  This is where the roadblock came in.

After selecting the disk, partition, rebuild boot sectors, continue to start repair, etc... I had selected determine auto cluster size.  DiskPatch said is was gathering NTFS cluster size data (or something very similar) and showed a dialog with white and grey bit boxes.  These changed periodically up until the progress bar got around 20% or so, then they stoppped changing.  I don't know if this is expected behavior or not, but wanted to mention it.  They stopped at 10 white blocks on 8 bit, 5 on 16, 3 on 32, 1 on 64, and 1 on 128.  The progress bar did continue to go up, so I let it run.  I let it run to 100% and then nothing happend.  There was no success message, no next steps, no nothing. It just stopped, went back down to 0% and stayed there, seemingly forever.  I even left it overnight and it had not changed in the morning.

I ran it again today, it did exactly as previously described, took about 7 hours to get to 100% and then just stopped doing anything and stayed that way for quite some time until I finally escaped out of the app. 

At that point, I created a Support Analysis Log, and here I am.  I really really really hope you can help here.  The log is attached.

Thanks,
Chris

[attachment deleted by admin]

[Joep]

Hello,

Can we see the logfile for the actual boot sector repair scan please? If not sure which logfile that was, ZIP all DP.lox files. And while at it, also create a disk health analysis report please.

About that boot sector repair: The current boot sector looks valid as it is, a repair will probably change nothing. In general, DiskPatch taking a really long time to scan, or even hang while scanning is sometimes an indication for a more structural hard disk problem.

[RecoverMe]

When DiskPatch did the boot sector validation is completed with a red "done".  Is that not an indication that there is a problem with the boot sector? 

I will have to do the disk analysis report after work today. But, in the meantime here are all the log files of activities to date, at least, the last 5.  Please take a look.

Thanks!
Chris


[attachment deleted by admin]

[RecoverMe]

Here is the report although it would seem to me that it is useless.  It is a report of the Laptop hardddrive which has nothign wrong with it.  Unlike the Support Analysis Log, which gives me the option to choose the drive I want to run the report against, running the SMART report does not give me that option.   It simply runs (in about 1s), no options, and it appears that it only did a report on the internal hard drive of the Laptop.  Diskpatch when run recognizes 3 drives, the internal laptop drive, the USB stick I have plugged in, and the usb adaptor connected bad drive.  SMART report only reports (or appears to me to report on) on the one.


[attachment deleted by admin]

[Tom]

SMART usually doesn't work through USB in the setup that you use, so you will need to connect the disk to the original PC for the SMART log to complete. At this point, from the disk's point of view, nothing much seems to be wrong. So that SMART log will help, hopefully, to figure out what's going on.

[RecoverMe]

Ok.  So.... I reinstalled the HD back internal.  Using the DiskPatch Boot CD I attempted to startup and run the SMART report.  I'm just going to type for you exactly what I see on the screen, because it's messed up...

...........................................
FreeDOS kernel version 1.1.35w (Build 2035w-UNSTABLE, Nov 30 2005)
Kernel compatability 7.10 - WATCOMC - FAT32 support

Copyright 1995-2005 Pasquale Villani andThe FreeDOS Project.
NO WARRANTY.  Licensed under the GNU General Public License version 2.

- InitDisk
Invalid Opcode at B6EB 0914 0082 009B 0296 1956 0005 0000 514E 98E5 08FE 0920 007C
dos mem corrupt, first_mcb=0000
prev   0000:0000|1C 12 CF 00 DF 11 CF 00 C3 E2 00 F0 DF 11 CF 00 ..[and a bunch of garbage characters]
notMZ0000:0000|1C 12 CF 00 DF 11 CF 00 C3 E2 00 F0 DF 11 CF 00 ..[and a bunch of garbage characters]

PANIC: MCB chain corrupted
System halted


---------------------------

Now if I try to boot from CD with a 1 gig USB Flash Drive in the USB port I get even wierder

-------------------------------

FreeDOS kernel version 1.1.35w (Build 2035w-UNSTABLE, Nov 30 2005)
Kernel compatability 7.10 - WATCOMC - FAT32 support

Copyright 1995-2005 Pasquale Villani andThe FreeDOS Project.
NO WARRANTY.  Licensed under the GNU General Public License version 2.

WARNING: partition Pri:1 FS 04 has CHS=  0-0-33, not   0-1-1
WARNING: partition Pri:1 FS 04 has CHS=1948-7-23, not 249-247-32
WARNING: partition Pri:1 FS 04 is not LBA
Please run FDISK to correct this - using LBA to access partition.
 start   0-0-33, end 1949-7-23
C: HD2, Pri[ 1], CHS=   0-0-33, start =     0 MB, size=   959 MB

Invalid Opcode at B6EB 0914 0082 009B 0296 1956 0005 0000 514E 98E5 08FE 0920 007C
dos mem corrupt, first_mcb=0000
prev   0000:0000|1C 12 CF 00 DF 11 CF 00 C3 E2 00 F0 DF 11 CF 00 ..[and a bunch of garbage characters]
notMZ0000:0000|1C 12 CF 00 DF 11 CF 00 C3 E2 00 F0 DF 11 CF 00 ..[and a bunch of garbage characters]

PANIC: MCB chain corrupted
System halted


--------------------------

So.... just how screwed am I here?  Hah.

Chris

[Joep]

Hello,

That's the FreeDOS OS crashing, nothing to do with DiskPatch basically. Uninstall DiskPatch > get the below setup (with MS-DOS rather than FreeDOS) and create a new boot CD/diskette/USB thing. Then try again.

http://www.diydatarecovery.nl/downloads/Demo/DiskPatch_Setup_w98dos.exe.

When DiskPatch did the boot sector validation is completed with a red "done".  Is that not an indication that there is a problem with the boot sector?

That or: DiskPatch looks up the various file system structures the boot sector is pointing to. If a particular structure doesn't appear to be there DiskPatch will flag that as an error. But the error can be 1. the boot sector is corrupt (contains false info), or 2. the boot sector is intact but the structure referenced to is corrupt.

In your case it looks up the MFT:

130/001:36/CBS> E: MFT location : 786432
130/001:36/CBS> 1st sector of MFT:
130/001:36/LOG> SectorDump requested at 37877760 (2357 199 19)
###
000   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
016   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
032   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
048   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
064   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
128   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
144   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
176   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
192   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
208   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
224   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
240   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
256   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
272   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
288   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
304   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
320   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
336   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
448   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................

And we find zeros. So, no MFT there. The MFT location as recorded in the boot sector is a standard value. It does not mean by defintion that it has to be 786432 but there's a good chance it is. So my guess is, that it is the MFT itself that is corrupt, not the boot sector. And then DiskPatch will not be of any help, and we're just wasting our time.

And then:

130/001:36/CBS> E: MFT mirror location : 59074047
130/001:36/CBS> I: 1st sector for MFT/MFTmirror equal

means we can't use the MFT mirror to fix the MFT either because it also contains zeros.

[RecoverMe]

And we find zeros. So, no MFT there. The MFT location as recorded in the boot sector is a standard value. It does not mean by defintion that it has to be 786432 but there's a good chance it is. So my guess is, that it is the MFT itself that is corrupt, not the boot sector. And then DiskPatch will not be of any help, and we're just wasting our time.

means we can't use the MFT mirror to fix the MFT either because it also contains zeros.

Are you saying the data is completely unrecoverable?

[Tom]

It looks like it, but you should definately try iRecover. Repairing is no longer an option, but you may be able to salvage files (if needed).

[RecoverMe]

 

Ok.  Thanks.  I'll download the iRecover trial and give it a go tonight.  If DiskPatch is going to be of no use, may I request a refund of the purchase, or an exchange to iRecover should the trial prove it will be useful?

Thanks,
Chris

[Tom]

Don't worry, we'll work something out. Just try iRecover first (the demo allows you to see if files can be found) and if that works out you can buy iRecover and we'll refund DiskPatch, or something like that.

[RecoverMe]

Just to leave no stone unturned, I created a Boot CD using the MS-DOS version of DiskPatch and created the SMART Report.  It is attached.  It's basically... empty.



[attachment deleted by admin]

[Tom]

That's a first, never seen that before. When running the SMART test, does it run to completion?
Something to try:
After having started from the DiskPatch boot cd (with the main menu up) press <escape> to exit the menu. You'll now be presented with a prompt ("A:>"). At this point type "dphdinfo" without the quotes and press <enter>, see what comes up. Check the screen, the disk health should be displayed.

[RecoverMe]

I will give that a try.  In the meantime, I downloaded iRecover and let it run.  It appeared very promising at first, finding a ton of valid segments, folders and files, and identifying the file system.  However, when it got to the folder tree to select files for recovery, it looks less promising.  The numbers are grossly inflated.  For instance, the Root says there is 1665 GIG, and it's only a 500 GIG drive.

I'm going to let the validation run to 100%, but should I expect what appears on the screen to change during this phase?  It does not look like the screen shots of the tutorial at all.  There are no intelligible folder names.  They are all simply named LostFiles123... and the contents of the folders are either unintelligible, or largely repeating.  One filename might repeat 20 times, for instance.

Please have a look at these two screen shots and let me know what you think.

Thanks.
Chris

[attachment deleted by admin]

[Tom]

You don't have to wait for validation to finish.

If no folder names can be found it means that the state of the volume is quite bad. You will simply have to copy as much as you can, or look for files you recognize and copy and test them.

Finding more files than expected is not abnormal. iRecover may find remnants, or more than one of the same file with different characteristics. Finding more than expected may also indicate that the volume is in a bad state.

In all it doesn't look very good. The only way to figure out what the results of the recovery may be is by trying. As always, in this type of case.