0

I seem to have a disk crash of some kind. A video processing program (VirtualDub) was writing a long video file (12GB), when I suddenly got an access denied message.

I went to my text editor containing the script to generate the video. it said that the file on the disk had changed. When I reloaded the file, it contained garbage.

Now I found that certain folders were giving an error, "H:\folder is not accessible. The file or directory is corrupted and inaccessible".

I rebooted the machine. The same status.

I remembered not to modify the drive. So, I copied as much data as I could from it. Now, for the last 2 days I am in search of a good, preferably free data recovery program. So far I have tried two, but they could not detect any lost files/folders.

Tried Active@ File Recovery. It chugged for 2 hrs., and now seems to have crashed. Will try again after reboot.

It is important to note that chkdsk did not run on system reboot. Also, I am afraid of running it myself, since the changes are irreversible, and there are complaints about chkdsk.

Is my MFT corrupted?

It is an external Maxtor 320GB 2.5" HDD, with H being a 250GB partition. I recall few instances where the USB cable got disconnected while data was being written into. Could that have caused this?

Significantly, the other partition of 70GB is perfect. I got all data copied from there, and there are no problems.

What should be my next step?

Regards Sanjay

Improve this question

6 Answers 6

Reset to default
1

Honestly, I would run chkdsk /r. I'm not sure what complaints there are about it, but if you salvaged as much data as you can so far, it is your easiest and best bet. I've seen situations like this probably hundreds of times and many of those times its just a bad cluster or two that can easily be fixed by chkdsk (though not always).

Improve this answer
0

With Windows recovery console you can try chkdsk /f or chkdsk /r, or if you boot with Rescue Is Possible (RIP) Linux you can run testdisk to see what that finds.

Improve this answer
0

If you are worried about losing the data, then the first thing I would do (before trying anything else) is boot from another drive (be it USB key or CDRom) and take a whole disk image using something like Symatec Ghost or Linux dd.

After that, the product I have used very successfully before is R-Studio. While it is not free, you can get the NTFS or FAT only versions for USD 50, which depending on how much value you put on your data is pretty cheap.

It is good because it not only looks for bad sector type problems, but it will scan your disk sector by sector and try to intelligently identify what sort of data it is seeing (i.e. it knows what a JPG file looks like and will reconstruct it from the data t finds even if the MFT is gone)

Improve this answer
1
  • If you are going to image the drive yourself, and you're serious about getting the data, be sure to use a read only adapter or a dedicated live distro - most others will set up swap partitions
    – Andy
    Aug 20, 2009 at 16:04
0

The first rule of disk crashes...

I remembered not to modify the drive.

was busted by this operation:

So, I copied as much data as I could from it.

In any case of suspected critical data loss you should never turn a drive back on. All operating systems (with the exception of dedicated live distros) write to the boot disk to initialise swap etc. Unless you have a read only adapter between your disk and OS you may be compromising fragments of data (in the case of MFT damage), swap or temporary files or the remainder of any allocation tables you may have. Once data is overwritten it becomes incredibly difficult (read: expensive) to recover. Put simply, only magnetic "memory" remains (the offset between the head's two "flips" of the magnetic field in the particular sector of the platter). More here and here.

This is why you should turn your computer off if you suspect a physical problem with your drive (noises, no response, files disappearing, smoke, fire, etc). The good news is that, in your case, I would guess that your data loss is logical. This may still be a problem with the drive controller, or software corruption, or simply a bad sector. If you are confident enough to take this into your own hands (and be it on your head), R-Studio is considerably more efficient (and has higher recovery rates) than most commercial offerings. I could not recommend you a free tool.

As for

chkdsk /r

it is more likely to diagnose and repair a bad sector on your drive, but may prevent recovery in case of serious corruption. Without knowing why you experienced this data loss (software, logical or physical) I would not recommend doing this as it may destroy data - it runs on the (possibly flawed) assumption that it can communicate correctly and efficiently with the disk beneath it, and has no fallback if it can not (i.e. if the disk stops responding correctly, as possibly occurred with your Active@ File Recovery attempt).

If software doesn't yield any results and the remaining data is of a high enough value, a data recovery company may be your only hope. Be sure to choose somewhere with their own Class 1 cleanroom otherwise they will outsource at your cost. Kroll Ontrack are considered world leaders, but are very expensive for an individual.

Improve this answer
0

It might be a corrupt partition table. TestDisk is a free open-source software which helps recover partitions and data. Its not the most user-friendly thing around, but does its job quite well.

Improve this answer
-1

My advice is to never create files above 2gb if possible, lots of software will crash with files above it

Improve this answer

You must log in to answer this question.