Filesystem Damaged - How To Repair?

[wallymik]

Hi,

My wife has a Dell Vostro laptop running Windows 7 and a regular 320GB HDD (WD Scorpio Black). It's ancient (~4 yrs old). One day the drive stopped working. It wouldn't boot up and when it went into Windows Recovery Mode it got stuck on "Repairing Windows" for days.

I took the drive out and put it into an enclosure. Plugged that enclosure into a desktop computer (also running Windows 7) to perform diagnostics / recover the data.

I should mention there are 3 partitions on the drive. When I plugged in the enclosure 2 partitions were instantly recognized but the main one (the one containing the OS and all her programs and data) was recognized only after some coaxing. Even then it showed up as RAW when I know it was NTFS. Windows asked if I would like to reformat, I said no.

The first time I did this, when I right-clicked on the partition in Disk Management and hit "Explore" I could see the root folder but any attempt to go deeper / copy files was met with Explorer crashing. Now I can't even explore - though the computer still gives the partition a drive letter.

When I try to open in Explorer I get:
"F: / is not accessible. The parameter is incorrect."

Other things I tried:
1) Tried running chkdsk from the cmd console. It recognized the file system as NTFS, but then gave the error "Errors found. CHKDSK cannot continue in read-only mode". I was afraid to run chkdsk /f because I didn't want it overwriting data that might be otherwise recoverable.
2) Went into Acronis to try to clone the partition and work with the clone. Acronis wouldn't even give me that drive as an option.
3) Downloaded TestDisk 64-bit (my OS is 64-bit). I selected the physical drive - and

a) Went to the "Analyse" tool. All 3 partitions were visible, with the main partition designated as "Primary bootable / NTFS". So far so good. While I do a "Quick Search" something weird happens, the hard drive unmounts and remounts. After that if I try to go to "List Files" it gives the error "Can't open filesystem. Filesystem seems damaged." This could just be because the drive unmounted though. A "Deeper Search" only gives about 100,000 "Read error"s at every block of every cylinder, but again that might be because of the unmounting / remounting.
b) Went into the "Advanced File Utils" tool - Boot Sector Recovery. Got this:

Boot sector. Status: OK
Backup boot sector. Status: OK
Sectors are identical.
​

So Boot Sector seems ok. I tried selecting "Rebuild BS" anyway - it's been 6 hours and we're about 1% done. Then it seemed to stay there. Needless to say I didn't let it complete:

Search mft 6225920/594338480
​

When I selected "Repair MFT" I got this:

repair_MFT
NTFS at 1917/84/24
file_win32_pread(100,4096,buffer,37093376(2308/243/48)) read err: read after end of file
file_win32_pread(100,1,buffer,37093376(2308/243/48)) read err: read after end of file
Can't read NTFS MFT.
Can't read NTFS MFT.
​

4) Downloaded GetDataBack, tried the following:

I searched the drive - and got this error for every single sector:

I/O Error 'Unknown error (23)' reading sector 625140364 on HD135:. Do you want to continue?
​

I tried a deeper scan with the software but got the same error as above.
​

So there you have it. The partition is there, filesystem is damaged. CHKDSK might overwrite / lose data so I would use it only as a last resort.

Can anyone offer suggestions?

Thanks,
W

 

[G73S]

Active@ Partition Recovery has always helped me recover a deleted partition which I deleted by mistake. It can repair most partitions / file systems

It hasnt ever failed me

I once deleted my 3 TB external USB HDD partition and was almost about to have a heart attack. Tried it and it worked! amazing simply

 

[HOSED]

If your goal is data recovery try booting from a live Linux Distro (to avoid any further drive activity). see "try before you install" Here http://www.ubuntu.com/download/desktop (I would use the 32 bit version) and create it on your desktop machine.
If you want to try this & need details on how to use Ubuntu in this scenario let us know.

& Welcome to the forum

 

[MongGrel]

Have any restore points ?

 

[wallymik]

Thanks all for your suggestions.

MongGrel: We are way past restore points my friend...

G73S: I tried this, see below...

• I downloaded Active Partition Recovery on your recommendation. I was very pleased when a scan of the drive showed its entire filesystem. So I paid $50 for a license, tried to Recover my partition onto a new drive. The partition unmounted as soon as I tried anything so I couldn't recover a thing. The problem is the mounting / unmounting keeps happening every time a scan is attempted...
• Active File Recovery (part of the same suite) for some reason failed to read the parition. It read the damaged drive as [not ready] and said my filesystem was damaged. There must be a way to recover files piecemeal!
• A SuperScan failed because - yep - the drive kept unmounting and remounting on its own

HOSED : Can't believe it may come to this. I've never tried Linux/Ubuntu before.

• How would this help exactly? Say I installed Ubuntu on to a bootable USB stick.
• Looks like I may need 64-bit version, which the website recommends for those running a 64-bit architecture?

Thanks,
Wassim

 

[C1]

Ive had cases where the drive would read only when holding the raw drive while squeezing it slightly causing the circuit card to flex slightly. Why I bring this up is because of the reported constant unmounting, almost as if there is some kind of circuit/electrical intermittent.

Couple other possibilities are Spinrite ( https://www.grc.com/sr/spinrite.htm ) and there are some old Norton Utilities for direct reading of the disk (eg, doesnt care about file integrity - useful for text recovery as well as even repairing data structures thru directly writing to the disk). You might also try a temperature cool down of the drive to see if you can get it to last long enough to pull the partition data off. I cool the drive down outside the computer first then use dry ice wrapped in a towel during the recovery process to limit the drive temperature. Better move fast though.

 

[phis6]

So there you have it. The partition is there, filesystem is damaged. CHKDSK might overwrite / lose data so I would use it only as a last resort.

Can anyone offer suggestions?

If losing data is the main issue then don't waste your time trying those applications that can't do anything to resolve the issue. I would definitely suggest that you clone the partition of the drive on to another drive with any reputable cloning software or you can use ddrescue in Linux. And then you can start recovering your files from the clone that you got.

 

[Matt L]

I've got a similar situation I've been working on for the past few days, made some progress but not much. I've gotten to the point where I know the magic number is screwed up, tried the list of numbers generated and none work. Any suggestions?

For me it's one partition of a disk with 4 others, the rest are fine. The Windows partition got hosed when I plugged the HD from a relative's computer I was rebuilding to pull files off of before wiping. After that my install died. that was a year ago, the HDD was sitting unplugged in the PC. Moved on to Linux, but want to use the HDD for a fresh install of Mint 17, hoping to pull a few things off before wiping. Not willing to pay $$ for software to save a few odds and ends, now it's more of a challenge.

 

[wallymik]

Hi guys, just to update you:

C1:

I don't know if there's anything physically wrong per se. The drive disconnect / reconnect usually only happens when I'm trying to access files in it. I've heard of the freezing technique, I even tried it successfully a few years ago, but I don't think this is the same thing.

I tried Spinrite, but it would stay stuck on "Selecting Drives..." forever, no matter whether I had my drive plugged into an enclosure or slotted into my laptop. It doesn't seem to recognise it.

phis6:

I've tried backing up / cloning the partition and drive using both Acronis and Spotmau PowerSuite. Neither worked, for the same reasons as above: Whenever it tried to access the bad part of the drive, it would disconnect, then nothing worked.

To top it all off, I finally relented and tried chkdsk /f. My worries about it being destructive were unfounded... because it didn't even work. I got the error "Unable to determine volume version and state. CHKDSK aborted".

Thanks all for your help but unless I get a novel solution I haven't tried yet I'm gonna admit defeat on this one...

Cheers,
W