Identifying files in bad sectors

[Lammergeier]

Hi,
I have Windows XP Pro SP3.

My hard drive developed bad sectors, and windows couldn't load (including safe mode). I used chkdsk /f on the drive which marked 8kb of bad sectors. After reading a bit here I found that running chkdsk /f was not a good idea...

Now I'm trying to figure out which files were damaged. I opened the drive in WinHex and I located the bad sectors (used the info from the windows Application log in Event Viewer to find the sector numbers reported by chkdsk). According to WinHex, the bad sectors are all in a file called $LogFile. Or to be more precise: they are in a file called $BadClus:$Bad , but I if I guess correctly (?) this file is simply the bad cluster mark created by chkdsk, while dozens of clusters before and after this specific sector contain the file $LogFile (this is what WinHex says). Using the "List Clusters" function in WinHex, I saw that the $LogFile file is fragmented exactly on the cluster with the bad sectors (for example, let's say $LogFile is in clusters 1,2,3,4,5,800,7,8,9,10... while cluster 6 has bad sectors and the file $BadClus:$Bad).

So my question is this: if I understand all of the above correctly, is it logical to assume that the location of the bad sector in the middle of a continuous stream of clusters that contain the file $LogFile, means that the file damaged by the bad sector is in fact $LogFile and not some other file? And if this $LogFile thing was damaged, could that explain why windows could not load?


Thank you very much.

[fzabkar]

I can't answer your question, but I found the following information:

Transaction log supports NTFS recoverability:
http://support.microsoft.com/kb/101670

NTFS System Files:
http://support.microsoft.com/kb/103657

[DavisMcCarn]

With the $LogFile being corrupted, your only hope is to use CHKDSK /R (and pray); but, you would be strongly advised to use WinHex to clone the drive to a good one, beforehand.

[ccamargol]

few bad sectors use HDD regenerator.
Carlos

[poehere]

First off you should not edit this data on this drive or even continue to work on this drve if you need the data on this drive

second your data is still on this drive

third sounds like you are having some LBA or MBA problems this should be looked into - (means if you can not figure this one out it is time for professional help on this one sorry to say this)

But not on this drive if you want back your data

clone this drive to another drive frist then only work on the other drive

buy yourself a new drive for your system and start to use this one and throw away this other drive when you have your data off of it

if all else fails you can always attach this drive to a new system up and running and go through the file structure and possible pull off your data