Partition Damage Recovery

[Asque]

I have a Seagate ST3320620AS, 3.AAE firmware, 7200.10 SATA hard disk.

The hard disk had an NTFS partition formatted across its 320 GB capacity.

On the hard disk was the partition C:, that had installed Windows 2000 Professional with Service Pack 4 to it.

After boot of the Windows 2000 operating sstem and arival at the Press Crtl + Alt + Delete to begin dialogue, a blue screen with Stop error "BAD_POOL_CALLER" appeared an a memory dump began.

The computer automatically rebooted and Windows 2000 began to load. The loading haulted with a message regarding a problem reading "C;\WINNT\SYSTEM32\CONFIG\SYSTEM".

I booted to the Windows 2000 Recovery Console and arrived at a "C:\>" prompt. I attempted to run CHKDSK to correct file system problems. CHKDSK failed to run and gave a message that problems exist.

Then suspecting a problem in the boot sector, I ran FIXBOOT C: to try to repair the NTFS boot sector. Surprisingly, Recovery Console FIXBOOT detected the partition as FAT and wrote a FAT bootsector.

The hard disk has not failed.

I have examined the drive with Windows Explorer from another system and the drive appeared as an empty 10.1MB FAT partition.

How can I recover the information on the drive?

[rchadwick]

The first thing you should have done is made an image of the drive. As you've found, tools you think will fix things often make things worse.

Make an image, and try real recovery software. Everyone will have opinions on what's best, and some work better in some situations, but you can try R-Studio to start.

[Asque]

The first thing you should have done is made an image of the drive. As you've found, tools you think will fix things often make things worse.

Make an image, and try real recovery software. Everyone will have opinions on what's best, and some work better in some situations, but you can try R-Studio to start.

Making an image requires quite a lot of storage space. At the moment do not have the storage space required, but shall acquire it later today.

Progress so far:

I am trying R-Studio 4.2 and reading its help documentation.

Opening R-Studio shows the attached display. The ST3320620AS disk shows a size of 298.1 GB, with what appears to be partitionos below it with aggregate sizes that exceed 298.1 GB and the true capacity of the disk (320 GB).

[pepe]

Hi

the capacity mismatch is due to the fact that HDD manufacturers call 1.000.000.000 bytes as a GB, however everyone who is familiar with programming will call 1.073.741.824 bytes a GB (1024*1024*1024 bytes).
First clone the drive, that's the safest method for recovery.
The problem is caused by the registry file, it is either containing invalid data or a bad sector.
If there's no bad sector U may try the 'Last known good configuration' option in the boot menu, or in another PC u can locate the '_REGISTRY_MACHINE_SYSTEM' file in the 'system volume information' folder in the latest Restore point folder and copy it back to C:\WINNT\SYSTEM32\CONFIG folder and rename it to 'system'.
I think U can do it only in safe mode.
after this procedure windows should start.
pepe

[Asque]

the capacity mismatch is due to the fact that HDD manufacturers call 1.000.000.000 bytes as a GB, however everyone who is familiar with programming will call 1.073.741.824 bytes a GB (1024*1024*1024 bytes).

pepe,

I was concerned with the sum of the enumerated partitions of the hard disk with the damaged NTFS partition (labeled as FAT16 by R-Studio) significantly exceeding the formatted capacity of the drive. The excess seemed to enumerated partition "Direct Volume". After a few shutdowns and restarts of the computer, R-Studio failed to enumerate "Direct Volume" (the enumeration of "Direct Volume" may have been a bug).

The problem is caused by the registry file, it is either containing invalid data or a bad sector.

If this was the case, CHKDSK should not have failed to check the disk; yet it did.

U may try the 'Last known good configuration' option in the boot menu, or in another PC u can locate the '_REGISTRY_MACHINE_SYSTEM' file in the 'system volume information' folder in the latest Restore point folder and copy it back to C:\WINNT\SYSTEM32\CONFIG folder and rename it to 'system'.
I think U can do it only in safe mode.

Safe Mode should not have been bootable; the bad registry file message is given during the non-GUI part of the operating system loading process. Also, when using the Windows 2000 Recovery Console, enumeration of the contents partition C: failed (I had not memtioned this before).

Restore point folders are used on Windows XP and newer NT-based operating systems (although it may be theoretically possible to add install the functionality) and their "SYSTEM" file may not be sufficiently compatible for Windows 2000 family operation systems (I am not completely certain about this point).

[Asque]

Thank you rchadwick for you recommendations. My files and directories have successfuly been recovered.

[pepe]

Hi,

My sequence was like first clone the drive, during this any physical problems like bad sectors should become known. If any of these occur, all the following would lose importance, at least concerning the patient disk.
Safe mode: I was talking about doing some registry repair on ANOTHER machine having bootable OS installed (NT or XP, I tried this method only on XP) and plugging the patient drive as secondary drive. (To be more precise I used a Preinstalled XP booted from a DVD).
I am not exactly sure of Win2000 having System vol. Info. folder or not, if it does not have, there should be some other means of registry backup...
However if only the data was important, it is the best to clone, then recover the data logically from the copy.
Glad to hear your success!

pepe

[Asque]

My sequence was like first clone the drive, during this any physical problems like bad sectors should become known. If any of these occur, all the following would lose importance, at least concerning the patient disk.

I did make and process an image.

Safe mode: I was talking about doing some registry repair on ANOTHER machine having bootable OS installed (NT or XP, I tried this method only on XP) and plugging the patient drive as secondary drive. (To be more precise I used a Preinstalled XP booted from a DVD).

I understand now what you were refering to, but it should not have worked because the logical disk had certainly become invalid when FIXBOOT wrote a FAT bootsector to the NTFS partition. Perhaps if an NTFS bootsector could have been written to the damaged partitiion over the FAT bootsector, logical manipulation of drive contents may have been possible.

I am not exactly sure of Win2000 having System vol. Info. folder or not, if it does not have, there should be some other means of registry backup...

On Windows 2000 registry backup may be performed by manually, copying the registry files or by using VERITAS Windows Backup ("NTBACKUP") to create an Emergancy Repair Disk (ERD) (which requires a floppy), or using Windows Backup backup feature to backup "System State" (which is the Windows registry).

[pepe]

Hi

thx for the info about Win2k!

pepe