Repairing a broken NTFS disk?

So wait, you can access your data partition just fine, but can't access your boot partition? Or do you mean your MBR is corrupted and you can't access any partition at all?

I can see both partitions, and I can mount them, but my boot partition shows up as empty under Ubuntu.

Copying from the data partition results in failure in some cases. I want to attempt to salvage what I can. The idea of losing 4 weeks of e-mail isn't too pleasing. While there is nothing of vital importance in there, I still had a handful of unanswered mails and I want that prototype project back. It's a few hours worth of work.

Toolmaker

you can get lower level programs that search the drive without needing any of that don't you? the kind the cops use to look for kiddie porn that's been deleted and suchlike, i can't remember what any of them are called but i know they're available for personal use as well since a few mates have had to use them, the only downside being if you've used the pc there's a danger some of the data has already been overwritten but i doubt that'd apply to you..?

maybe run that on a master drive and plug the laptop drive into the pc using one of them converter ide ribbons as a slave? probably a bit of effort but throwing it out there.

edit: i dunno about laptops, but on my girlfriends crappy seagate external hard drive the warranty covered data recovery so they got all her crap back, dunno if dell would have a similar service or if it's just the laptop as a whole... also my method above might void any warranty, bleh!

I'd recommended dd'ing out whatever data from the partition you can into a file of some sort, moving it out of your laptop, and later on using a low-lever searcher on the file through a loop device. The data is probably there, but the block ordering must be wonky. There are tools that can sift through data streams and reconstruct a file system out there.

If the disk is spinning it's pretty easy to recover data these days with something like EasyRecovery Pro
I'm sure there are free Linux alternatives like dd on Linux but it really comes down to how much your time is worth because there is no easy gui to use?

The only time it hasn't been able to recover my lost data is when I accidently used Ghost to clone over a drive-DOH!

p.s. Sometimes you can actually get away with just booting from Vista DVD and running a chkdsk from the command prompt you can get from repair options on the bad drive and that might get the system up long enough to copy the data you want.
At least I would try that first.

If the disk is accessible then you should be able to recover data from it. But keep in mind that if the MFT can't be recovered then the best you can do is recover clusters. This means that if the file was large enough to spread across multiple clusters, you'll have to tell the recovery program the size of the files you're looking for. The MFT lists what clusters held what files, and if that is missing the best the program can do is recover the data recoverable from each cluster, and if the program resides on multiple clusters you tell it the size and it will try to recover data is groups of clusters that equal your size. But the bitch of this is that if the MFT is missing AND your drive was fragmented, it will be almost impossible to recover the data without pieces (clusters) missing, so the recovered files would most likely return corrupted.
I also recommend Easy Recover Pro, but i also like EaseUs data recovery. I personally recently used EaseUs and found it quite nice. It first will scan for any drives that exist, even ones that don't show under windows but are plugged in, it will then try to recover any MFT/FAT's that exist and if so use those to reference specific clusters that will rebuild the files. Even if the MFT/FAT are missing it will then attempt RAW file recovery. If your files are small enough you may be lucky enough to recover the files even if the MFT doesn't exist.
Good Luck!

P.s. If you're sure you didn't get sector errors (showing signs of physical damage) and you think it is just software corruption, you can attempt FIXMBR and FIXBOOT to fix the main boot files required for the boot process. However, Vista has changed the names of those commands, so you'll need to search google a bit to find the Vista specific recovery commands, i don't remember them off hand.

Well, I think the disk is severely buttraped:


In other words, the disk surface is physically damaged, and I doubt I can recover any data from it. I'm currently using Acronis Disk Director to see if I can recover it, but I'm having severe doubts about this.

Toolmaker

If it is not already too late, give dd_rescue a try (should come with Ubuntu, if it doesn't, it is on the sysrescue CD).
This has once saved near 90% of my data in a similar case. Note that dd_rescue seemingly takes forever to run, but that's normal.

You first back up the whole file system into an image on another disk, and then do a filesystem repair on that image after mounting it. There's a detailled howto on that on the net.
With any luck, you lose some data and some file/folder names, but still get most of your data back.

In any case, I recommend not to boot into Windows, because in another case, I've had it happen that one of those dumb ass "intelligent" tools fired up and said "ohhhh... seems like the HD is not so good any more, let's mark all the bad sectors". When that happens, the sectors with your data are remapped, and any data you might still have is gone forever, no tool will be able to restore it.

Quote:

Original post by Toolmaker Well, I think the disk is severely buttraped: ..image... In other words, the disk surface is physically damaged, and I doubt I can recover any data from it. I'm currently using Acronis Disk Director to see if I can recover it, but I'm having severe doubts about this. Toolmaker

aw man, that's pure bad luck, i know how infuriating that must be, my housemate had a hard drive failure with his disseration on, next day his secondary hard drive which had all the latest versions backed up decided to die too, lecturer didn't believe a word, which is understandable

Well, at this point you might as well open up the drive and see if its something simple like a head locker thats stuck. And if you feel experienced with electronics you can try finding the problem and swapping some parts (if doing a head replacement be careful, they're tricky!).
I actually feel your pain, i didn't create a backup in a long time on anything but my raid 10 (had a single drive for C: which backed up to the raid 10)... and my main drive died near the same time i got some new hardware (2 new drives to replace the old one). But before i was able to move the data over, the drive actually stopped being recognized by the bios AND my raid 10 failed at the same time! I tried everything short of a platter swap (drive contained two platters and i didn't have the tool needed to keep them aligned, nor a proper replacement drive). I lost about 6-8 months of contract work... About had a meltdown for the first day.
Needless to say i now backup every week onto a thumb drive, and tell people to do the same with their data.
I would still attempt a recovery, you never know what the programs may find, they usually skip past any errors and recover the data anyways. If you don't want to sink any money into it, try: PcI Recovery.

Well, I no longer have access to the drive. Dell replaced the HDD and my laptop's speakers this morning(Both died around the same time) and I wasn't able to keep the drive for another day to recover it.

It's not a terrible loss. I lost some mail and some minor school work. I normally backup everything to an external machine which runs nightly backups to an external site. Except I didn't move those files to there yet, because I was still setting up Vista(I reinstalled it for a 64-bit version).

Well, it's a lesson learned. I didn't loose anything crucial, altho it's a shame I have to spend another 15 hours rebuilding that prototype.

Toolmaker

Quote:

Original post by Toolmaker Well, I no longer have access to the drive. Dell replaced the HDD and my laptop's speakers this morning(Both died around the same time) and I wasn't able to keep the drive for another day to recover it. It's not a terrible loss. I lost some mail and some minor school work. I normally backup everything to an external machine which runs nightly backups to an external site. Except I didn't move those files to there yet, because I was still setting up Vista(I reinstalled it for a 64-bit version). Well, it's a lesson learned. I didn't loose anything crucial, altho it's a shame I have to spend another 15 hours rebuilding that prototype. Toolmaker

Well, sorry about your luck. But i must say, compared to the loss others have suffered at the hands of data loss, 15 hours of lost work isn't that bad ;-)