Chkdsk had damaged volume directory

[Painless]

We had a customer's desktop in for a complimentary scan for viruses (We were working on the son's laptop which was riddled with viruses). When we tried to run the MacAfee live CD Chkdsk started to run immediately without any request or options - so we had to let it finish. When it had completed the machine will not boot either in normal or safe-mode. The XP splash screen starts, there is then a very brief flash of a BSOD and the reboot cycle starts over again.

We then took an Acronis True Image image of the drive before going any further. Acronis would only do a sector-by-sector backup and this backup has been expanded onto a spare harddrive.

UBCD4 is unable to read the original or the spare hard drive reporting 'Directory Corrupt or Unreadable'.

We have tried to repair Windows on the spare hard drive but the instal disk doesn't recognise that there is a Windows instal

My next move was to see if an XP instal disk would repair the original hard drive but I am reluctant to touch this drive until I can access the customers files.

Has anyone got ideas about what else I can try to recover the files before I can then look at whether the hard drive is failing and needs replacing or whether it is just chkdsk b***ering things up.

 

[Martyn]

From previous experiences I have used Getdataback NTFS, imaged the drive then work on the image to recover your data.

 

[Painless]

From previous experiences I have used Getdataback NTFS, imaged the drive then work on the image to recover your data.

Thanks for that. I already own a copy of Filercovery Pro from LCTechnology so I will give that a try first and if that doesn't work I'll try the demo of Getdataback to make sure it works before I part with the money.

 

[ZenTree]

What's the BSOD?

same BSOD in safe and normal?

 

[MobileTechie]

Try a linux disk first. Sometimes they can see right past Windows errors and allow data copying.

 

[Painless]

What's the BSOD?

same BSOD in safe and normal?

Sorry we can't see. It doesn't stay on the screen for longer than it takes for the eye to register that it is blue.

We are now running Filerecovery Pro (on the image) and it has started an intense scan that will take 3+ hours. So far after after 5mins it has found 3 directories and 240+ files so we will keep our collective fingers crossed.

MobileTechie - Linux can't read the drive either it says the file system is corrupt.

 

[nhicktrush]

I'm interested on recovering files from a not functioning drive.. hope to lists some helpful tips here.

 

[iisjman07]

Chkdsk /R? Sound like severe partition damage... Over than that you're into data recovery. You could try TestDisk, and see if that helps, or PhotoRec or Foremost to just grab files based on the file headers

 

[TLE]

Sorry we can't see. It doesn't stay on the screen for longer than it takes for the eye to register that it is blue.

You can press F8 as though you are going to start the PC in safe mode, then select the "Disable Automatic Restart".

After this the system will remain on the BS giving you time to note it down.

 

[iisjman07]

You can press F8 as though you are going to start the PC in safe mode, then select the "Disable Automatic Restart".

After this the system will remain on the BS giving you time to note it down.

My bet it's unmountable boot volume

 

[TLE]

My bet it's unmountable boot volume

Yeah I suspect you are right, this is going to be related to data corruption of some form. I wouldn't be using the original drive at this point, I would recover the data to a new drive and work on that until you have run further diagnostics on the original drive.

 

[MobileTechie]

I think if a linux boot disk cannot read the drive we're beyond worrying about the exact error at boot. The filesystem is corrupted to the point where files are not readable so obviously an error is going to show up.

It could just be something as simple as the partition table or it could be more systematic file system corruption.

Now an image has been secured I'd attach it to my bench machine run something over the drive to see if bad sectors are involved, if there are then correct with hddregen or similar, then checkout the situation in Disk Management to see if any partitions are being seen. if not then try a partition tool to see if the table can be rebuilt automatically. If partitions are seen but the drives cannot be read then chkdsk/r might just help but it seems unlikely at that point. If none of that works then it's DR time with the usual tools recommended.

 

[Painless]

Chkdsk /R? Sound like severe partition damage... Over than that you're into data recovery. You could try TestDisk, and see if that helps, or PhotoRec or Foremost to just grab files based on the file headers

We tried chkdsk /r from the recovery console but only got an error message (i'm sorry I can't remember the exact wording - it was a couple of hours ago)

You can press F8 as though you are going to start the PC in safe mode, then select the "Disable Automatic Restart".
After this the system will remain on the BS giving you time to note it down.

I think if a linux boot disk cannot read the drive we're beyond worrying about the exact error at boot. The filesystem is corrupted to the point where files are not readable so obviously an error is going to show up.

It could just be something as simple as the partition table or it could be more systematic file system corruption.

Now an image has been secured I'd attach it to my bench machine run something over the drive to see if bad sectors are involved, if there are then correct with hddregen or similar, then checkout the situation in Disk Management to see if any partitions are being seen. if not then try a partition tool to see if the table can be rebuilt automatically. If partitions are seen but the drives cannot be read then chkdsk/r might just help but it seems unlikely at that point. If none of that works then it's DR time with the usual tools recommended.

I had forgotten about the F8 and "Disable Automatic Restart" option but as MobileTechie suggests we may be beyond that stage.

I have run Filerecovery Pro and it has found loads of files. Unfortunately it tends to name them all as "cluster xxxxxxx" which is not very helpfull. I am going to give the trial version of Getdataback a try and see if that is any better. If it is I will invest in the full version. After that I will try the partition recovery tools such as hddregen and see what we can see.

We're still doing all this on the image disk but once we have finished trying everything on it I might try Spinrite on the original disk and see if it can perform its usual miracles!

 

[Painless]

Update.

The partition is unregcognisable because the NTFS index file is corrupt. Searching Google brings back the general opinion that the OS is not retrievable and the only answer is a clean instal.

Filerecovery Pro recovered lots of files but they were not in a userfriendly format. All the files are named as 'Clusterxxxxx' which is not handy and the current files are mixed in with partially retrieved ancient deleted files.

GetDataBack on the other hand gets a big + . It found all the files and then displayed them as an Explorer tree with all the the users folders and file names intact. The ancient 'lost' files were listed at the end of the tree.

The result is a happy customer: she is getting a clean instal with all her files retrieved and I have found an excellent new piece of software. Thanks Martyn,

 

[lake54]

Just want to chip in and say a +1 for GDB - we use it at work quite a lot and it nearly always works where data is recoverable. The only times when it hasn't worked are when the drive is literally unreadable (e.g. mechanical fault).

 

[kevinjhaag]

Chkdsk /R? Sound like severe partition damage... Over than that you're into data recovery. You could try TestDisk, and see if that helps, or PhotoRec or Foremost to just grab files based on the file headers

+1 for TeskDisk. TestDisk would've helped you out on fixing your problem maybe but it would have recovered the files too in original format if done right. TesDisk fixes things like this. Just 2 weeks ago my external usb drive decided to do the same thing as yours. Testdisk was able to fix it and I backed everything off the drive and then ran hard drive diagnostics and found out it was faulty. So I would run a diagnostics on the drive like MHDD to check for bad sectors.

I think if a linux boot disk cannot read the drive we're beyond worrying about the exact error at boot. The filesystem is corrupted to the point where files are not readable so obviously an error is going to show up.

It could just be something as simple as the partition table or it could be more systematic file system corruption.

Now an image has been secured I'd attach it to my bench machine run something over the drive to see if bad sectors are involved, if there are then correct with hddregen or similar, then checkout the situation in Disk Management to see if any partitions are being seen. if not then try a partition tool to see if the table can be rebuilt automatically. If partitions are seen but the drives cannot be read then chkdsk/r might just help but it seems unlikely at that point. If none of that works then it's DR time with the usual tools recommended.

I agree... as mentioned above. Run a diagnostics to see if their is any bad sectors and if so run manufacturers diagnostics and RMA if still under warranty. Well at least you got the files secured but to bad windows won't be exactly like she had it and her software. Its part of the process. Talk to you later.

 

[Martyn]

Update.

The partition is unregcognisable because the NTFS index file is corrupt. Searching Google brings back the general opinion that the OS is not retrievable and the only answer is a clean instal.

Filerecovery Pro recovered lots of files but they were not in a userfriendly format. All the files are named as 'Clusterxxxxx' which is not handy and the current files are mixed in with partially retrieved ancient deleted files.

GetDataBack on the other hand gets a big + . It found all the files and then displayed them as an Explorer tree with all the the users folders and file names intact. The ancient 'lost' files were listed at the end of the tree.

The result is a happy customer: she is getting a clean instal with all her files retrieved and I have found an excellent new piece of software. Thanks Martyn,

Glad it helped. It's more than paid for itself for me.

 

[Painless]

+1 for TeskDisk. TestDisk would've helped you out on fixing your problem maybe but it would have recovered the files too in original format if done right. TesDisk fixes things like this. .

Unfortunately Testdisk just said there was a problem with the partition and wouldn't do anything. It did allow me to alter the 'boot' partition so that we could boot from the recovery partition and start the reinstal.

I agree... as mentioned above. Run a diagnostics to see if their is any bad sectors and if so run manufacturers diagnostics and RMA if still under warranty. Well at least you got the files secured but to bad windows won't be exactly like she had it and her software. Its part of the process. Talk to you later.

Ran HDDgenerate, Seagate diagnostic and Spinrite. All gave the drive a clean bill of health.

The machine was in for a courtesy scan for malware and I can only guess that there was an infection and between that and chkdsk they corrupted the NTFS sys file.

Thanks for all the suggestions. We now have a happy customer and our knowledge/experience base has increased.

 

[kevinjhaag]

TestDisk...

Unfortunately Testdisk just said there was a problem with the partition and wouldn't do anything. It did allow me to alter the 'boot' partition so that we could boot from the recovery partition and start the reinstal.



Ran HDDgenerate, Seagate diagnostic and Spinrite. All gave the drive a clean bill of health.

The machine was in for a courtesy scan for malware and I can only guess that there was an infection and between that and chkdsk they corrupted the NTFS sys file.

Thanks for all the suggestions. We now have a happy customer and our knowledge/experience base has increased.

At least Testdisk did something. There are some cases it can't fix it and I basically backup the files and start from scratch with the hard drive. If you look further into Testdisk. If you do a analysis, quick search and then list files...I'm sure its files were their and it lets you copy them from there. I'm usually surprised to see files every time I use it on a corrupted/faulty hard drive. Well at least everything turned out ok and the customer is satisfied. I hardly ever use chkdsk due to the exact problem you ran into. Seems to happen to often; so I run diagnostics first before I ever run it and I always image before I start working on a computer because you just never know even for the littlest things. Well glad to hear you got it and thanks for letting us know how you repaired it. Always like to hear how things work. Have a good night, Painless!

Kevin