How did Scandisk damage my FAT? Any recovery options?

[Neuro]

Logical Error/FAT Damage caused by Scandisk:

I once was told that clicking the "exit" button (hitting space bar) on Scandisk is a recipe for disaster. Of course to my lament, I now can confirm this to be True. As most of you remember, on older machines 95/98/98se/me, Scandisk runs at boot if you shut down improperly. Why would Microsoft put the "exit" button/option in Scandisk if it can corrupt your hard drive?

Well, in any event my problem is that while I was reinstalling my network adapter drivers, my computer froze up and I had to power off the machine -- thus causing Scandisk to run at Boot. I have never hit the escape button until now, and immediately after escaping out of Scandisk the pc went to BSOD saying: VFAT Device Initialization Failed.

I immediately disconnected the drive and set it up as a slave for testing. There has been NO writing to the disk -- to protect the data.

I am somewhat thankful that this is only a logical error and not a physical one, but still when I check in either DOS or Explorer 75% of the folders inside C:\Windows are gone (including about 2GB of personal folders/files I had on the desktop). I've used recover4all to peer into the drive and many of the folders show up as deleted. However if I try to restore them to another backup drive they are damaged and unusable.

I also used Norton Ghost 12 to create a disk image (including MBR copy) onto a backup fat32 drive (same cluster size) to run tests, but unfortunately TestDisk reported no difference between the FAT and the Backup FAT on sector 6. I had been hoping that just the first FAT had been corrupted. Chkdsk /r /f did not help either.

It seems to me that something is wrong in the boot sector and it seems strange that selective folders were completely wiped out like that. I am going to buy Professional Recovery Software, but I decided to post here first to find out:

• Does anyone knows how scandisk works?
• What kind of corruption did I most likely experience?
• Does my issue sound like a damaged FAT?
• What is the best approach to recover the files without them being useless?
• What is the best software for this type of recovery?
• Are there any specific apps that can rebuild/recover/repair a damaged FAT?

~Neuro
Thanks in advance for all your help

[GDH]

Hi,

It is actually very difficult to know exactly what has happened to your FAT table without conducting a full forensic examination. To do this, we would need access to a bit image copy of the drive.

Scandisk can cause many different problems, depending on what it was up to when the process was interrupted.

I suggest you download Recover My Files from www.recovermyfiles.com and run the program in evaluation mode.

You should try a "Complete Format Recover", and search the "physical drive" only for the default selected file types (this will make sense when you run the program and follow the wizard steps). At the end of the search the program will rebuild the old FAT, and you should see all your files and folders with full file and folder names in "Folder View" of the results screen. Click on the files found to preview their contents in the preview window. If you can see the files (read the documents and see the pictures) then you know the files that have been found are valid and can be saved once the program is activated.

Please post here and let us know how it goes.

Thank you.

[Neuro]

Thanks Graham, I'm definitely going to buy recover my files and see what happens. I'll certainly let you know how it goes.

I found something interesting in the SCANDISK.LOG that explains what seems to have happened. The log is as follows:

ScanDisk checked drive C for problems, with the following results:

Directory structure

Directory entry C:\WINDOWS\_óÿ .éF
contained invalid characters in
its filename.
ScanDisk deleted the directory entry.

Directory entry C:\WINDOWS\@ contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

Directory entry C:\WINDOWS\ .@… contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

ScanDisk detected one or more invalid long filenames.

Directory entry C:\WINDOWS\À contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

File allocation table

Directory entry C:\WINDOWS had an invalid FAT chain.
ScanDisk did not correct the FAT chain.

File system

There were 106,989 lost clusters in 12,228 chains.
ScanDisk reclaimed the lost clusters as free space.

Surface scan

ScanDisk did not perform any tests.

So this is why a handful of folders with approximately 3.5 GB of data was deleted by Scandisk. What's strange is that the folders that were left intact under C:\WINDOWS, have folder names that are 'ALL CAPS.'


Thanks again,
~NeuroB

PS What happened to the ActionFront Forums! I can't believe it, that was seriously one of the best resources on the net for Data Recovery issues, and I can't believe that Seagate just decided to do away with the forum and all the thousands of archived posts after acquiring ActionFront. Seagate would rather that none of us have any idea how our Hard Drives and DR work. I wish I knew where all the thousands of expert members of that forum went to -- anybody know?