Restore corrupted Hard Drive to "As Was" Condition

[SW1]

Is it possible to use "Recover My Files" to restore on a corrupted hard drive all files, registry, partitions, etc. on the same hard drive so that the drive can be re-installed as the "Master Drive" and run exactly as is "Was" just before it became corrupted? Details of the "corruption" are as follows:
--HP non-destructive recovery was run, but "hung up" at the final "Finish" window
--HP DESTRUCTIVE recovery was started but lasted at most a few seconds when computer was immediately shut off with "On/Off" button.
--There are two partitions:
----8 GB hidden partition FAT32 with "HP Recovery files". The FAT32 file system is correctly indicated in the "Drive Management" view in WinXP
----52 GB data and programs partition NTFS. Only "Healthy (Active)" is indicated in the "Drive Management" view. NO "NTFS" is shown in this "Drive Management" view.
---Possibly all the files can be saved to another external Hard drive.
HOWEVER, I am wondering if the corrupted drive can be re-consituted to run exactly as it had run just prior to its failure and corruption.
Thank you.

[GDH]

Hi,

Recover My Files is not designed to "fix" a drive and make it work again.

Recover My Files is designed as a "data recovery tool" which will locate files on the problem drive and allow you to save the files to another drive.

-----

The drive fix approach

There are some programs available which will allow you to "fix" a drive in an attempt get it working again. The limitation of this approach is:

a). There are about 1000 different ways to lose data from a hard drive and it is hard to create a fix-all tool for all problems;

b). If the "fix" software does not get the solution 100% accurate, then you run the very real risk that when it writes its changes to the drive it actually makes things much worse and the probability of getting any data back could be greatly reduced.

-----

The Recover My Files approach

Recover My Files is written specifically so that it does not change the content of the drive being searched. You must save the data found to another drive.

With this approach, even if you do not decide to use Recover My Files, you can pursue other data recovery options, knowing that the status quo of the drive has been maintained.

[SW1]

Graham,

THANK YOU very much for correctly understanding my question and for your clear and excellent answers.

Just a quick follow-up.

If "Files" and the folder "Tree Structure" are saved, does that imply that the "content" of the files is NOT corrupted? As you might see from my original post, I did an HP "Non-Destructive Recovery" attempt....then I accidentally started a "DESTRUCTIVE RECOVERY" attempt which lasted for about 5 seconds before I hit the "On/Off" Start button on the computer. My concern is that the files might have been formatted or overwritten, etc. OR, DO YOU THINK THAT THERE IS HOPE THAT THE FILES FOUND WITH "RECOVER MY FILES" will NOT be corrupted even with the "Destructive Recovery" that was started?

Many thanks again. Looking forward to your answer.

[GDH]

Hi,

The short answer to your question is:

* If you run a "Format Recover" search (instructions are in the first sticky post of this forum) and;

a). in "Folder View" of the search results screen you can see the files and folder structure;

b). when you click on a file (graphic or document) you can see the picture or read the text;

then you file and folder structure can be saved and will work.

If you click on the files in "Folder View" and are not able to preview graphics or documents, then the data that has been found and listed is probably not valid and the saved files will not work.

-----

The longer answer to your question is that there is basically 2 methods of recover:

1. MFT Method

Each computer has an index at the start of the disk called the master file table which contains the file and folder names of every file on the PC and the storage cluster locations of the files.

When Recover My Files finds a file with its original file and folder name, it is using the MFT record.

MFT records can become badly corrupt, so it is possible that you can find an MFT record for a file, but the record does not point to the correct location on the disk - hence the data saved in the file is not valid.

2. The Header and Footer Method

If the MFT found is not valid (see above) it is still possible to get files off the drive. If you run a "Complete File Search" for specific file types, the program will find files by their unique file type header and footer. These files are called "Recovered_Filetype_1" (because the name of the file is stored only in the MFT).

--------

In summary: The best way to tell if your data can be recovered is to see if you can preview it in the search results screen.

I hope this helps.

[SW1]

Hi Graham,

Thanks again for excellent answers.

Again, a follow-up if I understand your previous answers correctly.
--You indicate that recovery by the "MFT Method" (I assume that is a choice when starting the "Recover My Files" Program) will give the correct "names" of the files, but the location of the files and/or the files themselves might still be corrupted since the location information was coming from the MFT.
--You indicate that recovery by the "Header and Footer Method" will essentially ignore the MFT and file names...BUT, might find the actual files and all connected fragments of the files....but without the correct file names.

It seems as if doing a "recovery" by the "Header and Footer" method gives a better chance of finding the continguous fragments of the files and, therefore, a better chance of recovering the complete, un-corrupted files, but without the correct file names.

?? Is there a way, or reason, to do BOTH recovery methods (i.e. MFT Method AND "Header and Footer" method")....which would connect a correct file names (i.e from the "MFT Method")....with the complete un-corrupted files (via the "Header and Footer Method?? Possibly, the "Tree Structure" would give a "one-to-one mapping" of "file name" (MFT Method) in one directory....which could be matched to the un-corrupted file (Header and Footer Method) in that recovery directory?

Thanks again.

[GDH]

The MFT method is the best type of recovery because

a). you get the file and folder structure back;

b). an MFT record contains a cluster "run list" for a file - meaning that if the file is fragmented on the disk, the MFT record tells you where each part of the file is and in what order to assemble it.

--

The Header and Footer method is great to, because if the MFT is corrupt, missing or destroyed, the Header Footer method will get your files back.....

However.....

a). The header footer method will not give you file and folder names;

b). The header footer method cannot track fragmented files.

When you select the specific file types to search for, Recover My Files travels sequentially down the disk and tests the data found to see if it matches the selected file types. When it finds a header, it travels down the disk looking for the footer.

If Recover My Files goes a pre-set distance down the disk from the header and does not find the footer (or it can't work out how far down the disk the footer should be) then it stops, and gives the file a default size. It then tests what it has found and makes a decision as to whether it thinks the file is valid - it if fails the tests, it is not included in the search results.

If you go into the OPTIONS box you will see under the "Lost Files" options, the ability to set the file size to a specific length. An example of a situation where this may be used is:

You have taken 90mb TIFF photos on your camera card and are trying to recover them. The Complete File Search for TIFF files does not give you good results, because the returned files are all 10mb in size (i.e. reached the default file size for TIFF and had not found the footer).

So you can set the required file size at 95mb, RMF finds the header, then jumps 95mb down the disk, and provides this as the file found.

This works well on camera cards, because usually photos are stored in consecutive sectors and are not fragmented.

When you open this file with a graphics editor and then save it, it will chop off the excess data at the end.

[SW1]

Hi Graham,

Brilliant and clearly written answers!!! Very nice!!!

A couple more follow-up questions are below.

1. I am particularly interested in trying to recover Netscape 7.2 email folders, email files, email address books, and bookmarks. A sample of these Netscape files extensions are as follows. What is the best method of trying to recover the file-extension types below, or any other file types, which are non-normal, non-RMF-selectable file types?
--bookmarks.html.sbsd.bak
--cert8.db
--custom.dc
--hostperm.1
--prefs.js
--Chrome.css
--XUL.mfl
--50953509.s
--51084564.w
--abook-1.mab
--default-connections.rdf
--Door_Threshold.msf

2. Are there options other than on-line purchase of RMF? For example, are there any stores (i.e. Staples, etc.) from which I can purchase RMF (I am in Northwest NJ)? Or, can I have a CD/User Manual mailed to me when I order the software online (I prefer that approach rather than taking a chance of downloading the software)?

Many, many, many thanks!!!

[GDH]

Currently the only way you will find these files is if you run they come back with their original file and folder name (i.e. an MFT record for the file is located and it is recovered this way).

The files types shown in the selection list within Recover My Files (there are about 300 of them) have all been reverse engineered by us so that we know the file header, the internal characteristics of the file and the file footer. If the file type does not appear in the list, it means that we have not gone through the process for that particular file type.

Usually we would say that if you send us 3 samples of a particular file, we can try and add it to the list. However we are at present working on getting Version 4 of Recover My Files released (it is a major new re-write from ground up) so we do not currently have the resources to dedicate to adding new file types.

Recover My Files is sold retail in the USA. The main distributor was CompUSA (may they rest in peace). You may find that other retail stores are running down the stock of version 3 in preparation to get version 4 out later in the year. The best way to find a current stockist would be to contact our USA distributor on 1.801.224.2955

[SW1]

Hi Graham,

THANK YOU for all of your excellent answers!!!

[SW1]

Currently the only way you will find these files is if you run they come back with their original file and folder name (i.e. an MFT record for the file is located and it is recovered this way).

The files types shown in the selection list within Recover My Files (there are about 300 of them) have all been reverse engineered by us so that we know the file header, the internal characteristics of the file and the file footer. If the file type does not appear in the list, it means that we have not gone through the process for that particular file type.

Usually we would say that if you send us 3 samples of a particular file, we can try and add it to the list. However we are at present working on getting Version 4 of Recover My Files released (it is a major new re-write from ground up) so we do not currently have the resources to dedicate to adding new file types.

Recover My Files is sold retail in the USA. The main distributor was CompUSA (may they rest in peace). You may find that other retail stores are running down the stock of version 3 in preparation to get version 4 out later in the year. The best way to find a current stockist would be to contact our USA distributor on 1.801.224.2955

Hi Graham,
A local computer store recovered my files using "Recover My Files" software. Quite impressive. They used the "MFT" scan approach.
QUESTIONS:
1. Can I assume that, if the folders and files were "recovered" and show with correct file name, that those folders/files are "intact" and NOT corrupted? The entire Netscape 7.2 file path was recovered....but I don't know if all the sub-files are corrupted or not?
2. All of the 271 "Lost Files" had the File Name format of "MFT XXXXX", where the X's are numbers. Is there a way to determine what these original files were so that I can re-constitute these files with the correct file extension and maybe salvage those 271 files?
Thanks.