NTFS drive corrupted, not bootable

[Feathers]

My story, as quick as possible.

Copying files from a Linux box to my Win2k PC while I was at work. Came home, found many popups, starting with 'such-and-such file corrupted', ending with '$MFT corrupted' and 'C: drive corrupted'. I tried to run checkdisk as the popups advised, but as soon as clicked the 'Properties' menu item, the system blue-screened. Rebooting got me a 'Unable to load OS' message.

Recovery console work gave me 'Unable to enumerate directory listing' messages when I tried to list the directory, and ChkDsk would immediately stop, telling me the drive had multiple unrecoverable errors. DiskPart (or whatever the partitioning program in the console is) reported the directory as damaged or destoryed. However, my Linux box could see the partition as an NTFS partition.

As a slave drive on a WinXP box, the drive appears in the list, but clicking on it reports it as unformmated and asks if I want to format it (which, naturally, I do not). I cannot remember what the Drive Manager reports the drive as (I don't have it hooked up currently) but I can check it if that information would be helpful. Needless to say, nothing has been written to this drive since the crash (I haven't been able to write anything).

As far as I can tell, the partition table is intact, but the $MFT is corrupted, and the $MFTMirror is hosed too (the $MFT reads at 184MB, the mirror as 4kB). And there are either large c***** of garbage written across the remaining files, or there are links to scrambled sectors in the middle of some file chains.

Now, I've downloaded a lot of trial recovery programs over the last week or two, including RecoveryMyFiles. My best results have come from RMF and GetDataBack. I just want to see if I can get a few more tips about RMF before I make a final purchase decision.

There were a fair number of TXT files on my drive that I'd like to get back, some of them with passwords and registration codes in them. Only a handful of these are recovered in a default 'Complete Format Recover', and seraching specifically for TXT files seems to raise so many false positives that it could take a long time to sort through them all. Anything I can do to improve my odds?

My Mozilla mailboxes can't be found and there's no explicit filetype selection for them. Is there something I could use instead, or a way to find them and get them back?

When I do a 'Complete Format Scan', the program stops in the middle of the filesystem reconstruction step. It's not frozen or hung, because I can click on files and preview them and browse through what it has found. But about 1/3 of the way through (based on the progress bar), it stops and the time countdown stops. Pressing 'Cancel' warns me that it will stop searching but the filesystem reconstruction will continue. Except that it doesn't and remains at that 1/3 spot. Something I'm doing wrong here?

I'm very impressive with RMF. The idea of looking for the file headers/footers in the raw data is impressive and before I downloaded RMF, no other recovery program could find much of anything on what remains of my drive. The free forums are a bonus too... just the extra step of help being available for the users.

Anxiously looking forward to a reply. Nothing on this drive is life-destroying if I lose it, but obviously if I could get a bit of it back, I'd be quite happy.

Thanks!

James

P.S. I've begun to think that if the drive had actually failed I'd have a better chance of recovery. It feels like Windows wrote garbage to the drive in the process of my copying. Therefore, it's not like files were 'lost', but instead they were 'purposefully overwritten' with trash. -_-

[john]

James,
Text files are notorious for false positives, simply because there are lots of fragmented files with text on unused areas of hard drives. One thing you can do is use the Filter option to cull the files you don't want and hone in on those you do.

I'll look into the Mozilla mailbox file format and see what can be done there. It may be that the emails are stored as "******* Emails" in which case you can search for that file type.

If the drive was NTFS then it "should" be able to recover many of your files using a Manully Set options search.

1. Click Manually Set Options
2. In the Search Tab - Turn OFF "Search for Deleted Files"
3. Turn ON "Search for Lost Files"
4. Change the Filesystem to just NTFS
5. Switch to the Advanced Tab - Turn ON "Search in Active file areas anin addition to Non-Active"
6. Turn ON "Allow Searching of Physical Drives"
7. Click OK
8. Select the Physical Drive to search
9. Select some files types to search.
10 Run the search.

I think from your d********** using these settings will give the best results.