NTFS is seen as FAT32-cant access data

:?:
To any god sent people,

Seems that we have a pretty unique problem here, I have spoke with numerous hard drive recovery people, all saying they cant help. Here it goes.

The problem is with XP and 98 confliction, I had a external HD formatted to NTFS. I plugged it into a 98 machine to pull some files off, then as a browsed the drive, I saw everything showing up in jumbled ascii figures. Since windows 98 uses FAT32 I realized the problem so I shut down and replugged the drive into and XP machine. Then I saw that 98 changed the format from NTFS to FAT32. The drive is a 180gb and since FAT 32 has a limit of 137GB that’s all it shows now, and in a unreadable format(ASCII looking characters)

How can I changed the file allocation tables back to NTFS?

Hope you can help, or maybe know someone who can.

Thanks in advance



S&C

What a vexing situation! If you're still monitoring this forum, post another message and we'll talk about a couple of things you could try.

-- Ed

Hey ed,

i appreciate the reply, ideas are what i need. i am about to try to recreate the scenario on a secondary hard drive so i can toy around with it and test so that i wont degrade the information on the original drive. what is the best way to communicate...email, messenger,or here?

thanks in advance

anxious steve

Hiya!

Well, the problems are strictly Windows, but the things I can think of at the moment use Knoppix, so it might help other people to see the discussion in the forum.

A "live CD," an operating system that runs entirely from an optical drive, is really useful for doing repairs for a couple of reasons. One is that it'll run even if the main hard drive won't boot. And with compression like Knoppix uses, there are plenty of tools on that CD.

By default Knoppix won't write to any other drive (with one tiny exception), so you can use it to look over the installed system without causing any further damage. The exception is that Knoppix will look for a Linux swap partition and write to that unless you tell it not to at boot time.

Even if you do have a Linux swap, though, it's just a scratch pad and usually there's no problem with writing to it. The main reason to avoid this is if you're looking for secrets on someone else's system. :wink:

Another bonus to Unix-like systems is that it's very easy to read and write raw data. Usually the worst case is that you can dump all those bytes onto a workbench drive and then use automated tools that sort through it, looking for the kinds of patterns that say, "I'm a Word file! I'm an Excel file! I'm a program!"

But I'm concerned that you've already been told that the data can't be recovered. Did these people say why?

Disclaimer: I haven't used Linux with anything attached to USB ports. Knoppix does great hardware detection, so in the startup messages I see that the hubs and devices (printer, SD card) are found. But so far I haven't had occasion to use them outside Windows. But I think you'll be able to see from what Knoppix tells you just what it calls your USB drive.

So, first - your main hard drive is okay? It boots and all? RAM is okay? How much is installed? Do you have another drive with at least as much free space as the hosed one so you can perform surgery on the data?

Next - do you have a good Knoppix CD? The current version is 3.7 - 3.8 is available but hasn't been officially released, and the main website says 3.8.1 will be coming in a few days. And it doesn't help to have a bad copy - do you have a way to run an MD5SUM check on the downloaded iso file? I've had bad luck with three or four little programs to cacluclate these sums in XP, maybe it's just me. But if you usually get good downloads, you'll probably be okay.

Next, how familiar are you with Linux or other Unix-like operating systems? Do you have one of them installed already? (Maybe I should have asked that first - if you have Slackware Linux on the computer already, you don't need Knoppix! :D )

This will give us a starting point. I think the first task is to find out what Knoppix thinks it sees, so we'll look at the table of file systems it builds as it starts up and also at the drive's partition table. Okay?

-- Ed

hey ed,

just noticed you are from colorado...i lived out there for a year in 2002, where abouts are you? i was in a small
town called elizabeth.

yes, i concur, its strictly a windows problem, in how it sees the tables. i was even to the point of calling microsoft
and paying the 35 bucks or something to hear them say they cant do anything. i was thinking that i should be simple to solve,
just change the way it sees the drive. but how, is the question.

alright lets answer some of your questions, fill you in persay.

i have a knoppix boot CD, v3.7. just never used it before.

what the data recovery companies said was that they never had come across this problem before. they even spread it thru the
veteran(20 yr) recovery specialist. they said that they could do it manually(physically) take the data off and reconfigure it.
the way they do it for physically damaged drives. it may be a marketing ploy, but they sounded honest. cheapest cost is 1000 bucks
its mainly for business people. i was asking for some software or for some patch, and they new of none.

yeah...my main drive for my laptop and desktop are fine. the desktop is a 2.4celeron with 256m. it has a 120gb drive...not quite 180.
also a laptop with an 80gb AMD2200 512MB. both have XP installed. in the process of getting a network external. my girlfriend
wanted me to tell you, that the problem came from colorado, i lived out there with her. shes from there. it was her old pentiumII 400
computer that we were trying to pull data off of. a little haha from her. But it no longer has 98 on it...it had XP now.

when knoppix scans this is what it says in relevance to USB:
scanning for usb/firewire devices

usb found, managed by hotplug: (re-)scanning usb devices... sync:[oo1 oo2 oo3 oo4 oo1 oo2 ] done.

i didnt notice anything about another hard disc...and in the knoppix platform, i didnt find a secondary hard disc.

im not sure how to do the MD5SUM check, what do i do.

Im not familiar with linux/unix, and i dont have one installed.

thanks again

what does the comands below say (typed in a console)
fdisk -l
dmesg|grep sd
dmesg|grep ub
they might help us help you.

DANGER
DANGER
DANGER

NOT tested
NOT recomended
a POSSIBLE "quick fix" that i have thought of, never tried or heard of, might be using fdisk and resetting the partition type to ntfs, this might be what is required BUT it may also DAMAGE things for you. just a thought,
NOT tested
NOT recomended (by me atleast)

DANGER
DANGER
DANGER

hey oerjan,

what console do you mean? command prompt?
i couldn't get windows to understand those commands. how do i go about doing it?

i also heard about resetting the partition type thru fdisk and it is dangerous..i was thinking of trying to create a dummy drive with the same scenario. where do i get fdisk that has this function. i only have fdisk thru win 98, is there a newer version? if not...then it is not possible.

thanks for your input.
the more the merrier

steev

Quote:

---

Originally Posted by mobilesoul

.... i only have fdisk thru win 98, is there a newer version?

---

The Win98 fdisk does not know about NTFS partition types. Xp uses a different program name. I wondered about his comment when I first read it too, them realized he was talking about a Linux program. It's included with Knoppix.

alright harry,

so what is the program XP uses?

i also have a copy of knoppix but am not fluent with it. what is the program there?

steve

Quote:

---

Originally Posted by mobilesoul

so what is the program XP uses?

---

Sorry, I'm not an xp heavy and don't know the name of it. Have only used it from the GUI and from inside XP, and from inside XP may be the way that it needs to be done. So if the partition is messed up so bad that xp will not run that is not likely to help.

Quote:

---

Originally Posted by mobilesoul

i also have a copy of knoppix but am not fluent with it. what is the program there?

---

The name of the fdisk program in Knoppix is fdisk. I thought I made that clear with my last post.

Yeah, Elizabeth.... I haven't been east of Castle Rock in a long time, but I know where it is. I grew up (sorta :D ) in Denver, then Boulder for the university thing, then 20 years in Colorado Springs, and now back to the same house in Denver for my second childhood.

There was an obscure law passed in 1877 that mandated barometric sensors in all computers sold in Colorado - you take them away from the high plains, and they fail randomly. It was supposed to keep people from leaving after they found out how hard frontier life was. (If I remember right, there was an episode about it on Dr. Quinn, Medicine Woman.) :wink: I'd say your best bet is to move back here.

Or set up your own data-recovery business. Hosed NTFS drives aren't going away anytime soon.

I can't figure out what the recovery people do for a flat rate of $1000. In my opnion, someone who knows what you need and has the tools to do it would offer to look at the drive's partition table and the NTFS Master File Table for their minimum labor charge of a half hour. Counting the time it takes to write up the ticket, just doing that much - which would give both of you an idea of how much work is involved - would take 10 minutes.

The folks at harddriverecovery.org disagree, saying "Avoid shops who claim they must 'see the drive' first hand in order to give an estimate." They offer flat-rate pricing and free demos of recovery software you can buy, but you have to hunt around to find the downloads. There's curiously little information about their software and none about their pricing.

But there is a warning on almost every page that amounts to saying that if you do it yourself you risk messing things up beyond all help, while they themselves give customers back their data 98% of the time. Hmmmm. On one page I did see the advice that writing to the disk with one of the puny utilities available to mere mortals could well destroy what you're trying to save.

Well, duh :!: Always work on a copy until you've wrung every "bit" of information out of it that you can. And what's the deal with their .org domain - they sure look like a for-profit company. I think I'd file them under the "Avoid shops who...." category.

Well, anyway. I went to Google and searched on a few different sets of terms. Using ntfs recover will get you a boatload of hits, which I haven't looked at closely, but here's commentary on some sites I pulled up with other search terms.

(Please, please note that I haven't used any of these tools and can't say any more about them than this!)

• Free software - most of what you find requires Linux or Unix, and probably will do a few things but not everything that a full-featured, full-priced package would do. And most of them probably focus on recovering data other than from NTFS. Some are easier to find if you use the search term forensics:
  - https://sourceforge.net/projects/air-imager - front end for Unix/Linux tools like dd - possibly not for file-level work;
  - https://sourceforge.net/projects/foremost - looks for files' beginnings and ends - must be compiled before running on *nix - info very skimpy;
  - www.linux-forensics.com - Penguin Sleuth Kit - Knoppix live CD with forensic tools instead of some other applications;
  - www.sleuthkit.org - forensic tools to run under Linux - the site mentions NTFS metadata so they might at least be able to see what your drive's problem is;
  - www.sysinternals.com/ntw2k/utilities.shtml - NTFSInfo, NTRecover, Remote Recover - see note about sysinternals below.

• Consumer software in the ~$100 range:
  - www.data-recovery-software.net - R-Studio;
  - www.grc.com - SpinRite - see note about Gibson Research Corp.;
  - www.stellarinfo.com - Stellar Phoenix FAT & NTFS.

• Corporate software - $1000:
  - www.winternals.com - Administrator's Pak - see note about sysinternals below.

Sysinternals/Winternals - Their free utilities are on the sysinternals site, and the three I mention are read-only. In addition to that limitation, the free version of Remote Recover is even more limited to reading only 100 MB. The full version of Remote Recover is in the corporation-targeted Administrator's Pak on their winternals site. They have other freebies besides these utilities, and I've used a couple. I'd trust the software to do what they say it'll do.

I think the Steve Gibson behind Automated Image & Restore is the same as the one at grc.com. His site has good information about some security issues and some useful and nifty utilities. In the consumer-products division, I'd choose his unless a long session with a search engine turned up something else so overwhelmingly tempting that I'd wonder why it didn't cost lots more than the three I mention here.

Okay, so a few other observations. The messages you posted from Knoppix show that it finds your USB ports - as expected. To find out what drives it recognizes, open a terminal window and type $ cat /etc/fstab - lines that start with # are comments, lines that start with /dev/hd are hard drives, and I don't know what a USB drive would start with. Maybe /dev/ub.

You'll probably recognize floppy drives (/dev/fb*) and two or three names for each CD drive, like /dev/cdaudio and /dev/dvd and possibly /dev/scd* (due to the confusing treatment of CD drives on a regular hard-drive bus as SCSI drives).

If you think you recognize the usb drive in /etc/fstab, you can safely view the partition table with $ sudo fdisk -l /dev/uba (or whatever the drive is called). Actually, you can safely view any drive's partition table this way so long as you use the -l option !!!. (That's the lower-case version of L.) This tells fdisk to list the table and quit instead of going into table-editing mode.

That's all I can think of for now.

-- Ed

If you have a bootable Win2k or XP install disk,

Boot from the CD
Select Repair
Select Using the Recovery Console (RC)
When the Recovery Console Prompt appears,
Type Help, press enter
Look for Diskpart, Fixboot and FixMBR for brief explanations

Run diskpart at the command line to see what the RC thinks your partitioning is.
I think you'll need to run both FixBoot and FixMBR to (possibly) solve your problem.
Type Exit to reboot the PC

Hopefully, all will be well again.

Hope this helps,
Jim

i have been away for a bit, now i will hopefully have a chance to resolve this matter. thanks for the input guys, i will keep you updated on the outcome soon.

alright guys, thanks for all the input.

i tried the repair feature and it didn't see my external drive.

what i ended up doing was getting "get data back" software for NTFS, and read the files, got most of my data back uncorrupted.

CASE CLOSED.

thank god