Windows disk crash, files inaccessible

**cybergeo3** · 10-23-2007, 01:48 AM

Good evening,

So i'm having trouble recovering a windows drive. I turned my computer on last night and in the middle of booting into windows, the computer started turning off and on about once a second. I tested a few things, and this turning off and on would happen immediately after turning on the box, before even trying to boot into windows. I switched out the power supply, had a cmos checksum error, so i reset the bios to defaults, and finally was able to boot up a knoppix live cd. windows does not boot though, it loaded a white flashing screen with some random blocks of color flashing.

some quick stats on my computer which i think are relevant, if i'm forgetting let me know:
windows xp pro service pack 2
2x 100 gb hard drives in raid 0 formation

--when i checked the drives in qtparted, i see hde and hdg, hdg shows as empty, and hde returns an error message "critical error during ped_disk_new!"

--this is what i see in the terminal when i run fdisk -l
Disk /dev/hde: 100.0 GB, 100030242816 bytes
255 heads, 63 sectors/track, 12161 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hde1 * 1 24322 195366433+ 7 HPFS/NTFS

Disk /dev/hdg: 100.0 GB, 100030242816 bytes
16 heads, 63 sectors/track, 193821 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Disk /dev/hdg doesn't contain a valid partition table

Ideally, it might be nice to recover and boot back into windows, but i'm ok simply recovering the data on the corrupted drives and copying it to an external hard drive. If there is something else I can provide, I'd be more than happy to. I tried searching some other sites and posts, but nothing seemed to address the fact that I can't even see the disks i'm trying to recover. Thanks in advance!

**Harry Kuhman** · 10-23-2007, 04:10 AM

Windows can often destroy a disk so bad that it can't be recovered with Knoppix (I lost 3 this way and still have 2 of them that I eould like to get files off of). But if the partition table is all that was lost, see the man page for the gpart command, it can figure out what the partition table should be and recover it.

**cybergeo3** · 10-23-2007, 11:59 PM

Harry,

Thank you for replying. I tried gpart and received a few different errors, all resulting in my computer freezing and requiring a restart. the errors were, and i'm paraphrasing since they all froze my computer
"fatal read error..."
"warning read error (EIO) near sector (xxx), skipping..." (it skipped 2 large sections then skipped every single byte from what i can tell)
or it would say begin scan and then freeze
so I was unable to receive any firm resolution from gpart. Also, I don't know if the fact that these disks are raid0 makes a difference.

If there is something else i can try, i would love to, i'm starting to feel like i've lost it all. Thanks.

**cybergeo3** · 10-24-2007, 12:23 AM

i was able to get this much on a reeetry of gpart

knoppix@2[knoppix]$ sudo gpart /dev/hde

Begin scan...

* Warning: short read near sector(2482137), 53248 bytes instead of 66048. Skipping...

* Warning: read error (EIO) near sector(2482241), skipping...

itt has not changed from this in the last 10-15 minutes

**Harry Kuhman** · 10-24-2007, 12:29 AM

Originally Posted by cybergeo3

Also, I don't know if the fact that these disks are raid0 makes a difference.

It makes a complete difference. You raid system is very very likely (ok, certainly) software based and the raid disks were built using special Windows drivers. Your manufacturer only gave you Windows drivers, and those drivers are needed to make any sense out of the disks (Level 0 is striping, where the RAID system lays down one track or cylinder of data on one drive and then switched to the other drive before moving the heads to the next track). There is basically no way that Linux would read these drives unless it had compatible drivers that knew about the exact drive geometry in use.

There are some Linux RAID systems (I don't believe that they are included in Knoppix), but that is not to say that the Linux software drivers lay out their data exactly the same as proprietary Windows systems do, and unless there is a perfect match you would do more harm than good trying to recover data on a system different than the one where the disks were first built.

And, it should go without saying, Level 0 gives you absolutely no redundancy (unlike Raid 1, Raid 5 or Raid 10). In fact, it increases your chance of data loss, since anything that goes wrong with the hardware or data layout of either drive can cost you the data stored on both. Good backups are imperative when using Raid 0 (and other Raid systems as well, other RAID systems protect you against only a single hard drive failure, not multiple failures that can be caused by a fan failure (overheating) and it doesn't protect your data from malware, Windows itself or user errors.

**sakiZ** · 10-25-2007, 02:02 AM

Do you have a bootable Knoppix CD?

If so, boot up the CD and open a terminal window and run TestDisk.

I've had some amazing results with it resurrecting trashed hard drives.

Good Luck,

sakiZ

**cybergeo3** · 10-25-2007, 04:08 PM

Thank you for the tip, i haven't tried the test disk utility yet.

I was able to delete and rewrite the array via the bios fast build utility, but no os is found when i let it try to boot from disk, and the drives are still inaccessible and reporting errors when i run gpart.

I was going to try the mrecover2 utility last night, but i found that the replacement power supply i used does not power the floppy drive for whatever reason. It's not the floppy drive itself as I switched it out for an alternative and still no power.
So i have to find another power supply or find some way to power the floppy drive, then I can try mrecover2 or norton disk utilities.

**cybergeo3** · 10-26-2007, 02:32 AM

So I ran testdisk. It didn't fix anything, the drives are still not accessible nor bootable. I've included the details on the screens below because I thought someone might recognize what the issue is. I tried writing the mbr and that didn't work. If anyone has any ideas, i'd love to hear them. Thanks!!

-------------------------------------------------------------
Select a media (use Arrow keys, then press Enter):
Disk /dev/hde - 100 GB / 93 GiB
Disk /dev/hdg - 100 GB / 93 GiB

---------------------------------------------------------------
Disk /dev/hde - 100 GB / 93 GiB - CHS 193821 16 63
Current partition structure:
Partition Start End Size in sectors
Invalid NTFS boot
1 * HPFS - NTFS 0 1 1 387631 13 63 390732867
1 * HPFS - NTFS 0 1 1 387631 13 63 390732867

Warning: Bad ending head (CHS and LBA don't match)

-------------------------------------------------------------
Disk /dev/hde - 100 GB / 93 GiB - CHS 193821 16 63
Partition Start End Size in sectors

Structure: Ok.

-------------------------------------------------------------
Disk /dev/hde - 100 GB / 93 GiB - CHS 193821 16 63

Partition Start End Size in sectors

No partition found or selected for recovery

------------------------------------------------------------
Disk /dev/hde - 100 GB / 93 GiB - CHS 193821 16 63
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 387631 13 63 390732867
Boot sector
Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

this is the second drive in the array:

-------------------------------------------------------------
Disk /dev/hdg - 100 GB / 93 GiB - CHS 193821 16 63
Current partition structure:
Partition Start End Size in sectors

Partition sector doesn't have the endmark 0xAA55

**ckamin** · 10-26-2007, 03:33 AM

I'm not sure, but the fact that you deleted and rewrote your disk array might have already compounded your troubles. I would like to make a quick and simple suggestion. Instead of using Linux to fix your windows problems, why not attempt to do so within Windows? You can create a BartPE bootable disk, include the Raid drivers, and then have at it. It will "live" boot into Windows and allow you to use the exact drivers that were working within Windows previously. I would start there and NOT start changing ANYTHING until you have tried some simple measures to recover the data. I have seen people do more damage trying to "recover" their data than was originally done to make the data unreadable in the first place.

Sometimes the best way to get yourself out of a hole is to stop digging.

**sakiZ** · 10-27-2007, 03:04 AM

You could also try this:

Boot up the computer using the Windows install CD.

You'll get an option to repair (Press R)

That will get you to the Command Console.

Once you have opened the Console -- and assuming a Windows installation/drive is found ---

use this command CHKDSK /R

Don't give up!

sakiZ