I was reading in another post that 2k sp4 doesn't like partitions above 128gig. I had bought a new sata drive 160gig for data storage (not OS) and was copying over data to it from other drives, to clear them out.

The new drive got quite full and just stopped after a while, then gave me a directory error once trying to get into these dir's. Windows didn't recognise the drive after that (free space). Tried many different tools finally purchasing DP2. It found the volume name i wanted once analysis was completed so I continued to repair. I missed upon reboot windows was deleting lots of orphaned files. Now I am left in windows with correct drive name but with only the directories i was copying on to there from other drives to format them and not the original data stored there... Can i get these back, any ideas ??? Can 2k not deal with partitions bigger than 128g ? iRecover was tried before DP with no success.


.../000:29/LOG> ### LOG START ###
.../000:29/LOG> DISKPATCH 2.0.100
.../000:29/LOG> (C) 2000-2004, DIY DataRecovery
.../000:29/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:29/LOG> DPRunType: 2
.../000:29/LOG> DPUsrName: D.P.TEMPKEY
.../000:29/LOG> MemFree: 111Kb
.../000:29/LOG> LogDate: 01-26-2005
.../000:29/CFG> Dump Options requested
.../000:29/CFG> FilePath="1/.DP_FILES"
.../000:29/CFG> LogFilename="DP.LOG"
.../000:29/CFG> ReadRetries="32"
.../000:29/CFG> MaxReadErrors="32"
.../000:29/CFG> ReadDelay="1"
.../000:29/CFG> AutoSaveState="1"
.../000:29/CFG> DumpFoundSectors="0"
.../000:29/CFG> LogLevel="2"
.../000:29/CFG> DebugLevel="0"
.../000:29/CFG> MaxFatScan="51200"
.../000:29/CFG> MaxDataColEntries="512"
.../000:29/CFG> ScanType="0"
.../000:29/CFG> IgnoreF8FF="0"
.../000:29/CFG> ScanSignature="55AA"
.../000:29/13H> Ext13H installed test requested
.../000:29/13H> Disk found at 128
.../000:29/13H> Ext13H version: 2.1 / EDD-1.1
.../000:29/13H> Ext13H Support: Extended disk access functions
.../000:29/13H> Ext13H Support: Enhanced disk drive functions
.../000:29/13H> Disk 128 X13H data : 16383/16/63 488395055/512
.../000:29/13H> Disk found at 129
.../000:29/13H> Ext13H version: 2.1 / EDD-1.1
.../000:29/13H> Ext13H Support: Extended disk access functions
.../000:29/13H> Ext13H Support: Enhanced disk drive functions
.../000:29/13H> Disk 129 X13H data : 16383/16/63 312579695/512
.../000:29/13H> Ext13H tested ok
.../000:29/FDL> DiskList requested
.../000:29/FDL> Disk found at 128
.../000:29/FDL> Disk found at 129
.../000:29/LOG> Dump DiskList requested
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .488395055 | 255 | 63 | 232
129 | .312579695 | 255 | 63 | 149
..0 | .........0 | ..0 | .0 | ..0
..0 | .........0 | ..0 | .0 | ..0

.../000:29/IAS> Admi Sector found on disk 0 (128)
.../000:29/IAS> Admi Sector on disk 1 (129) not free for DP use, dump follows;
.../000:29/LOG> SectorDump requested at 29 (0 0 30)
###
000 20 92 0B F8 11 BF 55 7F 3C 1B 0F 2A 1B 87 DC 3F | ’.ø.¿U<..*.‡Ü?
016 99 22 30 71 CF 8A D6 63 92 67 20 07 C7 6C 9E E2 | ™"0qÏŠÖc’g .Çlžâ
032 A1 52 E2 29 34 8E 1B 85 25 AA BD 9D F9 1D 97 D6 | ¡Râ)4Ž.…%ª½ù.—Ö
048 08 7B DC 5C 68 78 18 1E C6 6C 9E D1 5E 6D 0F D0 | .{Ühx..ÆlžÑ^m.Ð
064 0C 70 21 B7 0D FA BB 2C AB 0A F4 B8 6E A7 86 C1 | .p!·.ú»,«.ô¸n§†Á
080 83 78 4C 00 0F 94 7B F0 71 BF 1C 58 00 00 EE A2 | ƒxL..”{ðq¿.X..î¢
096 A0 FE 70 30 00 00 00 00 92 67 21 07 C2 10 BA F6 |  þp0....’g!.Â.ºö
112 BC 97 D2 5C 1C 03 80 0E 34 00 C3 99 BA 94 75 34 | ¼—Ò..€.4.Ùº”u4
128 52 EC 0E A4 17 04 79 6A C2 00 95 AA 17 91 8C 22 | Rì.¤..yjÂ.•ª.‘Œ"
144 3E 9D 1C 04 97 3A C2 99 C8 BC 92 29 18 03 88 C1 | >..—:™ȼ’)..ˆÁ
160 82 82 98 C6 0C 28 8A 3C 6F 19 90 0B F4 5A F0 B4 | ‚‚˜Æ.(Š 176 1F A0 0C 8A 08 38 28 69 92 67 22 07 BC EF E3 3E | . .Š.8(i’g".¼ïã>
192 BE 42 55 11 E8 69 C1 A3 E0 96 D6 6E CF F1 FF F1 | ¾BU.èiÁ£à–ÖnÏñ.ñ
208 7E D6 79 59 33 49 75 44 B8 EC FD B1 02 8F 24 87 | ~ÖyY3IuD¸ìý±.$‡
224 00 FA 69 F1 98 1D CE EB 17 7F 60 A4 4B F5 4C 1E | .úiñ˜.Îë.`¤KõL.
240 74 8E 26 40 0D B8 B6 8F 15 80 00 00 00 00 EF 3B | tŽ&@.¸¶.€....ï;
256 1C 3F 3A 18 00 00 00 00 92 67 23 08 BE EB FD 14 | .?:.....’g#.¾ëý.
272 34 D6 43 94 00 47 E4 4B 54 B8 C0 6C F3 4B E0 40 | 4ÖC”.GäKT¸ÀlóKà@
288 21 49 24 80 71 10 DE 1B C4 AA E6 43 B5 A2 E7 02 | !I$€q.Þ.ĪæCµ¢ç.
304 F3 AE 3C 02 3C 16 C6 15 E9 E5 85 55 44 54 F7 17 | ó®<.<.Æ.éå…UDT÷.
320 5F 80 1F B0 0B A3 11 A2 38 BE 3B 21 76 81 F1 37 | _€.°.£.¢8¾;!vñ7
336 1F C7 82 DA 2E 2D 81 80 92 67 24 08 FB 9E 7A 1A | .Ç‚Ú.-€’g$.ûžz.
352 4B C5 38 DC 46 85 04 92 19 4B FB 93 30 82 85 34 | KÅ8ÜF….’.Kû“0‚…4
368 82 1E F0 01 20 61 75 60 FE 18 DE E7 81 51 05 EF | ‚.ð. au`þ.ÞçQ.ï
384 02 A7 EA 8D 04 53 FE 18 65 84 6C 00 B8 10 41 06 | .§ê.Sþ.e„l.¸.A.
400 B7 1A 28 34 1D A1 83 03 FE C5 E3 31 2C 2A CF 78 | ·.(4.¡ƒ.þÅã1,*Ïx
416 13 C1 64 52 3F 1E 58 00 92 67 25 08 C7 EC 9E F0 | .ÁdR?.X.’g%.Çìžð
432 09 19 BD CE 8F 29 1C E1 89 AE BD 1D D3 05 8B F0 | ..½Î).ቮ½.Ó.‹ð
448 D3 80 00 48 07 05 29 12 C7 6B 3D 87 13 10 49 26 | Ó€.H..).Çk=‡..I&
464 93 50 A0 50 FD 27 BE 95 5D 7B 69 25 D4 BA 82 30 | “P Pý'¾•]{i%Ôº‚0
480 E0 71 AC 9A 0E A8 07 E2 E3 78 CC 1A 6C 61 F0 25 | àq¬š.¨.âãxÌ.lað%
496 73 40 00 00 00 00 00 00 92 67 26 08 C0 87 55 53 | s@......’g&.À‡US
###
.../000:30/EXE> FingerPrint found
.../000:30/PFC> PQstuff signature detected on disk 0 (128)
.../000:30/PFC> PQstuff signature detected on disk 1 (129)
.../000:30/PFC> Partition State Backup not found on disk 0 (128)
.../000:30/PFC> Partition State Backup found on disk 1 (129), created on 20202020/202020
.../000:33/MNU> - Main, Select Disk
.../000:34/USD> Disk 1 (129) selected
.../000:34/USD> Read/WriteErrors reset to 0
.../000:34/USD> DataCollection / PartList cleared
.../000:34/GSC> AdmiSector not in use
.../000:34/GSC> AdmiSector not in use
129/000:37/MNU> - Main, MBR ops
129/000:39/CPA> Start Change Partition Attributes, dump follows;
129/000:39/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..0F | ....1...0...1 | .1023.254..63 | .....16065 | .312560640
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0

129/000:48/CPA> Change Partition Attributes finished, dump follows;
129/000:48/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..0F | ....1...0...1 | .1023.254..63 | .....16065 | .312560640
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0

129/000:55/MNU> MBR BootCode Refresh finished for disk 1 (129)
129/002:31/MNU> - Main, Tools
129/003:10/MNU> - Main, Analyze Disk / StateFile
129/003:12/EXE> Analysis aborted
129/003:13/MNU> - Main, Tools
129/003:31/MNU> - Tools, DiskEditor
129/003:31/DED> Start DiskEditor
129/003:42/DED> Exit DiskEditor
129/004:27/MNU> - Tools, Verify EPBR Chain
129/004:27/VEC> Start Verify EPBR Chain for disk 1 (129)
129/004:27/VEC> MBR: 55AA found, Valid Type F/5 found
129/004:27/VEC> Extended starts at 16065 (1 0 1)
129/004:27/VEC> EPBR at 16065 (1 0 1): 55AA found, Valid Type 5 not found
129/004:27/VEC> Partition Table info for sector 0 (0 0 1)
129/004:28/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..0F | ....1...0...1 | .1023.254..63 | .....16065 | .312560640
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0

129/004:28/VEC> Partition Table info for sector 16065 (1 0 1)
129/004:28/LOG> PartListDump requested at 16065 (1 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..07 | ....1...1...1 | .1023.254..63 | ........63 | .312560577
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0

129/004:28/LOG> BootSectorDump requested at 16128 (1 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 312560576
........MFT Location (dec): 786432
.MFT Mirror Location (dec): 19535036
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): 0420F14520F13DEC
............Checksum (hex): 00000000
....Sector Signature (hex): AA55

129/004:51/VEC> Verify EPBR Chain finished
129/004:54/MNU> - Main, Disk Ops
129/005:07/MNU> - Main, Options
129/005:16/MNU> Options, Custom Geometry
129/005:23/CFG> Dump Options requested
129/005:23/CFG> FilePath="1/.DP_FILES"
129/005:24/CFG> LogFilename="DP.LOG"
129/005:24/CFG> ReadRetries="32"
129/005:24/CFG> MaxReadErrors="32"
129/005:24/CFG> ReadDelay="1"
129/005:24/CFG> AutoSaveState="1"
129/005:24/CFG> DumpFoundSectors="0"
129/005:24/CFG> LogLevel="2"
129/005:24/CFG> DebugLevel="0"
129/005:24/CFG> MaxFatScan="51200"
129/005:24/CFG> MaxDataColEntries="512"
129/005:24/CFG> ScanType="0"
129/005:24/CFG> IgnoreF8FF="0"
129/005:24/CFG> ScanSignature="55AA"
129/005:28/MNU> - Main, Quit
129/005:28/LOG> RunTime: 005:28
129/005:29/LOG> ### CLOSE LOG ###

Operating system / Service Pack: Diskpatch 2

Size of subject harddisk: UK

Hello,

For all 'does my OS support disks larger than 128Gb or 137Gb (depends on how you calculate this)?' type issues please refer to http://www.48bitlba.com/ and the Microsoft Knowledge Base. Anyway I believe SP4 for Wk2000 does support 48 bit LBA addressing but apart from the ServicePack you need to edit the registry (MS KB article q305098).

The consequense for lack of 48 bit LBA support is that sooner or later you will write data to a point > 128 Gb, say 140 Gb. And once that happens data gets written to 140 Gb - 128 Gb, and by doing so probably data is overwritten. Overwritten data can not be recovered.

Writing to 128 Gb + 1 sector will effectively overwrite sector 0 (the MBR). This probably happened as well and explains why the disk appeared to be empty. This was what DiskPatch fixed, DiskPatch can however not fix NTFS file system structures.

Before trying iRecover on this system, it is important that you FIRST take care of the 48 bit LBA addressing issue. But even then, data that was overwitten can not be recovered. The same goes if MFT entries or INDX blocks pointing to the lost files were overwritten with structures pointing to new files. Possible a tool that scans for file signatures rather than system structures can recover files (for example Davory from www.winhex.com).

--
Kind regards,
Joep

Size of subject harddisk: Haarlem - Netherlands - Europe