Hi,

I enquired about a product from Steve Gibson and I received a mail from them saying to check your site/products.

I run win2k SP4, edited the registry to cope with large drives, prepped the drive with Western Digital's tools and used their DDO software to overcome my Bios' limitations.

All looked fine (windows Explorer and Disk Management saw the proper drive size), so I started to cut&paste all my data onto the 160gb hdd.

Once I had copied over 128/137gb, i got this error message: file or directory is corrupted and unreadable

What I could see in Windows:
ALL files and folders, with odd characters/symbols,
inaccurate file sizes displayed in windows explorer as in
- found a very big file like a 3gb file that i know for sure i dont have
- or files/folders's properties showing a size of 0kb.
Also, looking at windows explorer's display of the disk usage, it showed i had used just over 138gb of diskspace in use.

I didnt run checkdisk to make sure it wouldnt make things worse and kept the file system intact.
I suspect the files should NOT be fragmented since I just copied them.
My motherboard manufacturer dont have a bios update that will support 48bit-lba.


1. Would I have more chance to recover the data or reconstruct the FAT or whatever is wrong using a hex editor or something else?
2. what do I have to do in win2k to disable checkdisk to avoid further problems?
3. What went wrong since I had DDO software and LBA enable in registry? (since those steps should overcome old BIOS limitations)
4. Which programs do I need to attempt to recover the data?
5. Which programs do I need to maybe/somehow undo the damage and restore my hdd/data in its previous state?
6. Do I need to use a 48bit lba compatible system to attempt recovery?
7. If yes, wont the change of translation mode for the drive risk further data corruption?
8. What bios mode for the wd160 do I need to use to increase chance of recovery?
normal, large, auto, lba?
9. Do I need to uninstall the Dynamic Drive Overlay software on the drive? If so, why?
10. What Windows operating system is more prone to create less problems with my hardware specifications for recovery purposes?
11. Is it better to attempt recovery from DOS or Windows system?
12. Do you know what most likely happened to the data on the WD160:
a. it's still there but the file allocation table is incorrect?
b. the data is physically there but not accessible to OS? if so, how to go around that?
c. the sectors are now reported as bad? if so, what to do?
d. the data is in lost clusters? if so, what to do?
e. the data has been silently corrupted? If so, what does this implies? and what to do?
f. any other suggestion on the data situation?
13. Has the bios performed wrapping and created an offset in the FAT system/directory tree thus overwritting some data by making some cross-linked files? if so, any clues on fixing it?
14. Is there a simpler or better way of fixing this problem than recovering the data?
15. Can the system be amended so that the drive and its data are accessible again?
16. To attempt data recovery, should I use the drive as a slave, a master or it doesn't matter?
17. Is there a freeware prog to tell if a system is 48bit lba compatible?

Thanx immensely for any help you can provide.

Operating system / Service Pack: Windows 200 SP4

Size of subject harddisk: WD 160gb

Hello,

"so I started to cut&paste all my data onto the 160gb hdd."

Arghhh ... if you would have done copy&paste you'd at least had the original data now.

Anyway, recovering the data may in the end turn be easier from the *original* drive. So you should stop using that!

Fixing the destination disk is not possible. If the damage was indeed caused by the 48 bit LBA issue then data that was meant to be written at (137 Gb + n) was actually written to (0Gb + n). Effectively *overwriting* the data at the start of the disk. Data that is written over can not be recovered.

To recover *try* to the data I'd do the following steps in the following order:

- Stop writing to the source disk (the one you cut from) and the destination.

- Try to recover the data from the source disk first. Cutting files is the same thing as deleting them. So, you can try if undelete software can be used to recover the files.

If the undelete software does not show the files, software that actually scans the disk (like iRecover) for lost files and folders can be tried as a next step.

- Attempt to recover data from the destination disk (the damaged one). Try first without installing 48 bit LBA support. Use software that actually scans the disk to find lost data. Our tool iRecover is such a tool, but if one particular tool does not succeed, try tools from other manufacturers as well.

- If all else failed, install 48 bit LBA support and then try to recover data from the damaged disk again using software that scans for lost files.

Note: Many of the data recovery tools allow you to save the scan data so you don't have to scan a disk over and over. The files you have saved when scanning the disk in the previous step should NOT be used. Instead you need to actually scan the disk again.

For info on the 48 bit LBA issue see http://www.48bitlba.com. I can not answer questions like, 'why or how did this happen since I did install 48 bit support, or DDO" etc..

--
Kind regards,
Joep

Thank you very much for your valuable input, I appreciate.
I know the data on the original drive should be quite fragmented, but I'll try both the options you suggested anyway.
I will let you know if I stumble accross anything that might be of help to someone else.
Thanks again

Operating system / Service Pack: Windows 2000 SP4

Size of subject harddisk: WD 160gb

Just thought of something.
"If the damage was indeed caused by the 48 bit LBA issue then data that was meant to be written at (137 Gb + n) was actually written to (0Gb + n). Effectively overwriting* the data at the start of the disk."
This means I lost my MBR and FAT ect, its gonna be tricky to access the disk to recover the files without
formatting, any thoughts?
Take care
Heidi

Operating system / Service Pack: Windows 2000 SP4

Size of subject harddisk: WD 160gb

Hello,

"This means I lost my MBR and FAT ect, its gonna be tricky to access the disk to recover the files"

Yes, experience shows that sometimes that can be very tricky.

"without formatting"

I am not sure I understand you. Formatting is the way to ensure you erase all file system structures that may still be there and may aid in the recovery of your data. So formatting before the data is recovered is not something I would recommend.

--
Kind regards,
Joep