xp recovery

[tom lawler]

are any of these programs bootable to recover files from a xp disk that will not boot and apparently has a bad mft table?

[Alexey V. Gubin]

No. You need to get the disk out of the computer and attach the disk as a slave to another, working system.

[topher1]

what if the drive is still bootable but the FS type has been changed to RAW?

[Alexey V. Gubin]

If the system volume is OK but some other volume (containing data) is RAW and unreadable, then ZAR should work.

If the system volume has turned RAW, and is readable and botable at the same time, then the most consistent way is to back it up, format, and restore from a backup.

[topher1]

Thanks for the reply Alexey....

Both the system volume (C:) and my secondary drive have (F:) have turned RAW. My concern is that the things which turned them RAW are still on the C: drive someplace and all this might be a great big circle.

What is the right tool to use to back up C:? ZAR indicates that something like 7K files are bad.

I have a 500GB USB drive I can back it up to and restore it from.

My first thought was to bring in a new C: and reinstall XP from scratch (I have a valid license). Install the old C: as a secondary device. Then use ZAR to recover selected files as needed, thus avoiding the circle.

Regards,
Chris

[Alexey V. Gubin]

The idea to bring the new hard drive, install fresh Windows and then recover is good.

I presume the drive F: is already unreadable at this point, is that correct?
If C: is still readable, this would only last as long as you boot from it. Once you add it as a slave to the new XP installation, it will become unreadable as well.

The whole thing then looks like a corrupt LDM (dynamic disk) database. This sort of corruption is typically caused by some transient event and rarely returns once fixed.

Looks lilke the following course of action would be good:


Copy whatever files you need from C: to the USB drive. You may want to use NTBACKUP (on the Start menu, select Run, then type in "NTBACKUP" without quotes and press Enter), but I suggest you avoid backing up "the system state" - i.e. limit it to files only.
Shutdown, get the original hard drive and the USB drive out of the machine, install a new hard drive and install XP on it.
Get Windows Memory Diagnostic tool (http://oca.microsoft.com/en/windiag.asp) and run it to make sure there is no RAM issue. RAM issues are responsible for a significant part of the transient failures, so we want to rule that out.
Get an antivirus software installed on the new XP installation. Now plug in the USB drive and scan it for viruses. We want to ensure that in case the original problem is caused by a virus, we get rid of it. Do not open any documents or run any files from the USB drive before the scan.
Attach the original hard drive and use ZAR to recover files from the drive F: as needed.
Make sure you manually verified that all the files you are really interested in were recovered correctly before you reuse the original hard drive.

[topher1]

Thanks Alexey....

Both C and F are readable... right up to the point where I touch a fragmented file and then I get a BSOD. I understand all the steps you describe but I have a couple of questions that I also posed in email. I'm going to repeat them here in hopes that this creates a discussion thread that you can refer others to. (Let me know if you would rather this thread be ended or relocated.)

I'm using the trial version (4 directories) of ZAR right now and I will buy it if I can figure out the right way to use it. Perhaps this is in the Help menus that I haven't seen?

(1) When I ran ZAR on the C drive it comes back with a directory tree with everything under Temp and each folder is listed with 3 numbers after it. What do those 3 numbers indicate?

(2) Is there any way to tell where those directories were on the original C drive without digging thru it manually? (A side note: Using Windows search on that RAW drive gives a permanent solid black screen.)

(3) ZAR seems to indicate that the FS was FAT32. Somebody else told me XP should be NTFS. Is ZAR telling me the right thing or am I misinterpreting what I am seeing in the ZAR window?

Thanks again for the time you are taking in answering these questions.
Chris

[Alexey V. Gubin]

Since I did not receive the email, we'd rather continue here.

As far as manuals are concerned, good starting points are
http://www.z-a-recovery.com/demos.htm
and
http://www.z-a-recovery.com/man-main.htm
or clicking Help button in the lower part of ZAR window should open the website at the appropriate section, depending on what you are currently doing.

If ZAR says the filesystem is FAT32 this is most likely in error. This can happen if you have this volume originally formatted to FAT and then converted to NTFS (around the time you installed the original XP), or if there are many virtual machine disk images formatted to FAT.

You need to do this,
1. Start ZAR, click "Advanced Configuration" on the first screen
2. In there under "Overrides" set "Force filesystem type" to NTFS.
and rescan to see if this brings better directory structure.

Considering BSODs, I suggest you check your hardware. Memory and power supply come to mind first, given the sympthoms you describe. For the memory, Windows Memory Diag should do the job. If possible, get a power supply unit temporarily from some other machine. Alternatively, disconnect the non-essential items, such as extra hard drives, DVD drives, if possible.