Recovery on formatted NTFS after XP installed

[mcheck]

Ran v9b14 on a 250G drive that was formatted then XPHome reinstalled. The first scan with all defaults ran for approximately 20 hours with no results.

There were no bad sectors, CPU was at 100% and the log file started repeating:

Volume processing - Abort signal received [3]
Volume processing - Parser aborted
Volume processing - Abort signal received [3]
Volume processing - Parser aborted
Volume processing - Abort signal received [3]
Volume processing - Parser aborted

FIlesystem type said FAT though this is an NTFS drive?

Current operation and progress bar was all the way through and last identifier said: Looking for FATs

Are there some settings I should be checking for my situation? I changed the read and write cache to 128/64 and am running it again.

Thanks for the help.

Mike

[Alexey V. Gubin]

Start/Restart ZAR
Click "Avdanced Configuration"
Under "Overrides" set filesystem type to NTFS.
This forces ZAR to look for NTFS filesystem even though automation decides there must have been FAT.

[mcheck]

Thank you. Selecting NTFS override worked to find a lot of files that seemed recoverable. I purchased a license and recovered everything that I could.

Of the music, pictures and word documents found, it seems the Music came back mostly ok. However, the word docs and pictures are completely garbled and not, as far as I can tell, useable. Is there some setting or path I should consider in trying to recover these files?

The word files, for instance, all come back with "could not start the converter mswrd632.exe" and then tries to convert the file apparently because it is complete garbage on the inside. Or is it? It has the complete filename, is there something I can change in the recovery process to better look for this file data?

Thanks,

Mike

[Alexey V. Gubin]

Find the file, C:\Program files\ZAR\logfile.txt
and email me to development@z-a-recovery.com so I can take a look.

However, I do not expect we can achieve any significant improvement.
There are three common failure modes for recovery (on NTFS):

1. All files come up damaged, and the directory tree garbled.
This typically means: not an NTFS filesystem, damage during filesystem move/resize operation, or something really exotic. Typically beyond repair.

2. The directory tree is OK, and the smallish files, below, say, 800 bytes, are all OK, but all the files larger than that are bad.
This meas ZAR failed to determine what we call "parameter set" for the volume. Files larger than 800 bytes cannot be located if the parameter set is wrong, and there is one parameter set per volume, same for all the files on this volume. This is often correctable, make some adjustments or feed parameters manually and ahead you go.

3. Directory tree OK, small files OK, part of the large files OK. This is your case.
Typically this means the actual data is damaged. I know that the parameter set must be detected OK because without it, it would be "no large files recovered". In your case, the data was probably overwritten by XP reinstall. The pointers to data still remain, and we decoded them fine, but the data is just not there.

I will still double-check the log, to see if I can find some issue with the recovery, but usually nothing good comes up.

[Alexey V. Gubin]

I've just reviewed the log file you sent and there is nothing we can do to improve the result. Drop me a private message if you want a refund.

[mcheck]

Originally Posted by Alexey V. Gubin

I've just reviewed the log file you sent and there is nothing we can do to improve the result. Drop me a private message if you want a refund.

Thank you very much for the offer. But ZAR is a great piece of software and we did recover a decent amount of data. So I will be keeping my copy.

I did have another mishap in this whole process. The external drive onto which I was recovering, died. Yes. Seriously. An external USD 500GB drive.

Then the SATA dock that held the original drive from which we were restoring, fell off the desk, and now does not spin up. It is a seagate ST3250310AS and sounds like it is spinning up, but then makes a series of about 5-8 beeps then the spindle stops. Ugh!

So all of this wouldn't be bad cause I figured that I could restore the restore off the USB 500 drive that I already had. But now ZAR just goes deaf and stalls after 10 hours of scavanging the USB drive. It gets to 53% and and the process seems to lock up.

Do you have any advice for me? This has really turned ugly but I am still hopeful that I can retrieve SOME of the data.

[Alexey V. Gubin]

You should not use USB enclosures to recover hard drives which are known or suspected to have mechanical issues and/or bad sectors. Certainly somebody dropping the disk qualifies as "suspected mechanical issue".

I suggest you eliminate USB boxes. Connect the drive directly to mainboard, if it is possible. You need to check the model of the your USB drive to see it can be disassembled before starting.

Also I got little lost among your drives. That ST3250310AS is considered beyond repair, correct? Then, the USB 500 drive which you said "died", are you recovering from it now? what its model is?