Page 1 of 1

Win 8.1 Recovery from Partial Format

Posted: 17 Apr 2015, 06:11
by pjohnston
Hi
I was using running chkdsk ?: /f /x /b /r on via on each partition on a drive with 3 partitions via Command Prompt under (Power suite) where ? was either C: D:

C Drive was the main operating system & data drive
D drive was the partition for the swap file only

I forgot the reserved partition that does not normally have a drive letter would transpose as C, the C Drive would be D and D Drive would be E when the drive is accessed at command prompt after booting from a CD.

After running Chkdsk on C (which was the reserved drive) I then ran it on D & it started to show errors, so I aborted Chkdsk d: /f /x /b /r & started a Format D: I put in the volume label and it started formatting thinking that this was only the swap partition (huge error on my part)

As soon as the format started I realized my mistake and aborted the format with CTRL C
I now have a partially formatted partition (c: Drive) that I need to recover
The reserved system partition in good order and the swap file partition (d:) in good order

What I have done so far with test disk started and running as administrator is as follows:-

Stage 1: = Create select drive proceed, Intel, analyse, quick search, highlight second partition (c: drive) enter, write, Write Partition table y/n = Y as response, enter reboot drive required, so rebooted.

Stage 2 : = Create, select drive, proceed, Intel, advanced, select partition (c: drive) boot, list, I can see directories and file structure plus successfully copy files and directories to another drive files, no corruption.

Stage3: : = Create select drive proceed, Intel, advanced, highlight 2nd partition (c: drive:) boot, Repair MFT,
Fix Mirror using MFT? <Y/N> = Y and got failed to fix MFT mirror Write Error enter

Is there a way to repair this or do I have to resign myself to just extracting important files to a backup drive

Stage4 : = Create select drive proceed, Intel, advanced, highlight 2nd partition (c: drive:) boot, Repair MFT, Fix Mirror using MFT? <Y/N> = N. I got Boot Sector OK Backup Boot Sector OK Sectors are Identical followed by A valid NTFS boot sector must be present in order to access any data; even if the partition is not bootable.

The drive is not now but used to bootable before the format error I assume the Master File Table is corrupt.
The drive is not accessible under windows, gets a not accessible access denied error,

Any help would be appreciated

Pjohnston

Re: Win 8.1 Recovery from Partial Format

Posted: 17 Apr 2015, 12:30
by cgrenier
The access denied error looks like a NTFS permission problem. Try to take ownership of the disk.

You may have to reinstall the OS and restore the files you have copied with TestDisk.

Re: Win 8.1 Recovery from Partial Format

Posted: 17 Apr 2015, 16:16
by pjohnston
Hi

Re-install OS is not an option (just cause I am lazy) I have a backup drive (made with a drive duplicating machine ~ my own creation) this backup is only 3 weeks old so I am going to recover the data files in the documents folder the downloads folder and the Thunderbird mail from the APPDATA folder & merge those with the backup drive.

(I took a second copy of the backup drive before I started in case the merging experiment goes belly upwards)

Then once I have tested the merged drive that will become the master and then I will make a new copy as the backup. Does my logic sound OK?

Regards
Pjohnston

Re: Win 8.1 Recovery from Partial Format

Posted: 19 Apr 2015, 10:00
by Fiona
Did you use quick format?
Since vista, if you used full format, windows wipes your disk through writing zeroes to each sector.
Overridden data are not recoverable.
In case you'll need datarecovery software like photorec to have a try to recover not overidden files.
What kind of format did you use?

Fiona

Re: Win 8.1 Recovery from Partial Format

Posted: 20 Apr 2015, 02:01
by pjohnston
Hi Fiona

Thanks for you reply

"Did you use quick format?" No I did a Format D: at the command prompt (see paragraph 4 original message)
"Overridden data are not recoverable" Maybe I am lucky then (see paragraph 8 original message quoted below)

"I can see directories, and file structure plus successfully copy files, and directories to another drive files, no corruption".


I suggested my recovery logic in my 2nd message " I am going to recover the data files in the documents folder the downloads folder & Thunderbird mail from the APPDATA folder & merge those with the backup drive.

Then once I have tested the merged drive that will become the master and then I will make a new copy as the backup. Does my logic sound OK?

Well that has now been tested & the new master is in the drive duplicating machine making a new backup
as I am writing this so TestDisk has saved me, however my original question still remains unanswered

Quoting from paragraph 9 onwards from my original message

Stage3: : = Create select drive proceed, Intel, advanced, highlight 2nd partition (c: drive:) boot, Repair MFT,
Fix Mirror using MFT? <Y/N> = Y and got failed to fix MFT mirror Write Error enter


Is there a way to repair this or do I have to resign myself to just extracting important files to a backup drive

Stage4 : = Create select drive proceed, Intel, advanced, highlight 2nd partition (c: drive:) boot, Repair MFT, Fix Mirror using MFT? <Y/N> = N. I got Boot Sector OK Backup Boot Sector OK Sectors are Identical followed by A valid NTFS boot sector must be present in order to access any data; even if the partition is not bootable.

The drive is not now but used to bootable before the format error I assume the Master File Table is corrupt.
The drive is not accessible under windows, gets a not accessible access denied error,

It is not an ownership or permissions issue as suggested by Christophe I have tested and eliminated that


Any suggestion on how to resurrect the MFT Master File Table and make the original drive bootable again?
I dont need it any more now I have dreated another master I just want to try things to see what works & doesn't


Kind Regards
Pjohnston

Re: Win 8.1 Recovery from Partial Format

Posted: 20 Apr 2015, 09:48
by Fiona
If your file system or MFT is corrupt, you should copy/backup your files first.
Afterwards you can try to run chkdsk driveletter: /r to have a try to repair your file system.
Repair MFT using testdisk is only intended, if chkdsk doesn't work.
Info:
Repair An NTFS MFT
http://www.cgsecurity.org/wiki/Advanced ... n_NTFS_MFT
Note, it's only intended to have a try to repair your file system.
That's why I suggest to backup/copy files first!
My style is rather to recover data than to modify anything within a corrupted file system.
If a repair doesn't work, you can recreate a new partition, format it and copy data back.
If a repair of the partition works and the partition will still not boot, you can use testdisk to check, is your partition active and bootable.

Fiona

Re: Win 8.1 Recovery from Partial Format

Posted: 20 Apr 2015, 19:45
by pjohnston
Hi Fiona

"Afterwards you can try to run chkdsk drive letter: /r to have a try to repair your file system."
That was one of the first things I did see paragraph 1 of my original message
I was using running chkdsk ?: /f /x /b /r on via on each partition on a drive with 3 partitions via Command Prompt under (Power suite) where ? was either C: D:

If your file system or MFT is corrupt, you should copy/.backup your files first
I extracted files using testdisk & merged them with backup see paragraph 4 and 5 of my reply to you which says
"Then once I have tested the merged drive that will become the master and then I will make a new copy as the backup."
"Well that has now been tested & the new master is in the drive duplicating machine making a new backup"


Repair MFT using testdisk is only intended, if chkdsk doesn't work
Well Chkdsk did not work and Repair MFT also failed as outlined in my message to Christophe
see paragraph 9 of my original message to Christophe which says
Stage3: : = Create select drive proceed, Intel, advanced, highlight 2nd partition (c: drive:) boot, Repair MFT,
Fix Mirror using MFT? <Y/N> = Y and got failed to fix MFT mirror Write Error enter

So the repair to the MFT failed also the bootsector was fine. There were no errors in the boot sector, also the partition along with all files on it were accessible so I am not changing the partition

If a repair of partition works & partition will still not boot, you can use testdisk to check, is your partition active & bootable. Well the Partition was OK & it was marked as Active but it still wont boot due to MFT problem

Kind Regards
Pjohnston