Recivering Windows XP with TestDisk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Marxon13
Posts: 5
Joined: 05 May 2012, 13:45

Recivering Windows XP with TestDisk

#1 Post by Marxon13 »

I've been trying to use TestDisk to repair my windows xp system after a power surge. I followed the "Step by Step" on the TestDisk page, I wrote the partition table to disk, and it said the boot sector was ok. I've also tried to repair the MFT, and TestDisk says "Both MFT seem ok but they don't match. use chkdsk" I then tried chkdisk and it failed to recover around 75% through.I tried booting, but I'm still getting the same error as before, shortly after the windows logo shows and the blue bar starts moving.In safe mode it fails to load after "Mup.sys". The blue-screen I keep getting is 0x000000ed, UNMOUNTABLE_BOOT_VOLUME. I believe something is keeping the partition table from being repaired, since I still cannot mount the HDD, but Testdisk can see all the files. The HDD is 250 GB NTFS.

Any help is greatly appreciated.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recivering Windows XP with TestDisk

#2 Post by Fiona »

Chkdsk is a utility to have a try to repair a file system but not to recover data.
In your case it's recommendable to copy data first.
If you list your data in TestDisk you'll see all the commands at the bottom of the screen.
If you check that 2 dots press enter you'll get one directory up.
To enter any folder you can check it and use your right arrow key.
Stabndard path where TestDisk copies files to ist the testdisk folder.

Afterwards you can have another try to repair your file system using chkdsk from your recovery console.
Have a try to repair it like;
chkdsk driveletter: /p /r
Parameter /p is only available in your recovery console.
In your recovery console, drive letter could be changed.
Use dir (directories) to check, that you have the right drive/partition!
If chkdsk hangs agin

Fiona

Marxon13
Posts: 5
Joined: 05 May 2012, 13:45

Re: Recivering Windows XP with TestDisk

#3 Post by Marxon13 »

I got an external HDD and am copying the "Documents and Settings" now with TestDisk.
I'll try chkdsk again, but I don't think it is going to work. Especially since Dir doesn't work. It just returns an error when I try to list what is on the root of the C:\ drive where windows should be installed. How do I check what drives are accessible in the recovery console, just in case the drive letter randomly decided to change? I know cd d/ X: will change to a new drive, but is there a way to list them. Like going to /Volumes in Mac OS X.

Marxon13
Posts: 5
Joined: 05 May 2012, 13:45

Re: Recivering Windows XP with TestDisk

#4 Post by Marxon13 »

I've basked up everything and ran chkdsk. It fails at 75% "The volume appears to contain one or more unrecoverable problems." I also ran a test with bootcfg /scan and got "failed to scan disks for windows instillations. this problem may caused by corrupt filesystems. Use chkdsk to repair these issues"

So, the main partition is messed up? I can view it just fine in TestDisk. I also told it to save the partition to disk. So why is it not fixed?

I noticed on the root of the HDD, there are 40 files with the same exact name. Would this cause a problem since there are overlapping files?

Could I also determine where chkdsk was failing based on that 75%?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recivering Windows XP with TestDisk

#5 Post by Fiona »

I assume that your data are backed up?
Would it be possible to go in Testdisk to Advanced / Boot and Repair NTFS?
Please let me know.
Some Infos about;
http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair

Fiona

Marxon13
Posts: 5
Joined: 05 May 2012, 13:45

Re: Recivering Windows XP with TestDisk

#6 Post by Marxon13 »

Running repair MFT returns the following:
"Both MFT seems ok but they don't match, use chkdsk."

could I force it to copy over the backup MFT? is that a bad idea?

I also randomly found out that the HDD keeps its own error log. The error it shows are four "Uncorrectable error in data" and a "address mark not found. And it lists five LBAs all in the same region, just a few digits off from each other.

My drive uses S.M.A.R.T, if the power surge fried a Block, or as for as I can see, three, shouldn't it mark those pieces as bad sectors and move on? I'm ran a test with GSmartControl,
It finished very fast, The 78 minute test says the drive passed, but the test failed after 10% ~5 min. The error was "read failure" and listed the same LBAs that I had before the test.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recivering Windows XP with TestDisk

#7 Post by Fiona »

Running repair MFT returns the following:
"Both MFT seems ok but they don't match, use chkdsk."
Please don't change anything to your file system.

Can you check your S.M.A.R.T values using CrystalDiskInfo also.
http://crystalmark.info/software/Crysta ... dex-e.html

Please let me know.

Fiona

Marxon13
Posts: 5
Joined: 05 May 2012, 13:45

Re: Recivering Windows XP with TestDisk

#8 Post by Marxon13 »

I here are the S.M.A.R.T values:

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
See vendor-specific Attribute list for marginal Attributes.

General SMART Values:
Offline data collection status: (0x84) Offline data collection activity
was suspended by an interrupting command from host.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 121) The previous self-test completed having
the read element of the test failed.
Total time to complete Offline
data collection: ( 6480) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 78) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x303f) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000f 199 199 051 Pre-fail Always - 49787
3 Spin_Up_Time 0x0003 160 147 021 Pre-fail Always - 5000
4 Start_Stop_Count 0x0032 099 099 000 Old_age Always - 1775
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail Always - 0
7 Seek_Error_Rate 0x000e 200 200 051 Old_age Always - 0
9 Power_On_Hours 0x0032 066 066 000 Old_age Always - 24991
10 Spin_Retry_Count 0x0012 100 100 051 Old_age Always - 0
11 Calibration_Retry_Count 0x0012 100 100 051 Old_age Always - 0
12 Power_Cycle_Count 0x0032 099 099 000 Old_age Always - 1621
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age Always - 230
193 Load_Cycle_Count 0x0032 200 200 000 Old_age Always - 1796
194 Temperature_Celsius 0x0022 107 103 000 Old_age Always - 40
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age Always - 0
197 Current_Pending_Sector 0x0012 200 200 000 Old_age Always - 40
198 Offline_Uncorrectable 0x0010 200 200 000 Old_age Offline - 10
199 UDMA_CRC_Error_Count 0x003e 200 200 000 Old_age Always - 0
200 Multi_Zone_Error_Rate 0x0008 001 001 051 Old_age Offline FAILING_NOW 35515

After looking at these, I'm going to replace the hard drive after I get everything working again. That way I can clone the current HDD onto the new one, and avoid a complete re-installation of Windows.

Locked