Originally posted by: leeland
OK here are some answers to your questions
More info needed:
How many drives are in your system?
The system has two PATA drives one 40 gig (c drive) and one 80 gig drive (d). I have a NAS unit that is a mapped drive so I am not sure if it is recognizing that as the third drive???
Describe them (ATA, SATA, all internal etc).
PATA for both of them...they are fairly old...5+ years at least.
Do all three show up in BIOS ok?
They both show up in the BIOS appropriately.
Was this third disk a dynamic disk (other two show basic)?
Like I said the third disk may or may not be the mapped drive I have to my NAS...other than that I don't know what it could be I don't have three drives in that system.
The problem did just start...the drive has worked like a champ for 5+ years...never had problems...and it has seen some use so I wouldn't be suprised that it is dying if that is the case.
I did a virus scan of the entire system and found nothing so that isn't the case...
I will attempt to take the drive out and put it into a different computer as a primary slave and see what that does if anything.
Otherwise what should be my next step? You listed several options...
Thanks for the time to answer the questions...how do you know about all this stuff?
Hm. Ok I was concentrating on that third drive in the ftdump output. that's a red herring. mapped drives (nas or otherwise) don't really count in this output.... I'm actually surprised to see anything at all relating to a 3rd disk now that you've described your layout.
If this is software (some misconfig of the data on your disk actually) it's going to be 10 kinds of hassle to pinpoint it. I would probably need you on the phone so I could walk you through some diskprobe stuff. I can read that ftdump output you provided up to a point. After that I need to view the same info in diskprobe cuz it has some built in parsers that break that info down. Some other things we could do first:
1. Yea, get it mounted in another box or move it to a different controller+different cable in your current box.
2. get a copy of that mounteddevices regkey I previously mentioned and post it here. That key can be deleted and it will auto rebuild but I want to take a peek first....under just the right (and pretty rare) settings exist in there, letting it autorebuild could shift your windows drive letter... a very scary thing since the symptom would be a login screen loop. This would be correctable by reediting the registry while the system drive was mounted in a 2nd box, but I would rather just avoid the whole potential hassle and have a peek at the regkey contents first.
3. goto device manager (NOT disk manager) and simply delete that bad drive out of there. Reboot the box and it will redetect. If this fixes it, yay! I doubt it will though. what it will gain us though is the redetection at reboot will write some potentially helpful info to your windows\setupapi.log file. After the drive is redetected, come post the last page of that setupapi.log file here so I can take a peek. If the drive never comes back....that would be an answer in itself, although not a good one
🙁 possible but unlikely.
4. check your system event logs. You are looking for event ids: 7,9,11 for indication of controller/hardware failure. You are also looking for 50,51,55 events indicating delayed write failures or other disk problems. Also check for 26s. the 26s would be pretty generic popups...if any mention disk issues make a note, otherwise ignore those. The 7,9,11 & 5x ones are of interest. Check the application log for events from source Winlogon. this is where boot-time chkdsk runs are recorded as well as the results.
The sobering stuff:
There is still a lot we can look at but here is what troubles me: To the naked eye (without a diskprobe parser), your Sector 0+MBR look ok, as do your boot sectors. Chkdsk should at least be able to run (might find an assload of errors but it should be able to run). the fact it won't run makes me worry your MFT is shot. I don't know anyone who can put that back together by hand. If this is the case then recovery software (or a very expensive recovery company) would be the only option. The MFT is a real humpty-dumpty kinda thing. I can't put it back together. Some recovery software can but it can be pretty brutal about it... some mildly corrupted stuff will simply be truncated to make the MFT as a whole intact again.
Post that mounted devices key, check those event logs, drop the drive into a different box, delete drive from device manager and post that setupapi.
do this, and I'll take a peek. We might get lucky. I'll also have a run through the internal KB when I'm at work tomorrow. That's probably the end of the road tho. Beyond that you'll need to try some recovery software or data recovery services.
To answer your question: I know this stuff cuz I spent a year at MS on the team that handles disk issues. I learned to undo fdisks and unconvert dynamic disks on my first day there. I know a lot but I don't know everything and there are certainly folks out there who know more..I'm a bit rusty too
😛. We fixed a lot of stuff like this at MS but we do not officially do data recovery. that's in the realm of ontrack and other such companies.
