Win2k: CHKDSK ate my hard drive

[Trygve]

Last night I got a "corrupt directory" error when selecting a directory (several levels deep) in Windows Explorer. Nothing important; I was just checking on the version of a piece of freeware. Everything else appeared fine. Foolishly, I asked Windows to check for and fix errors on the drive and rebooted. Chkdsk ran when it restarted and deleted approximately 97% of my files, apparently at random. I had 120 gig of files on a 160 gig drive before, now 5 gig are left, with typically one or two files in each directory that wasn't deleted (which also seems to have happened at random; no relationship to creation date, etc.).

I have not touched the drive since and have avoided doing anything that would write to it. I see no sign that there's a hardware problem with the drive. I do have backups, but they're a few months old (I know, I know). Has anyone seen this problem before? If so, is there some known trick or utility that's good at recreating the files and directories deleted by chkdsk?

I'm running Win2k pro with the current batch of service packs and patches; this machine has never been infected with a virus or even adware. The drive was formatted as a basic disk with ntfs.

 

[Smilin]

Short of a recovery service such as Ontrack there is not much you can do. There are some free data recovery utilites out there that may have some success, but don't get your hopes too high.

Your decision to run chkdsk was not necessarily a bad one. Chkdsk uncovered problems, it didn't really create them. (It's kinda like blaming antivirus for infections that it finds).

Check your system event logs for events ids 7,9,11 and anything in the 50s. It should give you some indication if there was a drive problem before this. If there are none of these events listed your drive may be physically ok if you can get the filesystem in order. If you haven't done a chkdsk with an /R switch you may want to consider it. A bad sector sitting under your MFT will bite you again in the future if you don't find it.

Even though your backups are old the fact that you have them puts you far ahead of most people.

Good luck dude.

 

[Trygve]

Thanks! Checked the logs and found a series of error 55 messages: "The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume D:." all within the span of about one minute when I'd been trying to access the directory in question. No such errors since then or before, dating back to when I'd built this machine in early March.

I do blame chkdsk. The error may have been there, but if I hadn't run chkdsk, I could have copied the files over the network (it's all gigabit ethernet here and I have a machine next to it with 2tb of RAID-5 storage for video work). Poking around the filesystem before rebooting the system produced no other errors, nor did I encounter any difficulty reading any other directories or loading any other files. Having one unreadable directory was much to be preferred over having 97% of my files deleted.

I may try some of the data recovery utilities out there. I've had good luck recovering data from fat32 and fat16 partitions that way, but I've yet to find one that seems to do anything useful with ntfs.

 

[Abzstrak]

chances are that you had alot more wrong with the file system if chkdsk did that.... I doubt you woulda been able to copy the files off had you not run chkdsk as you said, something had to be pretty badly wrong with it to do that, I've used it for many many years and never seen that behavior...

 

[Trygve]

Originally posted by: Abzstrak
chances are that you had alot more wrong with the file system if chkdsk did that.... I doubt you woulda been able to copy the files off had you not run chkdsk as you said, something had to be pretty badly wrong with it to do that, I've used it for many many years and never seen that behavior...

Never seen this particular behavior before either--and I'm supporting several Win2K boxes (and NT boxes before migrating to 2K). I think it's amusing that Microsoft's page on this feature says that when it pops up the "please run chkdsk" message box, they do not recommend running chkdsk without backing up your data first and warn that running chkdsk may result in data loss. I just wish I'd done some searching on the net *first* before assuming that "please run chkdsk" meant that I should run chkdsk. Silly, I know.

Obviously, it's too late to be certain, but since I had no problem reading any other files or directories (I was careful not to do anything that would write to that volume after seeing the message, though), I don't see why they couldn't have been backed up prior to running chkdsk, though I would normally have copied them to another machine rather than tried backing up to tape at that point.

I checked into some data recovery software out there; I've had good success with some tools on Fat32 and Fat16 partitions that users had messed up, but I've never had much success with data recovery tools on ntfs. Tried FileScavenge 2.0 and it came up with thousands of unidentified .jpg files (with no identifiable filenames or associated directories) and a remarkably large number of unidentified .wma files, which was a surprise, since I can't think of any .wma files that I would have had on that machine. (I don't ever use it for video, sound, or multimedia. Never even had speakers hooked up to it.) Doesn't look like FileScavenge was able to recover much that would be of interest. Despite a couple of runs of FileScavenge in "thorough" mode, I haven't gotten any more errors on that drive either.

Oh, well; I've already recovered most of the accounting data, documents, and graphics projects that I was worried about from backups and other machines. It's just going to take some more sorting and version control before I get back to work on a lot of these things again. Nothing that can't be recovered without a bit of work, but it was still a shock.

 

[Smilin]

Being able to see a file listed and actually accessing it's contents (or copying it off somewhere) are two different things. I'm still saying the problems were likely there to begin with, not necessarily caused by chkdsk.

It sounds like you are in pretty good shape considering. With no other events your physical drive may be ok (the 55 was expected at that time). Once you get things back in order and backed up you should still consider a chkdsk /R.

 

[Trygve]

Originally posted by: Smilin
Being able to see a file listed and actually accessing it's contents (or copying it off somewhere) are two different things. I'm still saying the problems were likely there to begin with, not necessarily caused by chkdsk.

I'm still saying that I don't believe that they were, considering that I had no problems accessing the contents of the files that were deleted prior to running chkdsk. Granted, I didn't try loading every single file on the drive, but none of the ones I did read had any problems, errors, or delays in loading (I dont keep programs on that drive, just data files). While this is just personal opinion, I do believe that actually accessing a file's contents is not all that different from actually accessing its contents.