| Author | Message | ||
     spytalk Username: spytalk Registered: N/A |
Hello everyone I hope someone can help explain what I'm observing. I'm using the evaluation ver. of winhex to examine an 80gb Western Digital WD800JB drive that quit working this week. It was running as a win 2000 boot drive with an overlay on the drive from the Western Digital tools back in 2005. It wouldn't boot fully as of 01-29-2007. It would begin to load windows, then blue screen with "can't read boot drive" something to that effect. The drive is connected as a slave on ide0 now and I'm viewing the drive using winhex. I get many "can't read sector" error messages. Winhex did however manage to create what looks like a valid ntfs directory tree for the drive. This drive has college coursework for my Son on it so it's important to try and recover any and all data. When I choose Tools, Open Disk, HD1, winhex shows 74.5GB Partition 1. When I right click and choose Explore for Partition 1, I get a whole bunch of "cannot read from sector" errors. If I tell it to ignore all read errors, it scrolls endless read errors in the message window "cannot read sector 21,835,144" etc. etc. If I minimize the winhex window, it doesn't come back. It is stuck apparently getting drive read errors over and over. One would think the winhex window would at least come back to the user to view the progress. I can END TASK on the winhex app and restart it. When I open disk HD1 again, this time I press ESC for every sector error and I get: "a snapshot of this volume taken 3 hours ago is reused" and I get what looks like a fairly valid NTFS directory listing of the drive. I can dive down into folders and list the files etc. But here is what is strange: In Winhex, If I click on a filename that is less than about 570 bytes it's ok, but if I click on a filename greater than about 570 bytes I get "cannot read from sector 33,492,895" etc. This holds true no matter what folder or filename. If I try to use Recover/Copy it only works if the file is less than about 570 bytes. I even sorted all files by filesize and right at about 570 to 600 bytes or greater it quits working when I try and recover the files. Any clues as to what is going on here? Why can't winhex read the data of files larger than about 570 bytes on this drive? I can provide further info if it would help thanks. Hard disk 1, Partition 1 File System NTFS Total Capacity 74.5GB Bytes per cluster 4096 Bytes per sector 512 | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
For explanation: Files that are smaller than a certain threshold are stored on NTFS volumes in a different way than larger files are. You seem to be lucky that the so-called master file table ($MFT), where so such files are located, is not affected by the bad sectors. We recommend sending physically damaged hard disks to an appropriate data recovery service. | ||
| spytalk Username: spytalk Registered: N/A |
Thanks for your response. Specifically I would like to know how a drive with an overlay driver (from Western Digital in this case) can affect Winhex during attempted recovery of data. Scenarios would be: what if the overlay was missing, what if the overlay area was corrupt etc. how would different scenarios with a dynamic drive overlay (DDO) affect usage or likely success of using Winhex. Please elaborate on this topic, thank you. |