Hex Calculations, Fat Tables, and NTFS ... oh my... - Tilted Forum Project Discussion Community

Captain Pike · 06-03-2005, 10:17 PM

One hour before I was about to do my monthly backup... I cooked supper. It was a fine meal, but to the point, computer was down to a dead crawl.

Hmm... reboot, get into safe mode. What's that cricket like noise? Oh the hard drive... well it's loaded up ntoskernel.exe... 2 minutes later, the next module loads up.

Interesting... Shut off computer, get a new drive. Now my plan is to reinstall windows on the newer hard drive, then setup the dying/dead drive as a slave, then try and recover the data off of it.

I have, many many many moons ago recovered files in FAT16 and FAT32 partitions by rewriting the Hex Calculations in the FAT tables. I do not have any modern tools or knowledge on how to do this in NTFS. Specifically XP pro.
Can anybody point me in the right (write) direction? I'd rather learn how to do this, and be more geekier then have to redo my taxes again as I got shafted on my return.

Thanks in advance all.

CSflim · 06-04-2005, 03:59 PM

You should probably post this in Tilted Computers - you'll get more responses there.

j8ear · 06-15-2005, 12:57 PM

Disk Commander is my favorite software. It has worked everytime I've used it, and that's about 30 times, inlcuding NTFS 4.0 and 5.0. It has even worked on compact flash and memory stick cards! I can charge big bucks to recover someone's PSTs or word docs

There are a number of similar products available.

Essentially Disk Commander (same people who make ERD commander, which has a feature called "locksmith" which can reset an administrator password you don't know) is a stand alone operating system that you boot too...and follow the instructions.

It's pricey but can had be had for a "reasonable" fee if you know where to look.

CSFilm is right though...Tilted Computers would be a better forum for this topic.

Good Luck,

-bear

tres · 06-15-2005, 01:04 PM

If you have any files or folders marked PRIVATE- make sure you disable the PRIVATE before you transfer the files. I had the same problem, then realized I could not access any of my files on the new install.

SiN · 06-15-2005, 01:20 PM

definitely belongs in the puter forum.
/me moves

WillyPete · 06-15-2005, 01:35 PM

check out the knoppix STD site.
It's a bootable CD image that runs on a linux framework. Loads of tools to help you recover your files and or installation.
Reads NTFS very well.

Captain Pike · 06-15-2005, 03:35 PM

Cool, cool. Will keep those in mind for the future, I bought a new hard drive slaved the flakey one, and managed to get all of the files copied over.

Five minutes later, I tried booting off the flakey one just to see, computer would not boot with it hooked up. Got halfway through ram check, reboot. Tried it on another computer, it got to about 1/4 way through around the 90 mb mark, and reboot.

Bizarre, I've never had a hard drive do this to me before. I will summarily rip it apart and turn it into an ashtray... or perhaps a paperweight as I'm trying to quit smoking. Or test to see how magnesium does burn through a hard drive. Or have a priest bless it, then I'll marinate it in irish whiskey and give it a proper wake.

Thanks for the help, and hope this thread stays on to help others who need some data recovery help.

06-03-2005, 10:17 PM	#1 (permalink)
Captain Pike Upright	Hex Calculations, Fat Tables, and NTFS ... oh my... One hour before I was about to do my monthly backup... I cooked supper. It was a fine meal, but to the point, computer was down to a dead crawl. Hmm... reboot, get into safe mode. What's that cricket like noise? Oh the hard drive... well it's loaded up ntoskernel.exe... 2 minutes later, the next module loads up. Interesting... Shut off computer, get a new drive. Now my plan is to reinstall windows on the newer hard drive, then setup the dying/dead drive as a slave, then try and recover the data off of it. I have, many many many moons ago recovered files in FAT16 and FAT32 partitions by rewriting the Hex Calculations in the FAT tables. I do not have any modern tools or knowledge on how to do this in NTFS. Specifically XP pro. Can anybody point me in the right (write) direction? I'd rather learn how to do this, and be more geekier then have to redo my taxes again as I got shafted on my return. Thanks in advance all.

06-04-2005, 03:59 PM	#2 (permalink)
CSflim Sky Piercer Location: Ireland	You should probably post this in Tilted Computers - you'll get more responses there. __________________

06-15-2005, 12:57 PM	#3 (permalink)
j8ear Gentlemen Farmer Location: Middle of nowhere, Jersey	Disk Commander is my favorite software. It has worked everytime I've used it, and that's about 30 times, inlcuding NTFS 4.0 and 5.0. It has even worked on compact flash and memory stick cards! I can charge big bucks to recover someone's PSTs or word docs There are a number of similar products available. Essentially Disk Commander (same people who make ERD commander, which has a feature called "locksmith" which can reset an administrator password you don't know) is a stand alone operating system that you boot too...and follow the instructions. It's pricey but can had be had for a "reasonable" fee if you know where to look. CSFilm is right though...Tilted Computers would be a better forum for this topic. Good Luck, -bear __________________ It's alot easier to ask for forgiveness then it is to ask for permission.

06-15-2005, 01:04 PM	#4 (permalink)
tres Insane Location: Long Island, NY	If you have any files or folders marked PRIVATE- make sure you disable the PRIVATE before you transfer the files. I had the same problem, then realized I could not access any of my files on the new install. __________________ "Its better to be hated for who you are, then loved for what your not" --Van Zant "Tell me and I forget. Show me and I remember. Involve me and I learn."

06-15-2005, 01:20 PM	#5 (permalink)
SiN strangelove Location: ...more here than there...	definitely belongs in the puter forum. /me moves __________________ - + - ° GiRLie GeeK ° - + - ° 01110010011011110110111101110100001000000110110101100101 Therell be days/When Ill stray/I may appear to be/Constantly out of reach/I give in to sin/Because I like to practise what I preach

06-15-2005, 01:35 PM	#6 (permalink)
WillyPete Addict	check out the knoppix STD site. It's a bootable CD image that runs on a linux framework. Loads of tools to help you recover your files and or installation. Reads NTFS very well.

06-15-2005, 03:35 PM	#7 (permalink)
Captain Pike Upright	Cool, cool. Will keep those in mind for the future, I bought a new hard drive slaved the flakey one, and managed to get all of the files copied over. Five minutes later, I tried booting off the flakey one just to see, computer would not boot with it hooked up. Got halfway through ram check, reboot. Tried it on another computer, it got to about 1/4 way through around the 90 mb mark, and reboot. Bizarre, I've never had a hard drive do this to me before. I will summarily rip it apart and turn it into an ashtray... or perhaps a paperweight as I'm trying to quit smoking. Or test to see how magnesium does burn through a hard drive. Or have a priest bless it, then I'll marinate it in irish whiskey and give it a proper wake. Thanks for the help, and hope this thread stays on to help others who need some data recovery help.