300gb tib file missing on external drive after internal drive wiped

After purchasing two 500GB drives (one internal (SATA), one external(eSATA)), I wanted to start my whole workstation over from scratch and load my old files over as I needed them. I put the external drive to use right away to serve as my backup drive (and also to test that the drive works) by placing a few (50 megs or less) files on to the drive, deleting them from my old internal drive, and then copying them back from the external. No problems there.

I then also ran several tools that check disks for bad sectors and disk integrity on my external drive because I wanted to be sure that once I backed all of my current partitions to it, that they didnt disappear. Again, no problems.

I then made a compressed (probably my 1st mistake) .tib image of a couple different partitions that were spread across different drive. The total file size came out to be somewhere around 300 gigs. I also performed a verfiy on the image and it tested OK. I was even able to remount all of the partitions and access any data that I went looking for.

I then shutdown the PC (and yes, my PC was turned off/on several times while I was testing the drive), disconnected the drive from the eSATA port and power, then removed all of my other hard drives. I then installed the new internal drive, and loaded WinXP onto it. My OS setup was going to be identitcal to what I had previously. After getting XP loaded up and installing ATI, I shutdown the PC, connected the drive back up and turned the PC back on. Before even starting ATI, I went into Windows Explorer to look for the .tib image. Unfortunately, all that I saw instead was three .tmp "folders" named MSI****.tmp (where **** were random letters/numbers) all marked at 0 bytes, and only 3 of the 8 or so other files from the original disk testing mentioned above (These 8 files were copied w/o using TI).
***See attached picture below***

After trying to clear the lump in my throat, I went straight for the CHKDSK /r only to find that the .tmp files went missing (but the other 3 files remained). My drive now shows that it is completely free space except for the ~50 megs between the other 3 files (an exe, rtf, and rar). I have tried multiple file recovery software packages and the ones that bring results only give me corrupt files, not many file names in tact, but some pictures did recover (but all cut off due to corruption). I assume this is due to either a) the fact that the .tib file was set to be compressed in TI, b) the partitions probably had some file fragmentation, and/or c) the CHKDSK /r command ruined them further?

One last odd note is that everytime I reboot the PC, those .tmp "folders" come back. Also, there has been no data written to the drive what-so-ever other than anything that the CHKDSK command did.

Any help would be GREATLY appreciated. PLEASE!!!!!!

 

Don't format or delete anything just yet!

your zero byte report may well be due to the fact you've changed the SSID of your Windows install. You can check this out by rebooting into safe mode (that's Windows Safe Mode) navigate to the temp folders, right click and choose permissions - add these files to your new user log on name.

Reboot, back into standard windows - see if these files have become available again to you.

Oh yes, you need to be using XPpro for this to work.

Colin

 

jas3442,

First, compressed tib and chkdsk /r, no problems.

So the 300 MB of tib files disappeared from the external HD? Strange.

Do you still have the original HDs containing the OS and data? The tib files can be created again?

You don't need to install WinXP or any OS before restoring an image. Just restore to an empty HD.

How many internal HDs do you have in the computer? How large is your C: drive? How much free space do you have on the second HD?

 

The msitemp files sound like temporary files leftover from microsoft installer operations -- nothing to do with ATI making backups. I hate to ask this, but are you sure which drives you put which files on? Where you going by drive letters or names applied to the drives? Could you have gotten your harddisks mixed up when swapping? It's easier to do than most people think. And I only ask because it's the simplest explanation for what you have described.

 

bodgy, Brian, shieber:
Thank you all for the fast replies. It's greatly appreciated. Let me answer you back one at a time. I think in reverse order here...

shieber:
I agree, that the tmp files sound like MS installer files that are left over, but I never installed anything onto that drive or ever specified it as a temp folder area for any program. Also, I am absolutely positive of which drives I had the files on and what not. Working in an info security department for a few years has taught me to be more than careful to pay attention to drive labels, sizes, and so on. Also, all of the drives I have are different sizes (except for the two new 500gb internal and external, but I have never had them both plugged in at once). I do know that it is a simple explanation though, and I appreciate you not looking it over, as we do all make mistakes. Bottom line, I am POSITIVELY certain I did not mix any of the hard disks up. See my response to Brian below for a little more explanation.

Brian K:
Unfortunately I do have the drives, but some were wiped and reused for my new OS installs. I had only wiped them after I verified that the data on the external was still there. Here is the list of my drives and what my process was:
-120gb SATA w/ 3 partitions (10gb win98 (C: - FAT32)(don't ask, wasnt used anyway) 35gb WinXP (D: - NTFS) OS and program files/installs, 75gb (E: - FAT32) for game installs and the like)
-80gb SATA w/ 1 partition (F (Vista OS install for testing)
-200gb SATA w/ 1 partition (G: - NTFS) (My music, documents, ISOs, etc.)

I had backed up the D, E, and G partitions to the .tib file. I did not wipe the C, D, and E partitions yet (Thank GOD as it has my most critical data), but F and G was wiped. Obviously I didn't care about F anyway b/c it was just test installations and whatnot. But the G drive has tons of stuff that I would really like to get back. A lot of memories and digital projects on there. I then used the wiped 80gb drive as my primary drive (plugged in by itself) to install a fresh XP setup. I then installed my new 500gb internal drive and installed Vista. After that was installed I reconnected my external 500gb and booted into Vista first to check on something (nothing done to the external drive though), then rebooted into XP. This is when I found the .tib file and the other 5 small files missing.

I know I didn't have to install an OS to restore the image, but I wasn't looking to restore the partitions. I just wanted to mount them as extra drives and pull the data off manuall as I went along.

bodgy:
I understand your SSID theory, but it sounds like a long shot to me. I definitely will try it though here in a minute as I really want this stuff back if I can get it. And yes, I do have XPpro installed (both before and after). I will try this and post back the results.

Thank you all again for you suggestions so far. They are greatly appreciated. I hope I answered all of your questions, but if not please let me know and I will post them back.

 

interesting results!

did exactly as instructed and found a few interesting things...

1) When going into the permissions of the first file, it was set only to "SYSTEM" and did not have the "Inherit" (to save a paragraph) opiton checked. The other two files were set to Everyone and the "Inherit" option was already checked. I added my user name to the list for all three anyway.

2) After booting back into normal mode, the first file (that had only SYSTEM privileges previously) now has subfolders! See pictures below!

The _RESTO~2 folder is empty, but the second folder has the folders shown in the second picture below. In RP2 there are 3 files: change.log.1, change.log.2, and RestorePointSize. In the rest of the folders there are only 2 files: change.log.1 and RestorePointSize. None of the files have an extension.

I'm lost at this point. I hope that's not something from a Windows Restore Point because I have no clue how that would have gotten on there. They appear as less than 1KB in size and notepad shows one line with some unparseable symbols and then the file path (with each character spaced out).

:shrugs:

 

Double check the permissions on those new folders. There should have been an option to include child folders as well as inherit.

Though I'm also now a little puzzled as the folders ought to revert back to their real names once permissions have been allocated, although of course as you say these may turn out to be Microsoft files rather than TI's files.

Colin

 

i will give it a shot if i have a chance tomorrow evening, though like you said, this is starting to not look like a TI file. anyone else have any thoughts?

 

If worst comes to worst, see if "testdisk" can find the missing TIB on your external drive. As long as you haven't reformat that drive it should still be there.

http://www.cgsecurity.org/wiki/TestDisk

 

Those certainly sound like suystem restore folders/files -- not anything like ATI stuff.

 

hmmm i never heard of testdisk, but it's worth a shot i suppose. i've tried several other data recovery tools, and it finds many files and even a decent chunk of the actual folder structure, but again it appears to see the files that are backed up in the tib instead of the tib file itself. as a result, most of the files end up corrupt due to the tib file being compressed.

i will give this a shot though. any other suggestions in the mean time would always be appreciated.

thank you again to everyone who has given their input.

 

Hello jas3442,

Thank you for choosing Acronis Disk Backup Software.

We are sorry for delayed response.

Could you please clarify, what version and build of Acronis True Image have you used to create the image? Was it from Windows or using Acronis Bootable Rescue Media? Is the external drive formatted with NTFS filesystem?

Thank you.
--
Marat Setdikov

 

I used Acronis TrueImage Enterprise Server 9.1.3602 under Windows (not the bootable rescue media). And yes, the external drive is formatted with NTFS. Also, something I just remembered is that when backing everything up, the external drive was connected using USB 2.0. After I had installed the new internal drive and was reinstalled Windows, the external drive was then hooked up using eSATA. I don't see how this could cause any issue, but I figured I should post it in here just in case.

 

Hello jas3442,

We are sorry for delayed response.

Please be aware that we have not heard about such problems of Acronis True Image before. From the symptoms it looks like the archive for some reason lost part (or all) of its header information, effectively stopping being a file. Unfortunately, it's highly unlikely the data can be recovered if that's the case.

Anyway, if you wish us to look into the problem, could you please create Acronis Report as it is described in Acronis Help Post? Then submit a request for technical support. Attach all the collected files and information to your request along with the step-by-step description of the actions taken before the problem appears and the link to this thread. We will do our best to investigate the problem and try to provide you with a solution.

Thank you.
--
Marat Setdikov