Files System Error: File System Corrupted on Extend/Non-primary partition

OK here we go,

Just switched over to Disk Director Suite from Partition Magic 8.0, and my F: drive properties shows a file system error: file system corrupted message.

With Partition Magic I had performed the following:

1. Added space to my boot partition (from F a couple of times previously. The most recent try at this, it said that it couldn't increase my C: partition, because too many errors on F: drive.

Switched over to Disk Director after this to see if it would work better on my partitions.

My hard drive is partitioned as follows:

C: Windows boot (Running Windows XP Professional, NTFS file structure)
E: Applications
F: Data files

When analyzing F: in Disk Director Suite, the properties showed that it had a file system error: file system corrupt issue.

I ran a chkdsk on my hard drive. C: and E: had no problems at all. Chkdsk found what seemed like thousand of file fragment errors and fixed/deleted them. (This was a mistake to perform I think).

Disk Director still showed a file system corruption issue.

Now a couple of days later, F: is showing up as a FAT32 partition on the main screen. And the type says:

FS: FAT32 Partition: 0x7(NTFS, HPFS)

Properties indicate a file system error: FAT corrupted now.

I could access this partition OK, until yesterday, but now I can't access the partition to save data off of it to another drive. I had registry/system state backups of my computer, but they were unfortunately only saved to my F: partition.

Is there anyway to repair the file system? Or am I looking at data recovery utility software? Any recommendations if this is the case?

My computer mostly works OK, outside of my data all being inaccessible.

Any ideas or help is greatly appreciated!

Thanks, Darin

 

Darin:

Welcome to the forum, but ouch! It seems you do have a problem. The last time that I had a corrupted filesystem it was with NTFS and it was so far gone that it was unrecoverable by any method that I tried. Fortunately I had a TrueImage backup.

It does sound like the Chkdsk operation made things worse. I agree that some kind of data recovery software is in order. There were a couple of posts on here recommending Data Recovery Wizard.

Best of luck; let us know how it goes.

 

Darin,

What does DD's Disk Editor show for the partition table (in the MBR) of the drive in question? (A screenshot might be helpful.)

Does it show the F: drive as FAT32 or as NTFS?
What format is the F: drive supposed to be?

You may not want to mess with it before trying recovery software, but depending on what DD showed, you might be able to change the partition type to the correct setting and see if you could access the partition.

 

First off, thank you very much for both of your replies. Here are some screenshots that you suggested MudCrab:

The format of F: is/was supposed to be NTFS.

Notice that DD is now indicating a small (10.99 GB) FAT partition and the rest is unallocated space (445.5 GB).

It started out earlier this week as one (465 GB) NTFS partition, then moved to one FAT32 partition, and now it's a FAT partition with alot of unallocated space.

I'm pretty sure the partition is mucked up beyond repair...

The first screenshot is from Disk Editor for the FAT part of F:
The next is from Disk Editor for the unallocated space of F:
The third one is for the C: partition or WinXP boot partition, and
The bottom screenshot is the main DD display.

Let me know if you find anything. And, thanks so much for even trying to help out. I appreciate it very much. Lemme know if you want anymore screenshots.

Thanks,
Darin

** Most of these screenshots deleted by me to ease thread viewing. **

 

Actually, none of those screenshots are the one I wanted to see (sorry). It's the correct screen, but not the correct sector so the data shown is wrong.

Take a look at this post to see the screenshots for a similar procedure. The screen should display something like those shown in this thread (absolute sector 0).

You need to right-click on the Disk #, then select Advanced, then Edit. In the Disk Editor, select the View menu and pick As Partition Table.

 

MudCrab,

So when I right-click on the Disk #, then select Advanced, then Edit, then View As Partition Table, I get the screen as in my first reply. Do I need to enter 0 into the OS Selector Boot Sector box and hit enter? If so, does this actually change anything on the disk, or just where it is viewing? Maybe you could give me a little more guidance (I'm a noob to this), when you have some time.

Or, in other words, how do I get Disk Editor to show absolute sector 0 once I'm at that screen (not sector 19,486,90.

Thanks again for all of your help,
Darin

 

Darin,

If you're doing it correctly, then I don't know why you're not getting sector 0.

Make sure you've selected the Disk 1 text (click on it -- it should be highlighted) and not a partition line. Then right-click on the Disk 1 -> click Advanced -> click Edit and the editor should show sector 0.

As shown in this post, the editor's title bar should show Sectors 0 - ###,###,### for the entire disk since the entire disk is selected. Selecting "As partition table..." will display the sector as a partition table.

 

Man, I'm sorry I wasn't understanding before. Here it is:

 

Okay, that's the correct screen. However, only the first partition is Primary so I still can't see the partition type for the other partition (no fault of yours). The second entry is the Extended partition container which holds the Logical partitions (E: and F.

I'm assuming E: and F: were always Logical partitions?

I don't know if DD can view/edit Logical partition entries directly. I've never looked into it.

 

Yes, E: and F: are logical partitions in the extended partition.

Is there good place I can go to learn more about proper partitioning (or partitioning in general), for when I will set up a new hard drive, to make it easier to analyze if something goes awry or gets corrupted? I thought only your active boot partition could be primary...

Thanks again,
Darin

 

Hi guys. To follow the chain of extended partitions, click on the "Enter" button to the left of the second entry in the partition table (the extended partition container). This will take you to the first logical partition. Clicking on the next "Enter" button will take you to the next, and so on. You can follow the chain of extended partitions to the end.

 

You can have up to four Primary partitions on a drive. Only one can be the Active Primary partition. If you have less than four Primary partitions, you can have an Extended partition that can contain any amount of Logical partitions.

I have checked with DD and you can edit the Logical partition sectors. You can find them with the "Enter" button" (see K0lo's post above - #11) or you can locate them manually.

I have a feeling, though, that your partition is probably corrupted beyond repair.

If you want manually check what the partition table looks like for the F: partition, do the following:
Right-click on the E: partition -> Advanced -> Edit. The Disk Editor will show in the title bar the sectors used by the partition (16,128 - 6,313,544 in the sample below).


Then, if you choose to Edit the Disk 1 entry again (like you did before), right-click -> Advanced -> Edit and select the Search Menu -> Go to... and enter the very next sector (6,313,545 in my sample)


and view it as a Partition Table, it should display the settings for your F: partition. In my example, it's showing Type 07h NTFS


If your extended partitions are linked normally, this should work. However, if DD has "reordered" them, then the sector containing the partition information will be located elsewhere.

 

Mark,

Thanks for that. I tried the Enter button, but didn't follow the values close enough to know exactly where it was going. Also, when I tried, I had my partition formatted as NTFS when it was supposed to be FAT32 so when the Enter button displayed NTFS I thought it was doing something else.

I have posted how to find them manually in a standard setup.

 

Darin:

Lots of good stuff on Dan Goodell's site: http://www.goodells.net/multiboot/

With four "slots" in the partition table you can have up to four primary partitions. If you have four then there is no room left for logical partitions. A logical partition container uses up one slot but can contain an unlimited number of logical partitions. So you also could have up to 3 primary partitions and an unlimited number of logical partitions.

 

Darin:

Have you tried the Recovery Expert feature of Disk Director to see if it can sort out the correct starting and ending locations of your damaged F: partition? See Chapter 5 of the Disk Director manual.

 

OK, here's the screen for the MBR in the partition table for my F: drive.
Any ideas?

Thanks again,
Darin

And thanks for the general info on partitions as well. I'm learning alot today. You guys are both very cool for trying to help me out, too. Much appreciation.

I'll take a look at Chapter 5. Thanks k0lo.

 

Darin,

If you knew the number of sectors the original partition used, you might be able to change the partition type to NTFS and change the number of sectors to the correct value. (If you use the Disk Editor and browse to the end of the disk, you may be able to find the last sector.)

A chkdsk on the partition may still not work as (if I remember correctly from the screenshots you removed) the partition's bootsector shows that it is FAT32 and not NTFS. In which case, perhaps the bootsector would have to be manually changed back to NTFS.

For the DD Partition recovery, did you try it? Did it find anything?

I don't know if you'd have to delete the existing F: partition before it would find anything or not. I've never had to use that feature.

Sometimes it's better to run chkdsk without the /f or /r options and just see if it finds errors and how many. That way you have a better idea of how things look before you let it repair anything. In your case, it seems to have totally corrupted the partition.

 

MudCrab and k0lo,

DD Recovery Expert just finished searching my disk, and it didn't find anything.

I think I'm going to give up for now. Going to try out Data Recovery Wizard to recover data to a hard drive that I should be getting on Monday or Tuesday. Maybe then I will try more to repair the file corruption issue on my F: drive, just to see if it can be done.

How would I go about browsing in Disk Editor to find the correct the number of sectors and then change back to NTFS, as you suggested MudCrab?

I'll post a message to the end here next week, letting you know if anything good came out of it, if you are interested.

Thanks again for all of the help and info!
Darin

 

Darin,

I just ran a quick test and I could find it by doing the following. Please note that these are rough instructions and only general procedure. I'm not an expert when it comes to repairing corrupt partitions.

Since you know that the F: NTFS partition used all the space on the drive and was the last partition, the ending copy of the bootsector should be near the end of the drive.

Select Disk 1 -> Right-click on Disk 1 -> Advanced -> Edit, then select to View as Hex. You should be viewing all the sectors on the drive (0 - ###,###,###). Drag the scroll bar all the way to the bottom to get to the end fast (the last sector). Click in the sector so it the "current" sector. Then you can Page-Up through the sectors until you find the one with the copy of the NTFS bootsector. It will look like the following:


That sector number will be the last sector of the NTFS partition (in this example, it is 18,940,634).

You may want to highlight the sector (all 512 bytes) and save them to a file so you have a copy to restore to the start of the partition.

Now go back to the Partition Table entry for the F: partition (where you got the screenshot in Post #16). Notice the partition # displayed in the lower right (19,486,845). Subtract this number from the sector number you found at the end. Then subtract 62. This should give you the value to put in the Number of Sectors box. Change the partition type to NTFS instead of FAT32.

Once that is done, save the changes and close the Disk Editor. Then, from the main screen right-click on the F: partition -> Advanced -> Edit and select to view as hex. This should display the bootsector for the F: partition in hex mode. From the screenshot you displayed before, it looked like FAT32, and since that's the "corrupt" format, it makes sense. However, it should be an NTFS bootsector. So, click on the first byte in the sector and then read the previously saved NTFS bootsector (from the end of the partition) into this sector.

Even if you do all this, the MFT will probably still be screwed up since chkdsk did what it did.

It's up to you what you want to try, of course. You may want to try the Recovery Software first and that's probably a good idea. Usually the sooner you run it the better. Once you mess with stuff too much, the recovery software has a much harder time fixing things.

If you get any results from anything or have more questions please post back. I'm interested and I'm sure Mark is too.