Get a FREE fully-working copy of Steganos Security Suite 7 (worth £49.99) when you sign up to the Practical PC Newsletter. Recovering Data from a Corrupt NTFS Disk
Iain Laskey looks at what to do when disks go bad.
In a decade of using PCs I have never had a disk get corrupted unless it was something silly I had done. As a happy Windows XP user I ensured all my drives were formatted as NTFS to ensure maximum safety. After all, NTFS is more reliable than FAT or FAT32. Recently I found out to my cost that my total trust in NTFS was possibly misplaced.
Symptoms
The PC in question has been happily running for a year or so. It has 3 hard drives, 2 X 160GB and 1 X 80GB and gets used for video editing and backing up another PC. All the drives are formatted as NTFS and everything was working fine. Then disaster struck. I noticed that one of the 160GB drives had suddenly decided it was formatted as RAW which basically means Windows can't read it. Panic!
Luckily it wasn't the boot disk so I could still use the PC. A quick Google search indicated that this was far from uncommon and a trawl through Google groups showed a worrying number of people reporting NTFS disks in XP machines suddenly becoming 'RAW'. In most cases they managed to get the data back using a variety of 3rd party disk tools but some people lost everything. With a disk holding 160GB of data, that's a lot to lose.
At this point I hold up my hand and admit I hadn't been too diligent backing this one up as it had become a bit of a dumping ground for downloaded files, backups from other machines, old MP3s and other sundry odds and ends that I could potentially live without but didn't particularly want to lose either.
Fixing the Corruption
At this point I didn't know if the disk was truly wiped or 'just' corrupted. I started to search for suitable software I could download to fix the problem. There were a lot of options but most were designed to create a bootable floppy disk to start the repair process. Unfortunately, the PC in question has no floppy drive. I rarely use them and so most of my machines are devoid of these devices.
Initially I tried ScanDisk which is built in to Windows and thus ready to hand. That simply exited as soon as it started with no error. Next I tried to use Partition Magic's error checking. That got about 30% of the way in before insisting I had asked it to quit. It was time to try something more powerful.
After some digging I came across a tool called GetDataBack. (You can read a full review of this program here). The free download lets you look at what can be recovered. I let it loose on the unreadable partition and an hour or so later was relieved to see a full directory listing had been generated of all the files on the drive. It even managed to keep the subdirectories and filenames intact indicating that whatever the problem was, it had not affected most of the data on the drive. To actually recover the data, you need to pay for an activation key ($79). The software was let loose and within a few hours had extracted every single missing file and copied them to other drives. I checked a few dozen files from different directories and they all seemed fine.
Rebuilding
Having extracted the data, it was simply a matter of formatting the drive and copying all the data back. This went without a hitch. At this point I don't yet know if it was a chance corruption of the NTFS file structures or an imminent drive failure so the next step will be to find and download a tool to check the SMART status of the drive. Most hard drives feature SMART monitoring which allows you to probe the drive's operating data via software to see if it has detected any problems which may indicate a failure is approaching. Whilst SMART isn't perfect, it does spot things like an increase in read problems, temperature problems and so on. I decided to install ActiveSmart to handle this side of things.
Other Options
For the more technically clued up, there is always the option of manually editing the disk at the sector level. The NTFS structure is reasonably well documented and with appropriate disk editing tools it is possible to replace missing bytes, copy any backup versions of the NTFS structures that may exist and generally get down and dirty. I'm not that brave.
As noted above, if you have a floppy drive, you have rather more options available and a quick web search on partition recovery tools will provide a rich selection of programs to help you get your precious data back. Some simply recover data to a safe location; others actually repair the disk itself. The former is generally the preferred option in case writing to the damaged disk actually makes the situation worse.
Conclusion
If you're unlucky enough to find your NTFS disk has become corrupted, it may not be the end of the world. There are some pretty clever tools out there that can help you recover from the situation. To maximise your chances it is useful to have a floppy drive and somewhere else to copy the data to. It's also a wake up call to get a better backup regime in place but that's another story.
