Comparison of NTFS/MFT recovery software?

In article ,
J. S. Pack wrote:
On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"
wrote:

Hi,

The current state of NTFS recovery software (I.E. supplied with the O.S.)
appears to me to violate "The Goal of Trustworthy Computing", Reliability:
The customer can depend on the product to fulfill its functions.

Under normal circumstances. Which it does quite well, better than FAT32
ever did, so there's no violation.


There appears to be a dichotomy in the handling of file system errors.


As well there should be.

CHKDSK will run or CHKDSK will not run is the dividing point.

If CHKDSK will run, it does its work and repairs the file system with
minimal reporting. The decision apparently has been made to have it do its
work now behind a blank screen during the boot process. Thus it has passed
into to the realm of programs that to weekend computer warriors will always
succeed as it is started and runs without input from the user.



If what's on your disk is valuable to you, you'll back it it and keep
a copy at another location, and never overwrite your most-recent
backup media. There are any number of ways you can lose the contents
of your disk dive that dtaa recovery can't fix. Theft and lightning
are obvious ones.

And, if you're protected against fire, flood, theft, etc, you are, by
definition, protected against a file system failure (whatever that
means.)

It's not clear to me that the OP has an NTFS problem, because two file
systems became unavailable at the same time. To me that sounds like
losing partition information or a hardware failure. I'd like to know,
when the dust settles if the disk formats correctly and works OK.

It's also not clear what the OP was doing when the problem happened.

NTFS is better than any non-journalling FS I've ever worked with, from
a reliability standpoint. Performance is a different question and not
revevant unless you have a million files, or so,

IMO NTFS is more reliable that the disks it runs on.

IMO NTFS is amazingly tolerant of failing hardware that the disk is
connected to.




--
Al Dykes
-----------
adykes at p a n i x . c o m

"Jan van Wijk" wrote in message news:W1d6fUB5m4qH-pn2-sMpV7SdY3igU@merlin
Hi Odie,

On Tue, 31 Aug 2004 15:12:38 UTC, Odie Ferrous wrote:

The program is NOT free, but it is not that expensive either.

You can download the evaluation version and play with that
for a month or so to see what it can do.

Top man - you could never know what it means to be able to test software
properly.

Oh, I surely do.
I have been doing that professionally for over a decade :-)

Wow, you tested evaluation versions 'professionally' (whatever that means)
for over a decade. You must be quite an expert.

Yet simply setting up your newsreader properly you can't manage.



Programs that supposedly let you "see" what they could deliver with the
full version suck.

I agree, so the DFSee evaluation version delivers everything the full
version will.

The evaluation version for my software is EXACTLY the same as the
'full" version.
The only difference is the right to use it for anything else than
evaluation ...

So if by accident you actually manage to salvage anything you have
to reverse the situation again (which it probably won't do for
you, now what?) and make a registration so you can 'legally' use it .......


There is a timeout on un-registred versions (60 days from release),
but if you need further evaluation, simply download the latest ...

Or if you're not downright stupid you just set your clock back
and save you the 1.5 MB download that may not even be different.

There is a new (minor) release almost once a month ...

The registration you pay for DFSee is NOT really for the software
itself,
it is simply for the right to use it legally and even more important
to receive support and help on using it ...

Regards, JvW

On Wed, 1 Sep 2004 23:05:05 UTC, "Folkert Rienstra"
wrote:

Wow, you tested evaluation versions 'professionally' (whatever that means)

Picky picky ...
Testing system software has been part of my job for many years ...

Yet simply setting up your newsreader properly you can't manage.

I notice you mention that a lot to anyone who's posts you don't seem
to
like for some reason, yet you never tell anyone WHAT is wrong.
I am not to old to learn ...

I don't understand your behaviour at times, i KNOW you are a
knowledgable
person from many valuable posts I have seen from you, yet you seem
to enjoy ****ing everybody off most of the time.

snip
There is a timeout on un-registred versions (60 days from release),
but if you need further evaluation, simply download the latest ...

Or if you're not downright stupid you just set your clock back
and save you the 1.5 MB download that may not even be different.

Of course, if you feel happy with it, that will work too :-)

Regards, JvW

(not offended, just amused)

--
Jan van Wijk; Author of DFSee: http://www.dfsee.com

On Mon, 30 Aug 2004 22:38:35 +0200, "Joep"
"cquirke (MVP Win9x)" wrote in message

I did find a number of tools, mainly Windows-based (meaning you'd have
to have a recovery PC)

Not perse ... some run from BartPE (http://www.nu2.nu/pebuilder/), for
example iRecover (http://www.diydatarecovery.nl/~tkuurstra/irecoverpe.htm).

Ah, Bart'sPE - I must have another look at that, once it's SP2-ready
(current change log mentions changes to accomodate an SP2 RC, but
dunno if that makes it OK for RTM SP2).

I've tried Bart's PE before, and liked it, except without a full av
that I could run from it (and a way to update that av from USB camera
or flash drive) it wasn't that useful to me at the time.

For every data recovery, I usually need to do 10-20 formal av scans,
and for a while it looked as if Bit Defender Live would be better
there. But so far that's been too unstable to complete a full scan.

If you can still download recovery software, then it may be assumed you have
access to an additional PC anyway.

Yes, but I'd still rather not run NT if I can avoid it - too much risk
of it fiddling with the at-risk HD I dropped in (SR, AutoChk, etc.)

One in-place repair tool, diskette-based, that didn't boot when I tested it.

Maybe the DOS or Linux version on the diskette didn't boot - that doesn't
tell you much about the tool itself. The tool itself probably doesn't boot,
it needs to be started once the OS (DOS/Linux) runs.

Like MemTest86+ and several HD vendor's diags, it was an .EXE download
that writes a self-booting diskette when "installed". This diskette
may well be Linux-based, as MemTest86+ is, or it may use a FreeDOS as
some similar utilities do. Whatever the details, it didn't boot.




--------------- ------- ----- ---- --- -- - - - -
Sucess-proof your business! Tip #37
When given an NDA to sign, post it on your web site
--------------- ------- ----- ---- --- -- - - - -

On 31 Aug 2004 06:48:54 GMT, "Jan van Wijk"
On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

In that case you might want to check out my DFSee tool:

http://www.dfsee.com/dfsee.htm

That will display many filestructures (including most NTFS stuff)
has lots of specific 'fix' commands to repair 'common' problems
It also has file copy/recover commands for undeleting
and saving data from damaged filesystems.

The program is NOT free, but it is not that expensive either.
You can download the evaluation version and play with that
for a month or so to see what it can do.

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)



-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
-------------- ---- --- -- - - - -

"cquirke (MVP Win9x)" wrote in message
On 31 Aug 2004 06:48:54 GMT, "Jan van Wijk"
On Mon, 30 Aug 2004 20:35:44 UTC, "cquirke (MVP Win9x)"

I'd settle for an equivalent of Norton DiskEdit, i.e. show me the
structures, document them, let me scribble.

In that case you might want to check out my DFSee tool:

http://www.dfsee.com/dfsee.htm

That will display many filestructures (including most NTFS stuff)
has lots of specific 'fix' commands to repair 'common' problems
It also has file copy/recover commands for undeleting
and saving data from damaged filesystems.

The program is NOT free, but it is not that expensive either.
You can download the evaluation version and play with that
for a month or so to see what it can do.

Thanks; I've downloaded it, but will wait until I have time before I
try it (else the demo period may time out before I get a round tuit)

"There is a timeout on un-registred versions (60 days from release),"

Maybe you should read first before you snip?




-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
-------------- ---- --- -- - - - -

No one has truly said anything about whether there are files to fix a
corrupted $Mft however. Or recover all data off a disk that has one.


I have an external USB hard drive that has been having problems
writing to G:/$Mft, and has been hanging on those scans when you plug
in your drive. It finally (it meaning the $Mft file?) died and
decided to show up as a Local Drive that was unnamed (the hard disk
had been named in XP for easy reference).

Now when I try to open the hard disk, I get "The parameter is
incorrect" or "The file or folder may be corrupted". Considering my
previous $Mft troubles, I truly suspect the $Mft to be the culprit,
but perhaps much more experienced hands can tell me if that is the
case.

I daren't spend money on file recovery programs until I'm sure they
will solve my problems!

==============
Posted through www.HowToFixComputers.com/bb - free access to hardware troubleshooting newsgroups.

In article ,
alchow wrote:
No one has truly said anything about whether there are files to fix a
corrupted $Mft however. Or recover all data off a disk that has one.


I have an external USB hard drive that has been having problems
writing to G:/$Mft, and has been hanging on those scans when you plug
in your drive. It finally (it meaning the $Mft file?) died and
decided to show up as a Local Drive that was unnamed (the hard disk
had been named in XP for easy reference).

Now when I try to open the hard disk, I get "The parameter is
incorrect" or "The file or folder may be corrupted". Considering my
previous $Mft troubles, I truly suspect the $Mft to be the culprit,
but perhaps much more experienced hands can tell me if that is the
case.

I daren't spend money on file recovery programs until I'm sure they
will solve my problems!

==============
Posted through www.HowToFixComputers.com/bb - free access to hardware
troubleshooting newsgroups.

There is no certainty in this life. There are so may ways a disk can
fail that there is no all-purpose tool. It's possible that the mft is
a cause, or just happens to be the file that is being refered to when
something else dies. If it's a hardware problem, there may be nothing
you can do. The data may be lost, beyond recovery.

IMO Ontrack is the big dog in the data recovery services business.

http://www.ontrack.com/Homepage.aspx...ename=Services

They've recovered the server disk for one on my clients that was too
lazy to put tapes in the tape drive. It cost him $4000 to get his
data back, but they did it.

--
Al Dykes
-----------
adykes at p a n i x . c o m

On Tue, 31 Aug 2004 17:33:09 GMT, "Stephen H. Fischer"

The current state of NTFS recovery software (I.E. supplied with the O.S.)
appears to me to violate "The Goal of Trustworthy Computing", Reliability:
The customer can depend on the product to fulfill its functions.

Breaks the safe hex principle that the system should not initiate
potentially destructive system changes.

If CHKDSK will run, it does its work and repairs the file system with
minimal reporting. The decision apparently has been made to have it do its
work now behind a blank screen during the boot process.

This is the bad news.

If CHKDSK will not run, then there is no path to recover.
That is the violation.

No, that's not the violation.

ChkDsk is inadequate and IMO is unfit for use, period. Users in the
21st century deserve better than a tool dating from DOS 5 or older.

If it is not allowed to "fix" automatically, it is known to return
spurious errors when checking a volume that is in use. Most PCs are
setup as one big C: that is always in use. Join the dots.

If you allow the thing to "fix" automatically, it will discard
conflicting data when it "fixes", thus breaking the ability to use
that data to really "fix" if ChkDsk guesses wrong. After ChkDsk
"fixes", the "fixed" data is likely to be broken, the info needed to
really fix is thrown away, and it can no longer be detected as a
damaged file because the "fix" has rubbed off the sharp edges.

What you want is the ability to *interactively* check the file system,
as Scandisk does for FATxx. You want ChkDsk to stop and say "I found
such-and-such an error and (more info) I plan to "fix" this by doing
X, Y, Z. Continue, or abort?" but it's too brain-dead for that.

AutoChk (that runs after bad exits) is even worse; it can only run in
"fix" mode. The point about "fix" mode is that this does NOT have an
interest in preserving user data; it is only concerned with keeping
the file system sane. If you read the fine print in MS's NTFS
documentation, they are quite clear on this, e.g. transaction rollback
may preserve sane metatdata but it does NOT preserve user data.

When it comes to management of physical disk errors, it gets worse.
As it is, the HD's firmware attempts to paper over failing sectors on
the fly, by copying material from a failing sector to a spare and then
doing an address switcheroo. Now the OS (on NTFS volumes) tries to do
exactly the same thing. Too many cooks? You bet! Hide information
you urgently need to be aware of? You bet!

So I choose to avoid NTFS altogether, and use DOS mode Scandisk for
elective and controlled file system repair.

To those who say that the only method of repair if CHKDSK will not run is to
hire a person who has many years of experience and makes a living doing data
recovery just adds to the dichotomy. CHKDSK is trusted (and Norton) to
repair the file system all by its self for the second case.

ChkDsk is NOT a data recovery tool, and has no right to presume to be
one. Automating data-destructive "fixes" may help MS cut down on
support calls, but it is detremental to data safety as it robs the
user of the option to manually repair.

And yes, a compitent tech (or an end-user recovery tool) can do better
than autofixing logic to manually repair, even if only because it can
pull data based on both items of conflicting data.

Repair in place I have stated is the only viable solution for gargantuan
sized external hard drives that cannot be backed up currently.

Backup, by definition, loses data. So a need for data recovery is not
going to go away, no matter how much you backup.

The perfect backup contains all content except unwanted changes.
Ponder on how you separate unwanted changes (loss) from all data you
saved right up to the present moment, and see the problem.

The argument that confusing and intimidating information must not be shown
to the users is an strong argument towards eliminating the dichotomy and
doing the job without the user being involved.

That's lazyware, i.e. "let's cut support costs, and if that breaks
user's stuff, who cares; we aren't liable for that".

Furthermore, keeping information from all persons because some may not
understand is elitist and should not be condoned.

Absolutely!

The recording of what CHKDSK has done behind the blank screen when booting
is being done is perhaps a model of presenting the information to persons
who can understand it and not showing it to others.

Well, burying it the depths of Event Viewer under "Logon" on something
seemingly unrelated is pretty opaque and user-hostile.



-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
-------------- ---- --- -- - - - -

On Sat, 04 Sep 2004 12:29:12 +0700, J. S. Pack wrote:

URL http://65.108.230.150/downloads/mybo...uilder3032.zip

I've tried Bart's PE before, and liked it, except without a full av
that I could run from it (and a way to update that av from USB camera
or flash drive) it wasn't that useful to me at the time.

This has *exactly* what you need:

http://www.windowsubcd.com/index.htm

I get a 404 on that link...



-------------- ---- --- -- - - - -
"I think it's time we took our
friendship to the next level"
'What, gender roles and abuse?'
-------------- ---- --- -- - - - -