How did Scandisk damage my FAT? Any recovery options?

[NeuroB]

Logical Error/FAT Damage caused by Scandisk:

I once was told that clicking the "exit" button (hitting space bar) on Scandisk is a recipe for disaster. Of course to my lament, I now can confirm this to be True. As most of you remember, on older machines 95/98/98se/me, Scandisk runs at boot if you shut down improperly. Question: 'Why would Microsoft put the "exit" button/option in Scandisk if it can corrupt your hard drive?'

Well, in any event my problem is that while I was reinstalling my network adapter drivers, my computer froze up and I had to power off the machine -- thus causing Scandisk to run at Boot. I have never hit the escape button until now, and immediately after escaping out of Scandisk the pc started to boot and went to BSOD saying: VFAT Device Initialization Failed.

I immediately disconnected the drive and set it up as a slave for testing. There has been NO writing to the disk -- to protect the data.

I am somewhat thankful that this is only a logical error and not a physical one, but still when I check in either DOS or Explorer 75% of the folders inside C:\Windows are gone (including about 2GB of personal folders/files I had on the desktop). I've used recover4all to peer into the drive and many of the folders show up as deleted. However if I try to restore them to another backup drive they are damaged and unusable.

I also used Norton Ghost 12 to create a disk image (including MBR copy) onto a backup fat32 drive (same cluster size) for recovery, but unfortunately TestDisk reported no difference between the FAT and the Backup FAT located on sector 6. (Did this happen because I was comparing FAT1 and FAT2 of a copied drive and not the original?) I had been hoping that just the first FAT had been corrupted, and I could restore it from FAT2. Chkdsk /r /f did not help either.

It seems to me that something is wrong in the boot sector and it seems strange that selective folders were completely wiped out like that. I am most likely going to buy Professional Recovery Software, but I decided to post here first to find out:
[UL]
[LI]Does anyone know how scandisk works?[/LI]
[LI]What kind of corruption did I most likely experience?[/LI]
[LI]Does my issue sound like a damaged FAT?[/LI]
[LI]What is the best approach to recover the files without them being useless?[/LI]
[LI]What is the best sotware for this type of recovery?[/LI]
[LI]Are there any specific apps that can rebuild/recover/repair a damaged FAT?[/LI]
[/UL]

~NeuroB
Thanks in advance for all your help!

 

[kjv1611]

I don't know all the answers regarding Chkdisk, but I'd suggest trying one of the apps from Active. Here is one of them:

http://www.partition-recovery.com/

I used this one once before to recover a RAID 3 array that was badly damaged, and to the best of my knowledge, all files were recovered 100%, no issues whatsoever. That was nearly 1 Terabyte of data.

--

"If to err is human, then I must be some kind of human!" -Me

 

[NeuroB]

Thanks kjv1611, I'll definitely look into that, and let you know how it goes.

I found something interesting in the SCANDISK.LOG that explains what seems to have happened. The log is as follows:

[small][ul]ScanDisk checked drive C for problems, with the following results:

Directory structure

Directory entry C:\WINDOWS\_óÿ .éF
contained invalid characters in
its filename.
ScanDisk deleted the directory entry.

Directory entry C:\WINDOWS\@ contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

Directory entry C:\WINDOWS\ .@… contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

ScanDisk detected one or more invalid long filenames.

Directory entry C:\WINDOWS\À contained invalid characters in its
filename.
ScanDisk deleted the directory entry.

File allocation table

Directory entry C:\WINDOWS had an invalid FAT chain.
ScanDisk did not correct the FAT chain.

File system

There were 106,989 lost clusters in 12,228 chains.
ScanDisk reclaimed the lost clusters as free space.

Surface scan

ScanDisk did not perform any tests.[/ul][/small]

So this is why a handful of folders with approximately 3.5 GB of data was deleted by Scandisk. What's strange is that the folders that were left intact under C:\WINDOWS, have folder names that are 'ALL CAPS.'


Thanks again,
~NeuroB

[!]PS What happened to the ActionFront Forums![/!] I can't believe it, that was seriously one of the best resources on the net for Data Recovery issues, and I can't believe that Seagate just decided to do away with the forum and all the thousands of archived posts after acquiring ActionFront. Seagate would rather that none of us have any idea how our Hard Drives and DR work. I wish I knew where all the thousands of expert members of that forum went to -- anybody know?