VOGONS

Data recovery help

Topic actions

First post, by jwt27

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie

I've been testing various ISA VGA and Hercules graphics cards yesterday. At one point when I was about to start a game, it wouldn't let me change to the game's directory. Double checked; no typos. So I changed to C:\GAMES\ and entered DIR. And was shocked to find... IT'S EMPTY! 😳

Or, well, not exactly empty. There's now a single file, several gigabytes in size, with a file name composed of non-printable characters (so DIR doesn't show anything). In any case my saved games and high scores are gone now. I can't imagine the graphics cards had anything to do with it, although I was rebooting fairly often and may have rebooted just while the harddrive was trying to write. Or maybe my trusty (NOISY) Fireball CX is finally starting to fail.

So far all I've tried is Windows 2000 scandisk, which told me the disk was fine. Yeeeah right. I think I'll make a backup of the partition first before trying anything else. Or maybe, get a new drive first, copy the partition, and try data recovery on that? Would Clonezilla be able to make a 1:1 clone, including broken file structures?
And then which file system check / data recovery programs should I try? I have FreeDOS CHKDSK, Win9x Scandisk, and Linux dosfsck on hand. Any recommendations?

I really do hope my saved games and high scores are still there. 🙁

Reply 1 of 7, by Firtasik

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie

Grab SystemRescueCd, make a backup with ddrescue and try a data recovery/partition fixing with TestDisk.

11 1 111 11 1 1 1 1 1 11 1 1 111 1 111 1 1 1 1 111

Reply 2 of 7, by jwt27

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie

Thanks, this CD looks very useful.

I made a backup image with ddrescue which came back with 0 errors. I'm not sure what TestDisk can do, I only see options to undelete partitions and files. It won't even read the games directory, saying there might be file system errors (no shit!!). I also tried a surface scan with MHDD from that CD but like ddrescue, it didn't find any bad sectors either.

Then I tried dosfsck with -n (so it doesn't make any changes) and I get a long list of files with shared sectors. Most of them share sectors with 4DOSSWAP.000, not sure why 4DOS would ever swap to disk with 128MB of free XMS, but that's one feature I'll disable from now on.
C:\GAMES shares sectors with some other directory, and if I'm reading this right I'm pretty sure dosfsck wouldn't fix anything if I'd run it without -n:

/GAMES  and
/PROGRAMS/DP/DP_PREFS
  share clusters.
  Truncating second to 0 bytes.
/PROGRAMS/DP/DP_PREFS
  File size is 324 bytes, cluster chain length is 0 bytes.
  Truncating file to 0 bytes.
/GAMES/\010\000Q±\013\000S\000.IBM
  Bad file name.
  Auto-renaming it.
  Renamed to FSCK0000.REN
/GAMES/\001\000\000\000\000\000\000\000.\000\000\000
  Bad file name.
  Auto-renaming it.
  Renamed to FSCK0001.REN
/GAMES/\015\033L\000\015\033K\000.\015\033J
  Bad file name.
  Auto-renaming it.
  Renamed to FSCK0002.REN
/GAMES
  "." is missing. Can't fix this yet.
/GAMES
  ".." is missing. Can't fix this yet.
/GAMES/\020\000\000\000\002\000\001\000.\000\000\000
  Start cluster beyond limit (16842755 > 1571290). Truncating file.
/GAMES/\020\000\000\000\002\000\001\000.\000\000\000
  File size is 1149042688 bytes, cluster chain length is 0 bytes.
  Truncating file to 0 bytes.
/GAMES/FSCK0000.REN
  Start cluster beyond limit (1344301426 > 1571290). Truncating file.
/GAMES/FSCK0000.REN
  File size is 1919251566 bytes, cluster chain length is 0 bytes.
  Truncating file to 0 bytes.
/GAMES/FSCK0001.REN
  Start cluster beyond limit (4456512 > 1571290). Truncating file.
/GAMES/FSCK0001.REN
  File size is 851981 bytes, cluster chain length is 0 bytes.
  Truncating file to 0 bytes.

Looks like it would just delete the big blob in the games directory and call it "fixed"...

Reply 3 of 7, by JaNoZ

Posted on 
User metadata
Rank Member
Rank
Member

Yes i would also recommend testdisk, awesome util.
Works very well.

Fireball is not failing, do a spinrite surface refresh to test and revive weak sectors.
Vlb controllers and psu noise and bad failing ram/cache i would think could be responsible.
Clean vlb fingers with pencil eraser and clean up. Cache and ram the same way or with glass brush an maybe a psu filter recap coul solve things.

Reply 4 of 7, by jwt27

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie
JaNoZ wrote:
Yes i would also recommend testdisk, awesome util. Works very well. […]
Show full quote

Yes i would also recommend testdisk, awesome util.
Works very well.

Fireball is not failing, do a spinrite surface refresh to test and revive weak sectors.
Vlb controllers and psu noise and bad failing ram/cache i would think could be responsible.
Clean vlb fingers with pencil eraser and clean up. Cache and ram the same way or with glass brush an maybe a psu filter recap coul solve things.

As I said, I don't know what testdisk could do here. I don't see any option to turn "data blobs" into files and it even errors out when I try to access the broken directory.
Could try the Spinrite test, but MHDD didn't show any bad sectors at all and ddrescue was able to copy every single bit without errors, so I'm not sure if Spinrite would have any effect.

This is on a Pentium 3 system, not much VLB here. I'm using the IDE controllers on the mainboard. Cache is integrated on the CPU, with L2 ECC enabled. RAM is ECC as well, so if that went bad I should've seen error messages before.
PSU is a 12 months old Seasonic, and I recapped the mainboard 9 months ago.

I did just manage to read a large part of the games directory though, so I copied as much as I could to an external USB disk. The trick was to mount the file system in Linux... Apparently Linux is able to read broken FAT32 better than both DOS and Windows 🤣
Unfortunately, the files I really wanted to save did not show up 🙁

Reply 5 of 7, by JaNoZ

Posted on 
User metadata
Rank Member
Rank
Member

Some ide cables are bad replace the ide ribbon.

Reply 6 of 7, by jwt27

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie
JaNoZ wrote:

Some ide cables are bad replace the ide ribbon.

That would make sense, will certainly do that!

And, um, oops. I just booted into Windows 2000. It finally discovered the broken file system and started CHKDSK while I was looking the other way... It threw some errors at the end which went by too fast for me to read. But I think I know what that was about: I now have ten thousand files named FILE0000.CHK to FILE9999.CHK, and I guess it couldn't count any further.
CHKDSK also took the easy way out, and simply removed the GAMES directory entirely.

Oh well, at least I still have the dd image.

I've been looking through that image file with a hex editor. I have no idea what I'm looking at though and it's kinda hard to find anything in a 6.4GB binary file.. especially if you don't even know what you're looking for.

Reply 7 of 7, by jwt27

Posted on 
User metadata
Rank Oldbie
Rank
Oldbie

Believe it or not, I got my files back. Using a hex editor, and this web page: https://www.pjrc.com/tech/8051/ide/fat32.html

Some file was apparently written on the wrong sector offset, overwriting the first sector of the GAMES directory. Then, since the directory seemed empty, the second cluster was overwritten too. I "fixed" that by filling the first sector with bogus directory entries (marked as deleted).
Then I started looking for the missing directories by searching for known files in there. Calculated the cluster number from the byte offset, and made new directory entries pointing to the missing ones. After that I was able to mount the image in Windows with OSFMount and copy everything to a safe location.
PHEW... Took a while, but it was worth it! 😀

Go to top of page Go to top of page
Back to General Old Hardware
Close window
Close window