NTFS drive completely corrupted by partimage restore

[ndmurph04]

I recently tried out partimage for my 2 Windows XP machines (desktop and laptop). The desktop was non-essential, so I used it as a test case. Everything worked like a charm, backup and restore, so I was inclined to believe the rosy accounts of how NTFS support works great, even though it's experimental. Boy was that a mistake. A week later I got a nasty virus on my laptop and figured I was covered since I had a recent image, and there were no errors when making the image. I did all the good stuff before backing it up... full virus scan, spyware sweep, and defrag.

My computer has not booted on its own since. I restored the partition image, no luck. I though maybe I need to restore the MBR too, but this definitely didn't help. I keep getting an error stating that the VCN of the buffer is not the expected value of 0x1, or something to that effect, whenever I try to mount the drive.

After some work, I was able to boot XP from CD using the Ultimate Boot CD 4 Windows (the XP CD would not recognize my SATA drive). Initially the drive shows up with a size of -1MB and cannot be opened. When I run chkdsk /R, it goes for hours spewing orphan files and whatnot, and even then the drive will not boot and seems likely to be highly corrupt, although it does allow me to see that files exist.

I also tried creating a file on an ext2 drive, setting it up as a loopback device, extracting the partition to it, and then mounting it in hopes that it was a hardware issue... still no luck, got the same error.

I am almost at my wit's end since that laptop had so many important files on it. Even if I recover the data, it will take forever to get all my apps reinstalled (it was my development laptop).

I originally took the images while running partimage on a customized ubuntu 9.04 LiveCD. I used that same CD to restore them initially, but have actually switched to a wubi installation of 9.04 I have on my desktop. My laptop drive is only 150 GB, and I have 2 1TB backup drives that I can use for any restoration procedures, so I can try a few things simultaneously if anyone has ideas.

Has anyone seen this behavior before? Any thoughts on how to possibly restore the image in such a way that my data is recoverable? If I have a perfectly good image file, what are the odds of being able to get the data one way or another? I appreciate any ideas at all.

[ndmurph04]

it appears likely that the issue is a corrupted MFT. After running chkdsk, I am able to view some, but by no means all, of my files. I'm not sure if there would be a reason that partimage might put the MFT back in a location other than the one NTFS is expecting or something of that nature, but but it seems odd that both the MFT and the backup MFT would be corrupted or missing(I assume they are, or I would think it could recover more data).

[feffer]

hmmm, what do you mean by MFT? Did you really mean MBR or is it something else?

feffer

[ndmurph04]

Appreciate the response, but I was referring to the Master File Table (MFT). After restoring the partition cannot be accessed at all. Then, I run chkdsk /f and get thousands of entries like the following:

Correcting error in index $I30 for file 436350

followed by thousands more like
Recovering orphaned file ~DF1EF1.tmp (25750) into directory file 218390.

As best I could tell, this seemed indicative of a corrupt MFT since it seems to be rebuilding the file and directory structure. After completing the chkdsk, I am able to browse the drive to a degree, although there seem to be some significant holes in my drive. I guess I could get to the level of using a raw file recovery tool, but this would this wouldn't get the drive booting again, which would eliminate the usefulness of the image over just putting the data files on the backup disk.

I noticed that my problem bears some resemblance to http://www.partimage.org/forums/viewtopic.php?t=253, although none of the suggestions there seemed to help my situation in any way.

Another possible item of interest is that the laptop has a "recovery partition" of approximated 6.5GB. I am not touching that, but it might cause the partition layout to be a little different than the norm, so I thought I would add that in case it is the cause of the chaos.

[feffer]

OK, I understand. You are now beyond partimage and in realm file recovery. Nothing in partimage that I know of will help you here.

What I'll say now will not help in your situation, but may prevent someone else from getting into this tar pit. When the docs say partimage for NTFS is experimental...well now you know the reason. Development on partimage stopped some time ago. You can tell this by looking at the forum posts and dates. Meanwhile NTFS may have changed. For sure, other things around NTFS have changed. Some machines have the partition table on the GUID rather than MBR. Some machines use hidden recovery partitions which can muck things up etc, etc. I use partimage for linux ext3 partitions and have had reliable saves and restores. I NEVER use it for my NTFS partitions, and recommend that others stay away from it for these.

Better to buy windows specific imaging software for frequent uses. Or for occasional use, like moving a system to a larger hdd, use dd. It is slower, but free and is actively developed. Sorry you had a problem.

Regards,
feffer