« previous next »
Pages: [1] 2   Go Down

Author Topic: Interesting Event  (Read 1602 times)

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Interesting Event
« on: September 06, 2012, 05:54:11 AM »
I have been engaged in doing online work with engineers outside of the U.S. using a meeting software that requires a Java installation. I turn Java off (disable) when Im not using the meeting software. Midday Monday my primary boot partition for that system became sluggish and unresponsive so I rebooted at which point the boot partition disappeared (blue screen: unmountable_boot_volume). I booted another OS so I could examine the drive in detail and the entire drive (according to Disk Management) was marked as a RAW volume. The files were still intact but there was no way to access them and if I had believed the Windows tool I would have thought the entire disk had been eliminated. Windows repair failed. Windows DVD repair failed not that I wanted to run chkdsk anyway. Mini Tool Partition Recovery saw the files but could not restore boot capability. Its big brother Partition Wizard had the same failure.

I keep the partition backed up with True Image but in this particular instance there was a 540 GB folder with recent changes that I needed to recover. What I did in order to recover the partition was to backup the drive using True Image and then restore it to another hard drive (3 hours). I then used SpinRite to do a deep level restore of the original disk and it fixed the problem (46 hours) but I do not trust the drive now so it is headed to the Home Theater system for daily recordings until it fails permanently.

With the recent Java scare I thought that might be the problem at first but now I think this is just a Windows glitch that happens infrequently. I wonder how many people encounter this problem and reformat?
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Interesting Event
« Reply #1 on: September 06, 2012, 06:28:05 AM »
Quote from: Chalenge on September 06, 2012, 05:54:11 AM
I have been engaged in doing online work with engineers outside of the U.S. using a meeting software that requires a Java installation. I turn Java off (disable) when Im not using the meeting software. Midday Monday my primary boot partition for that system became sluggish and unresponsive so I rebooted at which point the boot partition disappeared (blue screen: unmountable_boot_volume). I booted another OS so I could examine the drive in detail and the entire drive (according to Disk Management) was marked as a RAW volume. The files were still intact but there was no way to access them and if I had believed the Windows tool I would have thought the entire disk had been eliminated. Windows repair failed. Windows DVD repair failed not that I wanted to run chkdsk anyway. Mini Tool Partition Recovery saw the files but could not restore boot capability. Its big brother Partition Wizard had the same failure.

I keep the partition backed up with True Image but in this particular instance there was a 540 GB folder with recent changes that I needed to recover. What I did in order to recover the partition was to backup the drive using True Image and then restore it to another hard drive (3 hours). I then used SpinRite to do a deep level restore of the original disk and it fixed the problem (46 hours) but I do not trust the drive now so it is headed to the Home Theater system for daily recordings until it fails permanently.

With the recent Java scare I thought that might be the problem at first but now I think this is just a Windows glitch that happens infrequently. I wonder how many people encounter this problem and reformat?

There has been a few nasty infections around that corrupt the hdd as a parting gift. Maybe you hit one of those? Are you using Gotomeeting by any chance? :)
Logged
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Skuzzy

  • Support Member
  • Administrator
  • *****
  • Posts: 31462
      • HiTech Creations Home Page
Re: Interesting Event
« Reply #2 on: September 06, 2012, 06:33:36 AM »
There is a malware program, making the rounds, which does exactly what you described Chalenge.  Basically it eliminates the MBR and the copy of the MBR, and wipes the root filesystem record,  but not before it sends out all the personal information it can find on your drive.
Logged
Roy "Skuzzy" Neese
support@hitechcreations.com

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Re: Interesting Event
« Reply #3 on: September 06, 2012, 01:10:59 PM »
Well I hope that isnt it Skuzzy! Considering all the safety precautions I go through if I got hit then I think literally anyone could.
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Interesting Event
« Reply #4 on: September 06, 2012, 01:22:55 PM »
Quote from: Chalenge on September 06, 2012, 01:10:59 PM
Well I hope that isnt it Skuzzy! Considering all the safety precautions I go through if I got hit then I think literally anyone could.

With windows infections are just a matter of time, not if they'll happen. Especially if you share the computer with kids/family.
Logged
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Skuzzy

  • Support Member
  • Administrator
  • *****
  • Posts: 31462
      • HiTech Creations Home Page
Re: Interesting Event
« Reply #5 on: September 06, 2012, 01:53:51 PM »
Quote from: Chalenge on September 06, 2012, 01:10:59 PM
Well I hope that isnt it Skuzzy! Considering all the safety precautions I go through if I got hit then I think literally anyone could.

I hope that is not it either, but I thought you should know, just in case.  It just seems a bit timely as this one just got into the wild earlier this week.
Logged
Roy "Skuzzy" Neese
support@hitechcreations.com

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Re: Interesting Event
« Reply #6 on: September 06, 2012, 02:54:07 PM »
According to the answer I got at Microsoft it is a problem that stems from using non-MS disk utilities. I know for a fact that if I put chkdsk onto the task it would have thrashed the hard drive and lost data so that little bit of advice is useless!
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline Skuzzy

  • Support Member
  • Administrator
  • *****
  • Posts: 31462
      • HiTech Creations Home Page
Re: Interesting Event
« Reply #7 on: September 06, 2012, 03:14:59 PM »
Quote from: Chalenge on September 06, 2012, 02:54:07 PM
According to the answer I got at Microsoft it is a problem that stems from using non-MS disk utilities. I know for a fact that if I put chkdsk onto the task it would have thrashed the hard drive and lost data so that little bit of advice is useless!

Of course they are going to say that, after all, no one can make software as good as Microsoft can.

In this particular case, I doubt chkdsk would have done anything at all.  Without the root inode block or any of the copies of that block, chkdsk is pretty much clueless.  That is assuming the malware bugger got you.
Logged
Roy "Skuzzy" Neese
support@hitechcreations.com

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Re: Interesting Event
« Reply #8 on: September 06, 2012, 05:35:30 PM »
I ran GMER and a few rootkit scanners on it and they came up with nothing. I think its probably just poorly written software (meaning Windows). Even Thurott says that as time goes by the system will eventually become more and more unstable which is why the Repair option is available in the first place. SpinRite got it working but I dont trust the drive anymore even if it was the OS that caused this issue. It is the first Sata 3 I ever bought and I think its time it was put to use recording television.
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Interesting Event
« Reply #9 on: September 06, 2012, 11:57:05 PM »
Quote from: Chalenge on September 06, 2012, 05:35:30 PM
I ran GMER and a few rootkit scanners on it and they came up with nothing. I think its probably just poorly written software (meaning Windows). Even Thurott says that as time goes by the system will eventually become more and more unstable which is why the Repair option is available in the first place. SpinRite got it working but I dont trust the drive anymore even if it was the OS that caused this issue. It is the first Sata 3 I ever bought and I think its time it was put to use recording television.

Huh? Put your worst hdd to record the most valuable data you have??????  :O
Logged
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Re: Interesting Event
« Reply #10 on: September 07, 2012, 01:01:44 AM »
Ha! Television is the last thing I worry about.
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Interesting Event
« Reply #11 on: September 07, 2012, 01:38:13 AM »
Quote from: Chalenge on September 07, 2012, 01:01:44 AM
Ha! Television is the last thing I worry about.

The copyright holders opinion seems to differ  ;) If bits were gold you couldn't store more valuable data there.
Logged
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline cattb

  • Silver Member
  • ****
  • Posts: 1164
Re: Interesting Event
« Reply #12 on: September 11, 2012, 03:34:04 PM »
Since the partition was still there and nothing wrote over the information, why not just recover the information with recovery software?
Logged
:Salute Easy8 EEK GUS Betty

Offline Chalenge

  • Plutonium Member
  • *******
  • Posts: 15179
Re: Interesting Event
« Reply #13 on: September 11, 2012, 11:38:10 PM »
Thats what SpinRite is. I have since done a refresh install just to be sure.
Logged
If you like the Sick Puppy Custom Sound Pack the please consider contributing for future updates by sending a months dues to Hitech Creations for account "Chalenge." Every little bit helps.

Offline icepac

  • Platinum Member
  • ******
  • Posts: 7273
Re: Interesting Event
« Reply #14 on: September 12, 2012, 03:35:11 PM »
Can't you do a FDISK /MBR to load a generic mbr and then access the drive in windows?
Logged
Pages: [1] 2   Go Up
« previous next »