Crash recovery – a litany of errors

Here’s how NOT to recover from a faulty hard drive.

I turned on my laptop and got an error while booting about a faulty NTLDR.SYS file – or some name like that. The error said to insert the Windows CD and select option “R” to recover.

My Acer laptop didn’t come with a Windows CD, it came with a “Recovery CD”. So I inserted that CD, booted from it, and the damned thing started formatting my hard drive. Yes there was some vague warnings in broken English about backing up data, but I was expecting to see a Windows message, and got something totally different.

“Ah!!!!” I screamed as I saw what was happening, and turned my machine off in the middle of the format.

Now the disk drive was partially formatted, and had no directory info on it.

So I plugged in my trusty USB drive backup, and went about getting the machine ready to Ghost the backup drive back to the original drive.

Getting a laptop to boot from a CD and run Ghost is an effort in itself and took me about 2 hours to figure out. If you want to try it yourself, get Ghost to burn a bootable floppy that does the same thing, and use something like UBCD to convert the floppy to a CD.

So I ghosted the backup drive back to the laptop, booted the laptop and…. NOTHING. The USB drive was faulty, and the backup drive was unreadable.

“Ah!!!!” I screamed again in a Homer Simpsonesque panic.

I ran Spinrite on the USB drive in a vain attempt to fix it. But the back up drive was faulty (remember, Neil?) and so it just made things worse – and I lost the partition table on the backup drive.

So I threw the USB drive caddy out the window, and connected te Backup drive to a spare IDE port on my desktop computer. Still no joy.

So I tried a thing called “Diskpatch” which is supposed to fix partition tables. It said a few encouraging words, and did absolutely nothing.

Finally, I tried a thing caled “iRecover”. It was able to see stuff on the drive. Most of it was scrambled, but I used it to pump as much corrupted data from the drive as I could.

It has been running for about 7 days, and has almost finished pumping everything from the 60GB backup drive. about 75% of the stuff is rubbish. I was able to recover one or two snippets that were some use to me.

Bottom line – I lost about 6 months worth of work – but was able to scrounge a lot of it back from other sources.

I NEVER EVER want to go through this again. It’s bad for my health, my marriage and my business. Here’s what I will do in future:

1. Backup more regularly to multiple locations.
2. Use something like NTI to create a bootable backup DVD of my drive.
3. Get a new Laptop – the Acer Travelmate is rubbish.
4. Never try to run windows repair on a faulty drive until I’ve pumped it for all the information I can.
5. Never trust a USB drive. Especially one that runs hot.
6. Backup more regularly to multiple locations.
7. Buy high quality equipment

The other thing with Laptops – don’t move them around until you’ve put the machine in standby mode. If you do, the diskdrive is still spinning, and there’s a good chance you’ll stuff the drive up.

You will have one of your disks crash on you sometime in the next few years. It’s happened to me 4 times in the last 12 months on 2 different machines. Make sure you can recover from it. Do something about it today.

iRecover is available from http://www.diydatarecovery.nl

It works, but it is damned slow.

Loan repayment calculations and high school algebra

FV = (PMT*(1+RATE*TYPE)*(1-(1+RATE)^NPER)/RATE) – PV*(1+RATE)^NPER

This is the formula for the “Future Value” (FV) of an investment assuming an initial investment (PV), constant repayments (PMT) and a constant interest rate (RATE) over a fixed term of months (NPER). When “TYPE” is zero, loan repayments are made in advance. When “TYPE” is 1, loan repayments are made in arrears.

You can algebraically rearrange the formula to give an expression that calculates PMT.

You can also rearrange the formula to give an expression that calculates PV.

Both of these just require simple high-school algebra.

But you CAN’T rearrange the formula to give an expresion that calculates RATE or NPER.

To work out these figures, you have to use an iterative method where you “plug in” a guess of what you think the rate or period should be, evaulate the result, and adjust your guess accordingly.

If you use some smart iterative methods, you should only have to loop about 5 times. The simplest way is given two guess / result pairs (x1, y1) and (x2, y2), and wanting to find the “x” which will result in “y”, your next best guess is to try x = y*(x1-x2)/(y1-y2).

In subsequent iterations, discard the (x,y) pair furthest from the desired result, and repeat the process with the new results.

RAID-1 Upgrade (RTFM!!!)

My server had 2 x 60gb Seagate IDE drives in a software RAID-1 array.

For those of you who don’t know, this means that although I had two 60gb drives in the server, it only looked like I had one, because I’d set it up so that Windows kept a “mirror” of the drive. That meant that if one drive failed, my machine would still work ok because the “mirrored” copy would still be available.

One of the drives recently started showing errors, so I decided to replace it.

Although 60gb drives are still available, I decided to replace the array with two 160GB drives to give me a bit more space.

The big question was, how to replace the drives without taking my server offline for too long?

One alternative would be to break the mirror (remove the faulty drive from the machine) and replace it with the new 160GB drive, then add that 160GB drive to the mirror. Althoug I wasn’t 100% certain, I thought that if I did this, the 160GB drive would only use 60GB of the available space, and I’d be wasting most of it. Despite this, the advantage would be that the machine would only be offline just for the time it took to replace the drive and turn it back on again.

Instead of this approach, I decided to add one of the 160gb drives to the machine as a 3rd disk drive. I would then use Norton Ghost to copy the contents of the mirrored volume onto the new drive. The disadvantage of this approach is that Norton Ghost requires the machine to be offline while it runs in DOS mode to copy the entire contents of the drive, ensuring that nothing gets changed inadvertently while copying from one drive to another.

For some reason I cannot fathom, 10 minutes after starting the Ghost, the screen on the server went blank, and the server died. Initially I thought it was just some sort of lowlevel screen saver in the video card (optimistic, aren’t I?) so I left the machine for a couple of hours, hoping that ghost would finish.

Eventually, after trying the same process several times, I came to the conclusion that ghosting a mirrored volume just wasn’t going to work. I thought perhaps it was because my power supply couldn’t cope with 3 drives, tape drive and DVD drive and so disconnected the DVD and tape. This still didn’t fix the problem, so all I can suggest is that Ghost doesn’t like copying mirrors.

In the end, I read the instructions on the label of the new disk drive, downloaded a utlility from http://www.seagate.com/support called “DiscWizard for Windows” and ran it.

It’s great!!! It found my new drive, formatted and partitioned it for me, then asked me if I wanted to replace an existing bootable drive. I said yes, it copied all the files, then gave me a printout telling me what jumpers to change on each of the drives, and whereabouts on the IDE cable to put the new drive. All with friendly illustrations.

AND it did all the copying while the server was still online.

AND (best of all) it worked!

The added bonus is that DiscWizard is free. It comes with all Seagate drives.

So the moral of the story is that I was trying to be too smart. In this situation, if I had just RTFM (read the fine manual) I would have saved myself about 12 hours of frustrating heartache.

Today I’ve got two 160gb drives in a mirrored array, and feel very relieved that it’s all working again. I’ll know next time how to swap my disks over with the minimum amount of messing around.