Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

gmillerx

macrumors newbie
Original poster
Jan 23, 2009
8
0
Here's the summary:
*
8-core MacPro2,1 running 10.6.8, Paragon NTFS for Mac, Bootcamp Win7.
*
4 internal HDD drives: two 1.5TBs for data, one 1TB for MacOS, one 1.5TB for Win7 bootcamp.
*
I mostly use the Mac side for music production (but rarely), and the Win side for business and everything else. Scores and scores of Win apps installed over the years. [4 monitor system], well over 500K files on the drive.
*
I just backed up the data from the two data-only drives, and made a bootable clone of the MacOS drive (SuperDuper). I have never successfully been able to clone the Win7 Bootcamp NTFS drive (even with Winclone back in 2009) because of volume sizes (or something). I decided to try again, from WITHIN Windows this time (all other attempts were from the Mac OS side).
*
I bought, downloaded, and installed Acronis True image from within the Win7 bootcamp system. [I obviously did not know that it was gonna modify my MBR, and I had no idea at the time that the GPT and MBR areas were somehow 'mingled' on a bootcamp drive.]
*
So, when I performed the Acronis-requested reboot (my default boot is into the Bootcamp/Win7 drive), it failed to boot and requested some Windows recovery media or something. I was concerned that anything i put in the DVD drive would sabotage my priceless (in retrospect) stable/optimized Win7 bootcamp system. So, i just hard-powered down the Mac and tried to restart.
*
I did the Alt/option key, and i was presented with the Mac or Win drive icons. I selected Win, and then I got a different boot error message--'no MBR found'.*
*
But this time i realized that Acronis had stepped where it shouldn't have, and I figured the Mac side could fix the boot problem (maybe with bootcamp assistant or something).
*
If i had stopped THERE, and searched the forums i could have found how to fix THAT problem--that has been answered tons of times…
*
But, instead, i went to Disk Utility and asked it to repair my Bootcamp partition (I have Paragon NTFS and it has worked for years, and so I did not have a reason to doubt Disk Utility's ability to Repair an NTFS volume--not that i have tried it before, of course).
*
Disk Utility repair ran for about 10-15 minutes and said it fixed about 10-20 things.
*
The drive information (in the side bar and below) still had the BOOTCAMP partition, reported that it was NTFS, said that there was 308 GB still available of the 1.5TB drive, and that it contained 1.19TB 'used'. Looked normal to me.
*
I closed Disk Utility and then opened a Finder window to see if DU left any 'artifacts' of its 'fixes' on the BOOTCAMP partition, and all the files were gone! Even though DU said it had 1.19TB 'used', all of my files are gone. [I rebooted also, to verify that it was not some 'delayed reporting' issue.]

*
When I enable 'hidden files' to show, what I get on the Bootcamp partition are these three entries:
.DS_Store (16KB), .fseventsd folder (with a 1KB UUID file inside it), and a .Trashes folder with zero KB.
*
At this point, I panic and assume the position of despair. There is no 'undo' key for the D/U that I can find. I do an orderly shut down of the system, physically remove the Win7 BC drive, and make/verify a sector-by-sector clone of the drive (on a Win7 laptop, using Acronis--22 hours).
*
In Win7 Disk Management, the GPT partition (on the original drive) shows up and the BOOTCAMP partition shows up--with the proper size--but windows does NOT recognize the partition as being NTFS. It reports it as being RAW and 'urges' me to format it (yeah, right…).
*
So, I place the sector-by-sector duplicate back into the Mac, boot up (only the Mac OS is given as an option), and am ready to 'work on' recovering the Win7 BC partition (if possible).
*
I am avoiding trying to fix the booting problem, because recovery of the 1.2TB of a working system is much more critical for me.
*
The clone HDD reports the same in DU, except now the GPT partition shows up as greyed-out 'disk1s1', right above the "BOOTCAMP" partition in the sidebar. [I understand from researching this that disk1s1 is somehow related to the bootloader for BC?]
*
I used the demo version of Data Rescue 3 to scan for recoverable files from the drive, but it doesn't even report the .files. (I am running the deep scan now, but will take about another 9 hours to complete that).
*
Has anybody got any suggestions on how to reclaim this partition and its system?
*
Here are a couple of other details from diagnostic tools:
*
*Model Name:*** Mac Pro
* Model Identifier:*** MacPro2,1
* Processor Name:*** Quad-Core Intel Xeon
* Processor Speed:*** 3 GHz
* Number Of Processors:*** 2
* Total Number Of Cores:*** 8
* L2 Cache (per processor):*** 8 MB
* Memory:*** 13 GB
* Bus Speed:*** 1.33 GHz
* Boot ROM Version:*** MP21.007F.B06
*
newmac:~ gmmx2$ sudo gpt -r show disk1
****** start******* size* index* contents
********** 0********** 1******** PMBR
********** 1********** 1******** Pri GPT header
********** 2********* 32******** Pri GPT table
********* 34***** 262144***** 1* GPT part - E3C9E316-0B5C-4DB8-817D-F92DF00215AE
***** 262178******* 2014*********
***** 264192***** 409600***** 2* GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
***** 673792* 2929602560***** 3* GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
* 2930276352******** 783*********
* 2930277135********* 32******** Sec GPT table
* 2930277167********** 1******** Sec GPT header
*
newmac:~ gmmx2$ diskutil list
/dev/disk0
** #:********************** TYPE NAME******************* SIZE****** IDENTIFIER
** 0:***** GUID_partition_scheme*********************** *1.0 TB**** disk0
** 1:*********************** EFI************************ 209.7 MB** disk0s1
** 2:***************** Apple_HFS Macintosh HD*********** 999.9 GB** disk0s2
/dev/disk1
** #:********************** TYPE NAME******************* SIZE****** IDENTIFIER
** 0:***** GUID_partition_scheme*********************** *1.5 TB**** disk1
** 1:******** Microsoft Reserved************************ 134.2 MB** disk1s1
** 2:*********************** EFI************************ 209.7 MB** disk1s2
** 3:****** Microsoft Basic Data BOOTCAMP************** 1.5 TB**** disk1s3
/dev/disk2
** #:********************** TYPE NAME******************* SIZE****** IDENTIFIER
** 0:***** GUID_partition_scheme*********************** *1.5 TB**** disk2
** 1:*********************** EFI************************ 209.7 MB** disk2s1
** 2:***************** Apple_HFS D3********************* 750.0 GB** disk2s2
** 3:****** Microsoft Basic Data DATA3***************** 749.9 GB** disk2s3
/dev/disk3
** #:********************** TYPE NAME******************* SIZE****** IDENTIFIER
** 0:**** FDisk_partition_scheme*********************** *1.5 TB**** disk3
** 1:************** Windows_NTFS SSDSUB**************** 1.5 TB**** disk3s1
*
*
[Disk 1 is obviously the BC one]
*
*
newmac:~ gmmx2$ sudo fdisk /dev/disk1
Password:
Disk: /dev/disk1*** geometry: -5415437/4/63 [-1364690128 sectors]
Signature: 0xAA55
******** Starting****** Ending
*#: id* cyl* hd sec -* cyl* hd sec [**** start -****** size]
------------------------------------------------------------------------
*1: EE*** 0** 0** 2 - 1023 254* 63 [******** 1 - -1364690129] <Unknown ID>
*2: 00*** 0** 0** 0 -*** 0** 0** 0 [******** 0 -********* 0] unused******
*3: 00*** 0** 0** 0 -*** 0** 0** 0 [******** 0 -********* 0] unused******
*4: 00*** 0** 0** 0 -*** 0** 0** 0 [******** 0 -********* 0] unused******
*
*
*
I cannot be the only one who has much such a catastrophic error, so I am hoping that there is something I have overlooked (being only a part-time Mac user) or there is some utility somewhere which can fix this--
*
Or if you need more data, let me know...
*
thank you for your time--gmm
 

gmillerx

macrumors newbie
Original poster
Jan 23, 2009
8
0
here are the 'repairs' DU made--i found the log

2013-01-28 04:31:00 -0700: Disk Utility started.

2013-01-28 04:31:30 -0700: Verify and Repair volume “BOOTCAMP2013-01-28 04:31:30 -0700: Starting repair tool:
2013-01-28 04:31:30 -0700: Verifying files...
2013-01-28 04:31:57 -0700: Adjusting instance tags to prevent rollover on file 0x606f0.
2013-01-28 04:31:57 -0700: Adjusting instance tags to prevent rollover on file 0x606f2.
2013-01-28 04:31:57 -0700: Adjusting instance tags to prevent rollover on file 0x606f4.
2013-01-28 04:32:01 -0700: Files verification completed.
2013-01-28 04:32:01 -0700: Verifying meta files...
2013-01-28 04:32:01 -0700: Meta files verification completed.
2013-01-28 04:32:01 -0700: Veryfing $AttrDef.
2013-01-28 04:32:01 -0700: Veryfing $Boot.
2013-01-28 04:32:01 -0700: Verifying $UpCase.
2013-01-28 04:32:01 -0700: Correcting $UpCase data.
2013-01-28 04:32:01 -0700: Verifying $LogFile.
2013-01-28 04:32:01 -0700: Verifying $Volume.
2013-01-28 04:32:02 -0700: Verifying files with EAs...
2013-01-28 04:32:02 -0700: EAs verification completed.
2013-01-28 04:32:02 -0700: Verifying folders...
2013-01-28 04:41:54 -0700: Folders verification completed.
2013-01-28 04:41:54 -0700: Minor inconsistencies are detected on the volume.
2013-01-28 04:41:54 -0700: Creating root directory
2013-01-28 04:41:54 -0700: Verifying security descriptors...
2013-01-28 04:41:54 -0700: Clearing invalid security descriptor 0x25e
2013-01-28 04:41:54 -0700: Clearing invalid security descriptor 0x260
2013-01-28 04:41:54 -0700: Clearing invalid security descriptor 0x797
2013-01-28 04:41:54 -0700: Clearing invalid security descriptor 0x1538
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SII entry 0x25e
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SII entry 0x260
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SII entry 0x797
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SII entry 0x1538
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SDH entry Id=0x797
2013-01-28 04:41:54 -0700: Deleting orphan $Secure::$SDH entry Id=0x25e
2013-01-28 04:41:55 -0700: Deleting orphan $Secure::$SDH entry Id=0x260
2013-01-28 04:41:55 -0700: Deleting orphan $Secure::$SDH entry Id=0x1538
2013-01-28 04:41:55 -0700: Verifying files security...
2013-01-28 04:41:55 -0700: Record 0x97c contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0x99b contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0xb88 contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0xb91 contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0xb92 contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0x5633 contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0x5635 contains invalid security Id (0x260)
2013-01-28 04:41:55 -0700: Record 0x5637 contains invalid security Id (0x260)
2013-01-28 04:41:57 -0700: Record 0xe1d4 contains invalid security Id (0x25e)
2013-01-28 04:41:57 -0700: Record 0xe1d5 contains invalid security Id (0x25e)
2013-01-28 04:41:57 -0700: Record 0xe1d6 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x111c9 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x111ca contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x111cb contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x111dc contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x11285 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x11297 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x113c4 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x113c5 contains invalid security Id (0x260)
2013-01-28 04:41:58 -0700: Record 0x12528 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x1cfe2 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x1dce1 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x1f6a8 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x1f6a9 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x1f6c4 contains invalid security Id (0x260)
2013-01-28 04:42:00 -0700: Record 0x21d57 contains invalid security Id (0x797)
2013-01-28 04:42:03 -0700: Record 0x3220d contains invalid security Id (0x260)
2013-01-28 04:42:06 -0700: Record 0x4bc2a contains invalid security Id (0x260)
2013-01-28 04:42:10 -0700: Record 0x64ff9 contains invalid security Id (0x1538)
2013-01-28 04:42:11 -0700: Can't read $SDS
2013-01-28 04:42:12 -0700: Security verification completed
2013-01-28 04:42:12 -0700: Verifying $MFT.
2013-01-28 04:42:12 -0700: Verifying $MFTMirr.
2013-01-28 04:42:12 -0700: Verifying $Bitmap.
2013-01-28 04:42:18 -0700: Volume repair complete.2013-01-28 04:42:18 -0700: Updating boot support partitions for the volume as required.2013-01-28 04:42:18 -0700: Repair tool completed:
2013-01-28 04:42:18 -0700:
2013-01-28 04:42:18 -0700:
 

gmillerx

macrumors newbie
Original poster
Jan 23, 2009
8
0
Update: DataRescue3 results

Update: Data Rescue 3 ran 14 hours and found 28+ million files. I recovered 2-3million files (354GB), but without the original filenames, I would have to open each file to determine contents. The most important file (Outlook email repository) was not found. So, the data might still be on the drive, but I do not know how to rebuild the directory structure/etc, assuming it can be done.
 

switon

macrumors 6502a
Sep 10, 2012
636
1
RE: 28+million files...?

Wow, do you really have over 28+million files in 1.2TB of space? This is amazing. And I thought I had a lot of files...

Good luck,
Switon
 

gmillerx

macrumors newbie
Original poster
Jan 23, 2009
8
0
file count is from Rescue...

the 28M file count was the number reported by DataRescue3 -- but i KNOW some (many? most?) of these are fragments. The 2M files that I recovered are a mix of fragments and good files. There were gobs of OLEs and image fragments, partial Word docs, etc. I dont really believe I had but 1-2 million files on the drive to begin with (Win7 files, adobe CS5, and tons of video and image files--eg buttons, fonts, etc).
 

switon

macrumors 6502a
Sep 10, 2012
636
1
Re: ...

Hi gmillerx,

I would not want to be in your shoes right now...I assume you don't have a viable backup of this material?

Good luck,
Switon
 

gmillerx

macrumors newbie
Original poster
Jan 23, 2009
8
0
Ran out of time--Giving Up. Will start from scratch, and restall win/and the layers of applications updates-upon-updates needed.

I dont know how to remove this thread, but maybe a mod/admin could. no real useful information in it, so it could be deleted. i wont be checking it anymore.

Thanks anyway--to anyone who read and tried to help (or offered condolensces--sigh/smile).
 

aitl

macrumors newbie
May 16, 2013
1
0
Same story

got a 2tb passport studio from Western digital. Lost data second time after using the repair. heres how it happens.

1. The plug of the hdd disconnects accidently
2. next time you plug it in your mac dont detect the hdd, but it shows nicely in the hdd utility area
3. start a verify process
4. start a recovery process
5. disconnected and reconnect the drive, it shows well
6. you've lost all/most files
no recovery is possible
Now, the question is that is it the fault of western digital or mac utility repair.
This post confirms the doubt it seems.
ANyone with any solutions for recovery?
 

TheEasterBunny

macrumors 6502
Jan 22, 2013
251
0
Delaware
USB cables do wear out. If you lost connection, no matter how briefly during the verify or repair, or any accessing of the drive, it can and will corrupt the files to the point of Mac OS not being able to read them. a recovery app may be able to find them.

In the work I do, we use USB cables a lot, I have seen cables that look perfectly fine just stop working reliably, causing corruption, and errors.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.