Nuked SD card after chkdsc or BCD change - any file forensics help?

Greetings, everyone!

Can anyone provide advice on forensic approaches or utilities to try on a
nuked SD card? Or suggest the best forums to cross-post in?

In the middle of installing a multiboot of Server x64 RC2 and Vista x64 SP1
RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
began to hang in Vista, and even on the occasions I could get into a Safe
Mode boot, the BSOD would reappear.

Somewhere in there, the path for the Vista boot was erased, and I used
EasyBCD to restore the entry successfully. That triggered Chkdsc instead of
Autochk on the next reboot, but no change in Vista's behavior. Amidst all of
this, I'd inadvertently left an SD card in a reader slot, and the contents
at some point got nuked.

(For those who begin to tut-tut, please know that Server has given me none
of the instability issues that the Vista x64 SP1 RC has. It installs drivers
without balking that Vista refuses to, and has none of the BSODs or Autochk
hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the source
of the problem -- reacting to non-threatening driver problems and directory
mismatches by making the situation a whole lot worse.)

The SD card shows a large number of folder and blank file icons, with
gibberish as names and file extensions. (It's possible that these are
elements of the pre-existing folder and file structure, as there was about
1GB of info on it.) Double-clicking on anything leads to unreadable file
errors.

Undelete Plus finds the volume unscannable.

Thanks for offering your insights.
a.k.a.

On Wed, 26 Dec 2007 15:46:50 -0500, a.k.a. wrote:

> Undelete Plus finds the volume unscannable.

How old is the card? These have a limited lifetime (shorter than what I had
hoped for). It's possible yours has bit the dust?

--
Sharon F
MS-MVP ~ Windows Shell/User

a.k.a. wrote:
> Greetings, everyone!
>
> Can anyone provide advice on forensic approaches or utilities to try on
> a nuked SD card? Or suggest the best forums to cross-post in?
>
> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> SP1 RC, I began encountering BSODs on shutdown of Vista. On reboot,
> Autochk began to hang in Vista, and even on the occasions I could get
> into a Safe Mode boot, the BSOD would reappear.
>
> Somewhere in there, the path for the Vista boot was erased, and I used
> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> of Autochk on the next reboot, but no change in Vista's behavior. Amidst
> all of this, I'd inadvertently left an SD card in a reader slot, and the
> contents at some point got nuked.

(snippage)

> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was
> about 1GB of info on it.) Double-clicking on anything leads to
> unreadable file errors.
>
> Undelete Plus finds the volume unscannable.

You can run data recovery software on the card. I've heard that Undelete
Plus is good but I'd try some others, too. The ones that cost usually
will let you download a trial to see if they can recover the files. I
use Easy Recovery Pro, but it is expensive. People whom I respect have
recommended R-Studio and Restoration. YMMV.

http://www3.telus.net/mikebike/RESTORATION.html
PCInspector File Recovery -
http://www.pcinspector.de/file_recovery/welcome.htm
Executive Software “Undelete” -
http://www.execsoft.com/undelete/undelete.asp
R-Studio - http://www.r-tt.com/
File Scavenger - http://www.quetek.com/prod02.htm
Ontrack's EasyRecovery - http://www.ontrack.com/software/

I've also had very good luck with PhotoRescue:
http://www.datarescue.com/photorescue/

If consumer-level data recovery software will not help, then your only
recourse is a professional data recovery company such as DriveSavers.
This is quite an expensive proposition ($500+), but only you know the
value of your data.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Sharon, in this case, the card is at most 2 months old, bought based on a 4+
star rating at Newegg, so presumably reliable. I'll eventually reformat to
see if the card is corrupt, but of course it's too early to do so. Most
likely this was another one of those hidden Windows death traps. Grr.

a.k.a.

"Sharon F" wrote:

> On Wed, 26 Dec 2007 15:46:50 -0500, a.k.a. wrote:
>
> > Undelete Plus finds the volume unscannable.
>
> How old is the card? These have a limited lifetime (shorter than what I had
> hoped for). It's possible yours has bit the dust?
>
> --
> Sharon F
> MS-MVP ~ Windows Shell/User
>

Malke, thanks for all of these leads! I'll give them a shot, and in a while,
will post back with whatever results they give.

a.k.a.

"Malke" wrote:

> a.k.a. wrote:
> > Greetings, everyone!
> >
> > Can anyone provide advice on forensic approaches or utilities to try on
> > a nuked SD card? Or suggest the best forums to cross-post in?
> >
> > In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> > SP1 RC, I began encountering BSODs on shutdown of Vista. On reboot,
> > Autochk began to hang in Vista, and even on the occasions I could get
> > into a Safe Mode boot, the BSOD would reappear.
> >
> > Somewhere in there, the path for the Vista boot was erased, and I used
> > EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> > of Autochk on the next reboot, but no change in Vista's behavior. Amidst
> > all of this, I'd inadvertently left an SD card in a reader slot, and the
> > contents at some point got nuked.
>
> (snippage)
>
> > The SD card shows a large number of folder and blank file icons, with
> > gibberish as names and file extensions. (It's possible that these are
> > elements of the pre-existing folder and file structure, as there was
> > about 1GB of info on it.) Double-clicking on anything leads to
> > unreadable file errors.
> >
> > Undelete Plus finds the volume unscannable.
>
> You can run data recovery software on the card. I've heard that Undelete
> Plus is good but I'd try some others, too. The ones that cost usually
> will let you download a trial to see if they can recover the files. I
> use Easy Recovery Pro, but it is expensive. People whom I respect have
> recommended R-Studio and Restoration. YMMV.
>
> http://www3.telus.net/mikebike/RESTORATION.html
> PCInspector File Recovery -
> http://www.pcinspector.de/file_recovery/welcome.htm
> Executive Software “Undelete� -
> http://www.execsoft.com/undelete/undelete.asp
> R-Studio - http://www.r-tt.com/
> File Scavenger - http://www.quetek.com/prod02.htm
> Ontrack's EasyRecovery - http://www.ontrack.com/software/
>
> I've also had very good luck with PhotoRescue:
> http://www.datarescue.com/photorescue/
>
> If consumer-level data recovery software will not help, then your only
> recourse is a professional data recovery company such as DriveSavers.
> This is quite an expensive proposition ($500+), but only you know the
> value of your data.
>
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>

Incidentally, the weird thing about the Vista x64 Autochk hang was that,
waiting a bit, you could hear the audio Vista startup jingle! I even tried
ctrl+alt+del -> password -> enter on the premise it might actually log in.
The screen remained in B&W verbose mode, but the hard drive activity kicked
in again for several long minutes.

The Autochk hang occurred at the point where it said it was done with the
scan of all of the volumes.

Anyone know another forum where this issue should be reported?

a.k.a.

"a.k.a." wrote:

> Greetings, everyone!
>
> Can anyone provide advice on forensic approaches or utilities to try on a
> nuked SD card? Or suggest the best forums to cross-post in?
>
> In the middle of installing a multiboot of Server x64 RC2 and Vista x64 SP1
> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
> began to hang in Vista, and even on the occasions I could get into a Safe
> Mode boot, the BSOD would reappear.
>
> Somewhere in there, the path for the Vista boot was erased, and I used
> EasyBCD to restore the entry successfully. That triggered Chkdsc instead of
> Autochk on the next reboot, but no change in Vista's behavior. Amidst all of
> this, I'd inadvertently left an SD card in a reader slot, and the contents
> at some point got nuked.
>
> (For those who begin to tut-tut, please know that Server has given me none
> of the instability issues that the Vista x64 SP1 RC has. It installs drivers
> without balking that Vista refuses to, and has none of the BSODs or Autochk
> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the source
> of the problem -- reacting to non-threatening driver problems and directory
> mismatches by making the situation a whole lot worse.)
>
> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was about
> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> errors.
>
> Undelete Plus finds the volume unscannable.
>
> Thanks for offering your insights.
> a.k.a.
>
>

If a drive constantly hangs when doing an auto check, or when running
chkdsk, I would certainly run the drive manufacturers hard drive test
utility from a bootable floppy or CD.

--

Regards,

Richard Urban
Microsoft MVP Windows Shell/User


"a.k.a." <> wrote in message
news:FBE4CE80-9599-4DB0-8AD4-...
>
> Incidentally, the weird thing about the Vista x64 Autochk hang was that,
> waiting a bit, you could hear the audio Vista startup jingle! I even tried
> ctrl+alt+del -> password -> enter on the premise it might actually log in.
> The screen remained in B&W verbose mode, but the hard drive activity
> kicked
> in again for several long minutes.
>
> The Autochk hang occurred at the point where it said it was done with the
> scan of all of the volumes.
>
> Anyone know another forum where this issue should be reported?
>
> a.k.a.
>
> "a.k.a." wrote:
>
>> Greetings, everyone!
>>
>> Can anyone provide advice on forensic approaches or utilities to try on a
>> nuked SD card? Or suggest the best forums to cross-post in?
>>
>> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
>> SP1
>> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
>> began to hang in Vista, and even on the occasions I could get into a Safe
>> Mode boot, the BSOD would reappear.
>>
>> Somewhere in there, the path for the Vista boot was erased, and I used
>> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
>> of
>> Autochk on the next reboot, but no change in Vista's behavior. Amidst all
>> of
>> this, I'd inadvertently left an SD card in a reader slot, and the
>> contents
>> at some point got nuked.
>>
>> (For those who begin to tut-tut, please know that Server has given me
>> none
>> of the instability issues that the Vista x64 SP1 RC has. It installs
>> drivers
>> without balking that Vista refuses to, and has none of the BSODs or
>> Autochk
>> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the
>> source
>> of the problem -- reacting to non-threatening driver problems and
>> directory
>> mismatches by making the situation a whole lot worse.)
>>
>> The SD card shows a large number of folder and blank file icons, with
>> gibberish as names and file extensions. (It's possible that these are
>> elements of the pre-existing folder and file structure, as there was
>> about
>> 1GB of info on it.) Double-clicking on anything leads to unreadable file
>> errors.
>>
>> Undelete Plus finds the volume unscannable.
>>
>> Thanks for offering your insights.
>> a.k.a.
>>
>>

> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was about
> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> errors.
>
> Undelete Plus finds the volume unscannable.
>
> Thanks for offering your insights.
> a.k.a.

For the successful recovery of pictures from SD card, take the help of
Stellar Phoenix Digital Media Recovery Software. Stellar Phoenix
recovers lost, deleted and formatted digital photos / pictures /
images / audio files from removable media, after an accidental
deletion, media format or corrupt media. Apart from the SD card it
also provides data recovery from Memory Sticks, Flash Cards, Sony
Memory Stick, IBM Micro Drive, MMC Cards, XD Cards, Secure Digital
Card, Zip Disks, Mini Disks.
For more information visit: http://www.stellarinfo.com/digital-media-recovery.htm

Richard,
I'll do so. This is a brand new drive, though, with the latest firmware
flash. What's puzzling about the hangs is that they only occur in Vista x64.
The Server 2008 x64 that's mounted on the same drive has never seen a single
hang of this sort.
a.k.a.

"Richard Urban" wrote:

> If a drive constantly hangs when doing an auto check, or when running
> chkdsk, I would certainly run the drive manufacturers hard drive test
> utility from a bootable floppy or CD.
>
> --
>
> Regards,
>
> Richard Urban
> Microsoft MVP Windows Shell/User
>
>
> "a.k.a." <> wrote in message
> news:FBE4CE80-9599-4DB0-8AD4-...
> >
> > Incidentally, the weird thing about the Vista x64 Autochk hang was that,
> > waiting a bit, you could hear the audio Vista startup jingle! I even tried
> > ctrl+alt+del -> password -> enter on the premise it might actually log in.
> > The screen remained in B&W verbose mode, but the hard drive activity
> > kicked
> > in again for several long minutes.
> >
> > The Autochk hang occurred at the point where it said it was done with the
> > scan of all of the volumes.
> >
> > Anyone know another forum where this issue should be reported?
> >
> > a.k.a.
> >
> > "a.k.a." wrote:
> >
> >> Greetings, everyone!
> >>
> >> Can anyone provide advice on forensic approaches or utilities to try on a
> >> nuked SD card? Or suggest the best forums to cross-post in?
> >>
> >> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> >> SP1
> >> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
> >> began to hang in Vista, and even on the occasions I could get into a Safe
> >> Mode boot, the BSOD would reappear.
> >>
> >> Somewhere in there, the path for the Vista boot was erased, and I used
> >> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> >> of
> >> Autochk on the next reboot, but no change in Vista's behavior. Amidst all
> >> of
> >> this, I'd inadvertently left an SD card in a reader slot, and the
> >> contents
> >> at some point got nuked.
> >>
> >> (For those who begin to tut-tut, please know that Server has given me
> >> none
> >> of the instability issues that the Vista x64 SP1 RC has. It installs
> >> drivers
> >> without balking that Vista refuses to, and has none of the BSODs or
> >> Autochk
> >> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the
> >> source
> >> of the problem -- reacting to non-threatening driver problems and
> >> directory
> >> mismatches by making the situation a whole lot worse.)
> >>
> >> The SD card shows a large number of folder and blank file icons, with
> >> gibberish as names and file extensions. (It's possible that these are
> >> elements of the pre-existing folder and file structure, as there was
> >> about
> >> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> >> errors.
> >>
> >> Undelete Plus finds the volume unscannable.
> >>
> >> Thanks for offering your insights.
> >> a.k.a.
> >>
> >>
>
>

Thanks for this suggestion. I'll check it out as well.

Of the many docs that were stored temporarily on the SD card, the most
important were PDFs. I've heard PDF described as a hi-performance graphics
format, so this one may be worth it if it decodes PDF.
a.k.a.

"" wrote:

>
> > The SD card shows a large number of folder and blank file icons, with
> > gibberish as names and file extensions. (It's possible that these are
> > elements of the pre-existing folder and file structure, as there was about
> > 1GB of info on it.) Double-clicking on anything leads to unreadable file
> > errors.
> >
> > Undelete Plus finds the volume unscannable.
> >
> > Thanks for offering your insights.
> > a.k.a.
>
> For the successful recovery of pictures from SD card, take the help of
> Stellar Phoenix Digital Media Recovery Software. Stellar Phoenix
> recovers lost, deleted and formatted digital photos / pictures /
> images / audio files from removable media, after an accidental
> deletion, media format or corrupt media. Apart from the SD card it
> also provides data recovery from Memory Sticks, Flash Cards, Sony
> Memory Stick, IBM Micro Drive, MMC Cards, XD Cards, Secure Digital
> Card, Zip Disks, Mini Disks.
> For more information visit: http://www.stellarinfo.com/digital-media-recovery.htm
>