SBS 2003 DC w/Exchange - sudden HDD failure
Happy New Year!
I'm screwed. I hope someone can help. SBS 2003 SP2 DC w/Exchange, 2 small HDD's, the master is 120G partitioned 80G/20G for OS and storage, respectively. The second HDD is a single partition for storage and backup.
Yesterday afternoon I took a look at the event logs (after several months of neglect) in the server and noticed a few disk related errors, i.e., "bad block" errors that apparently have been recorded consistently about 3 times a month for a few months. I figured it was time for a new drive. As a precaution I did a simple disk clean-up and cleared some log files on the root as well as deleting a few gigs of old data and stored applications on the second partition of the primary drive. Then a defrag. After the defrag was completed I took a look at the defrag log and noticed that a hefty amount of files couldn't be defragged; the largest of which were shadow copies I had enabled on the root. It appeared I shouldn't have been doing that in the first place so I decided to move those from the primary master disk to the secondary slave.
About an hour later I notice the HDD is accessing constantly, so I log in to the server to see what's going on. I ran a quick CHKDSK just to get a peek at what the file system looked like. To my dismay, CHKDSK reported the file system as "RAW". The server is still running and I can still browse shares, log on/off, send and receive email, browse the internet, etc. Not knowing what else to do I start trying to pull all the data I can from server shared folders to other workstations on the network. This was unsuccessful; the systems ended up hanging. The server was still up but response time was slowing.
I came across a post advising another user in a similar situation to run "sync.exe" (?) from the SBS resource kit in order to try to get the paged files on the drive to sync down if/when the system crashed, ostensibly to prevent file corruption if CHKDSK auto ran on reboot. I had the resource kit installed so I ran that command.
A short time later the machine suddenly shut down as though power had been pulled.
I booted to a SpinRite CD I had to see about trying to repair the disk before trying to restart Windows. It seems the drive is pretty hosed. After letting SpinRite run all night and only progress to 3% of the drive I stopped it for fear of doing more damage.
I booted to an ERD 2003 Commander CD to see what damage had been done and pull what data I could to do a restore later. I find that the secondary slave drive had about 15 Visual Studio C++ EULA text files in English and French all numbered in sequence saved in it's root. Very odd. Moreover, I see that even more C++ Visual Studio .msi files (about 10 to 15MB in size) are also saved there in a similar sequentially numbered naming sequence...probably about 20 or so of them. Those weren't there before. I take it this is a bad sign.
In going through the primary root with ERD I see that there appears to be some damage to the file system but it didn't look all that bad...until I tried to open the Windows directory.
It's empty, or so it appears to the OS...only the folder remains.
I tried to do a recover with ERD 2003 but that hung. I also tried booting to the new MS version of ERD and doing a recovery with it, but it hung as well. Interestingly, when I examined the secondary slave HDD's file system with the MS version of ERD, it appeared that either they were gone or that this version couldn't see them.
I pulled the server's primary drive and connected to one of the XP workstations via an external USB enclosure. I was able to pull the user's shared folders as well as some other data so it is accessible to a degree. Moreover even though the Windows folder won't browse, i.e., you can't see files there from withing explorer, I can still access certain folders within the directory if I happen to find a file in a visible folder that's mapped there. I happened on this by chance.
Windows XP reports partition 1 as being 1G total in size with 500MB free space. In actuality the partition is 80G with about 20G or so free. The second partition on the drive is reported correctly.
Acronis Disk Director Advanced 11, installed on the same XP workstation, reports the correct size for both partitions. I'm hoping this a good thing.
I've been advised by the MVP's over at TechNet that if anything can restore the corruption that's taken place with my HDD, it's Acronis.
I'm not too sure how to proceed with Acronis in this scenario. I'm hoping someone might give me a hand.
Thank you for your time.

- Log in to post comments

So this comment shouldn't be taken literally?
"you could try Active@ Partition Recovery to see if anything can be fixed on the drive. It appears that the partition boot sector may be corrupt. I had this happen recently, and this was the only program that found my working partition and was able to recover it properly. It is also priced quite reasonably."
Or do you mean there's another Acronis product he's talking about?
Thanks
- Log in to post comments

Active@ Partition Recovery is not an Acronis product, it's made by a company named Lsoft.
- Log in to post comments
