Logical Drives disappear - how does this happen?

[TVeblen]

I'm still thinking-thinking-thinking about this....

Suppose she had the folder open on the remote computer in Windows Explorer over the LAN, and shut down the PC without closing Explorer.
How would Windows handle closing down those open disks/drives/folders on shutdown? Would Explorer "flush" the network disks so as not to be looking for them at startup?
Maybe the Extended Partition got caught up in the "flushing"?

What do you think?

 

[whs]

I would check whether it can be opened from the remote computer. Normally it should properly close explorer when you shut down. But maybe the remote computer has a handle on it.

 

[TVeblen]

I will hold my breath and try that!

 

[jumanji]

OK. The screenshot below shows my system drive. It has three primary partitions and the fourth primary is the extended partition holding three logical drives.



Below is what Bootice shows in the MBR sector (sector 0).The number of byte assigned to the partition Table in MBR is 64 bytes each partition data being a 16 byte string. The four partition data strings are highlighted in different colours. The 16 byte string highlighted in green is the fourth primary extended partition.



If this fourth string gets corrupted for any reason, all the logical drives contained in it will become inaccessible.

Below I had deliberately written zeroes in that 16Byte string and saved it to the disk as shown and I lost access to all the three logical drives.





This,I presume is what exactly happened in this case.

Partition Recovery Wizard when run, will find the beginning of the fourth partition and rewrite that partition string in its assigned space and all the logical drives in it will become accessible.

What is the reason for that sudden collapse of that fourth partition string? ( Well, what I did is just an experiment writing zeroes and corrupting that16 bytes to make it lose its identity.)

I wouldn't say it came upon suddenly out of the blue. It has been happening gradually over the period of the last four years or so and the final day came on this day when those content just became unreadable and unfortunately it happened in the first sector..When it happens in other places the files become unreadable, the drivers get corrupted, audio and video misses here and there but on the first sector you lose access to the drive.

That particular spot has been losing its magnetism and the signal level has gone below the detection level.Rewrite the data and it will hold on for some more time.Spinrite to a large extent tries to rejuvenate the bad sectors by repeatedly reading and writing into it and many believe that using spinrite periodically reading and writing each sector will prolong the longevity of a hard drive and good for maintenance rather than data recovery from bad seectors.

Now an analogy: People more often these days backup their data and archive it on to a new pendrive. Five years later they take it one day and try to access the data. To their chagrin they find that here and there the data is missing just like the dropouts in the oft used magnetic tape.And the pen drive was not used at all unlike the magnetic tape. The data on the pen drive is stored as charges and over a period the charge has dissipated and the data here and there has become unreadable. Write the data again and it will hold it for another few years.

 

[TVeblen]

Wow, great stuff Jumanji! That explains a lot. Thanks.

Now what is interesting is that when you zeroed out that string the Extended Partition became Unallocated in a Black outlined box in Disk Management, as we would expect.
In this case, the Extended Partition became "Free Space" in a Green outlined box. Do you see any significance to that? Or is it just computer semantics?

There is another wrinkle too, which I will post next in response to WHS.

 

[TVeblen]

I would check whether it can be opened from the remote computer. Normally it should properly close explorer when you shut down. But maybe the remote computer has a handle on it.

Well this brought up my first real clue as to what may have happened, possibly even explaining how that string got corrupted.

I fired up the laptop (KLap) and the desktop (CHLOE) that she was getting files from, plus my personal desktop (AS) was on anyway.

CHLOE did not show up as a Computer in the Network on the laptop (KLap), nor did it show in the Homegroup. (AS did). CHLOE did show up as a Media Device however.

Going to CHLOE, I could see KLap in the Network but when I clicked to access it I got the message: "Windows Cannot Access KLap".

Back to KLap, I restarted. Now CHLOE shows up and all shared folders are accessible.

Back to CHLOE, and KLap is still not accessible. I restart CHLOE and I can see it rebuilding the Network Shares with KLap (green progress bar). Now KLap is accessible and all shared folders too.

And all is back to normal.

So that raises the question: if KLap was connected to CHLOE and accessing a shared folder on it, and KLap was shut down without closing Windows Explorer, could that action cause the corruption that messed up the File Table?

 

[jumanji]

Yep, I had seen you saying that it looked as a free space and here in this experiment it became unallocated . In fact I would have loved to see the Windows Disk Management picture. Have no idea as to what could have made it as a free space.

I have to go deeper into the 16byte string and understand how different byte groups affect the outcome. Too much to my already overloaded brain cells.

Hitting my sack now.

 

[TVeblen]

Unfortunately I did not have the presence of mind to snip that screenshot- it was crisis mode with a distraught wife!

Have a good night!

 

[TVeblen]

This is what the disk looks like in it's normal condition (current, repaired):



And this is similar to what it looked like when it had the problem:



The only difference was the first 14GB Recovery Partition was there, and the Free Space box listed 351.30GB of free space.

 

[whs]

So that raises the question: if KLap was connected to CHLOE and accessing a shared folder on it, and KLap was shut down without closing Windows Explorer, could that action cause the corruption that messed up the File Table?

A shutdown from another system should not corrupt the MBR - even if the drive was open. It is supposed to be an orderly process. But then you never know. We'll have to find someone who is familiar with the disk management internals.

 

[dsperber]

This is what the disk looks like in it's normal condition (current, repaired):

View attachment 348358

And this is similar to what it looked like when it had the problem:

View attachment 348359

The only difference was the first 14GB Recovery Partition was there, and the Free Space box listed 351.30GB of free space.

Doesn't really shed any more light on exactly how it happened, but the second screenshot shows that the extended partition's boundary was recognized (note the dark green outline around the bright green "free space"). The extended partition is one of the possible max of four primary partitions defined through the "boundary box" at the front of the drive, so this suggests there was no damage done to the low/high sector values in the "boundary box" for this partition. It's still defined, and it's still recognized as an extended partition, and it's still there.

But since there are no logical partitions shown inside of that dark green extended partition, and that the entire area is shown as bright green "free space", if this is where the two previously known logical partitions used to live, it suggests that the corruption (or damage or reset or whatever caused it) was to the internal logical partition definition area inside of the extended partition itself. Somehow, the low/high limits of the two logical partitions inside the extended partition got erased or reset to the same initial state it would have when no logical partitions have been defined but one or more actually did exist at one time (so that the extended partition would have been created).

Anyway, still very interesting. Can't imagine how this type of very specific reset/delete of the very specific previously existing logical partition boundary definitions could occur "naturally" on its own without the involvement of some program (like DISKMGMT or Partition Wizard) that understands about partitions and how/where the low/high limits are specified.

Very odd.

 

[TVeblen]

Odd indeed!

I must admit that I've seen folks post similar problems where I have been guilty of thinking: "well, you had to have done something. These things don't just happen".
Now I know better!

 

[TVeblen]

So that raises the question: if KLap was connected to CHLOE and accessing a shared folder on it, and KLap was shut down without closing Windows Explorer, could that action cause the corruption that messed up the File Table?

A shutdown from another system should not corrupt the MBR - even if the drive was open. It is supposed to be an orderly process. But then you never know. We'll have to find someone who is familiar with the disk management internals.

Granted.

The system also should not lose the connections to network computers and shared folders in the Homegroup either.
Both problems happening so close to one another leads me to conclude that they must be related. Just can't think of how.

 

[whs]

Well, homegroup is another iffy area. With homegroup and on the high seas you never know what happens, LOL.