I'm still thinking-thinking-thinking about this....
Suppose she had the folder open on the remote computer in Windows Explorer over the LAN, and shut down the PC without closing Explorer.
How would Windows handle closing down those open disks/drives/folders on shutdown? Would Explorer "flush" the network disks so as not to be looking for them at startup?
Maybe the Extended Partition got caught up in the "flushing"?
What do you think?
I would check whether it can be opened from the remote computer. Normally it should properly close explorer when you shut down. But maybe the remote computer has a handle on it.
OK. The screenshot below shows my system drive. It has three primary partitions and the fourth primary is the extended partition holding three logical drives.
Below is what Bootice shows in the MBR sector (sector 0).The number of byte assigned to the partition Table in MBR is 64 bytes each partition data being a 16 byte string. The four partition data strings are highlighted in different colours. The 16 byte string highlighted in green is the fourth primary extended partition.
If this fourth string gets corrupted for any reason, all the logical drives contained in it will become inaccessible.
Below I had deliberately written zeroes in that 16Byte string and saved it to the disk as shown and I lost access to all the three logical drives.
This,I presume is what exactly happened in this case.
Partition Recovery Wizard when run, will find the beginning of the fourth partition and rewrite that partition string in its assigned space and all the logical drives in it will become accessible.
What is the reason for that sudden collapse of that fourth partition string? ( Well, what I did is just an experiment writing zeroes and corrupting that16 bytes to make it lose its identity.)
I wouldn't say it came upon suddenly out of the blue. It has been happening gradually over the period of the last four years or so and the final day came on this day when those content just became unreadable and unfortunately it happened in the first sector..When it happens in other places the files become unreadable, the drivers get corrupted, audio and video misses here and there but on the first sector you lose access to the drive.
That particular spot has been losing its magnetism and the signal level has gone below the detection level.Rewrite the data and it will hold on for some more time.Spinrite to a large extent tries to rejuvenate the bad sectors by repeatedly reading and writing into it and many believe that using spinrite periodically reading and writing each sector will prolong the longevity of a hard drive and good for maintenance rather than data recovery from bad seectors.
Now an analogy: People more often these days backup their data and archive it on to a new pendrive. Five years later they take it one day and try to access the data. To their chagrin they find that here and there the data is missing just like the dropouts in the oft used magnetic tape.And the pen drive was not used at all unlike the magnetic tape. The data on the pen drive is stored as charges and over a period the charge has dissipated and the data here and there has become unreadable. Write the data again and it will hold it for another few years.
Wow, great stuff Jumanji! That explains a lot. Thanks.
Now what is interesting is that when you zeroed out that string the Extended Partition became Unallocated in a Black outlined box in Disk Management, as we would expect.
In this case, the Extended Partition became "Free Space" in a Green outlined box. Do you see any significance to that? Or is it just computer semantics?
There is another wrinkle too, which I will post next in response to WHS.
Well this brought up my first real clue as to what may have happened, possibly even explaining how that string got corrupted.
I fired up the laptop (KLap) and the desktop (CHLOE) that she was getting files from, plus my personal desktop (AS) was on anyway.
CHLOE did not show up as a Computer in the Network on the laptop (KLap), nor did it show in the Homegroup. (AS did). CHLOE did show up as a Media Device however.
Going to CHLOE, I could see KLap in the Network but when I clicked to access it I got the message: "Windows Cannot Access KLap".
Back to KLap, I restarted. Now CHLOE shows up and all shared folders are accessible.
Back to CHLOE, and KLap is still not accessible. I restart CHLOE and I can see it rebuilding the Network Shares with KLap (green progress bar). Now KLap is accessible and all shared folders too.
And all is back to normal.
So that raises the question: if KLap was connected to CHLOE and accessing a shared folder on it, and KLap was shut down without closing Windows Explorer, could that action cause the corruption that messed up the File Table?
Yep, I had seen you saying that it looked as a free space and here in this experiment it became unallocated . In fact I would have loved to see the Windows Disk Management picture. Have no idea as to what could have made it as a free space.
I have to go deeper into the 16byte string and understand how different byte groups affect the outcome. Too much to my already overloaded brain cells.:)
Hitting my sack now.
Unfortunately I did not have the presence of mind to snip that screenshot- it was crisis mode with a distraught wife!
Have a good night!
This is what the disk looks like in it's normal condition (current, repaired):
And this is similar to what it looked like when it had the problem:
The only difference was the first 14GB Recovery Partition was there, and the Free Space box listed 351.30GB of free space.
A shutdown from another system should not corrupt the MBR - even if the drive was open. It is supposed to be an orderly process. But then you never know. We'll have to find someone who is familiar with the disk management internals.So that raises the question: if KLap was connected to CHLOE and accessing a shared folder on it, and KLap was shut down without closing Windows Explorer, could that action cause the corruption that messed up the File Table?
Quote
