Along these same lines, I am trying to recover an NTFS on a drive with bad sectors as well, but chkdsk /r goes so far as to say that there is no free space to do anything, including allocate new blocks for the bad sectors. In total, the bad sectors cover almost 100K of data, but the drive has over 100GB free.
If I were to assume it actually had no free space left, I could dd the drive to a file in Linux, then ntfsresize that, except that it won't mount an NTFS if it has errors.
Any ideas? The NTFS driver from Linux kernel 2.4 will mount it read-only and allow me to back up only a few of the files before it chokes on the bad tree, and bad trees in NTFS are recursive, so once I access a bad file in a folder, the rest of that folder becomes unusable until I remount. (Despite all of the extra work put into journaling, NTFS has got to be one of the most unstable filesystems in use today! MS could have used reiserfs completely for free, legally, but they'd rather cut off their nose to spite their face.) (/me digresses.) NTFS-3G and NTFS-old in kernel 2.6 refuse to mount, citing major filesystem errors.
I know the data is still there, because the file tree is still complete, and it correctly points to the files. If I dd data directly from allocated blocks, I can get parts of files I recognize, in the places they're supposed to be. If I could just brute-force mount the FS in read-only, I'd be able to recover the data, but I don't know of anything that will let me do that. The pityful NTFS recovery programs spend a few seconds looking at the drive, then give me the brilliant advice to bring it to a service technician.
Oh yeah, and I think the most viruses we've seen on a computer was around 13,000, though we've seen around 70,000 virus instances on one computer, when duplicates are included. 76,211 is amazing, DaMadScientist! I do have a good record from long ago, though. In the good ol' days when CPAV for DOS was the best you could get, I encountered a virus called (I think) HIV1, and it would hook onto the file access commands in the DOS interrupts. This one would also run in the clock tick interrupt and detect if something directly accessed the hard drive instead of using the int's, as CPAV did, and would follow it, infecting files ahead of it. CPAV would then find viruses, lots of them; the number of files on your computer times the number of times the virus was able to insert itself into them, which for executables was as many times as the virus could re-add its code using JMP's. It would find millions of viruses, on a computer that had only a few hundred or thousand files.
