RAW Hard Drive Data Loss

ViTaLC0D3R · 25 May 2020

Windows 10 1909 x64

So I had mounting a Hard Drive to VMware and access the drive through VMware. One day I tried to access the data on the drive and Windows detected the drive as a Raw drive and I had know idea what do so I looked online and people suggested running chkdsk /r so I did and after that it fixed the drive but now it says the drive is completely empty there is nothing on the drive. So I download Recuva and checked to see if the data is there and there are lots of files but i am unable to tell what everything is. Is there a way to rebuild this back to normal and recover the data on the drive or am I sol? Thanks for the help. I have at included the output of chkdsk, Recuva screenshot, and Windows Explorer.

output.txt

RAW Hard Drive Data Loss-recuva64_akkd3puokl.png

RAW Hard Drive Data Loss-explorer_fqr6waeykt.png

zbook · 25 May 2020

Code:

Correcting errors in the Master File Table (MFT) mirror.
Correcting errors in the master file table's (MFT) DATA attribute.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.

/f Fixes errors on the disk. The disk must be locked. If chkdsk cannot lock the drive, a message appears that asks you if you want to check the drive the next time you restart the computer.

/r Locates bad sectors and recovers readable information. The disk must be locked. /r includes the functionality of /f, with the additional analysis of physical disk errors.

https://docs.microsoft.com/en-us/win...ommands/chkdsk

Ubuntu may allow you to view and recover files using a different operating system.

I'm not aware of a method to reverse the results of a chkdsk /r unless its restoring an image.

On a working computer create a bootable Ubuntu flash drive:
Create a bootable USB stick on Windows | Ubuntu tutorials
Create a bootable USB stick on Windows | Ubuntu
Linux to the rescue! How Ubuntu can help a computer in distress | PCWorld

Samuria · 25 May 2020

You made a big mistake a raw disk just means it lost the partition table and free partition recovery software can often get it back very quickly and all the files are there as before. If you have written anything to disk you may have messed it up. You could try specific partition recovery software and see if it works

jumanji · 25 May 2020

Hi @ViTaLC0D3R,

1. Please post a full screenshot of Windows Disk Management hiding the Console Tree , Action pane, and adjusting the seperators in the Disk list appropriately so that all information can be seen.
Disk Management - Post a Screen Capture Image - Windows 7 Help Forums

2. Download install and run the free trialware Getdataback Pro. ( Read all the documentation in the website on using it) Scan the drive and check whether it shows all your files. If your files are shown, you can open and check their integrity. This is only an investigative process. To copy the files you may need to buy the licence. But no need to buy immediately. If we can see the files, then we shall try freeware TestDisk and check whether we can recover the files.Keep getdataback as the last resort.
Data Recovery Software Products - Runtime Software Products

jumanji · 25 May 2020

GetDataback Sample screenshots:

RAW Hard Drive Data Loss-25-05-2020-18-01-58.jpg

RAW Hard Drive Data Loss-25-05-2020-18-07-13.jpg

RAW Hard Drive Data Loss-25-05-2020-18-14-38.jpg

ViTaLC0D3R · 25 May 2020

RAW Hard Drive Data Loss-mmc_ngf8yr4jot.png

- - - Updated - - -

I can't seem to find any useful files from Recuva. My one question is why would chkdsk /r delete the files I looked it up and it says it doesn't delete files.

spunk · 25 May 2020

When you have bad sectors on your HDD, the data on the bad sectors becomes corrupted or orphaned. When Check Disk scans your drive it looks for Bad Sectors, if it finds one, it tries to relocate that file to a good sector. There are a limited amount of spare good sectors to move to. If there are too many bad sectors, the files are corrupted, If files are orphaned from their Parent directory then Check Disk will remove these, usually it puts them in a temp file named .000Found etc. Get DataBack can usually find these files and recover them but they may be too corrupted to be useful.

jumanji · 26 May 2020

No need for any assumptions.
Run checkdisk in read only mode. ( without any parameter)
The results at the end will show if there are bad sectors.

RAW Hard Drive Data Loss-26-05-2020-11-03-05.jpg

And chkdsk /r will not delete files. Whoever told you that?

Even if MFT is corrupt, Getdataback can show all the files. When we try to repair Filesystem corruption ( corrupted Partition Boot sector, corrupted MFT) with TestDisk, and if TestDisk says it is unable to repair MFT, we redirect the OPs to recover the files using Active@ File recovery or GetDataBack as a last resort. Of course they had to buy a license after
checking the integrity of the files shown and they are satisfied with it..

Attendum:
As you can see in the above screenshot Checkdisk in the read only mode found errors in MFT mirror. I ran chkdsk V: /r and it corrected the errors. It did not delete any files.

RAW Hard Drive Data Loss-26-05-2020-15-29-21.jpg

RAW Hard Drive Data Loss-26-05-2020-15-26-32.jpg

Compare this with the files shown by GetDataBack in my post #5 which was run before MFT Mirror correction

zbook · 26 May 2020

Once data is salvaged this may be useful in the future:
Free Hard Disk Sentinel version 5.5 offer (approx 8 hrs remaining)

jumanji · 26 May 2020

Hi @ViTaLC0D3R

Something strange has happened in this thread. Initially your first post had the following screenshot.

RAW Hard Drive Data Loss-26-05-2020-20-20-21.jpg

This was reproduced in post #2 by zbook.

Now this screenshot has vanished from the post and instead there is an output.txt file. I downloaded and examined it. It is the complete run of chkdsk h: /r ending like this

RAW Hard Drive Data Loss-26-05-2020-20-23-45.jpg

It shows a ) checkdisk has made corrections to the MFT b) there are no bad sectors and c) conclusively that there are no files. Almost all allocation units are available.

And that is the fact. You have no files in h: ( If you see the checkdisk screenshot of my V: drive it has 1838 files and it has even after running chkdsk V: /r after making corrections to the MFT.)

And the fact remains that checkdisk /r does not delete the files.