Samsung SSD 2.5 EVO 970 Raw Corruption from NTFS

@jumanji

I would like to ditto @rik33or's remarks. You are an outstanding member of the community and have provided many solutions and support. I want to take a moment to thank you.

For others in need of assistance, here's Jumanji's previous referenced threads:
Thread 1: (File System Corruption) External SSD, NTFS, RAW
Thread 2: SSD disk appear as RAW

I am too in need of your assistance. I shall now post the notes below.

SSD Specifications:
Samsung 2.5" EVO 970 1TB
Partition 1 on letter X:\ with 512,001 MB as NTFS on MBR. Formatted with 4096 cluster size. Approximately, 280 GB was used and written to. Note that this SSD has no physical damage and is in excellent health. Samsung software disk quality checks, firmware updates and full format were ran before putting into use.

Scenario:
Running robocopy.exe from the SSD to cloud storage overnight. Awoken in morning to find SSD in 'corrupt' state and unable to access data via Windows Explorer. USB C ports were intact, no removal of wires or loss of power and unknown why this has occurred.

Windows Disk Management:


Hard Disk Sentinel:
Note that installed this and ran on a different partition. All of my Windows OS are set for the SSD to appear as X:\ but on this partition it's now appearing as F:\. Note that I haven't manually changed anything for this to occur.


Recuva Scan:
I performed a scan to see what Recuva could find, as rik33or did this and provided him some reassurance that the SSD had not been wiped. With all the settings enabled to search for every directory and file in a deep scan, here's the bug that shows going above 100% and setting a large completion time every second.


Recuva Results:
Here's the results of the scan. I had to press cancel as it would continue forever. For most of the files it has not preserved the folder structure, only a few have a listing for that and inclues '\?\'.


TestDisk Status:


TestDisk List:


TestDisk Repair MFT:


Note that up to this stage and after running TestDisk, the issue remains.

Here is someone having issues with chkdsk.exe. I can not afford to encounter this problem as 280 GB of data has been written. Appreciate the help and assistance.

Welcome to the forum. If it's raw it's lost its partition and specific partition recovery should be used trying to recover files can mess it up if partition is recovered all files will be their

@JumanjiFan

Thank you for the compliments.

I am still looking into the thread. I will take sometime to fully grasp it. So hold on.

My first question.

Why does your 1TB Samsung SSD show two partitions? Did you create these two partitions, formatted only the first partition leaving the other partition unformatted?

jumanji said:

@JumanjiFan

Thank you for the compliments.

I am still looking into the thread. I will take sometime to fully grasp it. So hold on.

My first question.

Why does your 1TB Samsung SSD show two partitions? Did you create these two partitions, formatted only the first partition leaving the other partition unformatted?

Hello to the legendary jumanji. It's a pleasure to make your acquiescence.

1TB Samsung SSD has 1 active partition set to 512,001 MB. The other partition has not been touched and left unallocated. Yes, you are correct.

Please note that I acknowledge your support and am very thankful that you've blessed me with your presence. Therefore, I would like to reward you if we manage to get this working (praying without issues).

Here (mbr - How to fix a partition detected as RAW, when Chkdsk correctly reads it as NTFS? - Super User) is another reason why I cannot afford to run chkdsk.exe.

"WARNING: running this command can be really dangerous and I just got the consequences of it. I ran this command and chkdsk restored my partition but found many errors which it recovered by writing the recovered files in a found.000 folder. These recovered files have OVERWRITEN some other files that could have been recovered by a dedicated tool. Now, if I run such a tool, it says the files are unrecoverable because they have been overwritten by the ones in found.000. If I had known that, I wouldn't have run chkdsk." - Another User

Hello @JumanjiFan,
Welcome to TenForums.

May I suggest that you keep to one Thread for related questions, otherwise, members will NOT know what has already been advised and tried, and the subsequent results.

@JumanjiFan

Do not worry. If file system gets corrupted and as a cosequence the disk has become RAW, one should not run checkdisk blindly.There are many reasons why a disk turns RAW. - a)Protective MBR in sector 0 is corrupt. b)Volume boot sector at the start sector of a partition is corrupt, c) MFT - the Master File Table is corrupt.

If MFT is corrupt that means the file index in it is corrupt. Your data is all there but those are no longer indexed correctly due to the corruption. If without knowing this you run checkdisk blindly, checkdisk will do a vigorous scavenging and delete all files that are not indexed properly in the MFT. One loses all the data. This has happened in many cases. People blindly and on an impulse run checkdisk and then find they have lost all data, In such cases why jumanji even God can't help.

Reason why I always insist running TestDisk to find what exactly is the file system corruption. In your case as revealed by TestDisk, Volume boot sector, its backup as well as MFT and MFT mirror are absolutely fine. So you can safely run checkdisk.

Please disconnect from internet.

Remove all USB plugged in storage devices and have only the Samsung 1TB external plugged in.

In Windows Disk Management, note the exact drive letter of the Samsung 500GB partition which is RAW. Close Windows Disk Managment.
Run check disk from an elevated command prompt - run as administrator. Because it is an SSD you can omit the /r switch

Type CHKDSK K: /f /v /x .Press Enter. Note: 1. There is a space before every / 2. Replace K: with the actual drive letter of the partition to be checked. .

Do not, do not, do not interrupt for any reason.[/I]" Hands off the PC. No multitasking either

When checkdisk is completed, close it and reboot your PC.

Now a copy and paste from rikk33or's thread post #5:

"If TestDisk says "Both MFT and MFT mirror are OK" close TestDisk. You will run check disk on that volume to correct the file system corruption.
Caution: You will run checkDisk only and if only TestDisk confirms that your MFT Mirror/MFT is OK. Be patient and allow checkdisk to complete even if it takes hours and hours. Checkdisk is checking all filesystem parameters and correcting where necessary. Interrupting checkdisk halfway through will leave your data in shambles)

Run check disk from an elevated command prompt - run as administrator.

Type CHKDSK K: /f /v /r /x Press Enter. Note: 1. There is a space before every / 2.Replace K: with the actual drive letter of the partition to be checked.
Take your hands off the PC and Allow check disk to complete.Do not, do not, do not interrupt for any reason."

Note: Since it is an SSD you can omit the /r switch as mentioned earlier.