Storage HDD (D:) Disappearance -- I DARE you to figure this one out!

knight15 · 21 Apr 2023

Thanks all. Cloning the drive tonight -- the software for which shows, by the way, the same amount of data on the drive as before this disaster began. Two things about the temp folder Eraser appears to have created: 1) this folder is also created when the program over-writes FREE SPACE on the drive -- which I believe may be what inadvertently happened. Unless CHKDSK-induced errors somehow got some of my data characterized as "free space" beforehand, (is this even possible?) then, I'm holding out hope the 1.8 TB of data I'm still registering is recoverable. 2) IF Eraser actually wiped any data from the drive, it doesn't appear to have run for very long -- so again, I'm trying to hold out some hope for at least a partial -- hopefully majority -- recovery scenario. If you guys have expertise in data recovery, I could use your recommendations on software to try once the clone is complete. You all have been a GREAT help so far -- I'm slowly making the transition from being infuriated with myself for being so stupid, to using this as a learning opportunity.

Malneb · 21 Apr 2023

massive can of worms but isn't continuous large files all the same size going to suggest corrupt MFT? id be looking here and trying to repair the MFT for this drive. As the others suggested clone the drive first.

- - - Updated - - -

i did see the photo earlier in the thread saying no errors and other things but when you got problems like this you can't always take face value what tests are telling you because its chalk and cheese results at this point.

The computer don't always know that MFT is corrupt if it actually is sometimes it also sometimes does not know that it is doing the right line of operations in times like these so it could be telling you repaired this ok or this thing is ok but its not actually always the case.

Been a long time since i have had to do this kind of repairs but i think its a good chance that there is a problem with the MFT for this drive.

obviously you know there is corruption going on just by the situation.

- - - Updated - - -

The drive is probably fine too as its self induced problem

jumanji · 21 Apr 2023

Malneb said:

massive can of worms but isn't continuous large files all the same size going to suggest corrupt MFT? id be looking here and trying to repair the MFT for this drive. As the others suggested clone the drive first.............

Welcome to this thread. Keep contributing to this thread.

Malneb · 21 Apr 2023

I would not know what to suggest next without trying to step through it myself i have not had to fix a problem like this for quite a while so i would be to rusty.

But i still think there is a good chance that its MFT issue, i just would have to try and fix it in person for me to understand it in real time.

jumanji · 22 Apr 2023

Malneb said:

I would not know what to suggest next without trying to step through it myself i have not had to fix a problem like this for quite a while so i would be to rusty.

But i still think there is a good chance that its MFT issue, i just would have to try and fix it in person for me to understand it in real time.

It is always possible to find out if the OP's disk has an issue with MFT online using TestDisk.Just read through the process here.

hard drive D: is not accessible

Lost partition on an external drive

(File System Corruption) External SSD, NTFS, RAW

While rendering online help sitting thousands of miles away, one cannot expect the OP to hand over the disk physically on a platter.

jumanji · 22 Apr 2023

knight15 said:

Thanks all. Cloning the drive tonight --...........I'm slowly making the transition from being infuriated with myself for being so stupid, to using this as a learning opportunity.

When you have finished cloning, let us know.

We shall then run TestDisk to know the exact ststus of the cloned disk

Note: Do not run TestDisk on your own unless I instruct you to do so. It is always difficult for the first time user.

1. Plug in your cloned disk and post a screenshot of Windows Disk Management.

Follow the guidelines here How to Post a Screenshot of Disk Management

2. Let me know whether the cloned disk is an MBR or GPT disk.

Right click on the Disk X Basic XXGB (the cloned disk in Windows Disk Management) > Properties > Partition Style

Note:
a. Will be in Arcadia CA 29 Apr to 02 May --- No laptop No internet activity

b. Travel to New Brunswick NJ 09 May to 16 May - No laptop, No internet activity

Barring these two periods, I will be availqble in my current location Suwanee GA till 22 May

knight15 · 22 Apr 2023

So the unfolding saga took a couple turns for the better (I hope) over the past 24 hours: it seems I successfully cloned the disk, and ran a preliminary scan on it with data recovery software (ReclaiMe): it seems it was as you said, earlier in this thread, Jumanji: CHKDSK seems to be what burned me: there is a HUGE "found.000" folder with HUNDREDS of .CHK folders & files. Many of the .CHK files/folders appear to contain many of my original files, and ReclaiMe's preview feature seems to display them as intact. I find very little intact data on the clone disk outside of the "found.000" folder. At the pace it is scanning the clone, it will be several days (weeks?) before I can truly determine what is intact. Any tips/pitfalls you can offer on data recovery would be much appreciated. One thought: there were error messages during the clone process, leading me to consider that more data might be recoverable on the original drive. I think my strategy at this point is to recover what I can from the clone, the repeat the process of the original -- just to see if I get a higher-fidelity result. Thoughts?

Again, I cannot thank you enough -- everyone who's taken the time to read and thoughtfully reply to this thread: I definitely would not be looking at (at least some of) my files this morning without you!

jumanji · 23 Apr 2023

@knight15

I haven't used or even tried ReclaiME anytime because it is a paid software. Most of these programs are "try before you buy" ones. If the preview shows all your files, you can open/view the files and if you are satisfied with the file/s integrity, buy and copy the files.

It is left to you decide on it.

My question now is if you see the found.XXX folders on the cloned drive, where were those in your original disk? You had never reported seeing those on the original disk and not even after running and exploring with WinRAR which can show even super- hidden files. That led us to believe that Check disk only made some minor corrections and made your disk accessible but showing no files inside the folders shown in your screenshot (in your post #16). This again made us believe that the Erasure program could have played mischief and deleted the files inside.

I am just curious to know which program or methodology you used to clone the drive. - learning process

I am also veering around to running any data recovery program you would like to on your original disk. Just make sure that the original disk is in good health with Hard Disk Sentinel. Hard Disk Sentinel Trial version - HDD health and temperature monitoring

knight15 · 26 Apr 2023

Thanks Jumani,

It took a couple days for the recovery attempt to complete.

I used a windows-based freeware program called "Macrium" to clone the drive: again, it gave me a cloning error at the end of it's efforts. I will re-confirm, but I think you've got the story straight: the original drive didn't show a "found.000" folder, but this folder shows up after scanning the clone with the recovery software -- with some recoverable files inside the .CHK files within that folder.

Reclaime created two primary folders during recovery, titled 1) NFTS and 2) RAW. Tellingly, both folders contain roughly the same amount of data as my original failed drive. I have no idea how to work with the files in the RAW folder -- but wonder if there is a data recovery opportunity there. Under the NFTS folder, almost all sub-folders (reflecting my original drive's folder structure) are EMPTY. Only when I open the "found.000" sub-folder and click on .CHK files do I find some of my original files. And only some of those files are intact: photo and music files -- and .pdf files -- are most likely to be useable. MSOffice files, however, ALL report data corruption when attempting to open them. (and this of course, is where my greatest data-loss is.) This seems a systemic problem for office files -- as one would think that at least SOME of them would have survived. Yet not a single one of them can be opened.

The deeper I get into this process, the more the mysteries seem to multiply. If any of this sparks any thoughts or recommendations, I'm all ears!

jumanji · 27 Apr 2023

@knight15

As a last resort, you can try Photorec and check whether it recovers any data from the RAW files.

RAW means the file has lost its format . For example xxx.doc becomes just xxx and has lost its .doc format. Photorec "searches for known file headers" and reconstructs the file in the correct format provided the file is in one-piece and not fragmented. ( if reconstructed, copy the file/s to another disk. Do not write it to the same disk under recovery. The reconstructed file/s will not have their original name/s.)

Read about it here PhotoRec - CGSecurity

File formats that can be recovered: File Formats Recovered By PhotoRec - CGSecurity ( initially select only the most important formats. If you select too many, no harm but the search and reconstruct will take a long time.)

jumanji's write-up: Guide to using PhotoRec recovery software. - Windows 7 Forums ( very basic and written during the initial stages of my foray into data recovery. If you google you may perhaps find more exhaustive deliberations.)

This would perhaps be my last post in this thread since I will have nothing more to offer literally.

Good luck be upon you!