Restore last data on external HDD

Page 1 of 3 123 LastLast

  1. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
       #1

    Restore lost data on external HDD


    I think that I know the answer to this question but I have to ask before I plunge ahead.

    I have a 2TB external HDD that is attached to my media server (WDTV Live). I'm not sure what happened but the WDTV stopped recognizing the HDD. I connected it to my computer and the computer recognized the HDD but gives me the error message "You need to format the disk....before you can use it".

    I didn't format it but I suspect that the Master File Table has been corrupted.

    I used Wondershare Recoverit to examine the HDD. It took forever but it identified almost 300,000 files. Based on the few that I examined, many are file segments that would be worthless if recovered. (There was about 1.5TB of data on the HDD but FAR fewer that 300K files).

    I'm about to try the "Windows File Recovery" tool but before I do that I have to ask - Assuming that it has been damaged, is there any way to restore the Master File Table so that the drive can be fully restored? (Based on my research, I suspect that the answer is "No".) However, this won't be the first or last time that I have missed something.

    I have Win 10 Pro X64 Ver 2004 build 19041.1110.
    Last edited by dsscottage; 28 Jul 2021 at 13:27. Reason: correct title
      My Computer


  2. Posts : 42,737
    Win 10 Pro (22H2) (2nd PC is 22H2)
       #2

    There are tools that attempt to rebuild the MFT.. depends on damage. Random example:
    Advanced NTFS Boot and MFT Repair - CGSecurity
      My Computers


  3. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #3

    Just checking another detail.

    I attempted to run chkdsk from within File Explorer properties and it reported that the drive was unformated and was unable to run.

    I then ran chkdsk from a command prompt and got the following message:
    The type of the file system is NTFS.
    The first NTFS boot sector is unreadable or corrupt.
    Reading second NTFS boot sector instead.
    The first NTFS boot sector is unreadable or corrupt.
    Reading second NTFS boot sector instead.
    Unable to determine volume version and state. CHKDSK aborted.

    I was hoping that this would copy the backup MBR to the primary. However, the response to reading second boot sector confused me.

    Does this mean that the backup MBR is missing or corrupt?
    Last edited by dsscottage; 28 Jul 2021 at 21:10.
      My Computer


  4. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #4

    Hi @dsscottage,
    You have been making assumptions after assumption and that is not going to lead you anywhere. For example "Backup MBR". There is no such backup MBR and checkdisk will not find any and write it. That is not its job.

    1.How have you connected your 2TB HDD? Is it internally connected to the motherboard SATA port or it it put inside an external HDD enclosure?
    2. How many partitions were there in that 2TB HDD?
    3. Do you know whether it is an MBR drive or GPT drive?

    While I cannot make out anything with your checkdisk run, I believe that your HDD got corrupted very badly - may be beyond repair . The NTFS boot sector refers to the Volume Boot Record that resides on the first sector of each partition. Checkdisk failed to read that Boot Record of the first partition.. It went searching for the boot sector of the second partition which resides on the first sector of that partition. May be it did not find anything. That is all what I can makeout.

    To investigate and analyse what could have happened, the first requirement is a fullscreen screenshot of Windows Disk Management. Follow the guidelines here How to Post a Screenshot of Disk Management and post a screenshot.

    Depending upon what it shows, further testing and investigation may be in order. dalchina mentioned TestDisk in his post. May be we will run it but not staightaway to repair MFT.TestDisk can of course tell you whether your MFT is corrupted or not but TestDisk procedure mandates that we check the Volume Boot Record of each partition in the first instance and if corrupted restore it from the backup which exists on the last sector of each partition. If both VBR and its backup are corrupt, try to rebuild the VBR and so on it goes. ( If Both the VBR and backup VBR are corrupt, then it is a very serious state.)

    First let us know whether at all it is required. So first Disk Management screenshot. I make no assumptions based upon what all you have said in your posts.
      My Computer


  5. Posts : 42,737
    Win 10 Pro (22H2) (2nd PC is 22H2)
       #5

    Hi, would it be worth doing a couple of checks- SMART params - surface scan to assess damage?
      My Computers


  6. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #6

    No, I would rather check his disk for bad sectors - a quick run with Hard Disk Sentinel but I would defer it till I see the Windows Disk Management screenshot.
      My Computer


  7. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #7

    Sorry, I think that I overestimated my understanding of the research that I did before making the post.


    jumanji said:
    1.How have you connected your 2TB HDD? Is it internally connected to the motherboard SATA port or it it put inside an external HDD enclosure?
    The HDD an WD Passport external drive and was connected to my media server (WDTV Live) but I have connected it to my computer via USB for problem resolution. It is the E: drive.
    2. How many partitions were there in that 2TB HDD?
    There was only one partition
    3. Do you know whether it is an MBR drive or GPT drive?
    It was GPT
    Depending upon what it shows, further testing and investigation may be in order. dalchina mentioned TestDisk in his post. May be we will run it but not staightaway to repair MFT.TestDisk can of course tell you whether your MFT is corrupted or not but TestDisk procedure mandates that we check the Volume Boot Record of each partition in the first instance and if corrupted restore it from the backup which exists on the last sector of each partition. If both VBR and its backup are corrupt, try to rebuild the VBR and so on it goes. ( If Both the VBR and backup VBR are corrupt, then it is a very serious state.)
    I did try to run TestDisk. I admit that I didn't understand everything that it told me. However, it got to the point that it seemed to be reading each sector in an attempt to identify and restore files. This seemed similar to what Wondershare Recoverit had done so I stopped the process.
    Is there anything else that I need to add?
    Attached Thumbnails Attached Thumbnails Restore last data on external HDD-diskmanagement.jpg   Restore last data on external HDD-partition-style.jpg  
      My Computer


  8. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #8

    Hi @dsscottage,
    Thanks for the screenshot. Good that you chose to show the Device List showing Device Type and Partition style which clearly shows that it is a GPT drive.

    Your HDD shows as RAW and has a drive letter. That means the partition exists but the file system is corrupt - it can be a corrupt Volume Boot Record or a corrupt MFT. We are definitely going to use TestDisk and check whether it can repair the Volume Boot Record. If MFT is found corrupt, in most cases, TestDisk will not be able to repair it and you have use a commercial software to try and retrieve the data.

    You may go to sleep now since I will take quite sometime to write the detailed steps on using TestDisk. You may download the latest stable version 7.1 from TestDisk - CGSecurity and keep it. You may also read all documentation especially the link dalchina has posted in his post #2 Advanced NTFS Boot and MFT Repair - CGSecurity ( his prophecy is coming true )
    but do not try TestDisk on your own. Use a wrong command or process, it can muck up your HDD and make matters worse.
    Last edited by jumanji; 30 Jul 2021 at 02:28.
      My Computer


  9. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #9

    OK. When you wake up and ready for the exercise:

    Download the latest stable version 7.1 from TestDisk - CGSecurity Extract the testdisk-7.1.win.zip to the root of your system drive C:. You will run testdisk_win.exe in the extracted testdisk-7.1 folder. TestDisk should be run with administrator privileges - Run as administrator (create a shortcut on your desktop)

    Do read my post here WD Elements being read as RAW // Contents readable through app - Windows 10 Forums.

    Go upto screen 6 which will show the status of the Volume Boot Sector

    I repeat the steps here specific to your case.

    Screen1: [No Log] Press Enter ( You will use the Up/Down Left/Right arrow keys to highlight/select any field in the TestDisk windows)

    Screen 2: Highlight/Select your 2TB external HDD (identified by its capacity) [Proceed] is already highlighted. Press Enter

    Screen 3:
    Highlight/Select [EFI GPT] (if it is not highlighted already) Enter

    Screen 4:
    Highlight/Select [Advanced] Enter

    Screen 5:
    Does this screen show your single partition highlighted? Is [Boot] highlighted? Enter

    Screen 6:
    will show the status of the Boot sector and Backup boot sector. Further action will depend on their status.

    To be continued after a short break.
    Last edited by jumanji; 30 Jul 2021 at 02:40.
      My Computer


  10. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #10

    Continued:
    Various possibilities exist:

    1. Boot sector - Bad

    Backup boot sector - OK
    Execute the [Backup BS] command ( writes the backup to the start sector of the partitïon when you confirm "y" in the next screen)

    2. Boot sector - Bad
    Backup boot sector - Bad
    Execute [Rebuild BS] command ( Rebuilds the Volume Boot Record and writes it into the Partition start sector and partition end sector)

    3. Boot sector - OK
    Backup boot sector - Bad
    Execute [ORG. BS] command. ( this will copy the original boot record in the partition start sector to the partition end sector and make it OK.)

    The above three operations should repair the boot sectors and make your drive accessible. A reboot is required.

    Please remember whenever you see a

    [List] command in the page, give that command and if the files are listed copy to destination. if the files are not listed you can go back to the previous page by [Quit] Command or pressing Q .


    The fourth possibility and an important one:
    Boot Sector - OK
    Backup Boot sector - OK
    Hmmm... both are good. Then what is the problem? MFT???
    You will execute [Repair MFT] command.

    If TestDisk says 'Both MFT and MFT mirror are OK" close TestDisk. You will run check disk on that volume to correct the file system corruption. Caution: You will run checkDisk only and if only TestDisk confirms that your MFT is OK and you will not interrupt Check Disk for any reason)

    "Run check disk from command prompt.

    Open Command prompt. Start > All programs > Accessories > Command Prompt

    Type
    CHKDSK K: /f /v /r /x Press Enter. Note: Replace K: with the actual drive letter of the external drive

    Allow check disk to complete.

    "
    If TestDisk says it is unable to repair MFT, you will have to use a commercial software to recover the files - GetDataBack or active @ File recovery. These are "try before you buy" software. If these show your files, you may be able to preview/open the files and check the file integrity. You can buy a license only when you are satisfied.

    If at any point you have a doubt in running TestDisk and require clarification post the screenshot and quit TestDisk.
    Last edited by jumanji; 30 Jul 2021 at 02:31.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 11:01.
Find Us




Windows 10 Forums