Restore last data on external HDD

Page 2 of 3 FirstFirst 123 LastLast

  1. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #11

    jumanji said:
    OK. When you wake up and ready for the exercise:

    Download the latest stable version 7.1 from TestDisk - CGSecurity Extract the testdisk-7.1.win.zip to the root of your system drive C:. You will run testdisk_win.exe in the extracted testdisk-7.1 folder. TestDisk should be run with administrator privileges - Run as administrator (create a shortcut on your desktop)

    Do read my post here WD Elements being read as RAW // Contents readable through app - Windows 10 Forums.

    Go upto screen 6 which will show the status of the Volume Boot Sector

    I repeat the steps here specific to your case.

    Screen1: [No Log] Press Enter ( You will use the Up/Down Left/Right arrow keys to highlight/select any field in the TestDisk windows)

    Screen 2: Highlight/Select your 2TB external HDD (identified by its capacity) [Proceed] is already highlighted. Press Enter

    Screen 3:
    Highlight/Select [EFI GPT] (if it is not highlighted already) Enter

    Screen 4:
    Highlight/Select [Advanced] Enter

    Screen 5:
    Does this screen show your single partition highlighted? Is [Boot] highlighted? Enter

    Screen 6:
    will show the status of the Boot sector and Backup boot sector. Further action will depend on their status.

    To be continued after a short break.
    As per your instruction, I have not gone any further than step 5. The next screen shows the single partition but doesn't show [Boot]. I'll post a screen shot. By the way, the HDD is not bootable. It was only used for storage.
    Attached Thumbnails Attached Thumbnails Restore last data on external HDD-screen.jpg  
      My Computer


  2. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #12

    Is this what has happened to your WD HDD?


    Is this what has happened to your to your WD HDD?????
    Western Digital (WD) Hard Drives Remotely Wiped Clean Worldwide - Driz Group

    This question has been ringing in my mind as I read and reread your first post during the course of this episode. Nothing is certain until it becomes certain. So go ahead with the following steps from where you left.

    ( In your case there is no MSR ( Microsoft System Reserved Partition), that being an external drive and hence you see only one MS Data partition )

    Restore last data on external HDD-a18-01-2021-11-20-23.jpg

    Restore last data on external HDD-b18-01-2021-11-26-45.jpg

    Restore last data on external HDD-c1-18-01-2021-11-34-13.jpg

    Restore last data on external HDD-c2-18-01-2021-11-41-51.jpg

    Restore last data on external HDD-d-18-01-2021-11-46-53.jpg

    Restore last data on external HDD-e-18-01-2021-11-55-29.jpg

    Restore last data on external HDD-f-18-01-2021-12-24-49.jpg

    Restore last data on external HDD-g-18-01-2021-12-28-46.jpg

    From hereon, in the next screen, if ( I am repeating so that this post is self containing.)

    1. Boot sector - Bad
    Backup boot sector - OK
    Execute the [Backup BS] command ( writes the backup to the start sector of the partitïon when you confirm "y" in the next screen)

    2. Boot sector - Bad
    Backup boot sector - Bad
    Execute [Rebuild BS] command ( Rebuilds the Volume Boot Record and writes it into the Partition start sector and partition end sector)

    3. Boot sector - OK
    Backup boot sector - Bad
    Execute [ORG. BS] command. ( this will copy the original boot record in the partition start sector to the partition end sector and make it OK.)

    The above three operations should repair the boot sectors and make your drive contents accessible. A reboot is required.

    Please remember whenever you see a

    [List] command in the page, give that command and if the files are listed copy to destination. If the files are not listed you can go back to the previous page by [Quit] Command or pressing Q .


    The fourth possibility and an important one:
    Boot Sector - OK
    Backup Boot sector - OK
    Hmmm... both are good. Then what is the problem? MFT???
    You will execute [Repair MFT] command.

    If TestDisk says "Both MFT and MFT mirror are OK" close TestDisk. You will run check disk on that volume to correct the file system corruption. Caution: You will run checkDisk only and only if TestDisk confirms that your MFT is OK and you will not interrupt Check Disk for any reason)

    Run check disk from command prompt.

    Open Command prompt. Start > All programs > Accessories > Command Prompt

    Type
    CHKDSK K: /f /v /r /x Press Enter. Note: Replace K: with the actual drive letter of the external drive

    Allow check disk to complete.

    If TestDisk says it is unable to repair MFT ( in most cases it will not), you will have to use a commercial software to recover the files - GetDataBack or active @ File recovery. These are "try before you buy" software. If these show your files, you may be able to preview/open the files and check the file integrity. You can buy a license only when you are satisfied.


    If at any point you have a doubt in running TestDisk and require clarification post the screenshot and quit TestDisk.
    Last edited by jumanji; 31 Jul 2021 at 13:45.
      My Computer


  3. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #13

    Here are the results of TestDisk:

    When I try to list files, TestDisk can't access them (screenshot attached)

    When I first execute [Boot], the Boot sector is bad, the backup is OK (screenshot attached)

    After [Backup BS], the HDD is ejected and reconnected but it is still inaccessable

    TestDisk is rerun to the [Boot] screen and it reports that both the boot and backup secotrs are identical (screenshot attached)

    TestDisk [Repair MFT] is executed and it reports that both MFT & MFT Mirror are OK (screenshot attached)

    Chkdsk is run but it reports that it is unable to determine volume version (screenshot attached)

    Still not able to access HDD.

    Before I attempt to recover files with commercial software, would the [Rebuild BS] command do any good?
    Attached Thumbnails Attached Thumbnails Restore last data on external HDD-chk.jpg   Restore last data on external HDD-mtf.jpg   Restore last data on external HDD-boot2.jpg   Restore last data on external HDD-boot.jpg   Restore last data on external HDD-list-files.jpg  

      My Computer


  4. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #14

    No need to rebuild Boot Sector, if both boot sector and backup bootsector are shown OK now..

    Once again reboot your PC, then plugin your external, run TestDisk and confirm that MFT and MFT mirror are OK.

    Check Disk still reports "Unable to determine volume version and state" I really do not know what should be done now .
    Google and see whether there is any solution for it.

    Anyway, try Getdataback and check whether it shows your files. Read the help and documentation files.GetDataBack — Data Recovery Software For Crashed Hard Drives
      My Computer


  5. Posts : 13,896
    Win10 Version 22H2 Pro and Home, Win11 Pro and Home
       #15

    dsscottage said:
    Just checking another detail.

    I attempted to run chkdsk from within File Explorer properties and it reported that the drive was unformated and was unable to run.

    I then ran chkdsk from a command prompt and got the following message:
    The type of the file system is NTFS.
    The first NTFS boot sector is unreadable or corrupt.
    Reading second NTFS boot sector instead.
    The first NTFS boot sector is unreadable or corrupt.
    Reading second NTFS boot sector instead.
    Unable to determine volume version and state. CHKDSK aborted.

    I was hoping that this would copy the backup MBR to the primary. However, the response to reading second boot sector confused me.

    Does this mean that the backup MBR is missing or corrupt?
    There is a backup file but it's for the FAT/File Allocation Table on a drive.

    https://docs.microsoft.com/en-us/tro...s-file-systems
      My Computers


  6. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #16

    jumanji said:
    No need to rebuild Boot Sector, if both boot sector and backup bootsector are shown OK now..

    Once again reboot your PC, then plugin your external, run TestDisk and confirm that MFT and MFT mirror are OK.

    Check Disk still reports "Unable to determine volume version and state" I really do not know what should be done now .
    Google and see whether there is any solution for it.

    Anyway, try Getdataback and check whether it shows your files. Read the help and documentation files.GetDataBack — Data Recovery Software For Crashed Hard Drives
    I ran TestDisk again and it confirms that the Boot Record is OK and the MFT & MFT Mirror match. CHKDSK will still not run.

    Prior to my initial post, I ran Wondershare Recoverit and it identified MANY files. It is likely that most are fragmented and therefore useless. I didn't attempt to restore anything because I didn't want to risk further damage on the HDD.

    Therefore, my only option left seems to be the arduous task of recovering files.

    However, I'd like to use this case as an opportunity to learn a little more.....
    • I don't understand Berton's comment that the backup is for the FAT table. My HDD is NTFS not FAT. If the backup was only for a FAT drive, would'nt [RebuiltBS] in TestDisk properly restore the NTFS Boot Sector?
    • If the MFT and BootSector are present and accurate and a restore program identifies all the file segments on the HDD, it sounds to me like everything exists to restore the HDD. Isn't there some process that can use the MFT to restore all the fragmented files?
      My Computer


  7. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #17

    Hi @ dsscottage

    I was out for dinner and returned just now. Tomorrow mornng that is 8 hours from now, I shall deal with your post.

    Since it is daytime for you, please go ahead with GetDataBack, scan your 2TB drive and check whether it shows all your files as indicated earlier in my post. It has four levels of scanning. If first level does not bring out your files , try Level 2, then Level 3 and Level 4. GetDataBack — Data Recovery Software For Crashed Hard Drives

    ( During the day I did a google search on " unable to determine volume version and state" and came across just one thread that said solved. Here it is Solved: External hard-drive:...format the disk in drive F: before you can use it. | Tech Support Guy. Just read it. Let us see whether it works in your case)
      My Computer


  8. Posts : 154
    Win 10 Pro X64, Win 10 Home X64, Win 7
    Thread Starter
       #18

    jumanji said:
    Hi @ dsscottage

    I was out for dinner and returned just now. Tomorrow mornng that is 8 hours from now, I shall deal with your post.

    Since it is daytime for you, please go ahead with GetDataBack, scan your 2TB drive and check whether it shows all your files as indicated earlier in my post. It has four levels of scanning. If first level does not bring out your files , try Level 2, then Level 3 and Level 4. GetDataBack — Data Recovery Software For Crashed Hard Drives

    ( During the day I did a google search on " unable to determine volume version and state" and came across just one thread that said solved. Here it is Solved: External hard-drive:...format the disk in drive F: before you can use it. | Tech Support Guy. Just read it. Let us see whether it works in your case)
    GetBackData is currently running on level one. The estimated time remaining is 24 hours. Therefore, I probably won't have the results when you post back in the morning.

    By the way, I can't thank you enough for taking the time to help me. You are a star!
      My Computer


  9. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #19

    Hi@dsscottage
    This post is going to be a long post. So I shall split it and continue.

    dsscottage said:
    I ran TestDisk again and it confirms that the Boot Record is OK and the MFT & MFT Mirror match. CHKDSK will still not run.....
    In all cases where we had restored the Volume Boot Records and TestDisk declared that MFT and MFT mirror are OK, running Check Disk rectified the corrupted file system. Disk access was restored. In your case however that did not happen. Why remains a mystery still. Or was it this? "Users worldwide of Western Digital (WD) hard drives, specifically My Book Live and My Book Live Duo devices, found their hard drives being wiped clean remotely last June 23." This question remains.
      My Computer


  10. Posts : 11,618
    Windows11 Home 64bit v:23H2 b:22631.3374
       #20

    dsscottage said:
    .........Prior to my initial post, I ran Wondershare Recoverit and it identified MANY files. It is likely that most are fragmented and therefore useless. I didn't attempt to restore anything because I didn't want to risk further damage on the HDD. Therefore, my only option left seems to be the arduous task of recovering files......
    Yes,and your only hope now is GetDataback. Let us see.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 21:15.
Find Us




Windows 10 Forums