Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
March 15th, 2017, 15:14
The "NTFS Search" should have offered you the option of saving a log. Did you do this?
The log lists the found MFT fragments in gory detail. I don't claim to completely understand the output, but someone else might.
March 15th, 2017, 15:26
I saved the log of both NTFS and raw scan. I will attach both. I'm scanning those two in the mean time.
- Attachments
-
- devscan.log
- NTFS scan
- (79.71 KiB) Downloaded 646 times
-
- devscanraw.log
- Raw scan
- (1.18 MiB) Downloaded 627 times
March 15th, 2017, 15:47
It's already finished that MFT/INDX scan and I think it's kinda saying there's no MFT found
http://i.imgur.com/EfNKE94.pngand finding something MFT related
http://i.imgur.com/ltK2NVA.png
March 15th, 2017, 16:14
- Code:
scan_range="0x0-0x5d27216000"
scan_state_sec="block:0x2000;inc:0x4000;first:0x2000;shift:0x2000;sec:0x2e9390b0;set:0x0"
MFT_frags_number=287
The scan spans the entire 400GB range (byte offsets 0x0-0x5d27216000) and the scan state points to the last sector (0x2e9390b0), so this indicates that the entire physical drive was searched and 287 MFT fragments were found.
I have sorted these fragments by their byte offsets (see attachment).
The first MFT record is at offset 0x23e647d800, ie sector 0x11F323EC (301147116). This corresponds to around 150GB.
- Code:
MFT_202=0x23e647d800:16:13:0x400:0x0:0x1000:0xffffffff:0x0:0:0:0x2
ISTM that the original file system was obliterated.
- Attachments
-
- MFTsort.rar
- (3.91 KiB) Downloaded 436 times
March 15th, 2017, 16:29
And now the translation of what should I do?
March 15th, 2017, 16:46
Your log indicates that DMDE has already found all the MFT and INDX records. AFAICS, another search would be pointless.
You could try an MFT search with Winhex, but someone else would need to advise you.
March 15th, 2017, 16:55
Ok I will wait till tomorrow night if I don't get anywhere I'm just going to format it back to NTFS, try something like recuva and what I get is what I get.
It's been too much of a hassle for me and even more for y'all.
March 15th, 2017, 17:06
Don't format your drive. You will only make things worse. DMDE's raw search should have found your files. PhotoRec should produce similar results.
March 15th, 2017, 17:16
But see the problem is that I don't have anywhere to copy them now. Since I couldn't find a decent hard drive I don't think I can get them recovered straight to that 400GB drive (no?).
March 15th, 2017, 17:35
If only I could see what I'm recovering so I can burn some stuff onto DVDs because I intended to do so even before I lost it all.
March 15th, 2017, 17:45
At least recover one or two files to a flash drive.
March 15th, 2017, 18:01
thekardinals wrote:Teamviewer good?
Good.
March 15th, 2017, 18:07
I can recover to one of the other hard drives. They've got plenty of space. Just don't know how much that file will take up nor how to recover them
P.S. actually I tried recovering from what was found by that raw search and it didn't let me because it was a free version of DMDE. Any free software without limitations?
March 15th, 2017, 18:31
Launch DMDE
uncheck the Show Partitions checkbox -> OK
Tools -> Full Scan -> Load -> devscanraw.log
select a particular search result, eg jpeg
double-click it or select Open Volume
expand $RAW -> Graphics -> jpeg
click the jpeg results
r-click a particular jpeg file (eg f39719466.jpeg) -> Recover the Object
March 15th, 2017, 18:42
PhotoRec is freeware.
March 15th, 2017, 18:47
Already tried that way with DMDE but it only allows 4000 files. Will try photorec tomorrow maybe on linux (because it's my main OS I always boot into it first). It's the same thing, at least it looks the same.
It's getting late now.
March 19th, 2017, 11:48
Well I recovered most of my video files but games would be too time consuming to download and rename all files as they should be. I recovered all this using photorec and it's pretty neat software for being free. You can even continue recovering after you shut down the PC so it's not all in one day.
Still I learned my lesson, backups, backups and backups.
Thanks to everyone that helped.
Solved.
Powered by phpBB © phpBB Group.