Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

Strange case

November 18th, 2017, 9:53

Hello guys,

I got a strange case here which i would like to share with you guys,,,

External USB3 drive when you Right-click (from My computer) the windows reports for example 1GB of USED data

BUT

Actually it contains more than this, estimated data size about 300GB

I tried the drive in many PC`s all reports the same (Win. , Lynx, MAC )

Any reason for this?

Re: Strange case

November 18th, 2017, 18:15

Was it removed from some computer without "ejecting" or while said computer was hibernating ?

Re: Strange case

November 18th, 2017, 18:20

Probably is a messed up or non-updated $BMP file. I've seen the opposite a few times, where a drive was reporting that it was almost full despite the size of actual data being nowhere close to full.

Sometimes chkdsk will fix it, other times you've got to just re-format to fix it.

Obviously after you recover all the data. :lol:

Re: Strange case

November 18th, 2017, 19:17

Have you examined the "dirty bit"?

Locating the NTFS "dirty bit":
http://www.hddoracle.com/viewtopic.php?f=117&t=2126

Re: Strange case

November 19th, 2017, 1:38

looks like bitmap file is not correct. Probably, checkdisk will help you.

Re: Strange case

November 19th, 2017, 3:45

Martin wrote:looks like bitmap file is not correct. Probably, checkdisk will help you.

Did you actually read any of the replies in this thread?

Re: Strange case

November 19th, 2017, 5:12

Hi guys,

@ rogfanther , No, this drive is a CLONE of drive which i changed heads to

@ data-medics & Martin , cannot format it, i just took the data from it for my client, and chkdsk is always a bad idea

@ fzabkar , i think your reply explains alot here... thank you

and thank you all guys...

after changing heads the drive had few bads (maybe 100 bads) somewhere in the middle thats why am wondering why windows reports wrong used space while UFS for example reports it correct.

Thank you all for your replies guys.. appreciate it

:D :D

Re: Strange case

November 19th, 2017, 12:39

einstein9 wrote:@ data-medics & Martin , cannot format it, i just took the data from it for my client, and chkdsk is always a bad idea


Chkdsk isn't always a bad idea, if you've already recovered all the data as I suggested in my post.

Can't format the drive as in, it won't let you? Or can't as in, there's still data on it needing to be recovered?

I can't see how the drive reporting a wrong amount of free space will have any impact on getting the data recovered out. I'm just talking about fixing the drive afterward when it's all done.

Re: Strange case

November 20th, 2017, 3:27

@ data-medics

PM sent :wink:

Thank you guys
Post a reply