All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: Can I recover from chkdsk d: /x /f ?
PostPosted: February 6th, 2018, 17:00 
Offline

Joined: February 6th, 2018, 16:28
Posts: 5
Location: Europe
I have an Elements external USB drive that was corrupted. I ran this command to fix it. The problem is it deleted the index entry files I needed. Is there a way to recover the data from these two files below? I have not written to the HD since.

C:\Users\user>chkdsk d: /x /f

The type of the file system is NTFS.

Deleting index entry filename-here.txt in index $I30 of file 452.
Deleting index entry filename-2-here.txt in index $I30 of file 452.

Any suggestions would be greatly appreciated.

Thanks.

S


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 6th, 2018, 17:28 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Try with Recuva, GetDataBack or R-Studio.


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 6th, 2018, 18:50 
Offline

Joined: February 6th, 2018, 16:28
Posts: 5
Location: Europe
I tried Recuva in the past and it didn't bring up the file I'm looking for. Maybe I'll try again with the latest version if R-studio doesn't work.

Currently scanning using R-studio which looks a bit more robust. Should I scan for all files or can I focus in on just the .txt files which I am after?

Since I'm after the data in "$I30 of file 452", how does that translate to the hex editor so I can see the data in that space? Or it doesn't work that way?

Deleting index entry filename-here.txt in index $I30 of file 452.
Deleting index entry filename-2-here.txt in index $I30 of file 452.

Thanks.

S


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 6th, 2018, 23:08 
Offline

Joined: June 17th, 2017, 18:30
Posts: 30
Location: Russia
Deleting index entries is a consequence of the problem, not the problem itself.

NTFS has an MFT entry for a file, and then in every directory containing that file (which may be more than one) it will store the index entry. If the file ceases to exist, index entries should be removed. This normally happens as a part of file deletion, but if there is a power failure or somethnig, or if the file is damaged instead of deleted, there is a stale index entry pointing to the file which does not exist any longer. These index entries are cleaned up during checkdisk.

Deleting index entry filename-here.txt in index $I30 of file 452.

translates into

Deleting index entry (a pointer to) filename-here.txt in index $I30 (normal directory index) of file 452 (of a directory which has MFT ID 452), because the file no longer exists.

You should look earlier in the log to see what happens with the file itself.


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 7th, 2018, 14:09 
Offline

Joined: February 6th, 2018, 16:28
Posts: 5
Location: Europe
"You should look earlier in the log to see what happens with the file itself."

There is nothing in the chkdsk log file with this filename before this entry. Just before the lines with the two files I'm trying to recover it displayed the following lines below. $130 matches but the file number is different.:

"Correcting error in index $I30 for file 441.
CHKDSK discovered free space marked as allocated in the bitmap for index $I30 for file 441.
Sorting index $I30 in file 441."

I've finished the scan. There are a bunch of .txt files with numbers for filenames. Is there a way to search for the old file name or contents of these files in R-studio?

Thanks.

S


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 7th, 2018, 14:30 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2105
Location: Ontario, Canada
Generally speaking, chkdsk causes irreversible damage and should never be run on a drive that isn't backed up.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 7th, 2018, 17:02 
Offline

Joined: February 6th, 2018, 16:28
Posts: 5
Location: Europe
Now the external drive is not booting and I'm getting a denied error. This is why I originally ran the chkdsk program to begin with so I could access the drive. I'm not going to do the chkdsk again. This occurred on Windows. I switched to the Linux computer and the drive shows up normally again. Now I have to re-install R-studio and run a scan again.


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 7th, 2018, 17:04 
Offline

Joined: February 6th, 2018, 16:28
Posts: 5
Location: Europe
This external WD Elements drive was supposed to be the main backup drive. My 2nd backup was a USB flash drive and that died too as well as the original SSD drive in my laptop which died first.


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 7th, 2018, 17:49 
Offline

Joined: May 21st, 2007, 16:10
Posts: 1535
Location: Gothenburg/ Sweden
Driver-21 wrote:
Now the external drive is not booting and I'm getting a denied error. This is why I originally ran the chkdsk program to begin with so I could access the drive. I'm not going to do the chkdsk again. This occurred on Windows. I switched to the Linux computer and the drive shows up normally again. Now I have to re-install R-studio and run a scan again.

First option should be to make a clone and work with that...not with the original drive.

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 10th, 2018, 15:47 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9981
Location: Portugal
lcoughey wrote:
Generally speaking, chkdsk causes irreversible damage and should never be run on a drive that isn't backed up.


FULLY AGREEE !!!!

:shock: :shock: :shock:

I did have a HUGE problem myself with my MAIN system last week !!!

Was running just fine and did never had a single problem for almost 10 years now.

It's running XP on a old 80 GB 7200.10 drive with 3 partitions. One for the OS and 2 for tools. Then i have other drives plugged for data.

It was raining allot here and thundering and while the computer was running and writting stuff the power went down. No UPS. So when the system re-started there was a message complaining about missing windows .dll.

I boot from the 1TB SATA drive that i have on the same system and chose Hirens mini xp. Tryed to replace the damaged file on C: of the main 7200.10 drive and it didn't allow me to write. Complained about damaged file and couldn't write at all. Power off the system and run MHDD on the drive. S.M.A.R.T. checked ok. Full surface scan checked ok, neither a single bad sector (or slow for that matter) all grey blocks (fast) and G-List was empty. Ok, disk was fine. Loaded min-xp again and run checkdisk with option to fix errors.

It created a found.000 folder or whatever on c: and now i was able to copy the missing .dll (damaged) back to the drive. Power off/on and booted from the main drive .... guess what ?

When window booted up there was no longer desktop background image and my documents, etc were gone ... I found most of the stuff inside sub-folders of found.000 that checkdisk created .... BIG MESS !!!!

:twisted: :twisted: :twisted:

That chkdsk is just BAD !!!! It's only good to diagnose problems with the file system and be sure that all is still in order. Example - you create a full backup and then you run chkdsk on the main drive to see if it have problems. If not you are good to go !!!

On my case i don't think i would be able to recover the damage done by chkdsk myself even with my collection of tools like R-Studio, GetDataBack, etc ....


The sollution that i did use to "solve" my issue was to restore the backup (full clone) of the drive. I'm using this 80 GB drive mainly for OS and to test firmware tools so it doesn't change much over time. Even so i do have a full clone done from 2 in 2 weeks with "savepart". I use sector by sector clone.

I did restore the clone to the 7200.10 power off/on and run chkdsk on it. All fine without a single error. Just to be sure i did left prime95 running for a day and memtest running for an entire night to test for hardware problems. Looks good to me now. Re-run the chkdsk no found.000 so far !

:D :D :D

If you run chkdsk and you see something like found.000 on the drive letter you run the command you are in for pain ... oh and make sure you have option to show hidden files enabled as well !!

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Can I recover from chkdsk d: /x /f ?
PostPosted: February 10th, 2018, 15:52 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9981
Location: Portugal
Driver-21 wrote:
This external WD Elements drive was supposed to be the main backup drive. My 2nd backup was a USB flash drive and that died too as well as the original SSD drive in my laptop which died first.


Flash have re-write cycles limits meaning that flash memory will die if you write to it more then it can take. Also its based on electrical charges that might dis-charge over time. Conventional HDD are based on magnetic storage ....

I'm not the best person in the world to talk about this but for me flash looks way less reliable for long term storage / backup ....

Even to move files around i only use conventional 2.5 HDDs now. For some reason i don't like "flash" as all the experiences that i had with it were not the best ...

Flash pen drives are only of use to move data that you don't mind to loose like i use that to copy movies/series from the PC main drive to watch on the television. I do have a big TV set that can read MPG, MKV, etc from the USB drives so you can use pen drives for that kind of stuff but NEVER to store important data that you want to keep over the years ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 27 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group