Data Recovery - Best Final Steps?

[dubesor]

I am finally nearing the end of a very lengthy process to get my valuable data back. So I don't want to screw anything up now and need your advice ...

Here's my first post describing what happened - http://forum.hddguru.com/drive-close-failure-need-advice-recover-data-t17246.html

Here's what I did so far:
1) Ran ddrescue on a broken 1TB drive. It took literally weeks to complete, but got back all 1TB of data onto a brand new 2TB drive with no errors left.
2) Ran dd to clone this new 2TB drive to another brand new 2TB drive

What is best to do now? Let chkdsk check the second cloned drive? Or run it through R-Studio instead? (The original drive's data was in Windows 7 NTFS filesystem)

[drguy]

You have 2 copies of your data so it would take a fair bit of stupidity to screw it up. Not thats it's impossible, but you would have to try hard.
Run chkdsk on 1 copy and if you are not happy with the results then just recreate the 2nd copy and run r-studio (or whatever else) on it.

[N.C.]

agree, you have another copy, so you can step back (by copy again) if chkdsk can't help to repair the 99.?? % image....

Janos

[dubesor]

Here's the output of chkdsk log. How bad is this? Maybe one of you can help me make sense of it?

Code:

Checking file system on F:
The type of the file system is NTFS.
Volume label is STORAGE.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 3)...

The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0xb.
The multi-sector header signature in file 0x200fc is incorrect.
42 41 41 44 30 00 03 00 e5 6d 7f 06 00 00 00 00  BAAD0....m......
03 00 02 00 38 00 01 00 30 02 00 00 00 04 00 00  ....8...0.......
Deleting corrupt file record segment 131324.
The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0xb.
The multi-sector header signature in file 0x200fd is incorrect.
42 41 41 44 30 00 03 00 de 6c 7f 06 00 00 00 00  BAAD0....l......
03 00 02 00 38 00 01 00 30 02 00 00 00 04 00 00  ....8...0.......
Deleting corrupt file record segment 131325.
The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0x9.
The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0x6.
The multi-sector header signature in file 0x200ff is incorrect.
42 41 41 44 30 00 03 00 db 65 7f 06 00 00 00 00  BAAD0....e......
03 00 02 00 38 00 01 00 18 02 00 00 00 04 00 00  ....8...........
Deleting corrupt file record segment 131327.

  131584 file records processed. File verification completed.
  30 large file records processed. 0 bad file records processed.                                       
  0 EA records processed. 0 reparse records processed.                                       

CHKDSK is verifying indexes (stage 2 of 3)...

The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0x9.
Index entry FR93F9~1.PSD of index $I30 in file 0x2d03 points to unused file 0x200fc.
Deleting index entry FR93F9~1.PSD in index $I30 of file 11523.
Index entry Frame5-OriginalScan-wb-levels-layered.psd of index $I30 in file 0x2d03 points to unused file 0x200ff.
Deleting index entry Frame5-OriginalScan-wb-levels-layered.psd in index $I30 of file 11523.
Index entry Frame5-OriginalScan.psd of index $I30 in file 0x2d03 points to unused file 0x200fe.
Deleting index entry Frame5-OriginalScan.psd in index $I30 of file 11523.
Index entry FRAME5~1.PSD of index $I30 in file 0x2d03 points to unused file 0x200fe.
Deleting index entry FRAME5~1.PSD in index $I30 of file 11523.
Index entry FRAME5~2.PSD of index $I30 in file 0x2d03 points to unused file 0x200ff.
Deleting index entry FRAME5~2.PSD in index $I30 of file 11523.
Index entry Frame7-OriginalScan-wb copy-adjlayers-smaller-sharp1px.jpg of index $I30 in file 0x2d03 points to unused file 0x200fd.
Deleting index entry Frame7-OriginalScan-wb copy-adjlayers-smaller-sharp1px.jpg in index $I30 of file 11523.
Index entry Frame7-OriginalScan-wb copy-adjlayers-smaller-sharp1px.psd of index $I30 in file 0x2d03 points to unused file 0x200fc.
Deleting index entry Frame7-OriginalScan-wb copy-adjlayers-smaller-sharp1px.psd in index $I30 of file 11523.
Index entry FRAME7~1.JPG of index $I30 in file 0x2d03 points to unused file 0x200fd.
Deleting index entry FRAME7~1.JPG in index $I30 of file 11523.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x1a7bb is incorrect.
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
Correcting error in index $I30 for file 108475.
The index bitmap $I30 in file 0x1a7bb is incorrect.
Correcting error in index $I30 for file 108475.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00  ................
ff ff ff ff ff ff ff ff d6 85 56 d1 c9 61 cb 01  ..........V..a..
57 c2 7b 9c d2 61 cb 01 57 c2 7b 9c d2 61 cb 01  W.{..a..W.{..a..
Sorting index $I30 in file 108475.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x1d01f is incorrect.
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
Correcting error in index $I30 for file 118815.
The index bitmap $I30 in file 0x1d01f is incorrect.
Correcting error in index $I30 for file 118815.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00  ................
ff ff ff ff ff ff ff ff 84 db 6a f4 a7 36 ca 01  ..........j..6..
84 db 6a f4 a7 36 ca 01 ee 39 b3 39 60 60 cb 01  ..j..6...9.9``..
Sorting index $I30 in file 118815.

146178 index entries processed. Index verification completed.

CHKDSK is scanning unindexed files for reconnect to their original directory.

Recovering orphaned file _RGB34~1.JPG (108476) into directory file 108475.
Recovering orphaned file _RGB3450_sp3_iso200_09.12.13_srgb-crop2.jpg (108476) into directory file 108475.
Recovering orphaned file _RGB35~1.JPG (108477) into directory file 108475.
Recovering orphaned file _RGB3524_edit.jpg (108477) into directory file 108475.
Recovering orphaned file 105_0507 (118816) into directory file 118815.
Recovering orphaned file 105_0508 (118963) into directory file 118815.
Recovering orphaned file ENDOFM~1 (120546) into directory file 118815.
Recovering orphaned file EndOfMay2010-P645 (120546) into directory file 118815.
Recovering orphaned file 0520(F~1 (120598) into directory file 118815.
Recovering orphaned file 0520 (First Medium Format Shots - Pentax 645, Agfa Optima 400-Y Film) (120598) into directory file 118815.
Recovering orphaned file 108_0531 (125044) into directory file 118815.
Recovering orphaned file 105_0528 (125133) into directory file 118815.
Recovering orphaned file 106_0529 (125162) into directory file 118815.
Recovering orphaned file 107_0530 (125253) into directory file 118815.
Recovering orphaned file 106_0509 (129673) into directory file 118815.
Recovering orphaned file 107_0510 (129694) into directory file 118815.
Recovering orphaned file 108_0511 (129709) into directory file 118815.
Recovering orphaned file 109_0512 (129790) into directory file 118815.
Recovering orphaned file 110_0513 (129795) into directory file 118815.
Recovering orphaned file 111_0514 (129854) into directory file 118815.
Recovering orphaned file 112_0515 (129971) into directory file 118815.
Recovering orphaned file 113_0516 (129994) into directory file 118815.
Recovering orphaned file 114_0519 (129997) into directory file 118815.
Recovering orphaned file 115_0520 (130056) into directory file 118815.

  21 unindexed files scanned. Recovering orphaned file 116_0523 (130348) into directory file 118815.
  0 unindexed files recovered.                                       

CHKDSK is verifying security descriptors (stage 3 of 3)...

The USA check value, 0x0, at block 0x1 is incorrect.
The expected value is 0x9.
  131584 file SDs/SIDs processed. Security descriptor verification completed.
  7298 data files processed. CHKDSK is verifying Usn Journal...
  27273712 USN bytes processed. Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

614614738 KB total disk space.
538320092 KB in 123640 files.
     41592 KB in 7299 indexes.
         8 KB in bad sectors.
    243382 KB in use by the system.
     65536 KB occupied by the log file.
  76009664 KB available on disk.

      4096 bytes in each allocation unit.
153653684 total allocation units on disk.
  19002416 allocation units available on disk.

Internal Info:
00 02 02 00 87 ff 01 00 20 dc 02 00 00 00 00 00  ........ .......
04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................


[warnerr]

you have a lot of data back and a few are now in numbered folders. take a look at what is back and copy to good destinatiojn. did you get back the files you wanted? if so its a success. if not then onwards

[dubesor]

you have a lot of data back and a few are now in numbered folders. take a look at what is back and copy to good destinatiojn. did you get back the files you wanted? if so its a success. if not then onwards

About those numbered folders, where would I find them? I did a search on F:\ (recovered volume) for 118815 but nothing was found ...

Anyway, the main two works I thought might be totally lost are now back which is a huge relief

This was such a trial, but I guess I learned a lesson about backup
I think my setup from now on will be 2 x 2TB drives in RAID1 array to safeguard from data loss.

[N.C.]

you have a lot of data back and a few are now in numbered folders. take a look at what is back and copy to good destinatiojn. did you get back the files you wanted? if so its a success. if not then onwards

About those numbered folders, where would I find them? I did a search on F:\ (recovered volume) for 118815 but nothing was found ...

Anyway, the main two works I thought might be totally lost are now back which is a huge relief

This was such a trial, but I guess I learned a lesson about backup
I think my setup from now on will be 2 x 2TB drives in RAID1 array to safeguard from data loss.

Please keep in mind, RAID can't be equal with a backup!

We are doing recovery from redundant RAID arrays about weekly....
Always backup to another place wich is important!

Janos

[dubesor]

you have a lot of data back and a few are now in numbered folders. take a look at what is back and copy to good destinatiojn. did you get back the files you wanted? if so its a success. if not then onwards

About those numbered folders, where would I find them? I did a search on F:\ (recovered volume) for 118815 but nothing was found ...

Anyway, the main two works I thought might be totally lost are now back which is a huge relief

This was such a trial, but I guess I learned a lesson about backup
I think my setup from now on will be 2 x 2TB drives in RAID1 array to safeguard from data loss.

Please keep in mind, RAID can't be equal with a backup!

We are doing recovery from redundant RAID arrays about weekly....
Always backup to another place wich is important!

Janos

That's too bad, thanks for the info. I don't know then what's the point of having a redundant RAID array if it won't protect your data?

[N.C.]

...

Please keep in mind, RAID can't be equal with a backup!

We are doing recovery from redundant RAID arrays about weekly....
Always backup to another place wich is important!

Janos

That's too bad, thanks for the info. I don't know then what's the point of having a redundant RAID array if it won't protect your data?

Well, if you don't want to make children, there is more way to protect yourself, this is similar a little.

[drc]

About those numbered folders, where would I find them? I did a search on F:\ (recovered volume) for 118815 but nothing was found

This isn't a folder named 118815 but the folder with record #118815. Just search for the files that are in it and you will find them (i.e. "EndOfMay2010-P645", etc)