Recovering zero byte files

[MikeMaster]

Hi all,
Im running into some difficulties im unable to resolve by myself. Its about my WD MyBook Essential 1 TB External harddrive. The drive itself is 3 months old and in excellent condition (technically).

It has some problems that chkdsk can't solve. Ive run various recovery programs. Most of them are able to recover the files. All files have lost their original location (maps) and filenames (they are all named found000x.jpg etc.). This seems to happen a lot with recovery programs so end of story you would say.

However: when i access the harddrive in explorer, all my maps are there, all my files are there but they all have a filesize of 0 bytes.

So as i see it (and im not a tech guy):
- the 'drive structure' (maps and filenames and so) are intact
- the files itself are intact
But the 'link' between the filename/ size and the actual file is missing.

Here's some additional info from the scan (i dont know what it means but maybe it helps):
file records: 40145
signature files: 27553

NTFS Boot Sector detected
MFT Mirror Zone detected
Block 1 Size 50.0 MB (5248800 bytes)
Sectors from 0 to 102399

MFT Zone detected
Block 62 Size 50.0 MB (5248800 bytes)
Sectors from 6246400 to 6348799)

NTFS Boot Sector detected
Block 5600 Size 50.0 MB (5248800 bytes)
Sectors from 573337600 to 573439999

Appreciate your help!

[Vulcan]

IMHO further investigation is needed to find the cause of the problem, instead of focussing on the symptoms which that problem has caused to the filesystem.

From your story (and many more details & answers would be needed as part of that investigation), personally I suspect a hardware problem - but finding it will need time, effort, and perhaps money. It isn't clear to me if you are asking for help to do that investigation, or asking for guesses about the cause, or something else...

[SAjunky]

Remove drive from enclosure and test it connected to PC SATA controller. By opening enclosure you lose warranty. Pictures of the drive interface, or at least drive model number would help.

[MikeMaster]

Thank you. I dont think its a hardware problem. The disk is about 3 months old en doenst show any failure in tests. More importantly: it got messed up when i aborted a disk cloning program. I ran about 5 recovery programs which all gave the same results. For now i was able to rescue most data in raw format. As i dont see any more options, im gonna format the drive.

[mr_spokk]

Remove drive from enclosure and test it connected to PC SATA controller. By opening enclosure you lose warranty. Pictures of the drive interface, or at least drive model number would help.

You that have so much knowledge must know that this model has an encrypted interface...so it will not work outside the enclosure.


@MikeMaster, first thing you should do is to clone that drive to a new one and work further from there.

[loki]

Remove drive from enclosure and test it connected to PC SATA controller. By opening enclosure you lose warranty. Pictures of the drive interface, or at least drive model number would help.

You that have so much knowledge must know that this model has an encrypted interface...so it will not work outside the enclosure

+1

@MikeMaster, first thing you should do is to clone that drive to a new one and work further from there.

+1 again

MikeMaster you would still need to remove the drive from the enclosure to make a full clone (thus invalidating its warrenty) as the USB bridge board also acts like a HPA & stops you accessing the VCD sectors etc. Also clone it to another WD 3.5" drive same size (or bigger if you know how to set a HPA to match)

Loki

[Vulcan]

@MikeMaster,

Thanks for the update.

I dont think its a hardware problem. The disk is about 3 months old en doenst show any failure in tests.

This isn't enough detail for me to agree with that conclusion - many times in my job (which isn't DR), I investigate issues where people tell me that everything tests OK, yet looking at the details, I (usually ) find the cause of the problem. Different people interpret things like test results, differently... However, it seems that this issue isn't a real problem for you, so further investigation isn't worth it.

More importantly: it got messed up when i aborted a disk cloning program.

Again, I'd need more details to properly understand what you mean, but in general - if this disk was the source of the clone, then you're only reading from that disk and hence no corruption should have happened to this filesystem, and there is something strange going on, which isn't understood at this stage; (if this disk was the target of the clone, then of course you'd not expect the filesystem on a partial clone to be usable, so I doubt that you mean this).

As i dont see any more options, im gonna format the drive.

OK - your disk, your choice Good luck!

[NeverSayDie]

If it isn't a hardware problem then the MFT is probably damaged. It contains the size of the file and if something reorganized the MFT improperly or crashed while doing it, it could set them all to a value that would be read as 0.

Chkdsk can do this sometimes as it tries to reorganize or repair the MFT. That's why you need to make an image and try everything else before running chkdsk (though Microsoft never warns of this). There is a backup MFT but unfortunately that only contains data for the system metadata files like the MFT itself and reallocated sectors map and such.

You should definitely make an image (I use GNU ddrescue in Linux which works without removing the drive from its enclosure if the drive is still visible) and then you can either recover raw data from the image which gives you no name info (I use PhotoRec for that) like you've already seen or you can use something that can read the MFT and if you are lucky, the information in the MFT for where the data is located on the disk is not corrupted like the size data. Combined with the filename you can search through the raw data on the disk to that location and recover the data. I use various forensic tools for that but I believe the cheap version of Restorer Ultimate has that capability.

Manually carving out the data like that is very tedious and gets extremely difficult if the files are fragmented. Some file types don't mind if you just get close to the correct end of the file but some files (especially ones that use compression) are very picky about you getting it exactly right.

James

[laptokowiec]

Sometimes a bad or too long data cable can cause that

[MikeMaster]

Thank you guys for the replies. Let me explain some more what happened.
I have a laptop and an external WD-drive. The WD-drive had an 3 months old backup of the laptop on it and some more files. The laptop fell down the table and the harddrive was damaged (smart-failure). I was able to access the laptop by booting with Ultimate Boot CD. After that i copied the files i didnt have on the backup to it. Last, i wanted to clone the whole laptopdisk in case i had forgotten some files on the laptop. When i ran the cloneprogram, i cancelled it after 5 minutes or so. I cancelled it because i was afraid it would overwrite existing data on the WD drive. This was my mistake.
After the cancelling of the cloning program my WD drive was messed up. It showed about 600gb of unallocated space. I could see the directory structure and files but all the files were 0 bytes.
I tried to rescue the data with TestDisk, GetDataBack, Active File Recovery and EaseUS Recovery Wizard (full edition). Results with all the programs were identical: all the files were copied but with the 0 byte filesize.
When i rescue the data in 'raw'-format (so files named found001.jpg and so) most of the files turn out ok (except large files). However filename and maps are missing.
This is the strange thing: it seems that the filenames and maps are ok (i can see them in explorer), the data itself is ok (i can extract them in rawformat) but they dont link together.

Here are some screenshots i took:

R-Studio Demo:




TestDisk:




for some reason TestDisk starts at 29%:








When using the MFT option in TestDisk, it sais both MFT's are fine but they dont match. It suggested i use chkdsk, which i did. It solved many problems during the scan but the results were the same.

[NeverSayDie]

That certainly fits with my assessment of the corruption in the MFT that I mentioned in my previous post above but the new information about dropping it points to physical damage also.

Before saying it was dropped you said...

I dont think its a hardware problem. The disk is about 3 months old en doenst show any failure in tests. More importantly: it got messed up when i aborted a disk cloning program.

James

[Vulcan]

@MikeMaster,

I interpret your comments differently to NeverSayDie, as I think you're saying that the corrupted drive is the WD 1TB external drive, not the damaged internal laptop drive. Here are a few comments, based on what I think you're saying.

Last, i wanted to clone the whole laptopdisk in case i had forgotten some files on the laptop.

OK, I understand the basics of your plan. Since you already had files on the WD 1TB extrnal drive, then if you were going to use that drive to also hold the clone of the laptop drive, your plan would have needed to be to clone that laptop drive into an image file on the 1TB drive. Your details are still not clear enough for me, unfortunately, but as I explain below, it seems possible that you started to to make a raw disk clone, and therefore started to overwrite the existing filesystem on the WD 1TB external drive.

When i ran the cloneprogram

If this was an important issue for you, and if I was trying to understand the deeper details, I would then ask questions like: Which "clone program"? Which options did you choose? What were you trying to do? What do you think you actually did? etc. etc. But since you explained you're going to format the disk, I've just given my guess about what you mean below.

i cancelled it after 5 minutes or so. I cancelled it because i was afraid it would overwrite existing data on the WD drive. This was my mistake.

I think you are saying that you did what I explained earlier i.e. you did not clone into an image file on the WD 1TB disk, but started to make a raw clone of the laptop disk onto the WD 1TB disk (thereby overwriting the existing filesystem), and then stopped that process after 5 mins.

If my guess is correct, then your result is similar to what I would expect, and of course that cause is human error, not a hardware problem (with the affected WD 1TB disk), as I had suspected from your initial comments. I could write more about recovery options but have run out of time now. For DIY, your raw recovery is probably the best you can do, IMHO.

Thanks for explaining more about the background - unfortunately it's another example of the risks of DIY. This is not an uncommon mistake. Good luck!

[NeverSayDie]

@MikeMaster,

I interpret your comments differently to NeverSayDie, as I think you're saying that the corrupted drive is the WD 1TB external drive, not the damaged internal laptop drive.

Yes, I misinterpreted that. Thanks for pointing that out and I'd like to apologize to MikeMaster.

I did just see the thread you posted at CGSecurity and I see that you have NTFSWalker. It can be used for manual data carving if you need to. Just look at the file entry for the file that you want to recover and look at the bottom of the right pane for the DATA RUNS entry and that tells you what cluster the file starts at. I wrote a tutorial about this technique for recovering deleted data at
http://html5.litten.com/windows-file-re ... le-system/
but it should work the same for you as long as the DATA RUNS data was not corrupted (though I would not be surprised if it is).

It's a little oversimplified so if you try it and have any questions, you can ask me here in this thread.

James

[MikeMaster]

Tnx all.

@NeverSayDie: no, i should apologize for not being more clearly. Indeed the situation is:
- my laptop internal drive got damaged by falling off the table
- my WD External drive got corrupted by cancelling the clone program
Also thank you for the NFTSWalker tutorial, its excellent.

@Vulcan, please see below for by answers:

@MikeMaster,

I interpret your comments differently to NeverSayDie, as I think you're saying that the corrupted drive is the WD 1TB external drive, not the damaged internal laptop drive. Here are a few comments, based on what I think you're saying.

Last, i wanted to clone the whole laptopdisk in case i had forgotten some files on the laptop.

OK, I understand the basics of your plan. Since you already had files on the WD 1TB extrnal drive, then if you were going to use that drive to also hold the clone of the laptop drive, your plan would have needed to be to clone that laptop drive into an image file on the 1TB drive. Your details are still not clear enough for me, unfortunately, but as I explain below, it seems possible that you started to to make a raw disk clone, and therefore started to overwrite the existing filesystem on the WD 1TB external drive.

Yes, that is correct

When i ran the cloneprogram

If this was an important issue for you, and if I was trying to understand the deeper details, I would then ask questions like: Which "clone program"? Which options did you choose? What were you trying to do? What do you think you actually did? etc. etc. But since you explained you're going to format the disk, I've just given my guess about what you mean below.

Not sure, i think i was using CloneZilla on the UBCD.

i cancelled it after 5 minutes or so. I cancelled it because i was afraid it would overwrite existing data on the WD drive. This was my mistake.

I think you are saying that you did what I explained earlier i.e. you did not clone into an image file on the WD 1TB disk, but started to make a raw clone of the laptop disk onto the WD 1TB disk (thereby overwriting the existing filesystem), and then stopped that process after 5 mins.

If my guess is correct, then your result is similar to what I would expect, and of course that cause is human error, not a hardware problem (with the affected WD 1TB disk), as I had suspected from your initial comments. I could write more about recovery options but have run out of time now. For DIY, your raw recovery is probably the best you can do, IMHO.

Thanks for explaining more about the background - unfortunately it's another example of the risks of DIY. This is not an uncommon mistake. Good luck!

I really appreciate your help guys. As i failed to recover my WD Drive, i am now gonna try to recover the original, internal laptop drive. First step is to make a clone. Im gonna try to do that using the UBCD (i have taken the internal drive out and placed it in another, older laptop i have). Im reading some DDRescue tutorials atm. The laptopdrive (500 gb) had two partitions on it (C: and D:). At this moment i can see the D: drive in Parted Magic (which shows up as sdc4), the C: drive shows up as unallocated space. My intention is ofcourse to clone the whole drive into an image and work from there.

[MikeMaster]

I really appreciate your help guys. As i failed to recover my WD Drive, i am now gonna try to recover the original, internal laptop drive. First step is to make a clone. Im gonna try to do that using the UBCD (i have taken the internal drive out and placed it in another, older laptop i have). Im reading some DDRescue tutorials atm. The laptopdrive (500 gb) had two partitions on it (C: and D:). At this moment i can see the D: drive in Parted Magic (which shows up as sdc4), the C: drive shows up as unallocated space. My intention is ofcourse to clone the whole drive into an image and work from there.

Almost made the same mistake again: i want to IMAGE the harddrive, not clone.

[MikeMaster]

Sorry, it seems i cant edit/ add to my previous posts.

Disk structure of my laptopdrive shows:
dev/sdc1 BIOS_RVY size (10 gb)
dev/sdc2 System (100 gb)
unallocated (273 gb) (i take it this was my old C-drive and should be dev/sdc3)
dev/sdc4 Data (162 gb) (this was my old D-drive)

I dont think i need to image the sdc1 and sdc2 section as they are sytem files (i think). If sdc3 and sdc4 are my old C: and D: drives i want to image them. Problem is (but still reading tutorials and howtos) that i cant mount the sdc3 and therefore cant image it.

[Computer_Genius]

I have recently had this problem, and unfortunately, your files are GONE FOREVER, especially if it was because of a file you downloaded, there's lots, and I mean lots of files in the warez scene that are doing this. I would stay clear away from those sites, I am not sure of you particular case, but in any case, don't download something unless you are 100% sure of the source you getting the files from, otherwise, it's your files at stake, and I lost tons of legit (paid for) stuff from a stupid file I downloaded from the warez scene. Don't take your chance like I did.