please help me solve

[jpacleb]

i'm new here.. but am looking to see if any one here can possibly help me, or point me in the right direction as i've never seen anything like this. A few weeks ago my girlfriend used my Western Digital Passport external drive then a few week or two later i went to get some files off of it to find that the files weren't exactly there, yet the drive was not empty.. it just has a bunch of gibberish files.. even though it registers as empty on windows.. in linux the drive shows completely empty. I can not even begin to describe the problem so i have attached a screen cap. thanks in advance for any help

[jono-ats]

I think the directory corruption is due to a hardware fault; perhaps the PCB is bad.

[microsoftengineer]

Hi
Try to Scan with R-studio or any Recovery software........i think Virus

[jpacleb]

I had previously tried photorec and test disk. One with no results and the other with useless results. I am currently in process of using recover my files professional addition.. it has been running since I first posted this topic and isn't even half way done with phase 5 of 6.. says it's scanning some 620,XXX,XXX sectors, has found over 20,000 files and over 1,600 lost files, as well as 3 partitions.. so I cannot wait for the full results.. might be useful, I will post an update if it works.. if not then I will look into hardware faults. It very strange as it says the modified dates on the files range from 20 years in thpast to 10 years in the future lol

[fzabkar]

I have seen corruption like this in FAT32 file systems in external drives when writes to disc have hung due to some USB communication problem.

[laptokowiec]

Check SMART for errors.

[mr_spokk]

I have seen corruption like this in drives that got misaligned and/or shifted.
You sure it had not been dropped?

[jpacleb]

@ laptokowiec this is an external drive, I do not boot from it either.. simply file storage.

@ fzabkar that's scary.. I suspect that the computer my girlfriend was using it on.. my cousins laptop has virus' and possibly other problems.. so hopefully this was a one time software related problem and not hardware.. is there anything I can check/test?

This program I am using has found and is recovering the files on the external drive which I am very pleased about. After recovery is finished how would I go about putting the drive back into service? Format the storage partition in windows? Never really dealt with external drive problems.. especially when it has multiple partitions.. one storing the files for the lock/unlock and other manufacturer(western digital) related files..

[jpacleb]

I have seen corruption like this in drives that got misaligned and/or shifted.
You sure it had not been dropped?

Not that I know of.. but that is a scary thought. If such a thing did occur, then is the drive useless or can I still use it? And fyi.. I have absolutely no clue why it shows those files in windows.. all my files were on an ntfs partition that got deleted or something, as I'm in the process of recovering said partition

[lcoughey]

I suggest you start by getting a full sector-by-sector clone of the drive.

[Vulcan]

This program I am using has found and is recovering the files on the external drive

I'm assuming that you are "recovering" files onto a different physical drive, and not onto the same "problem" drive.

Make sure you check the contents of each file that it claims to have recovered. In some recovery situations, file contents will be wrong / corrupted, even if the reported filename is OK. We have seen many reports of people who think they recovered their files, then they overwrite / re-use the original drive, and then later they find that they actually did not recover valid files - but have since overwritten the original drive. Game over. Beware of this possibility...

[Edited to add: While I've been typing, I see that lcoughey has made the very sensible suggestion that you (try to) clone your "problem drive", exactly to give you a "fall-back" plan, in case your "recovery" is not actually successful.]

I have absolutely no clue why it shows those files in windows.

Windows is interpreting corrupted, or incorrect data (e.g. not filesystem metadata), as if it was a directory. In that situation, you will see exactly the type of display which you provided. The problem is that on its own, this display does not explain the cause and hence does not explain what you need to do, to prevent this happening again.

After recovery is finished how would I go about putting the drive back into service?

Several approaches are possible - one approach is that at this stage "you don't" (put the original drive back into service). Until you have diagnosed what the original problem was (and its cause), why would you risk using the drive again?

As I said above, make sure you have definitely recovered all of the files that you need first (and that they are valid and usable). I would be further investigating the specific type of corruption first, which may help to identify what caused it. If you don't have the skills to do that, then at the very least, I would be doing both hardware testing, checking of SMART data, and limited use of the drive attached to one PC for non-essential storage for a while, in order to get confidence in that drive attached to a trusted PC first. More troubleshooting is needed to better diagnose what has happened, but would be difficult to talk you through doing remotely for several reasons.

As always, have a backup on different storage for any important files - then it doesn't matter whether this drive has a problem again, or not

Edited to add: Your response to laptokowiec seems odd. His (very sensible) suggestion to look at (and, if you are unsure, then provide here) that drive's (full) SMART data, is not affected by the fact that this is an external drive which you don't boot from. Therefore your reply doesn't seem to match his suggestion. Did you believe that SMART is only applicable to internal drives?

Last edited by Vulcan on May 27th, 2013, 13:49, edited 1 time in total.

[BlackST]

This program I am using has found and is recovering the files on the external drive which I am very pleased about. After recovery is finished how would I go about putting the drive back into service? Format the storage partition in windows? Never really dealt with external drive problems.. especially when it has multiple partitions.. one storing the files for the lock/unlock and other manufacturer(western digital) related files..

After the recovery is finished you need to see if the recovered files are VALID (i.e. a XLS file is correctly opened).

[ShaneWard]

My wifes files look like this on my computer when I view it over the network on her system, because all her files are named in Chinese characters. When I view them with my English computer, its cannot understand them.

Looks like the directory structure got messed up. Have you tried manually renaming one of the files and see if it opens?

[Vulcan]

My wifes files look like this on my computer when I view it over the network on her system, because all her files are named in Chinese characters. When I view them with my English computer, its cannot understand them.

On your computer, the dates of your wife's files should still be valid (unlike the OP's) even if you can't interpret the Chinese characters in the filenames.

Have you tried manually renaming one of the files and see if it opens?

IMHO this (or anything else which changes the data on the original drive) should not be attempted until the drive has been cloned, or unless the OP doesn't care about the data on the original drive any more. In a similar situation, I've seen the result of someone attempting to rename a file - it didn't help, because the problem was more severe than it appears which also seems true here - the OP says (and the screenshot shows) it's not just the filenames which are affected.

[jpacleb]

This program I am using has found and is recovering the files on the external drive

I'm assuming that you are "recovering" files onto a different physical drive, and not onto the same "problem" drive.

Make sure you check the contents of each file that it claims to have recovered. In some recovery situations, file contents will be wrong / corrupted, even if the reported filename is OK. We have seen many reports of people who think they recovered their files, then they overwrite / re-use the original drive, and then later they find that they actually did not recover valid files - but have since overwritten the original drive. Game over. Beware of this possibility...

[Edited to add: While I've been typing, I see that lcoughey has made the very sensible suggestion that you (try to) clone your "problem drive", exactly to give you a "fall-back" plan, in case your "recovery" is not actually successful.]

I have absolutely no clue why it shows those files in windows.

Windows is interpreting corrupted, or incorrect data (e.g. not filesystem metadata), as if it was a directory. In that situation, you will see exactly the type of display which you provided. The problem is that on its own, this display does not explain the cause and hence does not explain what you need to do, to prevent this happening again.

After recovery is finished how would I go about putting the drive back into service?

Several approaches are possible - one approach is that at this stage "you don't" (put the original drive back into service). Until you have diagnosed what the original problem was (and its cause), why would you risk using the drive again?

As I said above, make sure you have definitely recovered all of the files that you need first (and that they are valid and usable). I would be further investigating the specific type of corruption first, which may help to identify what caused it. If you don't have the skills to do that, then at the very least, I would be doing both hardware testing, checking of SMART data, and limited use of the drive attached to one PC for non-essential storage for a while, in order to get confidence in that drive attached to a trusted PC first. More troubleshooting is needed to better diagnose what has happened, but would be difficult to talk you through doing remotely for several reasons.

As always, have a backup on different storage for any important files - then it doesn't matter whether this drive has a problem again, or not

Edited to add: Your response to laptokowiec seems odd. His (very sensible) suggestion to look at (and, if you are unsure, then provide here) that drive's (full) SMART data, is not affected by the fact that this is an external drive which you don't boot from. Therefore your reply doesn't seem to match his suggestion. Did you believe that SMART is only applicable to internal drives?

Thank you for your long and thorough response. Of course I am backing it up to a separate drive, I am not taking any chances as there are files on there that I store for other people.. my girlfriend had already reamed me out for this even though she was the last one to use the drive before this happened, and don't want to go through the drama of explaining the loss to the other people..

You are right about my ignorance.. I thought SMART applied to drives used as boot media. I do not even know what type of corruption this is to begin to investigate it.. but as per your suggestion I will check the smart data for errors.. and see if I can check the health of the drive on my Linux machine.. any other hints, if possible, would be greatly appreciated as I've never dealt with this before, so it's new territory for me. I will also confirm that the files are valid I am positive that they are, but better safe than sorry(literally in my case as it's not just my data lol)

[jpacleb]

update: so yes, the files which I recovered from the drive were recovered I also ran some tests on the drive.. I scanned the drive for errors, 0.00% of blocks were damaged. I checked the smart health status and it passed. however when i checked smart for errors, it returned 3.. from best i can tell.. perhaps the external drive was unplugged without safely removing? I'm not sure so here is the log..

smartctl -l error sda

smartctl 6.1 2013-03-16 r3800 [i686-w64-mingw32-xp-sp3] (sf-6.1-1)
Copyright (C) 2002-13, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF READ SMART DATA SECTION ===
SMART Error Log Version: 1
ATA Error Count: 3
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 3 occurred at disk power-on lifetime: 6467 hours (269 days + 11 hours)
When the command that caused the error occurred, the device was active or idle
.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 01 ff 34 c5 e0 Error: ICRC, ABRT 1 sectors at LBA = 0x00c534ff = 129241
59

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
35 00 00 00 31 c5 e0 00 00:02:56.512 WRITE DMA EXT
35 00 00 00 2d c5 e0 00 00:02:56.007 WRITE DMA EXT
35 00 00 00 29 c5 e0 00 00:02:56.003 WRITE DMA EXT
35 00 00 00 25 c5 e0 00 00:02:55.998 WRITE DMA EXT
35 00 00 00 21 c5 e0 00 00:02:55.994 WRITE DMA EXT

Error 2 occurred at disk power-on lifetime: 6124 hours (255 days + 4 hours)
When the command that caused the error occurred, the device was active or idle
.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 01 c7 62 2e e2 Error: UNC 1 sectors at LBA = 0x022e62c7 = 36594375

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 08 c0 62 2e e0 00 02:16:24.853 READ DMA EXT
25 00 08 b8 62 2e e0 00 02:16:24.852 READ DMA EXT
25 00 08 b0 62 2e e0 00 02:16:24.845 READ DMA EXT
25 00 08 a8 62 2e e0 00 02:16:24.845 READ DMA EXT
25 00 08 a0 62 2e e0 00 02:16:24.845 READ DMA EXT

Error 1 occurred at disk power-on lifetime: 6124 hours (255 days + 4 hours)
When the command that caused the error occurred, the device was active or idle
.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 b9 c7 62 2e e2 Error: UNC 185 sectors at LBA = 0x022e62c7 = 36594375

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 00 80 62 2e e0 00 02:16:20.093 READ DMA EXT
25 00 00 80 61 2e e0 00 02:16:20.046 READ DMA EXT
25 00 00 80 60 2e e0 00 02:16:20.042 READ DMA EXT
25 00 00 80 5f 2e e0 00 02:16:20.031 READ DMA EXT
25 00 00 80 5e 2e e0 00 02:16:20.031 READ DMA EXT

if anyone knows what these errors mean then please let me know

[fzabkar]

https://ata.wiki.kernel.org/index.php/L ... r_messages

ICRC --- Interface CRC error during Ultra DMA transfer - often either a bad cable or power problem, though possibly an incorrect Ultra DMA mode setting by the driver

UNC --- Uncorrectable error - often due to bad sectors on the disk

ABRT --- Command aborted - either command not supported, unable to complete, or interface CRC (with ICRC)

[Vulcan]

@jpacleb,

If the reply from fzabkar is enough to answer your question, then great. It may be possible to add some additional detail and context, but that would need more of your time.

Glad you are confident that you've recovered your files

[laptokowiec]

So now you have to clone it to another hd. Use ddrescue (or dmde or hdclone).

[jpacleb]

@Vulcan. No, the reply from fzabkar was not enough to answer my question as it was just a generic copy and paste from a wiki page.. more detail and context would be welcomed as I feel that his reply was a bit out of context as those answers go against the good health of the drive- 100.0% good sectors, healthy smart status. To me, those errors would suggest that my girlfriend unplugged it without safely removing first as she admitted to doing so.. or she even disconnected it while files were still transferring in the background.. but if I really knew what I was talking about I wouldn't be here asking for help..

This just seems like a fluke incident, but I'm trying to find more detailed information about those errors before I decide whether or not I want to put the drive back into use..