Trying to recover new data apparently now in bad clusters

[ArgyleNavy]

New User!

Made a big mistake, removed old HDD from previous desktop. Tried to add as a second HDD in new desktop and believe somehow I answer yes initialize.
Have used Recuva and DiskDrill both have only drug up literally my son's old files that are 10 years old in a biz venture with a friend. But all of my info
saved does not show up. Did a full Recuva deep scan and it showed about 1GB of "bad clusters" but! no files have been overwritten.
So tried chkdsk /r and the drive still shows as virgin 1TB WD SATA hard drive.

I know my data is there. Only have a partial backup of files back in early part of the year. I did A LOT OF WORK in the past 3 months and re-creating. UGH.
DiskDrill bought the upgrade... but Recuva did pretty much the same thing for free.

What now? Recommendations? Can I get that data in the "bad clusters" that have not been overwritten?

thanks so much

[fzabkar]

Can you show us a SMART report?

https://www.reddit.com/r/datarecoverysoftware/wiki/index/smart/

Can you also show us the Partitions tab in DMDE?

https://dmde.com/

[ArgyleNavy]

Two Files attached not what requested but the info obtained to date.

So. Briefer summary. HDD apparently initialized. New Data not showing up in either Recova or Disk Drill. Did a chkdsk /r and still have bad clusters. not overwritten.
not sure why new files are not being found. partition? but drive is 1TB and it shows no files on the disk and 931 GB available? Only files shown are pre-my use for past year or so and data saved since then is not showing up.

Attachments

chkdsk /r cmd prompt summary

Recuva snip Bad Clusters of 1GB not overwritten

[fzabkar]

$BadClus is a sparse file. The amount of space allocated to it is the full size of the drive, in your case 1TB, not 1GB.

976759804 KiB = 1.0002 TB

Some light reading ...

https://katyscode.wordpress.com/2007/04/16/ntfs-bad-sectors-resolution-the-badclus-metafile/

[ArgyleNavy]

Mental Error on 1TB vs. 1GB - just glanced and thought 1GB not really looking at it until you pointed it out. Thanks.

Still at same place - done all I can do with Recuva, DiskDrill, and chkdsk /r Used paid version of diskdrill (bad decision #2) and Recuva. They both get the same files. None of which are the recent files.

Since Recuva indicates there are 976 $BadClus but that drive in File Explorer reports 931GB of 931GB available -- so is there 45B in limbo?

In researching MS says: Use this? DISM.exe /Online /Cleanup-image /Restorehealth followed by this: sfc /scannow

The main concern is not to overwrite or screwup the recovery of that data.
I don't think the data is gone but for whatever reason these tools are not accessing or finding that part of the drive?

[ArgyleNavy]

Edit to post was for correcting math error/difference in $badclus GB vs. directory GB -- how long do you require approval of each post?

This posted immediately am going to edit to see if that then goes to moderator approval. please release post from about one hour ago.

[fzabkar]

Edit to post was for correcting math error/difference in $badclus GB vs. directory GB -- how long do you require approval of each post?

This posted immediately am going to edit to see if that then goes to moderator approval. please release post from about one hour ago.

Stop using Recuva, DiskDrill, and chkdsk. In fact, don't write to the drive, especially not with CHKDSK.

I'm still waiting for the information that I asked for.

As for $BadClus, you still don't get it. Examine the size of $BadClus with DMDE (you know, that tool I referred to in my earlier post). You will probably find that its physical size is 0 bytes, or close to it. It's a sparse file.

[ArgyleNavy]

the moderator hasn't released a previous post. The $badclus is 976GB the file folder says the drive is empty 0 of 931GB. Thus there is a 45GB difference? possibly?

Holiday in the USA, 4th of July (independence day) so adult kids here and grandkids thru Sunday. Have not checked into DMDE yet.

I do "get it" on the disk size issue, in post not release stated, just glanced at it did not think it could be the entire drive so did not look closely at the number and just thought ok that makes sense 1GB is bad files/directory/clusters whatever.

[fzabkar]

Since Recuva indicates there are 976 $BadClus but that drive in File Explorer reports 931GB of 931GB available -- so is there 45B in limbo?

This is just more babble. Nothing is in limbo. All capacity is accounted for.

976759804 kibibytes = 976759804 x 1024 bytes = 1.0002 terabytes

Please read this:

https://en.wikipedia.org/wiki/Sparse_file

[fzabkar]

the moderator hasn't released a previous post. The $badclus is 976GB the file folder says the drive is empty 0 of 931GB. Thus there is a 45GB difference? possibly?

I do "get it" on the disk size issue ...

Do you not understand this ...

931 GiB = 1TB

[ArgyleNavy]

Don Quixote of Australia AKA fzabkar:

With 15K of posts, am sure that you're a valuable resource here. Maybe it is Aussie English, but found some comments as a tad over the top. With that said thanks for the education on the various links posted.

So in attempt not to "babble"
1. NEVER deleted the files of the HDD.
2. HDD is/was functioning well.
3. Added as a 2nd SATA drive to new desktop.
4. A message that seemed related to boot up was "okayed"
5. Result is the HDD shows as empty with no files to date overwritten other than in that initial boot (if that is what happened)
6. Attached are assorted DMDE screenshots per your request (if the correct screenshots not shown please elaborate)
7. Read with info from TestDisk that it looks at partitions and can fix. No errors were found
8. The files I need or hopefully most of them must still be on the HDD.

Am learning here on a problem that should not have created or had to deal with but am a "boomer" and hate to spend money plus would like to learn. So...

Am grateful for any help or suggestions.

[fzabkar]

You began this thread by focusing on $BadClus. My first request was for a SMART report, which you have consistently ignored. A SMART report will tell us if the drive has recorded any read errors, reallocated sectors, or pending sectors. (A cardinal rule of data recovery is not to thrash a drive that has physical problems.)

I then provided you with a link to a blog which explained the structure of $BadClus in detail. You appear to have ignored this also.

The reason I asked for a DMDE screenshot is so that we could then locate the $BadClus metafile and determine its real physical size. If you click $MetaData in your dmde.view2.PNG screenshot, you should see the size of $BadClus in the top RH pane.

BTW, I am also a boomer and have an engineering degree, FWIW. That said, I confess that I don't fully understand the "BAD " MFT records. I think DMDE normally fills an unreadable sector with "BAD ", so it would appear that MFT records 9, 10 and 11 are unreadable. These correspond to the $Secure, $UpCase and $Extend metafiles. If these are the only issues, then they should not affect data recovery.

My approach would be to clone your drive with HDDSuperclone and then recover your data from the clone.

https://www.reddit.com/r/datarecoverysoftware/wiki/hddsuperclone_guide/

Best of luck.

[ArgyleNavy]

Sorry, I ran that initially guess in editing my post, it got deleted. No issues on SMART report. Below is screenshot.

[Arch Stanton]

That would need to be a full SMART report that shows the SMART attributes, not some OK / not OK status.

[ArgyleNavy]

[Arch Stanton]

SMART.Report.CrystalDisk.PNG

If you look at Reallocated Sector Count and Pending Sector Count you see the RAW values are zero. Whatever problem you're having, it has zero to do with bad clusters.

https://forum.hddguru.com/download/file ... &mode=view shows plenty files, if you select NTFS 0 and click Open Volume you can review them.

[ArgyleNavy]

Agree yes no bad clusters and the HDD is "good" operating normally. What I have not found are the non-deleted but on the HDD files. All of these suggested routes to date have not shown recent non-deleted files... rather, all have shown LOTS as you note of files that are deleted that could be recovered. The HDD has not been written to except for the probable initialization. I had a lot of work that was after a backup and just plain forgot to do a B/U and then tried to install this HDD in a new desktop since my old desktop had a failing motherboard.

I'm really based on great input here trying to find what will restore the file structure even if not the right name of the files.

I did get a 2TB ext. HDD to clone the current drive so do not unintentionally do more writing to it. I've gotten some other software/apps to try when able. Lot on my plate right now so at this sporadically.

[ArgyleNavy]

** Update **

So quite a few tools recommended here and elsewhere. Final result is using Wondershare Recoverit, found the undeleted files that somehow won't show up in ALL of these applications - recuva, diskdrill, & testdisk.

I don't know how much Recoverit would charge, all I know is that they say 100MB is free but I found no way to extract a few files and "recover it" (pun intended) without a paywall.

I did a smartreport using CrystalDisk and TestDisc and there are no issues with the disk. The partition was initially a boot-up but now have as logical since connected to a new desktop.

Any suggestions for freeware and/or a reasonable cost software/app that can recover these undeleted files and not make me also recover all the deleted files from a previous use of the HDD (son) which is voluminous games/files/movies, etc. (like 500GB)

Thanks.

[fzabkar]

Did you try to locate your files with DMDE? DMDE's free version will recover up to 4000 files of any size from any one folder per click.

[Arch Stanton]

Wondershare Recoverit, found the undeleted files

What does it actually show you?