Hello there!

So I have a Western Digital WD10EADS-11M hard drive, which was used as an external hard drive. I was using it to store all sorts of stuff, including backups of previous computers/setups.

One day, something happened to it and I found out that the entire Documents folder of my 2021 backup was gone. At the time I attempted to repair the filesystem, which didn't really fix anything. When I tried to read certain areas of the drive, I would get I/O errors.

-

I've been making another attempt at recovering data from this drive. I took it out of its enclosure and connected it directly to my computer over SATA, thinking it might help to access the drive directly instead of having a USB board inbetween. Fun fact, said USB board applies encryption on-the-fly. I did find a PDF explaining how the encryption works and how to set up an appropriate decryption filter on Linux (I would link it if it's of interest, but I'm concerned that posting a link in my first post might trigger some anti-spam system).

With ddrescue, I was able to read out most of the drive's contents. There's about 2.23MB worth of bad sectors, near the end. With the aforementioned decryption filter, I was able to decrypt the image. When looking around the damaged area, I noticed that file entries for some of my lost files were still intact. So that gave me an idea.

I started writing some code to parse the NTFS filesystem in the image and assess the damage. The damaged area is contained within one chunk of $MFT.

Going through $MFT, I was able to locate and recover orphaned entries. I recovered 72418 files this way. However, there's still a whole bunch of entries that are lost. Since there's no damage outside of $MFT, the file data would be intact, but without the entries to keep track of where it is, it's basically lost.

So this has me wondering... I haven't found a whole lot of info about this.

When I try to read the bad sectors, it seems to be hitting a timeout - it waits 5-6 seconds then fails with an I/O error. I'm wondering if this means physical damage to the disk platter (in which case the data would be lost), or ECC failure due to corruption (in which case there is something that can be read, but it's partially or completely corrupted).

I read about a SMART command to change the ECC timeout, but this drive doesn't support it.

So my question would be: is there a way to bypass ECC, to force the drive to return some data? At this point I'm pretty satisfied with what I've been able to recover, but I don't really want to let go if I could recover more.

Thing to try now: Work on reconstructing files from the image using ntfs-3g tools + testdisk and signature carving (photorec, scalpel). Since you recovered ~72k orphan entries, targeted carving of likely file types (PDF, DOCX, ZIP, etc.) may recover a lot.