I did use DMDE, it did not find the UN-deleted files. All of these programs do a good to great job of finding deleted files. Am not understanding why they do not "see" the partitioned "lost" or non-deleted files that I would think have to still be there (or at least most of them) as the drive was NOT overwritten.

I thought that wondershare recoverit did but upon re-running and examining the area I thought they were in, it did not. I'm at a loss at this point as to what to do next. I've tried all of the suggested apps/recovery software.

DiskDrill
Recuva
Autopsy
DMDE
WondershareRecoverit

am now trying

easeus
minitool



from looking at them as they scan right now, not holding out much hope.

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

@ArgyleNavy, when you refer to "undeleted" files, do you mean "non-deleted"? That is, are these files ones which have never been deleted? Normally when we say "undeleted", we are referring to files which have been recovered after having been deleted.

In your original post you seem to be saying that your problems are the result of having initialised your drive. This normally only resets the partition metadata in sectors 0, 1 and 2. The free version of DMDE can reverse these changes in a few minutes.

https://www.reddit.com/r/datarecoverysoftware/wiki/index/dmde_insert_partition_guide/

That said, I'm confused as to what you actually did. The fact that you can run CHKDSK suggests that the partition is intact and formatted. :-?

_________________
A backup a day keeps DR away.

Aussie Don Quixote @fzabkar

Correct. As a relative neophyte in this arena, I'm sure that I've confused readers and the issue several times over.

Short recap. Did not back up old desktop HDD for about 45 days. But, HDD worked fine, and so I added it as a 2nd HDD inside with the cables internal to the desktop. When it booted an alert that the drive was there popped up. I believe I answered should it be initialized (thinking WIN10 needed to add it to "This PC" file directory. That apparently made my active directories/files NON-deleted i.e they "disappeared".

Have followed instructions provided here and from others. And the first issue/app fixed the partition but the HDD is shown as a clean new drive (shown as I: in snips provided). When I used all of the RECOVERY recommended apps, all I get is the 500 or 600 GB of deleted formatted files that were on the computer when the computer was "cleaned" and given to me. None of the NONdeleted files show up. Have rund the DMDE free program and did not see these files.

I ran DMDE per this post on reddit. There was not a "lost" partition. i.e. no partition -- it just vanished which is cautioned in this article not to proceed. I think the initialized and then my attempt using other recovery software has made this NOT easy or straight forward.

snip of dmde below

So, I just tried another EASEUS data recovery and went thru all file folders recovered and NONE were the NONdeleted.

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

Snip of DMDE

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

When Windows prompts you to initialise a drive, it means that it cannot find valid partition metadata. Moreover, your data recovery tools have been unable to find any trace of your files. One common explanation is that the drive has been moved from an encrypted environment, eg a My Book external enclosure, to an internal, unencrypted desktop environment. However, this simple explanation appears to be inconsistent with the fact that you can still find unencrypted files from your son's previous installation.

_________________
A backup a day keeps DR away.

Aussie guru. Agree. I've read a lot in the past few weeks and appreciate the input from you specifically and a few others. None of the programs are finding these NON-deleted files and some seem to be clone programs just under a different name of another.

Have read a few places (reddit - ms official community) that a partition initialization may have made the "current" files unrecoverable. That said, what I don't want to do is spend $500-1000 USD to find out that they are gone. Some places say no charge if no recovery but am not sure if I say "I only want non-deleted files not all the 600GB of deleted movies, games, old shitzu" that they will accommodate. Paying them for shitzu I don't want is obviously of no interest.

There's no problem with continuing to try things and not writing to the hard drive -- most of the files are not that important but the photoshop work on some business stuff are the things that would take days/weeks to recreate if I can even easily redo them. Bottomline - I need to get over my cloud back-up concerns -- Just hate them all as MS, google, Apple... they own the world, and that's not a good thing.

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

You are using confusing terms. "Initialization" is an action that Windows operating systems propose if they can't find an ID in the master boot record of a disk. I am not aware of a process called "partition initialization". What should that be? Probably a quick format operation.
There is no less invasive operation than "quick format" in the dialogues between Windows and the user.

This is unprofessional as Windows will try to write on your hard drive without asking permission from you.

You can use the free software PhotoRec to look for PSD files, for instance. Fragmented volumes will reduce your chances, though.

You speak as if there are no other backup options around.

As opposed to what you might think, the work needed to possibly recover only your Photoshop files does not necessarily depend on the runtime of some recovery software but rather might be a certain amount of time regardless of the amount of data extracted at the end.

How low is your hourly salary that you rather spend days or weeks to redo the lost work instead of having a professional deal with it?

By the way, you may be affected by the Western Digital load cycle problem.

Update. So I've tried everything from DMDE to TestDisk to Recuva etc. Fixed Partitions as initially an issue there.

"The" Issue: NON-deleted files on this ext. HDD are missing. All sectors good. HDD works perfectly. As stated the boot-up must have initialized it when I added THE old desktop HDD as a 2nd HDD to a new desktop. Had a backup but not of ~30 days. Just did not think an issue since everything was "fine" Ha.

The drive shows up with 1TB available and NO recovery software and I've tried all suggested here and on other forums has shown the NON-deleted (never deleted i.e active files on the HDD).

My concern is paying large dollars for a non-recovery - i.e. that they will only recover 600GB of 5 -10 year old DELETED files from the previous user of the HDD (my son), which is what all the recovery attempts have done, some better than others.

Any suggestions, if all of the relevant recovery software suggested cannot find.

IS IT REALLY POSSIBLE without a hardware failure that they are permanently "missing"?

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

ArgyleNavy; go super basic on this:

On your model (not SMR) user data can only exist on the UA (user area) part of the drive. It's possible data may have been moved around the drive due to sector reallocation, but the quantity of what could be moved around is extremely minimal and wouldn't create a fully working file. Further, as previously mentioned the SMART data supports sector reallocation has not occurred.

I am going to assume you've also performed a RAW scan; which ignores the file system, scans from sector 0 ALL the way to the end (the entire visible capacity of the HDD - which is 1TB), and blindly recovers data based on matches it read from HEX. It doesn't care about $BadClus, or any other filesystem assets; it's all processed & read during the scan.

It's important to note that different programs may have different or more "patterns" loaded in their software which can produce different "results". I'm guessing this is why you had slightly different results with the slew of software you've used.

As suggested, it's possible there is a firmware issue at play (eg: translator shift after a specific LBA) but I've personally never encountered it on that model. A credible data recovery company should be able to determine if such as issue is present and can offer options to resolve.

WebClaw:

Correct. All RAW scans have covered the entire 1TB of the SATA HDD. They all find give or take about 600GB of 5-10 year old data some with file names some just alphanumeric data files.

My I.T. hardware guy son gave me his old "gaming" computer about 5 years ago with a 5 year old (guessing) 1TB SATA HDD. Late spring this year, the motherboard was beginning to die... thus he built me another new desktop from his old gaming computer because he upgraded himself. On the SATA HDD (new has digital HDD), think at most I probably had 30GB of files on the computer. For whatever reason, none of these software apps find NON-deleted files in the HEX data. $BadClus and all of that aside, the actual old HDD tests and works great despite the age.

Credible data recovery company is the operative word. All that have researched so far have great and horrible reviews. Understand that negative reviews are sometimes written by aholes who just want to post when they screwed up their data and the recovery company doesn't get them their files, but still makes it hard to know who is credible.

So suggestions of 2 or 3 CREDIBLE REASONABLE data recovery where it is USA based and will LISTEN that it is only NON-deleted files that need recovery... would be nice.

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.

I would clone your drive to an image file on a larger drive, then search this file for signatures that correspond to your missing file types. If you don't find these signatures, then your files are not there.

This PhotoRec database describes the signatures that are typically associated with the various file types:

https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

If your file type is supported by PhotoRec, and if this tool doesn't find your missing files, then there would be no point in engaging a pro service.

_________________
A backup a day keeps DR away.

Frank is 100% correct -

Further, see a example relevant to your previous posts:
https://git.cgsecurity.org/cgit/testdis ... file_psd.c

So if you can't find any of these signatures either:

1. The data no longer exists (for whatever reason).
2. The data being produced by the drive is not accurate as a result of some firmware issue.

As previously indicated I've never encountered a firmware issue on the WD model you've indicated and I've evaluated over 12,000 drives. Interpret this as you want.

Why don't you email a potential lab your query? Provide them a link to this forum thread and get their 2 cents. I'll not endorse anyone.

Personally I don't believe your data is recoverable; you've thrown the kitchen sink at it (I respect your dilligence) - I'm just providing the options as they are.

Note, I feel you may complicate the conversation by bringing up "NON-deleted files in the HEX data". On your HDD the data exists and can be read or it cannot. You're an engineer that may be thinking there is a "special way / command / method" to read data that otherwise wouldn't be disclosed by the drive. That is simply not the case (though I wish there was !)

I am probably showing my ignorance, but is it possible that the drive was Bitlockered in the previous system, and could this other system have been Bitlockered on top of a previous non-encrypted build?

_________________
A backup a day keeps DR away.

I was thinking the similar, or maybe USB bridge (like Inito) - but this was an internal HDD.

I suppose if the OP had the model of the failed board / previous CPU we could see if TPM existed on it. At the end of the day, assuming BitLocker was present the file system (in the state shown in DMDE) likely lost assets needed to decrypt.

However, the DMDE screenshots do not show any markers and in my opinion there are far too many raw results. I would say BitLocker was not used.

Gents: I ran photorec and dmde again over the past 2 days multiple times on the "whole disk"... including all files and then just a .psd adobe design file via several different options/methods. This was also including the "brute force" option. I know nothing about of which you speaketh in the quotes above regarding bitlockered (attempted to read a bit but got too many other things to do) So, I'm inclined to stop and just begin expending considerable time reconstructing some or much of what I had created since it does seem like these files are unrecoverable.

** It still just blows me away that a simple boot-up and then restoring the partition somehow made NONdeleted files unattainable... but lesson learned here is back-up even when you imagine nothing can happen or really don't attempt to install a 2nd HDD when you're distracted. Ha.

Luckily this is not truly vital stuff but it is pain in the ass stuff. AGAIN === Thanks for all the assessments and the recommendations.

_________________
ArgyleNavy
SE USA
Boomer with Eng. Degree
Meaning I.T. is frustrating.