All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: chkdsk erased my MFT file
PostPosted: May 4th, 2021, 19:00 
Offline

Joined: May 4th, 2021, 18:45
Posts: 9
Location: Israel
Hi,

As the title says i somehow had a corrupt MFT file and all the error messages said use chkdsk which i did (foolishly), now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

I cloned the drive with ddrescue to another drive and got some of the data with recuva

What else can i do? recuva did find $MFT files one is 2GB but it's probably a fragment.
testdisk says mft and mft mirror are now the same so no issues, 256 kb :(

Running DMDE now which seems to have found a lot of the original MFT structure magically.

As for the drive details:
WDC WD30EZRX-00SPEB0 3TB


Attachments:
hdd.png
hdd.png [ 102.46 KiB | Viewed 14240 times ]
Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 8:24 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
totalre wrote:
Running DMDE now which seems to have found a lot of the original MFT structure magically.


Sounds like you already resolved it. Do you have an actual question or you just trying to avoid paying the already affordable price of DMDE?

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 11:03 
Offline

Joined: May 4th, 2021, 18:45
Posts: 9
Location: Israel
data-medics wrote:
totalre wrote:
Running DMDE now which seems to have found a lot of the original MFT structure magically.


Sounds like you already resolved it. Do you have an actual question or you just trying to avoid paying the already affordable price of DMDE?


My question is more of an is there something else to do to fix\recover it except scraping MFT fragments and file recovery while also wondering if a professional data recovery person would do a better job with some state of the art software or will he use the same tools i used on my own.


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 11:54 
Offline

Joined: September 30th, 2005, 7:33
Posts: 849
totalre wrote:
now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

Most likely all data is there, but some directories have been renamed.... Chkdsk doesn't like directory's names not written in English... :D


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 13:31 
Offline

Joined: May 4th, 2021, 18:45
Posts: 9
Location: Israel
BGman wrote:
totalre wrote:
now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

Most likely all data is there, but some directories have been renamed.... Chkdsk doesn't like directory's names not written in English... :D


The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree

Didn't find any other options and so far only DMDE and GetDataBack actually work with MFT fragments other tools only restore data.

It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 15:53 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Quote:
It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned


Unlikely, mirror only mirrors 4 file records. You can not restore or repair the MFT in the sense you want to. Instead you use file recovery tool, as you're doing now.

Quote:
The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree


Interpreter needed.

In general there's 2 ways to recover data: file system meta data (such as MFT), plenty of tools do this, or raw recovery in case you'll indeed lose folder structure and such (any info that's kept in FS meta data basically).

All this babbling about MFT fragments, it is far from uncommon the MFT is fragmented and good file recovery tools should have no problems with that. DMDE is a perfectly good tool for it and 'state of the art software' in essence does the exact same thing.

Some tools may handle things slightly differently from each other or take into account some odd circumstances so it is possible one tool does better in scenario X while the other in scenario Y.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 16:09 
Offline

Joined: May 4th, 2021, 18:45
Posts: 9
Location: Israel
Arch Stanton wrote:
Quote:
It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned


Unlikely, mirror only mirrors 4 file records. You can not restore or repair the MFT in the sense you want to. Instead you use file recovery tool, as you're doing now.


I'm aware of the mirror being only a few records so that is true however using chkdsk was a mistake since it runs automatically and there is no control over what it will do, testdisk on the other hand only does analysis so no harm there, one can also use it to back up the MFT or BOOT etc., obviously a clone would be even smarter if possible.

Arch Stanton wrote:
Quote:
The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree


Interpreter needed.

In general there's 2 ways to recover data: file system meta data (such as MFT), plenty of tools do this, or raw recovery in case you'll indeed lose folder structure and such (any info that's kept in FS meta data basically).

All this babbling about MFT fragments, it is far from uncommon the MFT is fragmented and good file recovery tools should have no problems with that. DMDE is a perfectly good tool for it and 'state of the art software' in essence does the exact same thing.

Some tools may handle things slightly differently from each other or take into account some odd circumstances so it is possible one tool does better in scenario X while the other in scenario Y.


Thanks!

Will try DMDE with deeper search while possibly getting a quote from a pro DRS


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 5th, 2021, 16:30 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Yeah, and try another tool if DMDE results aren't satisfactory. ZAR (zero assumption recovery) may be good at this actually.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 8th, 2021, 19:42 
Offline

Joined: May 4th, 2021, 18:45
Posts: 9
Location: Israel
Arch Stanton wrote:
Yeah, and try another tool if DMDE results aren't satisfactory. ZAR (zero assumption recovery) may be good at this actually.


Thanks for the help

So far i've tried:
DMDE
Zar
Recuva
Rstudio
EaseUS
GetDataBack

DMDE is by far the best, huge margin
I got most of my data back (80-90% maybe more)

Curious if there are any remaining worthy tools to try to get more results or is DMDE the defacto best tool around for this job?


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 8th, 2021, 22:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Try RAISE (or UFS Explorer) or ReclaiMe.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 9th, 2021, 3:09 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
This may or may not help you...........
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

I would copy the folder containing the said files to another device and then try these tools.

Another thing.....
From what I read here you have not even created a clone of the device containing your missing files. That is always a big mistake. You should only carry out work on the clone!!!


Top
 Profile  
 
 Post subject: Re: chkdsk erased my MFT file
PostPosted: May 9th, 2021, 5:18 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Theoretically there's no difference between raw scan and those chkdsk tools assuming the raw scanner scans same offset + clustersize.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot], Google Adsense [Bot] and 48 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group