chkdsk erased my MFT file

[totalre]

Hi,

As the title says i somehow had a corrupt MFT file and all the error messages said use chkdsk which i did (foolishly), now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

I cloned the drive with ddrescue to another drive and got some of the data with recuva

What else can i do? recuva did find $MFT files one is 2GB but it's probably a fragment.
testdisk says mft and mft mirror are now the same so no issues, 256 kb

Running DMDE now which seems to have found a lot of the original MFT structure magically.

As for the drive details:
WDC WD30EZRX-00SPEB0 3TB

Attachments

[data-medics]

Running DMDE now which seems to have found a lot of the original MFT structure magically.

Sounds like you already resolved it. Do you have an actual question or you just trying to avoid paying the already affordable price of DMDE?

[totalre]

Running DMDE now which seems to have found a lot of the original MFT structure magically.

Sounds like you already resolved it. Do you have an actual question or you just trying to avoid paying the already affordable price of DMDE?

My question is more of an is there something else to do to fix\recover it except scraping MFT fragments and file recovery while also wondering if a professional data recovery person would do a better job with some state of the art software or will he use the same tools i used on my own.

[BGman]

now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

Most likely all data is there, but some directories have been renamed.... Chkdsk doesn't like directory's names not written in English...

[totalre]

now the MFT is fixed, but erased, so the disk is accessible but all the data is gone.

Most likely all data is there, but some directories have been renamed.... Chkdsk doesn't like directory's names not written in English...

The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree

Didn't find any other options and so far only DMDE and GetDataBack actually work with MFT fragments other tools only restore data.

It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned

[Arch Stanton]

It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned

Unlikely, mirror only mirrors 4 file records. You can not restore or repair the MFT in the sense you want to. Instead you use file recovery tool, as you're doing now.

The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree

Interpreter needed.

In general there's 2 ways to recover data: file system meta data (such as MFT), plenty of tools do this, or raw recovery in case you'll indeed lose folder structure and such (any info that's kept in FS meta data basically).

All this babbling about MFT fragments, it is far from uncommon the MFT is fragmented and good file recovery tools should have no problems with that. DMDE is a perfectly good tool for it and 'state of the art software' in essence does the exact same thing.

Some tools may handle things slightly differently from each other or take into account some odd circumstances so it is possible one tool does better in scenario X while the other in scenario Y.

[totalre]

It was a mistake to use chkdsk should have used testdisk maybe it could have restored the corrupt MFT from the mirror, oh well lessons learned

Unlikely, mirror only mirrors 4 file records. You can not restore or repair the MFT in the sense you want to. Instead you use file recovery tool, as you're doing now.

I'm aware of the mirror being only a few records so that is true however using chkdsk was a mistake since it runs automatically and there is no control over what it will do, testdisk on the other hand only does analysis so no harm there, one can also use it to back up the MFT or BOOT etc., obviously a clone would be even smarter if possible.

The data is there, don't know if fully but without an MFT it can't been seen
Per my understanding in this case:
either restore data which is the files, loosing the structure and some metadata
or
restore some of the MFT from MFT fragments which preserves the data and the structure to some degree

Interpreter needed.

In general there's 2 ways to recover data: file system meta data (such as MFT), plenty of tools do this, or raw recovery in case you'll indeed lose folder structure and such (any info that's kept in FS meta data basically).

All this babbling about MFT fragments, it is far from uncommon the MFT is fragmented and good file recovery tools should have no problems with that. DMDE is a perfectly good tool for it and 'state of the art software' in essence does the exact same thing.

Some tools may handle things slightly differently from each other or take into account some odd circumstances so it is possible one tool does better in scenario X while the other in scenario Y.

Thanks!

Will try DMDE with deeper search while possibly getting a quote from a pro DRS

[Arch Stanton]

Yeah, and try another tool if DMDE results aren't satisfactory. ZAR (zero assumption recovery) may be good at this actually.

[totalre]

Yeah, and try another tool if DMDE results aren't satisfactory. ZAR (zero assumption recovery) may be good at this actually.

Thanks for the help

So far i've tried:
DMDE
Zar
Recuva
Rstudio
EaseUS
GetDataBack

DMDE is by far the best, huge margin
I got most of my data back (80-90% maybe more)

Curious if there are any remaining worthy tools to try to get more results or is DMDE the defacto best tool around for this job?

[fzabkar]

Try RAISE (or UFS Explorer) or ReclaiMe.

[dick]

This may or may not help you...........
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

I would copy the folder containing the said files to another device and then try these tools.

Another thing.....
From what I read here you have not even created a clone of the device containing your missing files. That is always a big mistake. You should only carry out work on the clone!!!

[Arch Stanton]

Theoretically there's no difference between raw scan and those chkdsk tools assuming the raw scanner scans same offset + clustersize.