Hello all. Having been in some tough e-scrapes in the past I'm thankfully aware I am in a salvageable state, but am looking for some helpful guidance as to how to proceed.

My storage (E:) drive USB connection was removed inappropriately and the host machine got a blue screen of death. Upon restart I got a Win repair utility which ran for hours--first saying "removing corrupt segments", then saying "removing orphaned folder". Finally Windows started and my E: drive was empty (but working).

The bottom line is: I can recover a huge ~163 GB chunk which is the lost data I am sure. However, there is no file structure and no file names. They're all named something like "LostFile_jpg_54748738.jpg". I want to try to recover the underlying structure which I know WAS stored in the MFT. So far:

I ran "Recover My Files". It found a few things.
(1) Lost File Results (~163 GB worth). This is almost exactly what was lost, but without file names or structure (folders).
(2) An existing NTFS partition. This will be the active partition being used on the newly emptied drive.
(3) 3 "Recovered" NTFS partitions. Why 3? I don't know. I'm pretty sure what I need is somehow in here, BUT...each is listed as being 17-20 TB!!! (with a "T"). Why? I don't know.

So, reading some articles I've heard terms like "testdisk"--but since there is a (new) working partition and MFT I don't know that this will work. I can use the drive as normal and it does not need repairing. Any thoughts as to how I might retrieve the MFT from a "repaired" NTFS partition and somehow use this to index the lost files?

All the pieces are here--I just need the glue!

Sounds like the MFT or FAT been recreated due to corruption.

This excert is taken from r-studios website about FAT & MFT:

On a disk, there is a table that stores information about files, such as filenames, folder paths, creation and modification timestamps and, most importantly, where the actual file content is located on the disk and where it begins and ends. For Windows, there are two supported file systems: FAT and NTFS. The file tables for these systems are called the File Allocation Table (FAT) and Master File Table (MFT).

When you format a disk, one of two processes will unfold. When a quick format is performed, the system will create a new file table to replace the existing FAT or MFT. The previous file table will be partially or completely overwritten, destroying information such as filenames, folder structure and the physical location of the data, but the data will still be there. This data will remain untouched until it is overwritten by another application.

loki is right, looks like your MFT got lost.

If i were you i would firstly check for "FOUND.000" chk files.
Then I would run R-Studio and try to recover files with it.

R-Studio will give you the opportunity to check whether your files can be recovered before you buy a license, so give it a try.

If your MFT got overwritten then directory structure is gone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

What does anyone think of "findandmount" (http://findandmount.com/); looks like it may alleviate the need for the MFT(?) but I haven't tried it yet.

IMHO the OP is probably describing autochk running on boot - effectively an automatic chkdsk was performed due to the filesystem state on that drive (which is a good reason never to have external USB drives attached when booting a system, or to disable autochk on booting, but that's a different rant ).

So I believe we're seeing the result of chkdsk running on a corrupted filesystem - not quite the same process as a recreating the MFT, but the results can also be bad

As northwind says, running something like R-Studio would be a good first step. Depending on the exact state of the MFT, some of the old filenames may still be recoverable.

@DiracDelta:

This post has recently appeared - it was probably held in moderation until it had been checked, due to you including a link and being a new member. It wasn't there when I first replied

To answer your question IMHO this utility is very unlikely to help, since you say that your "E:" drive is visible on your system (i.e. the filesystem is being mounted) - just that the filesystem is now empty. That findandmount utility can be helpful when the filesystem itself (i.e. the drive letter) is not being mounted by the OS, due to the loss of the partition boot sector, loss of the MBR, and other similar causes. That does not seem to apply in your case, and that utility does not "alleviate the need for the MFT" as you hoped. Of course it is free to try it, so you don't lose anything except time.

Whatever you decide to do, you must not write to your "drive E:" at all. Cloning the raw partition (i.e. all sectors) onto different storage, would be one way to take a complete backup copy, in case you accidently write to your existing drive E:, since that would only harm any chances you have of recovering the data and filenames from that drive. This is one of the risks of attempting DIY data recovery.