Hi

I have a 600GB FAT32 formated external HDD. It was used by Friend 1 with Windows 7. Friend 2 borrowed it and used it with OS X 10.6. At the time it had 260 GB of data on it, but friend 2 says it "went empty" with no storage used, and only some "weird folders" with "Arabic names." Apparently it happened because he closed the lid of the laptop and there's something wrong with his Mac, so it does bad dismounts or something when he does that. I'm not sure, but I think that may be the case. Nobody else had physical access to it, and the Mac was offline the whole time.

He gave me the drive. I booted into Windows 8, but it wouldn't appear in Windows Explorer. I booted into OS X 10.10.1 and the drive appeared, but it appeared to be mostly empty. Only 300ish MB used and some hidden folders that appear to have been created automatically by OS X. I

I ran apps like Disk Drill and Photorec (From the Testdisk bundle). They found all the files, but they didn't find the folder hierarchy or file names. And I really want to recover that as well.

That is what I am asking for in this post: How can I recover the folder hierarchy and file names? I have a feeling Testdisk may be able to do it, I just don't know how. Any input?

I can't see how to edit my post. but: There is not any used space at the drive showing at the moment. Only a few bytes, probably created by OS X.

Sounds like the drive was formatted while in friend 2's possession.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

try DMDE and see if it can see the structure ?
it looks like drive is formatted with your 2nd friend.

_________________
Data Recovery Pakistan

According to Microsoft the default cluster size of a 600GB FAT32 volume would be 32KiB.

https://support.microsoft.com/en-us/kb/140365

A single 32-bit cluster entry occupies 4 bytes in the FAT. This means there are 128 such entries per sector.

Therefore the default size of the FAT is 70MiB for FAT32.

600 GB / 32KiB / 128 x 512 bytes = 70MiB

There are two copies of the FAT (2 x 70MiB = 140MiB), but it would seem that both copies were probably overwritten ("300ish MB used"). I can't be certain, though, as I have never analysed a Mac file system.

If the FATs have indeed been destroyed, then I would think that it would be very difficult, if not impossible, to recover fragmented files. Moreover, the root directory is located immediately after the second copy of the FAT which means that it, too, would have been destroyed.

I would clone your drive, sector by sector, and then run DMDE against the clone. Use the "FAT search" function to find FAT32 related structures.

http://dmde.com/

_________________
A backup a day keeps DR away.

Sorry, but I made a mistake in OP, and I was unable to edit it, so I had to correct if in a reply. There was not 300ish MB of used space on drive. Only a few bytes.

Friend 2 would certainly not have actively formatted the drive, so if this happened, it would have to have been done by a virus or other malfunction of the computer.

The app "Disk Drill" says the drive is "Not partitioned" and Windows Explorer did not find the drive at all.

Also, I have been able to recover the files. It's just that they have lost their filenames and folder hierarchy, and that's what I'm asking for help in recovering.

I made a mistake in OP. There is not 300ish MB's used on the drive. It's totally empty. I don't know why I wrote that, maybe it was bytes or something, and I saw it as megabytes? Not sure.

Friend 2 wouldn't have actively formatted the drive, so if it was formatted while in his possession, it would have had to have been done by a virus or other malfunction. Or maybe, the disk was damaged by his computer, and then OS X did the "this drive has to be initialized thing, and he clicked "initialize" and thus he might have formatted it without knowing what he was doing. It's possible.

Wait, actually, I just took a closer look at the "recovered" (using Disk Drill) files, and a lot of them are corrupted.

The structure of a FAT file system is like this:

Boot sector
Reserved sectors
FAT #1
FAT #2
Root directory
File data and subdirectories

AFAICT, if the first 300MB were overwritten, then this would mean that the FATs and root directory were destroyed. The FAT maintains a record of cluster chains. This is crucial if a file is fragmented, ie if it consists of more than one cluster chain. A tool such as PhotoRec would probably assume that each file is contiguous. This means that the tail end of a fragmented file would be corrupt. Have you verified that your files are intact?

If the root directory has been wiped, then you cannot recover your original folder structure, at least not completely.

_________________
A backup a day keeps DR away.

This corresponds very well to what I have found in my "recovered" files. For example, I find long videos fragmented into many short video files, many of which are corrupt. Oh, and OS X again tells me that 385 MB are in use on the disk. (Why would this alternate?) Anyway, your theory sounds corroborated.

I guess it's kind of game over, huh?

If Friend 1 takes the drive to a professional in London, then the professional may be able to get something better out of it?

I mean, I read your suggestions about DMDE, but my Windows system doesn't work well at the moment, and I don't have enough hard drive space to make an image and then try recovery from the image. I'll just tell my friend to take it to a professional.

Fiksdal, the usual answer is "it depends."
Sure, a profi could much better and more efficiently than a laymen, but not always--especially after amateurish attempt--I mean 'work.'

No back up? And none of your friends has a copy?

IF you think it's worthy, THEN go ahead OR call it a day.
Good luck anyway)

Nope, no backups.... These guys aren't very computer smart.

Maybe it's better if I don't mess this up. I think Friend 1 might end up taking this to a professional.