Lost File System, Recoverable with filenames but $1,000?

[franknunez]

Hi folks, I bought a very popular recovery software for a new 10TB hard drive which just after I moved (yes moved not copied) data to it, came up in Win10 with "file system not recognized, format?" type error only 1 day later. The recovery software finds files but doesn't give filenames or folders. 10TB is a lot of files to rename so after I contacted their support, they hopped on my system with a hex editor and started looking around. I saw filenames in the hex editor, so that's the first weird red flag that their software's scan of the drive didn't seem to turn up names. But, after a few minutes of poking around, they said, we can recover the drive the "way it was" before the loss of the filesystem (ie. folder/filename structures?) but it would require a "sector scan" that would take many hours and would cost me close to $1,000. The software already took 40 hours to scan the drive, so how much "deeper" they can go with a sector scan sounds dubious, the whole things sounds scammy. If it's recoverable (and they've determined that after manually jumping around to the various addresses/hex&string locations they were searching for), is there a tool I can use other than the mainstream, big name data recovery tools to get it back. The one I was trying to use is among the top 3. What else does a different kind of scan, or a sector scan such that the drive would be differently recovered and preserve file/folder names/structures? OR are they just scamming, and going to do play a shell game where they modify some hex values while pretending to do hours of recovery so I the customer feels like 'work was done' justfiying the high fee?

Nothing about the controller card or platters or motor on the drive seem to be problematic, the drive was new, but some event, maybe unsafe removal caused some minor corruption making the file system unclear to Windows?

[fzabkar]

Can you show us the Partitions window in DMDE?

https://dmde.com/

Something like this ...

http://users.on.net/~fzabkar/DMDE/DMDE_Elements-8TB_Partitions.jpg

[franknunez]

Here are some screen shots from the drive. I was unable to match the view that you brought up in the newer version, I hope some of these though will help, and I'll go back in and get whatever info is necessary to help you all help me : )

I'm pretty sure I set the drive up as a full size default single partition, GPT/NTFS. I have another fully working drive of the same model and setup here that I could reference if it helps to get information/layout from that. I made a typo before, it's an 18TB drive, WD HGST.

DMDE began a full scan which at the rate it was going will probably take a couple of days, so I interrupted it and pasted some screen shots. If the full scan is needed to get the required info for your help, I'll do that and circle back in a couple days!

Thanks in advance, Frank

Attachments

[Arch Stanton]

Who's they? The guys that hopped around with a hex editor? What software is it anyway?

[franknunez]

I'm waiting on my uploaded screen shots to be approved, so they're on the way.
They is easeus's support, although I think their function may be more of sales. After looking at what they did, they confirmed at least 95% recovery (assuming the drive is not faulty and i didn't make writes to it after - both of which I think are true). That makes me think I can get it done without them, I used to do drive recovery in the early 90's on "RLL" and "MFM" full height drives, so I'm obviously feeling a little confidence and a lot of lack of confidence/knowledge in what might be required to DIY this file system/partition back into shape.

[fzabkar]

Volume 02 has a file system, but the $MFT appears to be damaged, probably due to bad sectors. Assuming the damage is confined to only a few MFT records, most of the files should be recoverable with their original file names. Ideally you should clone such a drive with HDDSuperClone or ddrescue.

Examine the drive's SMART report and look for reallocated, pending or uncorrectable sectors. GSmartControl will probably have a useful error log as well. If you see bad sectors, then cloning would be highly recommended, if not mandatory.

Assuming you can successfully clone the drive, a DIY solution should cost no more than US$20, if the free version of DMDE isn't already sufficient for your needs.

[franknunez]

On it, will run with your suggestions and see. I have another spare to clone to so I'll do that as well. It wasn't readily apparent in DMDE if building for instance the virtual file system to identify some of that data was destructive/a write to the drive or not.
Thanks Fzabkar! Frank

[Lardman]

The tech support rep was clearly clueless.

Your damaged mft is as fzbakar suggest probably due to bad sectors, clone the drive, doing so will also have the benefit of checking each sector. Assuming the damage is minimal you may find that your clone works without issue. You really want to stay away from any scans which put stress on the original drive, raw carving of files is always a tool of last resort.

Has smart started to show any problems?

[fzabkar]

MFT records 13 - 20 are unreadable. The first 24 records contain NTFS metadata, therefore the volume will not be mountable. It shouldn't affect the data recovery, though.

Each MFT record occupies 2 logical sectors, so each bad physical sector will knock out 4 MFT records.

[Lardman]

MFT records 13 - 20 are unreadable

You're assuming unreadable under windows using DMDE is absolutely faulty and unrecoverable

[ShaneWard]

Why not recover from the original drive you moved the files from. That should be fine, just run a scan on that drive and recover the deleted files and no need to mess with the copy.

[franknunez]

Sadly that drive (a 10TB) has already been filled up. I moved the data from the 10TB to the 18TB, filled the 10TB (huge reorganization of data across multiple drives), then flew with the 18TB before I had time to clone it (rush flight), got to my destination and... wah wah.
In 40 years of computing, never had that luck. And I used to (not sure if I said this) do drive recovery in the early 90's (RLL/MFM drives)...So, it's all on me at this point. I'm running the clone now. Thanks all so far!

[franknunez]

Actually, I should ask what currently method-wise would be the best way to determine if any errors are platter/sector damage (fixed address) vs head or controller card related (variable address)? This issue correlates with TSA swabbing the controller card (after I turned around and saw them) for explosive residue. If a short happened from the friction created static electricity, I'm expecting non-address specific read failures. Same maybe for vibration mediated head damage? If I start the clone right now, and it starts encountering read errors, I'd rather not have to wait for the entire clone to finish and put that strain on possibly failing components before making another possible strategic decision about moving ahead?

[fzabkar]

HDDSuperClone tries to determine if the pattern of bad sectors points to a bad head, and it then tries to avoid that head until the final pass. I think that's the best you can do. Moreover, being a WD/HGST helium model (WUH...), there is currently no support in the professional data recovery tools for playing with the head map.

[labtech]

HDDSuperclone also allows cloning in reverse/backwards. It could be a good option to avoid hammering the beginning of the drive.