Hi everyone, I got myself in a bit of a pickle!

I have two computers with almost identical Windows 11. Let's call them PC1 and PC2. I attached my external HDD (partition D - NTFS format) that contains my data to PC1. I was organizing my files, moving them around. Then I hibernated PC1 and then took the external HDD and attached it to PC2 as an internal HDD and booted it up.

Here is the important part:
- Using PC2, I did some file and folder activity i.e. moved and organized files etc.
- Then I hibernated PC2. After making sure it is powered off, I moved HDD and attached it to PC1.
- On PC1, I don't see the the changes that I made to my partition D ! It seems the folders that I moved and created and nested within to organize better are gone and my data is gone! What happened?

I used Runtime GetDataBack to see if I can see those folders that I moved around, but unfortunately GDB hasn't helped so far... I even used Level3 and it can't find those folders!

I have stopped doing any writing to the disk to minimize the chance of corrupting my data. What can I do?!!! Any help would be appreciated!

This is almost certainly Windows hibernation + write-cache behavior (not actual data loss).

Your files are very likely not deleted, just never committed to external drive. Metadata changes (directory moves, renames, nesting) may have only existed only in RAM / hiberfile, not on disk yet. If NTFS file system never committed the changes, DR tools won’t see them (regardless of "level" used).

You should run the scans on source PC (place that OS drive in other PC to avoid read / writes).

If you continue to do this, you may want to disable write caching in device manager.

well, if he moved the data, the source files are deleted, might be possible to recover if it wasn't an ssd or got overwritten.
i faced this issue once when a client brought me a target drive, i copied the data, he took it, then complained it isn't there.
did the process 2nd time and exactly the same thing happened, but then i noticed his laptop is coming up from hibernation after replacing the target hdd.
Then i knew why the data is missing, so i told him to correctly power down the laptop before my copy process.
the OP's case is slightly different but i guess the FS changes were not committed before the hibernation. So it sucks if the source files were deleted...

pepe

_________________
Adatmentés - Data recovery

Thank you both for your responses!

@pepe : Since then I have restarted both computers! And tried on both computers, source folders data is gone! I find it perplexing that the source folders that I nested in a newly created folder are not visible in GDB (level 3) as intuitively I believe data pointers should still be there, no?

@WebClaw : Like I mentioned above, I ran all levels of GDB to no avail! With this in mind, am I SOL?

Might be safer using a NAS for multiple machines as USB disks are not isolated volumes like NAS

I use USB enclosures and several computers and they work but I power down machines which makes sure no open files on any disks exist. That way USB disks are safe for file history etc.

_________________
Orico DS500C3-US-BK 5-disk 3.5" SATA, iTGZ 4x M.2 2280 Thunderbolt enclosure NVMe/SATA, etc. etc.

Maybe. DR professionals will not use GDB (level 3? means nothing to anyone in this forum / it's a marketing gimmick); and I am not sure if there were reads / writes to the drives. And pepe's comment about the drives being an SSD also make a difference.

Right. Any recommended softwares?

My drive is a HDD not SSD if that makes a difference/raise hope/etc.

hard disks are rather sluggish while PCIe SSD are far faster

I keep all my games on large server class disks and updates are slow but they get done overnight. My media library is also on a server class disk.

Now Steam can move games to and from the SSD so I fine this strategy better then spending a bundle on higher capacity SSD which are rather limited in max capacity. Hard disks reach 30TB and beyond. Seagate server disks are likely to get bigger in the coming years as HAMR designs mature. Hard disk platter materials have changed as well as new alloys are developed.

Because PMR technology hit its limit of areal density per platter at 3TB, a new way to increase areal density was needed. Developed by Seagate engineers and launched in January 2024, the Mozaic 3+ platform marks the world’s first implementation of heat-assisted magnetic recording (HAMR) enabling 3.2TB per platter with a roadmap to 5TB and beyond.  

The disks above 30TB are presently shingled which is slow to write which is a factor for games but media is much less sensitive. ST36000NM003K is the model and it is rather expensive.

_________________
Orico DS500C3-US-BK 5-disk 3.5" SATA, iTGZ 4x M.2 2280 Thunderbolt enclosure NVMe/SATA, etc. etc.

I have no idea how this helps the OP. I smell bot.

arta, try DMDE, R-Studio, UFS w/full sector scan.
Install the software on a computer and slave + offline the drives you want to scan to minimize R/W's to the drive.

CHKDSK /R

will check every block on a volume. The /R option is slow on modern high capacity hard disks.

_________________
Orico DS500C3-US-BK 5-disk 3.5" SATA, iTGZ 4x M.2 2280 Thunderbolt enclosure NVMe/SATA, etc. etc.

Don't do this.

Yeah, don't do this:



This is the right advice:

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

The reason you should avoid the /R or /F option on damaged drives or damaged/corrupted file systems is that Microsoft cares only about the integrity of the file system and will sacrifice your files to this end. Data recovery will become immensely more difficult, if not impossible, after Microsoft does its thing.

That said, running CHKDSK in read-only mode on a physically healthy drive should tell you what is wrong with the file system.

_________________
A backup a day keeps DR away.

cloning the source drive before any other operations is usually a good idea.

_________________
Adatmentés - Data recovery

This happened because you hibernated both PCs while moving the same NTFS drive between them. Windows cached the filesystem state, and when you put the drive back in PC1, it rolled back the NTFS metadata, hiding the changes made on PC2.

Your data is likely not deleted, just hidden by an NTFS state conflict.

Do this now:

1. Reconnect the drive to PC2

2. If the folders appear there, copy everything immediately to another drive

3. Do not run chkdsk or write to the disk

For the future: never hibernate when moving NTFS drives between PCs — always fully shut down.

To avoid any conflict, the best option is to disable the Windows Fast Startup feature, especially if you use drives on different PCs or on professional systems.

I normally ask my customers to restart their PC instead of shutting it down before plugging in a drive that contains recovered data.
Alternatively, you can simply disable Fast Startup.

You can disable it by using the following command:

powercfg -h off

FYI CHKDSK /F will attempt to recover data and move it to another allocation unit. Sometimes the block is bad so the data there will be lost.

ReFS is more recent but is not widely used yet. It is designed to be more proactive and keep storage reliable. ReFS is currently only available for Window Server while laptops still use NTFS.

https://learn.microsoft.com/en-us/windo ... s-overview

_________________
Orico DS500C3-US-BK 5-disk 3.5" SATA, iTGZ 4x M.2 2280 Thunderbolt enclosure NVMe/SATA, etc. etc.