Hi folks,

Someone dumped a 1TB WD MyBook on me, begging that I take a look at it and see if I can recover a large amount of important data. This isn't something I normally do, or want to do, but I'm willing to invest a little time and try to help the owner. Who is training prior to shipping out, and for the time being completely unreachable. So I can't even talk to them and ask fill-in questions. Ugh.

The owner purchased it and populated it via Windows and didn't have any issues. Then the unit had some exposure to a Mac (book presumably) belonging to a fellow soldier (a soldier who also has the same type or a similar type of WD MyBook). The next time it was connected to the owner's Windows machine, she found it "hosed". The owner told me that her MyBook was only briefly connected to the other soldier's machine to pull something off of it, but shortly after connecting it she realized the files in question weren't on her MyBook and she disconnected it. So... theoretically... no changes should have been made to the data on her MyBook. After it was found to be hosed under Windows, she tried hooking it back up to the other soldier's Mac again, but reported that she was unable to access anything from that machine as well. Mind you, the owner is not a sophisticated computer user.

When connected to a Windows PC with System Restore disabled, you get a \System Volume Information is corrupt and unreadable. Please run the Chkdsk utility message. However, the volume does mount. Windows Disk Management reports that it is a healthy 931.61 GB FAT32 volume. However, properties reports that it has a capacity of 465 GB, with 419 GB used and 45.7 GB free. The WD DataLifeGuard reports it as a 1TB drive, 499.98 GB Total Space, 49.15 GB Free Space, which passes the Quick Test.

The root directory contains a number of Windows and MAC folders/files. Some of the folders and files are accessible but all of those are empty if/when you attempt to look at the contents. The rest of the folders and files are "corrupted and unreadable" when accessed. The owner reported that it is as if some files/folders from the other soldier's MyBook were installed on hers, but in corrupted form and in a way that corrupted what she originally had on her MyBook. There is a FOUND.000 folder which appears empty when opened, which suggests to me that someone did a chkdsk /f on it after the problem arose and before I got it.

I could bone up on the subject and poke around with an inspector to see if the original, important files are still there. However, before diving into that, I thought I'd ping this forum to see if anything sounds familiar. Hope you don't mind. Thanks in advance.

doing chkdsk will more likely damaged any information on there.
which is a bad idea to do in the first place.

its more likely changed the windows files into a mac format file
just unchanged it

allso how did you client disconnected it ???????

Well, right away I have a few questions.

1. Is it a single drive or a dual-drive enclosure?
2. It may be possible to recover the data from the original disk from which it was copied onto the MyBook. Are those systems available?
3. Are you willing to acquire additional drive space? You need to make at least one copy of the entire drive, and better make two of them.
4. You may need to purchase additional software such as r-studio.
5. Why is it extremely urgent?

Honestly, this is a bit strange that the vendor tool returns half the capacity of the drive, yet recognizes full 1TB.

The drive was disconnected improperly and likely suffered file system corruption. If the drive is used in "performance" mode, it needs to be disconnected properly to prevent data loss. If the drive is in "quick disconnect" mode, it can be simply unplugged. Disconnecting from a Mac possibly introduced data that PC can't read.

If the drive is internally two drives in RAID0 configuration, your can of worms simply gets bigger.

A Mac can read a drive formatted in NTFS, but a PC can't read a drive formatted for the Mac OS (extended).

Hook the drive back up to the Mac and use the Mac's Disk Utility (Root/Applications/Utilities). See if the utility reports a 500 GB partition on the 1 TB drive.

I think you've got a bad case of directory corruption. PM me and I'll make a recovery software recommendation in your case.

Jon

_________________
http://www.datasaversllc.com

This is a WD10000H1U-00... 1TB WD My Book Essential Edition. Probably still under warranty, so just peering through the slots... only one drive. From what I understand, the owner bought this and spent a great deal of time filling it with those personal files that she thought she might need or want during a lengthy overseas deployment. I suspect that there are other "original" copies of most if not all of the data on this drive. However, said deployment is in the not too distant future and the training, etc schedule apparently leaves a) few opportunities to communicate with the outside world, and b) no time to rebuild this library before deployment. I briefly spoke with her over the phone and got bits of the story, but I really don't know precisely what this drive has been put through and in what specific order.

As for what happened to the drive, I too find it interesting that the reported available capacity is less than what is expected. AFAICT, a modern Mac should work with FAT32 USB drives without causing major issues or corruption (I believe they make benign modifications related to Trash handling). I'm led to believe that this drive was not knowingly written to when connected to any machine other than the owner's notebook. It almost sounds as though the other soldier's machine had cached some filesystem information for subsequent flushing to that soldier's MyBook, but due to improper dismounting of that MyBook the flush was left pending. Then this MyBook was connected to that machine and the flush was performed. However, that is the sort of scenario I think SHOULD be detected and protected against. Who knows... perhaps in reality the problems had absolutely nothing to do with the exposure to the Mac.

I do some PC tuneups and repairs here and there... custom software solutions... that's about it. I currently don't have the spare drive capacity to make a copy of this drive, and I don't have access to a Mac much less that particular Mac which may very well remain out of reach forever. I can't allow anyone else access to the drive without the owner's explicit permission, and it may be weeks before I get a chance to speak with her. If I could at least establish, ideally through the use of free/demo tools and merely inspecting the USB drive as is (however slow that may be), that there are files which can be recovered through rather straight-forward means, then I could consider doing more or at least give her an informed "push" to shell-out for professional data recovery.

I've started to read through the R-Studio manual. I'll PM Jona for the offered advice. I appreciate all the help so far, and any that may be offered down the road. Thank you.

Followup...

I've verified that there is recoverable data on the drive, and at least some of what I know the owner to be interested in.

One interesting thing I noticed was that there are **ALOT** of deleted MSIxxxxx.tmp files. There was only one with a recent date... yesterday at approximately the time I connected the drive. I think these drives are normally setup to autorun install some bundled software. However, given that I have disabled autorun on my PC... not to mention the drive corruption... I didn't expect to trigger anything but apparently I did. What is even more interesting is that there are MSIxxxxx.tmp files with timestamps that clearly jive with previous days on which the drive was used. Only instead of there being just one file, there are *MANY* files with timestamps just moments apart. Not quite sure what to make of that.

Copy what you can. Ignore the artifacts. We care about data, not the issues surrounding the circumstances of its loss. Since the drive is still in a USB enclosure and you are not talking to it directly, it can be difficult to diagnose. Those enclosures are a pain to open.

Rule of thumb of data recovery - you need at least twice, and usually three times, as much disk space as the device on which you are working. If you do not have it, you are constrained and can't go back to "as found" condition.

MyBook is not a good enclosure for the desert environment, so maybe it's good that it failed while still at home. Let's rethink the strategy.

If I were to go where she is going, I'd take a RAID 1 mirror box with me and a spare 1TB drive. Actually, I would also replace her internal laptop drive with a 500GB drive, take a 500GB drive in an external enclosure, and bring a spare 500GB 2.5" drive. I'd also take precision tools so I can open it in the field when the drive fails and to periodically clean out the dust. The RAID1 would live in a sealed plastic box for backups of both her main laptop and her external drive. Dust kills electronics. Laptops should be sealed against dust as well. You need to configure her laptop to automatically make backups to the external media.

Sounds expensive? It will cost less than our quotes and it would enable her to rebuild the laptop in the middle of nowhere, if necessary.

Advantage of a 2.5" enclosure is that she won't need an additional power supply to access her media. The 3.5" enclosure could remain on base where there is power.

You may want to burn a few DVDs as well for optical backup.

Hi Chris,

sorry I'm late to the thread - we had a similar case in last month and I thought I'd never see it occur again.

Customer owned a trusted external drive used with Windows then plugged it into a Mac which then hosed it. By the time we saw it, the customer had plugged it into at least one Windows PC and (ack) let chkdsk do its dirty deeds. The wreckage was extensive.

In such instances, we just shovel out whatever we can salvage and hope it's of use to the customer.

For this one, we used a program like R-Studio and went through the Lost Files folders manually - a good number had lost the top folder name, but the sub-folders and files were intact.

(of course, we worked from a clone of the original hard-drive - which showed no hardware errors)

Customers often ask what they did wrong (there's usually a mild degree of counselling involved - I'm not kidding), most times it's not their fault.

I wonder if the external hard drive had some auto-run program which kicked into life when it was plugged into the Mac - but it's a moot point really. The damage is permanent. Grab what you can & move on

Tom

_________________
Tierra Data Rescue
www.tierra.co.uk