I tried to rescue the data with TestDisk, GetDataBack, Active File Recovery and EaseUS Recovery Wizard (full edition). I could see the directory structure and files but all the files were 0 bytes. It showed about 600gb of unallocated space. This was my mistake.Īfter the cancelling of the cloning program my WD drive was messed up. I cancelled it because i was afraid it would overwrite existing data on the WD drive. When i ran the cloneprogram, i cancelled it after 5 minutes or so.
Last, i wanted to clone the whole laptopdisk in case i had forgotten some files on the laptop. After that i copied the files i didnt have on the backup to it. I was able to access the laptop by booting with Ultimate Boot CD. The laptop fell down the table and the harddrive was damaged (smart-failure). The WD-drive had an 3 months old backup of the laptop on it and some more files. I have a laptop and an external WD-drive. Some file types don't mind if you just get close to the correct end of the file but some files (especially ones that use compression) are very picky about you getting it exactly right. Manually carving out the data like that is very tedious and gets extremely difficult if the files are fragmented. I use various forensic tools for that but I believe the cheap version of Restorer Ultimate has that capability. Combined with the filename you can search through the raw data on the disk to that location and recover the data. You should definitely make an image (I use GNU ddrescue in Linux which works without removing the drive from its enclosure if the drive is still visible) and then you can either recover raw data from the image which gives you no name info (I use PhotoRec for that) like you've already seen or you can use something that can read the MFT and if you are lucky, the information in the MFT for where the data is located on the disk is not corrupted like the size data. There is a backup MFT but unfortunately that only contains data for the system metadata files like the MFT itself and reallocated sectors map and such. That's why you need to make an image and try everything else before running chkdsk (though Microsoft never warns of this). It contains the size of the file and if something reorganized the MFT improperly or crashed while doing it, it could set them all to a value that would be read as 0.Ĭhkdsk can do this sometimes as it tries to reorganize or repair the MFT.
If it isn't a hardware problem then the MFT is probably damaged. Here's some additional info from the scan (i dont know what it means but maybe it helps): the 'drive structure' (maps and filenames and so) are intactīut the 'link' between the filename/ size and the actual file is missing. However: when i access the harddrive in explorer, all my maps are there, all my files are there but they all have a filesize of 0 bytes. This seems to happen a lot with recovery programs so end of story you would say. All files have lost their original location (maps) and filenames (they are all named found000x.jpg etc.). Most of them are able to recover the files. It has some problems that chkdsk can't solve. The drive itself is 3 months old and in excellent condition (technically). Its about my WD MyBook Essential 1 TB External harddrive. Im running into some difficulties im unable to resolve by myself.
0 kommentar(er)
