NTFS - Undeleted files from 1TB drive fill 4TB partition

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
wfadm
Posts: 2
Joined: 23 Aug 2016, 07:26

NTFS - Undeleted files from 1TB drive fill 4TB partition

#1 Post by wfadm »

Hi! I've got a 1TB drive (WDC WD10EARS-00MVWB0) where I mistakenly deleted multiple folders, like "Users", "Windows", "Program Files". Now, having used testdisk and photorec before, I decided to use testdisk 7.1-wip to undelete the data to a new 4TB drive using ext4. I'm using the Undelete option, selecting all files using the key provided for it and choosing copy. The problem is that it fills my 4TB drive and it can't finish extracting because of that. I see a lot of files and folders in my 4TB drive, so it is not a single big file hoarding all the space.

Anybody has some pointers as to what could I do? I remember that the 1TB drive had Windows 7 Home Premium installed on it.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS - Undeleted files from 1TB drive fill 4TB partition

#2 Post by cgrenier »

As you will probably have to reinstall Windows itself, you should probably only recover the "Users" directory.

When a file is renamed and next deleted, testdisk may find 2 filenames for a single data allocation, so recovering this data will take twice the space.

wfadm
Posts: 2
Joined: 23 Aug 2016, 07:26

Re: NTFS - Undeleted files from 1TB drive fill 4TB partition

#3 Post by wfadm »

Oh! That makes sense, yeah! About recovering only the "Users" folder, there's two problems with that: The total number of files listed in Undelete is 771658. Scrolling through all that and selecting about 400000 files is hard, I've tried using PageDown and I couldn't get to the end of the list in a decent time. Having a way to select directories instead of the files themselves would be useful ;). And, messing with the recovered files, many of the files have got out of their original directories, so they are recovered as if they were in the root of the drive.

Also, I've been checking up the log. I've checked the log entries for the time when it starts taking too much space and this is what I see:

Code: Select all

Truncation not performed because file has an inconsistent $MFT record.
Missing segment at beginning, 225080 clusters.
Missing segment at end, 225080 clusters.
Truncation not performed because file has an inconsistent $MFT record.
Missing segment at beginning, 253240 clusters.
Missing segment at end, 253240 clusters.
Truncation not performed because file has an inconsistent $MFT record.
No surprise that the MFT is inconsistent, I unplugged the drive as soon as I realized what was happening. So, testdisk is being nice and is not cutting up those files just in case. And not only that, if I create the log in a different drive so it can continue logging it logs the files that it couldn't write:

Code: Select all

Couldn't create output file /WD10EARS/msvcprt.dll
Couldn't create output file /WD10EARS/msvcrt.dll
After a quick look through all those entries it seems that everything that I wanted got recovered already, so it is all fine now.

Thanks for a great data recovery suite. It's really, really useful! :)

Locked