Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
CyberMarys
Posts: 3
Joined: 20 Nov 2018, 17:25

Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

#1 Post by CyberMarys »

Hi everyone!

First of all hello guys! I would appreciate any help towards recovery of my partition and getting files back. here's the brief of what's happened....
I run Linux Mint 18.3, Windows XP SP3 and Windows 7 (each of them on seperate SSD). I've tried to change partiotions size on 2TB WD Red (the disk itself is physically 100% without bad sectors etc.)
Previously there were two NTFS partitions 200GB and the rest - about 1,62TB. I've made first one smaller from 200GB to 80GB and after succesfull opeartion applied (in Gparted run under Mint 18.3) change to make second one bigger from 1,62 TB to 1,74TB. Gparted said that it's going to take a few hours, but the time extended to around 16 hours! I've left it overnight to do the job.
Next day in the morning it was running smooth with just under 2 hours to complete. I went for shopping and when came back switched my monitor to see that gparted and linux completely freezed. It never happened before. It wasn't even possible to move mouse cursor TOTAL FREEZE!
I've waited for another 3-4 hours and nothing happened (in the meantime hdd led light were totaly off). I've had to give it a hard reset.
Loaded Linux Mint and Gparted again and run check partition, but it freezed whole system after 30 sek....
So, loaded Windows XP and chkdsk started working on that 2TB disk. I've always heard to leave it and let it do the job, but never had "deleting orphan files in index..." before...
I did let it work for about 10-15 minutes, but had strange feeling that it's making more damage than good and pressed hard reset button. Unplugged hard drive and I've made a copy using HDDGURU Raw Copy Too into another 2TB Seagate brand new drive.
From that moment has been working only on the copy. So no more harm or any data overwriten....
Now! I've tried DMDE to recover partition and whole data. It could easy see directory structure and most files, but not everything...
And the problem is that even with correct name and letter full version some recovered files can't be displayed (.jpg, xml, txt, mp4 etc.) they not working (All of them have got a right file size and name and whole directories structure, but not working nor open).
Partition is still visible under Windows and Linux with correct name, letter and size of 1,62TB and most of the directories, but I can't enter or access any of them...
HOW I COULD RECOVER MY PARTITION AND GET MY DATA BACK???
WHAT'S THE EASIEST WAY OF DOING IT?
wOULD ANYONE HELP ME??
Many thanks in advance!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

#2 Post by cgrenier »

As you were resizing the partition, data recovery utility will have a very hard time recovering your data.
PhotoRec on the whole space of the partition may be the best solution even if it doesn't recover the original filenames.

CyberMarys
Posts: 3
Joined: 20 Nov 2018, 17:25

Re: Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

#3 Post by CyberMarys »

Thanks for your quick reply to my post. That's what I've been doing for nearly last 48 hours... but Photorec (I'm using latest ver. 7.1-WIP Sept 2018 under Windows 7 x64) stuck in cyclic reading.... It has been like that for over 24h...
It loops between range of 440 0XX XXX and 444 46X XXX (total of 3 907 029 168) and sits on 11% for about 24 hours right now. It's not always coming back to the same sectors, but operates within the above range. It makes directories with files in it. Most of them are Cabinet files (what's that?). It takes around 3h to make another folder (each of them (made within lat 24hours) contains only 20-50 MB). Is this normal and let it run? What I should do? Many thanks in advance for your help!

P.S. I almost forgott to add that it's running slower that at the begining and it always freezes around sectors 443 8XX XXX for about 10 sek.
P.S.2. There's a chance for many small files allocated in this area transfered from Amiga hard drives (2x4,3GB) could that be a reason for long, cyclic work?
Attachments
photorec.JPG
photorec.JPG (58.59 KiB) Viewed 1884 times
stuck.JPG
stuck.JPG (103.44 KiB) Viewed 1884 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

#4 Post by cgrenier »

Bad sectors or fragmented files are the usual cause of slowdown / cyclic work. It's usually better to wait.
In the worst case, it's possible to manually edit the photorec.ses file (backup it first) to discard a sector range and resume the recovery with PhotoRec. (QPhotoRec can't resume).

CyberMarys
Posts: 3
Joined: 20 Nov 2018, 17:25

Re: Recovering NTFS partition/data after Gparted freeze & chkdsk deleting orphan files index.... Help needed!

#5 Post by CyberMarys »

Many thanks for your advice. I did as you said and manged to complete the scan. It has went into cyclic loop on another 3 occassions, but I was able to recover 99,99% of files.
Most of lost data I have recovered using DMDE + R-Studio, but Photorec recovered tose files which DMDE and R-Studio couldn't (they did, but files were damaged anyway).
0,01% of data which none of them couldn't restore to the proper working condition were .TBB and .TIB files (from T-Bat mailer), so looks like I've lost lots of emails...
Anyway! Photorec is a real master piece. It would be absolutely perfect if it could restore directories trees like above commercial ones and then copy restored files according to size automaticly.
Thay what I did manually. Once again many thanks for all your help! I've made a donatoin :)

Locked