Empty folders after NTFS file system recovery
Posted: 19 May 2013, 20:53
I used TestDisk to restore a "quick formatted" drive. When the software asked something about differing MFTs, I selected to copy the MFT backup. Now I've realized that whole directory branches are missing (like everything under bar in /foo/bar/xxx/xxx/).
When I select the drive in TestDisk, I see the following:
While doing a deeper search, I see the following:
The FAT32 is probably the empty file system I had created by accident and deleted while trying to recover the NTFS one. It's missing from the final result:
Unfortunately I had used some MB on the partly recovered drive before I dismounted it. I didn't do an image copy, but I made a backup with the list of partitions:
I can't find the missing files with the P: list files option on either selection. (The option itself is only visible when I select the second one.) How could I get back those files? The Undelete function doesn't see them. I've lost heaps of important files including a lot of GPX (Guitar Pro) from the less common types. I'm on Linux now.
I also tried scrounge-ntfs, that recovers some of the missing files, but stops after a short time with the message: couldn't write to output file: pagefile.sys: No such file or directory. Lot of my important files were also compressed, which I probably cannot get back with scrounge-ntfs.
When I select the drive in TestDisk, I see the following:
Code: Select all
Hidden sectors are present.
size 312579695 sectors
user_max 312579695 sectors
native_max 312581808 sectors
dco 312581808 sectors
Host Protected Area (HPA) present.Code: Select all
HPFS - NTFS 0 1 1 19455 254 63 312560577
Warning: Incorrect number of heads/cylinder 0 (FAT) != 255 (HD)
Warning: Incorrect number of sectors per track 0 (FAT) != 63 (HD)
FAT32 0 1 1 0 0 63 0Code: Select all
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 19455 254 63 312560577Code: Select all
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 1 1 19326 106 48 310478853
* HPFS - NTFS 0 1 1 19455 254 63 312560577I also tried scrounge-ntfs, that recovers some of the missing files, but stops after a short time with the message: couldn't write to output file: pagefile.sys: No such file or directory. Lot of my important files were also compressed, which I probably cannot get back with scrounge-ntfs.