Recovering from Event ID55

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Recovering from Event ID55

#1 Post by zazzn »

My Media drive somehow corrupted it self.
I've performed a surface scan for bad sectors and I couldn't find anything. I'm not sure how or why this happened.

I ran a CHKDSK /r which reset security permissions and found many files many of which are now corrupt.

I'm wondering if there is any way to recover the original files, since all the recovery software seems to find the same files which have already been recovered. I need to try to recover the original MST or FAT table so I'll have correct file names/folders.

Finally is there any utilities that you guys know of that can check data for corruption. Specifically video files that were recovered?

I'm not sure what options to use with tesetdisk but i'm doing an analyze right now to try to find out if there is something that can be done.

Any help or suggestions would be nice.

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: Recovering from Event ID55

#2 Post by zazzn »

Ok the disk is a GPT, it I'm guessing the FAT was corrupted and now all my files and file names are scattered in to the found.000 directories (thanks chkdsk) Is there anyway to recover the FAT Table so I can have the correct dir's and file names?

Also test disk doesn't show the disk size correctly it only shows the correct drive m: in this case as the correct size.

Any ideas?

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: Recovering from Event ID55

#3 Post by zazzn »

Wow lots of action here :/

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering from Event ID55

#4 Post by cgrenier »

"fidentify -check" can be used to check the video files. If it lists file_size=0, the file is corrupted.
You can try TestDisk, Advanced, Undelete. Maybe you will recover the original filenames...

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: Recovering from Event ID55

#5 Post by zazzn »

Thanks for the reply.

Another question was I started moving the files out of the found.000 directory, to the normal directories, and when doing this it seemed to corrupt other files there like it was overwriting the files. I stopped immediately after I noticed this. I though the files in the Found.000 should have already been allocated file space, I don't understand why moving these files was making other files corrupt or be overwritten. Does that sound normal to you?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovering from Event ID55

#6 Post by Fiona »

chkdsk can modify file system and files.
That's why I don't recommend it for datarecovery purposes.
Probably you'll find *.chk files in your found000-folder.
Please check this article related to your problems:
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

Fiona

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: Recovering from Event ID55

#7 Post by zazzn »

More on this, I found a thread on HARDOCP which may explain WHY my drive corrupted in the first place.

http://hardforum.com/showthread.php?t=1632902

I believe that because I was using the old intel rapid storage tech drivers, they where only 32 bit on my WHS 2011 box, and once I went over the 2TB threshold Kaboom.... Why do I say this? Well, I was able to recover most of the data, and while organizing my drives and getting ready to decommission my old sever, I started moving the files to the same drive again and BAM drive went offline and when I restarted it showed as "raw".

I'm not trying to figure out how to recover as I was recovering from the last data loss and I fear I may have lost alot more this time. Anyways, I have NOT ran chkdsk as I'm now wiser, but none of the tools I've used so far have been able to recover the files or restore the partition back to the way it should be.

NTFS getdataback
testdisk (see's the partition, but I see no files when I list inside)
Minitool partition wizard
R-studio
and several others

At one point I was able to see most of the files in WinHex, but now since trying to recover the drive I don't see them.

I have to wait for testdisk to complete the deep scan, but it seems to find many many old partitions of which have been deleted many moons ago when I was using this drive for testing.

Locked