Page 1 of 1

Recovering from Event ID55

Posted: 08 May 2014, 11:13
by zazzn
My Media drive somehow corrupted it self.
I've performed a surface scan for bad sectors and I couldn't find anything. I'm not sure how or why this happened.

I ran a CHKDSK /r which reset security permissions and found many files many of which are now corrupt.

I'm wondering if there is any way to recover the original files, since all the recovery software seems to find the same files which have already been recovered. I need to try to recover the original MST or FAT table so I'll have correct file names/folders.

Finally is there any utilities that you guys know of that can check data for corruption. Specifically video files that were recovered?

I'm not sure what options to use with tesetdisk but i'm doing an analyze right now to try to find out if there is something that can be done.

Any help or suggestions would be nice.

Re: Recovering from Event ID55

Posted: 09 May 2014, 07:58
by zazzn
Ok the disk is a GPT, it I'm guessing the FAT was corrupted and now all my files and file names are scattered in to the found.000 directories (thanks chkdsk) Is there anyway to recover the FAT Table so I can have the correct dir's and file names?

Also test disk doesn't show the disk size correctly it only shows the correct drive m: in this case as the correct size.

Any ideas?

Re: Recovering from Event ID55

Posted: 12 May 2014, 22:58
by zazzn
Wow lots of action here :/

Re: Recovering from Event ID55

Posted: 28 May 2014, 07:28
by cgrenier
"fidentify -check" can be used to check the video files. If it lists file_size=0, the file is corrupted.
You can try TestDisk, Advanced, Undelete. Maybe you will recover the original filenames...

Re: Recovering from Event ID55

Posted: 28 May 2014, 09:46
by zazzn
Thanks for the reply.

Another question was I started moving the files out of the found.000 directory, to the normal directories, and when doing this it seemed to corrupt other files there like it was overwriting the files. I stopped immediately after I noticed this. I though the files in the Found.000 should have already been allocated file space, I don't understand why moving these files was making other files corrupt or be overwritten. Does that sound normal to you?

Re: Recovering from Event ID55

Posted: 28 May 2014, 16:58
by Fiona
chkdsk can modify file system and files.
That's why I don't recommend it for datarecovery purposes.
Probably you'll find *.chk files in your found000-folder.
Please check this article related to your problems:
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

Fiona

Re: Recovering from Event ID55

Posted: 10 Oct 2014, 03:41
by zazzn
More on this, I found a thread on HARDOCP which may explain WHY my drive corrupted in the first place.

http://hardforum.com/showthread.php?t=1632902

I believe that because I was using the old intel rapid storage tech drivers, they where only 32 bit on my WHS 2011 box, and once I went over the 2TB threshold Kaboom.... Why do I say this? Well, I was able to recover most of the data, and while organizing my drives and getting ready to decommission my old sever, I started moving the files to the same drive again and BAM drive went offline and when I restarted it showed as "raw".

I'm not trying to figure out how to recover as I was recovering from the last data loss and I fear I may have lost alot more this time. Anyways, I have NOT ran chkdsk as I'm now wiser, but none of the tools I've used so far have been able to recover the files or restore the partition back to the way it should be.

NTFS getdataback
testdisk (see's the partition, but I see no files when I list inside)
Minitool partition wizard
R-studio
and several others

At one point I was able to see most of the files in WinHex, but now since trying to recover the drive I don't see them.

I have to wait for testdisk to complete the deep scan, but it seems to find many many old partitions of which have been deleted many moons ago when I was using this drive for testing.