Page 1 of 1

Strategy to recover NTFS?

Posted: 12 Mar 2016, 03:35
by roadworrier
Hi Folks -

I had two 5TB Samsung drives. I shut down my Windows 8 laptop and swapped the two drives so that my photo drive could use the USB3 connection. Once I turned the laptop back on, nothing worked. Each drive thought it was the other one briefly, but no files could be accessed, no writes could be performed. Eventually I lost all system knowledge that one drive was NTFS at all, looks RAW, no partition no data.

I used photo rec successfully in the past to recover files from an SD card, so I thought I'd give testdisk a try. I incorrectly identified my partitions as intel when I did my first "quick analyze"; I'm running again now as EFI GPT, but it takes at least overnight to run but I don't have any screenshots to show yet.

I'm posting this to ask though... what strategy should I use to recover my data? I thought NTFS kept multiple copies of its file indexes so if one got corrupted the other could be used or something, but I'm not seeing any evidence of that. I know my drives aren't bad, I know my files are there, it is just the directory structure/index that is fried. I have another good 5TB Samsung if it helps to give the partition information from it, to try and restore one of these, but of course it has a different set of files.

I have about 9 out of the 10tb I lost backed up, but the last TB would be nice to get back. Suggestions? Ideas?

Thanks.

Re: Strategy to recover NTFS?

Posted: 12 Mar 2016, 08:18
by cgrenier
Disk over 2 TB are usually using EFI GPT partition table. But disk using 4k sector can still use PC/Intel partition table.

There is a backup of the NTFS boot sector. It can be restored with TestDisk, Avanced, Boot.
There is also a backup of the MFT. It can be restored using Advanced, RepairMFT but it must only be used if both Windows and TestDisk failed to list the files.

Re: Strategy to recover NTFS?

Posted: 21 Mar 2016, 17:54
by roadworrier
Thanks very much for the reply. So I see that my 5TB disks are in fact 4096 sectors. So it sounds like it could be either EFI or Intel. How should I confirm? I assume it is important to have that correct before going to Advanced/ Boot?

If these drives were never used to boot up a system, but were just external drives, will they have an NTFS boot sector?

If I go to "Advanced" I see "no partition available"; I assume I need to run Analyse first? (I started to run the non-quick version, but it looked like that would take about a month to run... so I canceled that.)

I had just a single large NTFS 5tb/4K partition... I could look at one of my of my good drives to see more about what the layout is supposed to be if that would help.

Here's EFI
Drive W: - 5000 GB / 4657 GiB - CHS 76000 255 63
Current partition structure:
Partition Start End Size in sectors

Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

Here's Intel:
Drive W: - 5000 GB / 4657 GiB - CHS 76000 255 63
Current partition structure:
Partition Start End Size in sectors

1 E extended LBA 748 57 14 3090 5 51 37620992
No partition is bootable
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 748 61 18 1759 239 16 16252928
5 L HPFS - NTFS 748 61 18 1759 239 16 16252928
X extended 2070 45 1 3090 5 51 16383831
Invalid NTFS or EXFAT boot
6 L HPFS - NTFS 2070 46 25 3090 5 51 16383744
6 L HPFS - NTFS 2070 46 25 3090 5 51 16383744

Windows tells me that the drive is not accessible.

Thanks.

- Stefan

Re: Strategy to recover NTFS?

Posted: 22 Mar 2016, 03:35
by roadworrier
and here's the quick scan results for 'intel':

Drive W: - 5000 GB / 4657 GiB - CHS 76000 255 63

The harddisk (5000 GB / 4657 GiB) seems too small! (< 25 TB / 23 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
Partition Start End Size in sectors
> FAT16 <32M 155800 34 15 285796 45 4 2088386423
HPFS - NTFS 190109 164 63 392905 200 57 3257920003
FAT16 >32M 223044 50 62 356873 23 42 2149961165








[ Continue ]
8554 GB / 7966 GiB

Re: Strategy to recover NTFS?

Posted: 06 Apr 2016, 04:49
by roadworrier
so... any suggestion on what my next step could be?

Re: Strategy to recover NTFS?

Posted: 09 Apr 2016, 03:43
by roadworrier
cgrenier wrote:Disk over 2 TB are usually using EFI GPT partition table. But disk using 4k sector can still use PC/Intel partition table.

There is a backup of the NTFS boot sector. It can be restored with TestDisk, Avanced, Boot.
There is also a backup of the MFT. It can be restored using Advanced, RepairMFT but it must only be used if both Windows and TestDisk failed to list the files.
Is it possible to use any of these tools to copy the backup MFT from one disk to the other disk? because each disk got the other disk's MFT... which don't correspond to the files on the disk.

Re: Strategy to recover NTFS?

Posted: 09 Apr 2016, 14:43
by roadworrier
Nevermind; somehow after mucking with it a bit with test disk, running chkdsk /f seems to have recovered from the 2nd index at the end of the disk! Yay, I'm all set. Thanks for making this cool helpful tool.