recover files from NTFS partition after CHKDSK

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dspear99ca
Posts: 2
Joined: 29 Sep 2015, 04:22

recover files from NTFS partition after CHKDSK

#1 Post by dspear99ca »

First off, I apologize if this particular question has been asked and answered on this forum... I spent several hours reading and still am finding no joy, so here goes:

I've got a 1.5TB external USB drive which I use for a variety of tasks, including storage of a lot of family archival photos... like scanned images from the past 100 years, some of the originals no longer exist. There is one partition on the disk formatted NTFS. I've used it on both PC's and Macs using NTFS-3G... it worked flawlessly. For the record, the drive has realistically been hooked up and used less than 50 times although it's several years old.

At any rate, a few weeks ago I had it at a customer site, plugged it in (to a Windows machine) and got an error message that the drive was not readable. I brought it home and hooked it up to my Mac and it would not mount in my finder. Disk Utility could see it, read the volume label and knew the size, but I could not mount it.

So, after doing some reading on the internet, I figured that somehow the partition had somehow gotten corrupted, maybe by an unclean unmount while using NTFS-3G which seems to be known to cause such problems. I plugged the drive into a PC today and ran CHKDSK /F and a few screens of "deleting index entry..." flew by. The drive now mounts cleanly but there are no files, no directories. Nothing, in short.

I tried running Testdisk, it sees an NTFS partition, it sees that the MFT and MFT mirror are identical and OK, when I choose Undelete, however, it only shows one file: /System Volume Information/14{long string of HEX} of size 8176kb. I've done a Deep Search for other partitions, but none have been found by Testdisk.

Can anyone shed some light on what's going on, and any suggestions for me to recover what's on this disk? I have a testdrive log if that would be helpful.

Thanks so much for any replies.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#2 Post by cgrenier »

To recover the original filename, you can try http://thewalter.net/stef/software/scrounge/
Otherwise use PhotoRec

dspear99ca
Posts: 2
Joined: 29 Sep 2015, 04:22

Re: recover files from NTFS partition after CHKDSK

#3 Post by dspear99ca »

Thanks for your quick reply. So, I ran PhotoRec last night... it ran for ~15 hours. It was able to recover 174 files, about half of which were single-page PDF's of various language copies of a legal disclaimer for some software package. It did get a few video clips and pictures as well.

In the interest of expediency, I also started running Recuva software last night about 2 hours into to the PhotoRec run. It is still going, estimating 7 more hours, but says it's identified 470,000+ files. I'd say there were upwards of 10,000 files on the drive but half a million seems, um, a bit high. I am hoping it is able to recover some of the directory structure as it could fill up a pretty good chunk of time going through that many files "by hand".

Would you know of any tutorial I could read about how hard drive storage works? I am a former UNIX sysadmin so my level of knowledge is pretty good with hardware, just never got into the level of detail required to understand or execute data recovery strategies (drive failure or corruption --> restore from backup, EASY). I read through the recovery examples and there are some "jumps of logic" from one step to the next on some of them (particularly the partition recover) that illustrate the gaps in my knowledge.

Thanks again for your help.

Dave

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#4 Post by cgrenier »

scrounge-ntfs contains the logic to recover the filename.

Can you rerun latest PhotoRec 7.1-WIP (updated yesterday), choose [Whole], not [Free] after selecting the partition. Do you recover more files ?

DigitalCoke
Posts: 3
Joined: 05 Feb 2016, 02:18

Re: recover files from NTFS partition after CHKDSK

#5 Post by DigitalCoke »

What is the difference in running Free VS Whole. I usually run one of each. am i wasting my time?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#6 Post by cgrenier »

[Free] should only be used for non-corrupted filesystem.

Locked