Adata Classic CH94 corrupt files

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
AJNiteowl
Posts: 6
Joined: 16 Apr 2012, 12:57

Adata Classic CH94 corrupt files

#1 Post by AJNiteowl »

Hello Christophe - I had rather hoped I wouldn't be back here, however I am trying to fix what would seem to be a pretty hopeless case. A friend has the above drive at about quarter full (235GB) of 1TB. Something went wrong and he lost access to data. He then passed to IT "specialist" who put the drive on an Apple (for crying out loud) and tried using utilities there to recover.

Now the root directory has Apple files in it (things such as .fseventsd, and .SpotLight-V100 and .Trashes etc which have been put there because IT guy ran utilities off a Mac.

There is also a folder called "FOUND.000" which has CHKDSK "recovered" files which range in name from File0000.chk to File9999.chk.

Now the question is - can I try to get the partition back and recover these files and many others (presumably using the second file system) or is it beyond redemption?

I can send snapshots on screens if that helps?

Regards AJ

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Adata Classic CH94 corrupt files

#2 Post by Fiona »

I'm not Christophe, but despite that, I've a try to help! :)
Hopefully there is not too much overridden.
can I try to get the partition back and recover these files and many others
Is there any partition lost or changed?
presumably using the second file system
Is it a FAT32-partition?
If you already used TestDisk to diagnose it, please zip the testdisk.log and upload it.
I would need Infos from Analyse, Quick and Deeper Search.
In case, it would be possible to diagnose your boot sector using expert mode to see if there is another copy of a FAT32?

Don't write anything to that partition anymore.
The first thing you should do, copy the folder found000 included the checkfiles to another safe place.
There are some utilities to have try to get data out of your chk-files;
http://www.ericphelps.com/uncheck/
http://www.diydatarecovery.nl/chkmate.htm
In some cases, it was necessary to take ownership of the folder and files.
If it doesn't find anything, you should consider datarecovery software.

Fiona

AJNiteowl
Posts: 6
Joined: 16 Apr 2012, 12:57

Re: Adata Classic CH94 corrupt files

#3 Post by AJNiteowl »

Hi Fiona - here are the details of the properties of the disk: File System FAT32 - Used space: 235GB Free Space 695GB.

However there are 10,000 files in the Found.000 folder - named File000.CHK to File9999.CHK but these only account for 28.9GB.

I don't know if disk was originally FAT32 or NTFS, but I think it is likely to be FAT32, and then a file recovery has been run which 'found' the 10,000 CHK files.

TestDisk 6.13 agrees the filesystem is FAT32 and disk size is 931GB. The disk appears in good order through testing cylinders. I don't know how to copy the screen to get into this reply post, but when I when into 'Advanced' it highlighted "Undelete" - does that mean TestDisk recognizes files require 'Undeletion'?

I have checked the FAT and they are ok and Boot Sectors are identical (which suggests CHKDSK or similar has re-written them).

I can recover data out of "CHK" files using your suggestions or was going to try "CHK-BACK" which I think will do a similar thing - it looks in the CHK file and looks for particular combinations of characters that indicate whether a .MP3, .JPG etc like UnCHK or FileCHK or even CHK-Mate....

So I will copy all of the Filexxxx.CHK files off and try to recover them. Then I will image the disk and try to recover any data in non allocated file space. I would like to use an image creator that compresses unused (blank) disk space, to conserve image size (like DriveImage XML) - do you have any solutions?

Then on data recovery (in the "blank" area of disk) I need a utility that doesn't simply "undelete" files but analyses disk for data and then recovers the data (like CHKDSK) - do you have any thoughts?

Regards
Andrew

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Adata Classic CH94 corrupt files

#4 Post by Fiona »

If you create ar post you'll find the menu to attach a file below.
You can also copy and past content from the log file.
but when I when into 'Advanced' it highlighted "Undelete" - does that mean TestDisk recognizes files require 'Undeletion'?
The menu advanced doesn't require something.
Its only predefined, as a suggestion.
Just check your required option/menu and use it.
TestDisk has an Undelete-Feature.
On FAT and ext2, deleted files appear red colored.
If tey're not needed, you can press h to hide them.
The good thing about it is, it keeps filenames and folders as long as they're not overwritten.
Using it on NTFS you must use the menu Undelete, files are not red colored.
I would like to use an image creator that compresses unused (blank) disk space, to conserve image size (like DriveImage XML) - do you have any solutions?
Often, users used Acronis WD edition;
http://support.wdc.com/product/download ... dc_lang=en
But I've no idea, because I didn't test it.
Then on data recovery (in the "blank" area of disk) I need a utility that doesn't simply "undelete" files but analyses disk for data and then recovers the data (like CHKDSK) - do you have any thoughts?
Do you mean directly on an affected drive, like chkdsk repairs a file system successful and afterwards all data available?
No, I didn't see any datarecovery software which recovers data directly on an affected drive
PhotRec offers an opportunity to scan free/unallocated space only.
Before you can select your reqired files using Options and press s to deselect all file types.
So you can check only your required ones.
Currently, Christophe makes an effort to recover file names also.
It already worked with few file types.
Otherwise you need commercial datarecovery software like Restorer Ultimate.
You can use a File Search and list only deleted data.

Fiona

Locked