Data and file names present but can't recover

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
MattBurnside
Posts: 2
Joined: 02 Jun 2023, 06:18

Data and file names present but can't recover

#1 Post by MattBurnside »

Hi everyone and thanks for taking a look.

Got a problem with a drive that Windows started formatting when reinstalling the main OS to another drive. Feels like I've tried everything but thought I would drop a post here before completely giving up on the data.

The drive in question has around 5 years worth of my recording studios data on it and stupidly I don't have a backup of it anymore. I've run a program called DiskDrill that seemed to recover around 120Gb of data, I think the actual data was around 250Gb but these files have no names and would be impossible to put back together in the audio editing software. I've also run a program called Tenorshare 4DDiG that pulled 250Gb of data with a lot of that having the original names but none of these named files are opening. They look to have the correct file extensions and sizes but just fail when opened in any software.

I'm now using TestDisk to see if I can get a better result but it's not looking good. I'm currently creating a disk image to see if that helps but have tried the rebuild options and repairing the MFT all of which say there is no problems.I am new to all this so it may be something I'm doing but if anyone has any advise I would really appreciate it. Not going to lie, losing this data has made me feel sick, 5 years of work down the drain.Definitely should have had a backup sooner.

Any advise or help much appreciated.

Thanks
Matt

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Data and file names present but can't recover

#2 Post by recuperation »

MattBurnside wrote: 02 Jun 2023, 06:28 Hi everyone and thanks for taking a look.

Got a problem with a drive that Windows started formatting when reinstalling the main OS to another drive. Feels like I've tried everything but thought I would drop a post here before completely giving up on the data.

The drive in question has around 5 years worth of my recording studios data on it and stupidly I don't have a backup of it anymore. I've run a program called DiskDrill that seemed to recover around 120Gb of data, I think the actual data was around 250Gb but these files have no names and would be impossible to put back together in the audio editing software. I've also run a program called Tenorshare 4DDiG that pulled 250Gb of data with a lot of that having the original names but none of these named files are opening. They look to have the correct file extensions and sizes but just fail when opened in any software.

I'm now using TestDisk to see if I can get a better result but it's not looking good. I'm currently creating a disk image
Standard advice: Use ddrescue as described in the Testdisk manual to duplicate your disk.

to see if that helps but have tried the rebuild options and repairing the MFT all of which say there is no problems.
If you format a drive the file system structure will always be error-free unless there are no physical disk dammages.
Unfortunately error-free in the sense of what the chkdsk command tells you (don't use chkdsk here) does not mean that your lost or overwritten data will be retrieved.

Testdisk can only do a limited amount of repair that does not need much user intervention.
Photorec is the tool of last resort.
In between both programs there is a gap that you fill using commercial data recovery software. In your case you might consider consulting a professional lab. If your disk does not exhibits physical dammage recovery should not be that expensive.
I am new to all this so it may be something I'm doing but if anyone has any advise I would really appreciate it. Not going to lie, losing this data has made me feel sick, 5 years of work down the drain.Definitely should have had a backup sooner.
Unfortunately you took the "Lernen durch Schmerzen" trip (German: Learning by pain). I will refrain from pretending empathy but would like to state that even me (supporting Testdisk) is still learning. :? :roll:
Here is my best and maybe useless advice: Think about a backup concept.

The standard procedure using Testdisk (once your duplicate is finished) is described here:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

MattBurnside
Posts: 2
Joined: 02 Jun 2023, 06:18

Re: Data and file names present but can't recover

#3 Post by MattBurnside »

Hey recuperation and thank you so much for taking the time to reply, really appreciate it.

So I've followed these instructions to the point that I've found the deleted partitions and at this point is where I hit the problems.

When trying to list the files I get Can't open filesystem. Filesystem seems damaged. I can try and continue anyhow as I know which partition I need. At this point I select to continue and it says the boot sector (full drive) and the backuip boot sector (presumably my old data) are not identical. When I then try to use the copy backup boot sector over boot sector I get Write Error: Can't overwite NTFS boot sector.

I get the same error if I go to rebuild boot sector.

I think this partitioning problem is also the part of the drive where windows stores the MFT hence why my files have no names when using other recovery tools.

I presume that photorec will do the same, achieve great results on file recovery but no names alongside them.

Once again thank you for the reply at least now i have tried the stepos in the guide as well.

Thanks
Matt

Maximice
Posts: 6
Joined: 01 Jun 2023, 22:38

Re: Data and file names present but can't recover

#4 Post by Maximice »

Always try to connect the disk with SATA, Testdisk works better than over USB connection.

Also, it is better to clone the disk to a image file and then working with the image file instead to clone it to another disk to avoid hardware issues with the copy.

Also try to recover the files instead the partitions with Diskgenius (windows) It worked for me.

Locked