Empty folders after NTFS file system recovery Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Gergely
Posts: 2
Joined: 19 May 2013, 20:40

Empty folders after NTFS file system recovery

#1 Post by Gergely »

I used TestDisk to restore a "quick formatted" drive. When the software asked something about differing MFTs, I selected to copy the MFT backup. Now I've realized that whole directory branches are missing (like everything under bar in /foo/bar/xxx/xxx/).

When I select the drive in TestDisk, I see the following:

Code: Select all

Hidden sectors are present.

size       312579695 sectors
user_max   312579695 sectors
native_max 312581808 sectors
dco        312581808 sectors
Host Protected Area (HPA) present.
While doing a deeper search, I see the following:

Code: Select all

HPFS - NTFS              0   1  1 19455 254 63  312560577
Warning: Incorrect number of heads/cylinder 0 (FAT) != 255 (HD)
Warning: Incorrect number of sectors per track 0 (FAT) != 63 (HD)
  FAT32                    0   1  1     0   0 63          0
The FAT32 is probably the empty file system I had created by accident and deleted while trying to recover the NTFS one. It's missing from the final result:

Code: Select all

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0   1  1 19455 254 63  312560577
Unfortunately I had used some MB on the partly recovered drive before I dismounted it. I didn't do an image copy, but I made a backup with the list of partitions:

Code: Select all

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0   1  1 19326 106 48  310478853
 * HPFS - NTFS              0   1  1 19455 254 63  312560577
I can't find the missing files with the P: list files option on either selection. (The option itself is only visible when I select the second one.) How could I get back those files? The Undelete function doesn't see them. I've lost heaps of important files including a lot of GPX (Guitar Pro) from the less common types. I'm on Linux now.

I also tried scrounge-ntfs, that recovers some of the missing files, but stops after a short time with the message: couldn't write to output file: pagefile.sys: No such file or directory. Lot of my important files were also compressed, which I probably cannot get back with scrounge-ntfs.

Gergely
Posts: 2
Joined: 19 May 2013, 20:40

Re: Empty folders after NTFS file system recovery

#2 Post by Gergely »

I could recover everything, including the directory structure with GetDataBack (costs $79).

Locked