cgsecurity.org

I have a 1TB HDD I need to recover data from. It had roughly 1.9 billion sectors.

I ran photorec and it worked roughly until 1.3 or 1.4 billion sectors, after which it starts to loop and randomly goes to 1.8 billion > 1.5 billion > 1.7 billions etc.
It didn't recover any new files except some empty TXT or XML files and a new MPG file of about 8GB and then delete it, randomly.
The file was playable by VLC. This kept happening for about 72 hours after which I closed photorec.

I then used R-Studio recovery software for Windows on the same and it recovered 1TB of data out of the 1TB drive. Many of the files were just duplicates though. I wanted to try with Photorec again so I imaged the drive with R-Studio onto an external HDD and ran Photorec again on the imaged .DSK file. But the same thing happened as it did with the original drive... looping for almost a day until I closed the process.


I tried modifying the photorec.ses file to an earlier sector, which worked only after 1.6 billion sectors, but it only recovered a few files except random txt and xml files. If I try to modify the sector to start after 1.5 or 1.4 billion, photorec crashes after a few seconds.


Can anyone advise what I should do now? I want to recover everything with Photorec as it has been a god send in the past and don't really trust R-Studio's recovered files as I don't know if it actually recovered everything. Or should R-Studio have been enough?

phoen01 wrote: 14 Jul 2020, 18:57 I have a 1TB HDD I need to recover data from. It had roughly 1.9 billion sectors.

I ran photorec and it worked roughly until 1.3 or 1.4 billion sectors, after which it starts to loop and randomly goes to 1.8 billion > 1.5 billion > 1.7 billions etc.
It didn't recover any new files

Photorec and me do not know what "new files" are. There are only "files".

except some empty TXT or XML files and a new MPG file of about 8GB and then delete it, randomly.

Incomprehensible. The subject of the sentence is missing! Who is deleting? Photorec? Randomly?

The file was playable by VLC. This kept happening for about 72 hours after which I closed photorec.

I then used R-Studio recovery software for Windows on the same and it recovered 1TB of data out of the 1TB drive. Many of the files were just duplicates though. I wanted to try with Photorec again so I imaged the drive with R-Studio onto an external HDD and ran Photorec again on the imaged .DSK file. But the same thing happened as it did with the original drive... looping for almost a day until I closed the process.

Are you trying to recover an encrypted drive? Which version of Photorec are you using?

I tried modifying the photorec.ses file to an earlier sector, which worked only after 1.6 billion sectors, but it only recovered a few files except random txt and xml files. If I try to modify the sector to start after 1.5 or 1.4 billion, photorec crashes after a few seconds.

Can anyone advise what I should do now? I want to recover everything with Photorec as it has been a god send in the past and don't really trust R-Studio's recovered files as I don't know if it actually recovered everything. Or should R-Studio have been enough?

There is no such thing as "recovering everything". Fingerprinting is a guessing process which largely depends on the lack of defragmentation.

Neither you stated what type of files there had been before, what happened to the drive so that you need recovery, nor you stated your operating system ("Windows" stands for a bunch of operating systems) nor you mentioned the version of Photorec used.

You obviously duplicated your drive for a reason. Most people do not.
Please post a smartmontools log file to see if there are any obvious health issues.

recuperation wrote: 15 Jul 2020, 06:21 Photorec and me do not know what "new files" are. There are only "files".

Yes you are right, just files.

Incomprehensible. The subject of the sentence is missing! Who is deleting? Photorec? Randomly?

I'm not sure, a few files gets recovered, one of them a big 8-9 GB MPG video file, and then gets deleted, in a loop.

Are you trying to recover an encrypted drive? Which version of Photorec are you using?

No. I'm trying to recover from an NTFS drive which was wrongly formatted to a FAT32 drive by the Windows USB Media Creation Tool, not encrypted. I am using PhotoRec 7.2-WIP.

I also tried the Testdisk with a deep scan but it couldn't find any files or partitions.

There is no such thing as "recovering everything". Fingerprinting is a guessing process which largely depends on the lack of defragmentation.

Neither you stated what type of files there had been before, what happened to the drive so that you need recovery, nor you stated your operating system ("Windows" stands for a bunch of operating systems) nor you mentioned the version of Photorec used.

You obviously duplicated your drive for a reason. Most people do not.
Please post a smartmontools log file to see if there are any obvious health issues.

The types of files I am trying to recover were just a personal backup of family photos, videos and documents.
The drive was formatted by error by using Windows USB media creation tool, it was stopped but only after it formatted the drive into a FAT32 single partition.
I am running Windows 10 Pro, Version 10.0.19041.

I created an image of the drive into an external drive because of Photorec looping after 1.3/1.4 billion sectors. I thought the drive was maybe damaged somehow and an image file would yield better results.

Here is a smartmoontools log file of the drive: https://pastebin.com/w221tEG9

Thanks for providing all that additional information.
I looked at your logfile. I did not see the typical suspects. I have no explanation why the recovery outcome is so disappointing.
That means there is no hint left over for you, sorry.
If in doubt you could still try using the free versions of other commercial tools.

recuperation wrote: 15 Jul 2020, 17:29 Thanks for providing all that additional information.
I looked at your logfile. I did not see the typical suspects. I have no explanation why the recovery outcome is so disappointing.
That means there is no hint left over for you, sorry.
If in doubt you could still try using the free versions of other commercial tools.

The free tools I tried were not as good as Photorec, not even close.

I ended up buying R-Studio and it recovered 1TB out of 1TB with mixed results, because many of the files were duplicates or triplicates.

Thank you for the help.