cgsecurity.org

Hi forum,

I have a situation where my external hard drive used to have a bunch of folders of files, but now those folders are missing (recently had a power outage and I reckon this may have affected the hard drive somehow).
It reports that it has used X TB of data, but when I select all my files (Windows 10 user), right lick -> Properties, it shows that my files add up using X minus 2 TB.
So I know for a fact I am missing 2TB of data on my external hard drive. And I know this because I know there's a huge chunk of my work files missing in my hard drive (literally the folder is missing but not "hidden" in the Windows sense).
(It's not in the recycling bin, checked that already)

I have already used PhotoRec to confirm that indeed some of those files that are missing can be recovered, albeit the filenames are all "garbage" (I need the actual file names for work, or at least the folder structure that these files were put in).
So I am thinking of using TestDisk but I am unfamiliar on how to use it. I'm following https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step but it's pretty confusing. Am I supposed to use Analyse? Is there a way to see if there's some "table" that can just be recovered and boom, my folders are back?
Thank you for the help, this tool is amazing I just don't understand it.

UPDATE:
Photorec finished, but only 296GB of data was restored out of 2TB. Am I SOL? I'm running the default options on Testdisk right now but it's going to take forever

Try to navigate to the directories with the lost files using the "p"-key ("list files"). This function becomes available after analysis and selection of a partition. You can check if Testdisk lists your files.
You can use the function to copy files and folders to another drive.

If that fails you can try to use the undelete function
https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk
I am mentionning this function as I am not aware how both functions are realized internally.

If everything fails use Photorec or some third party recovery software.

recuperation wrote: 28 Dec 2021, 16:11 Try to navigate to the directories with the lost files using the "p"-key ("list files"). This function becomes available after analysis and selection of a partition. You can check if Testdisk lists your files.
You can use the function to copy files and folders to another drive.

If that fails you can try to use the undelete function
https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk
I am mentionning this function as I am not aware how both functions are realized internally.

If everything fails use Photorec or some third party recovery software.

Thank you for your response! I have already tried Photorec, and it only recovered 300GB of my 2TB data I am going through Analysis of the partition right now, will report after a while (it takes forever!) Will try this "p" key business.

Currently it says "MS Data" and "Linux filesys. data" but i am confused why it thinks Linux has a filesys?

That analysis is a result of an analysis and not just a copy of your current partition information in MBR or GPT partition table.
You can try out which partition contains information by using the "p"-key.

As you assumably do not use any Linux-style partition your partition content should be located in the "MS Data"-partition.

Hello @recuperation! My disk finally finished (it was a big disk).
I have found a folder called folder.002 that has most of my data in it. However, when trying to recover some files, specifically video files like .avi or .mp4, some of them don't seem to be able to replay anymore. Does this mean I'm SOL? Or is there a way to recover these files completely?
Thank you!

deadharddrive wrote: 13 Jan 2022, 09:46 Hello @recuperation! My disk finally finished (it was a big disk).
I have found a folder called folder.002 that has most of my data in it. However, when trying to recover some files,

How?

specifically video files like .avi or .mp4, some of them don't seem to be able to replay anymore. Does this mean I'm SOL?

???
Read point 2 here:
viewtopic.php?p=34916#p34916

My apologies. SOL means "shit out of luck."

I had an option to copy files after selecting a partition. Attached is a screenshot of the current process of recovering files; however some files like .avi and .mp4s cannot be played. I'm hoping a mp4 or avi repair tool can help... but it seems like many files are unplayable.
Thank you for the help

I've tried using multiple AVI / MP4 repair tools and identification tools and it seems like the file is just corrupt. I'm guessing I must have accidentally used my corrupt drive without realizing it was corrupt, and bytes must have been mis-set here and there. I'm starting to think these are unrecoverable