Empty folders after NTFS file system recovery Topic is solved

Using TestDisk to repair the filesystem
Locked
Message
Author
Gergely
Posts: 2
Joined: 19 May 2013, 20:40

Empty folders after NTFS file system recovery

#1 Post by Gergely » 19 May 2013, 20:53

I used TestDisk to restore a "quick formatted" drive. When the software asked something about differing MFTs, I selected to copy the MFT backup. Now I've realized that whole directory branches are missing (like everything under bar in /foo/bar/xxx/xxx/).

When I select the drive in TestDisk, I see the following:

Code: Select all

Hidden sectors are present.

size       312579695 sectors
user_max   312579695 sectors
native_max 312581808 sectors
dco        312581808 sectors
Host Protected Area (HPA) present.
While doing a deeper search, I see the following:

Code: Select all

HPFS - NTFS              0   1  1 19455 254 63  312560577
Warning: Incorrect number of heads/cylinder 0 (FAT) != 255 (HD)
Warning: Incorrect number of sectors per track 0 (FAT) != 63 (HD)
  FAT32                    0   1  1     0   0 63          0
The FAT32 is probably the empty file system I had created by accident and deleted while trying to recover the NTFS one. It's missing from the final result:

Code: Select all

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0   1  1 19455 254 63  312560577
Unfortunately I had used some MB on the partly recovered drive before I dismounted it. I didn't do an image copy, but I made a backup with the list of partitions:

Code: Select all

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0   1  1 19326 106 48  310478853
 * HPFS - NTFS              0   1  1 19455 254 63  312560577
I can't find the missing files with the P: list files option on either selection. (The option itself is only visible when I select the second one.) How could I get back those files? The Undelete function doesn't see them. I've lost heaps of important files including a lot of GPX (Guitar Pro) from the less common types. I'm on Linux now.

I also tried scrounge-ntfs, that recovers some of the missing files, but stops after a short time with the message: couldn't write to output file: pagefile.sys: No such file or directory. Lot of my important files were also compressed, which I probably cannot get back with scrounge-ntfs.

Sponsored links

Gergely
Posts: 2
Joined: 19 May 2013, 20:40

Re: Empty folders after NTFS file system recovery  Topic is solved

#2 Post by Gergely » 23 Aug 2013, 00:57

I could recover everything, including the directory structure with GetDataBack (costs $79).

Locked

Who is online

Users browsing this forum: No registered users and 1 guest