recover files from NTFS partition after CHKDSK

Using TestDisk to undelete files
Post Reply
Message
Author
dspear99ca
Posts: 2
Joined: 29 Sep 2015, 04:22

recover files from NTFS partition after CHKDSK

#1 Post by dspear99ca » 29 Sep 2015, 04:36

First off, I apologize if this particular question has been asked and answered on this forum... I spent several hours reading and still am finding no joy, so here goes:

I've got a 1.5TB external USB drive which I use for a variety of tasks, including storage of a lot of family archival photos... like scanned images from the past 100 years, some of the originals no longer exist. There is one partition on the disk formatted NTFS. I've used it on both PC's and Macs using NTFS-3G... it worked flawlessly. For the record, the drive has realistically been hooked up and used less than 50 times although it's several years old.

At any rate, a few weeks ago I had it at a customer site, plugged it in (to a Windows machine) and got an error message that the drive was not readable. I brought it home and hooked it up to my Mac and it would not mount in my finder. Disk Utility could see it, read the volume label and knew the size, but I could not mount it.

So, after doing some reading on the internet, I figured that somehow the partition had somehow gotten corrupted, maybe by an unclean unmount while using NTFS-3G which seems to be known to cause such problems. I plugged the drive into a PC today and ran CHKDSK /F and a few screens of "deleting index entry..." flew by. The drive now mounts cleanly but there are no files, no directories. Nothing, in short.

I tried running Testdisk, it sees an NTFS partition, it sees that the MFT and MFT mirror are identical and OK, when I choose Undelete, however, it only shows one file: /System Volume Information/14{long string of HEX} of size 8176kb. I've done a Deep Search for other partitions, but none have been found by Testdisk.

Can anyone shed some light on what's going on, and any suggestions for me to recover what's on this disk? I have a testdrive log if that would be helpful.

Thanks so much for any replies.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3505
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#2 Post by cgrenier » 29 Sep 2015, 06:16

To recover the original filename, you can try http://thewalter.net/stef/software/scrounge/
Otherwise use PhotoRec

dspear99ca
Posts: 2
Joined: 29 Sep 2015, 04:22

Re: recover files from NTFS partition after CHKDSK

#3 Post by dspear99ca » 29 Sep 2015, 16:27

Thanks for your quick reply. So, I ran PhotoRec last night... it ran for ~15 hours. It was able to recover 174 files, about half of which were single-page PDF's of various language copies of a legal disclaimer for some software package. It did get a few video clips and pictures as well.

In the interest of expediency, I also started running Recuva software last night about 2 hours into to the PhotoRec run. It is still going, estimating 7 more hours, but says it's identified 470,000+ files. I'd say there were upwards of 10,000 files on the drive but half a million seems, um, a bit high. I am hoping it is able to recover some of the directory structure as it could fill up a pretty good chunk of time going through that many files "by hand".

Would you know of any tutorial I could read about how hard drive storage works? I am a former UNIX sysadmin so my level of knowledge is pretty good with hardware, just never got into the level of detail required to understand or execute data recovery strategies (drive failure or corruption --> restore from backup, EASY). I read through the recovery examples and there are some "jumps of logic" from one step to the next on some of them (particularly the partition recover) that illustrate the gaps in my knowledge.

Thanks again for your help.

Dave

User avatar
cgrenier
Site Admin
Posts: 3505
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#4 Post by cgrenier » 02 Oct 2015, 16:11

scrounge-ntfs contains the logic to recover the filename.

Can you rerun latest PhotoRec 7.1-WIP (updated yesterday), choose [Whole], not [Free] after selecting the partition. Do you recover more files ?

DigitalCoke
Posts: 3
Joined: 05 Feb 2016, 02:18

Re: recover files from NTFS partition after CHKDSK

#5 Post by DigitalCoke » 05 Feb 2016, 02:22

What is the difference in running Free VS Whole. I usually run one of each. am i wasting my time?

User avatar
cgrenier
Site Admin
Posts: 3505
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover files from NTFS partition after CHKDSK

#6 Post by cgrenier » 05 Feb 2016, 09:22

[Free] should only be used for non-corrupted filesystem.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests