Main Area and Open Discussion > General Software Discussion

Need some help in recovery data from a damaged external HDD

(1/3) > >>

MerleOne:
Hi,

Yesterday, I just came across a strange problem on an external HDD : it is a 200 GB 3"1/2 Maxtor HDD, located in an IDE/USB2 enclosure.  There were 2 primary NTFS partition, P: and Q:.  I was using Q: to store freshly recorded content from DVB-T and Cable TV.  I have a XP Home system.

I was burning, as I do quite often, some MPEG2 files on a DVD, when suddenly, during the verify phase, lots of errors appeared and the verification failed.  I then tried to access Q: when I realize P: and Q: were somehow not reachable any longer, hence the verification error.

Chkdsk returned a strange message saying the MFT was missing on both partitions.  Looking further with tools such as testdisk (opensource), I came to the conclusion that both the MFT and the MFT mirror are gone.  I also ran a HDD surface verification tool for the first sectors, and the surface seems OK, so it doesn't seem like a H/W problem.

I have tried to delete then undelete the partition with Terabyteunlimited's BootItNG (it has helped me in the past for more or less similar situations), to no avail, chkdsk still refused to do anything.

I have tried the demo version of File Scavenger which, after quite some time, managed to find files on the damaged partitions, but for Q:, their names are lost, which complexifies the recovery process.

I have two questions :

1/ which software would you recommend to recover data from this HDD considering its current state
2/ does anyone has a clue as to what could have happened for having MFT+MFT mirrors both damaged on 2 partitions from a same drive.

I know there is a thread on this forum talking about file recovery, https://www.donationcoder.com/forum/index.php?topic=5242.0, but since its already more than 3 months old, there may be new solutions.

Thanks.

f0dder:
If you run into trouble another time, do not try tricks like delete/re-create partition, that can be pretty dangerous!

As to what could have happened, hm. I've experienced that for my USB2 enclosure, sometimes it will lose it's connection for half a second, then re-appear, causing XP to do it's stupid drive scan to see what kind of files are there, and pop up the "what do you want to do" dialog. I don't think that has caused any data corruption (yet?) though.

For firewire (which my enclosure also supports), it's a different story. The explanation is rather long, but google for firewire "delay write" if you're interested - this can lead to quite some data corruption.

The tool I've used with most success so far has been GetDataBack. It's extremely slow, but has given me >90% recovery rate. But ugh, both MFT and it's mirror destroyed?

MerleOne:
Thanks for the quick reply.

Actually I am afraid I have also done much worse than a simple delete restore with BING : since the restore was immediate and produced no effect, I decided to delete and clear the MBR from the deleted partition.  This time undelete didn't work so I just created a new entry in the MBR (I didn't format it of course) in order to have tools such as GetDataBack scan only the required disk zone.  Not the smartest thing to do I suppose, still it's a good way to learn... what not to do :)

The tool you propose seems really the kind of software that might do the trick.  Also, it supposedly manages physically damaged drive, so it's nice to have a single tools for this other situation.  Too bad DC doesn't have a rebate for it.  ;)

Regarding the cause, I begin to suspect the enclosure itself or a USB problem (I use another enclosure since the crash) : a few months ago, after having connected another external USB HDD, I got an XP error message saying : cannot update $MFT on P: and Q:

At first I thought the drive was physically damaged, but actually everything was fine after a reboot and having removed the second HDD.  As soon as I reconnected the second HDD, the problem reappeared, and only with this second HDD (I have a few of them...).  Since then, I was careful not to have both activated and everything was fine.  Yesterday, when the problem appeared, I had not anything else attached to the USB ports.  What I find really surprising is that both partitions were hit, and both at the MFT+mirrors.

Another track to explore : I have been using a new HDD defragmenter, JkDefrag, which does something to the MFT, and its mirror, to optimize file access.  I have used it on all my partitions and several PCs, so far I had no problems.  Maybe this + an USB problem are the cause.  Still, if the MFT mirror had been damaged by JkDefrag, chkdsk would have told me so.  I usually check my partition on a regular basis, but of course I cannot remember if I did it after or before JkDefrag.

Thanks again,

llley:
where can I get getdataback for NTFS license key? :) thanks.

jgpaiva:
where can I get getdataback for NTFS license key? :) thanks.
-llley (July 10, 2007, 02:28 PM)
--- End quote ---
I guess this'd do: http://www.runtime.org/buy_now.htm ;)
Here at DC we don't advocate illegal use of software.
We can, though, find you a bunch of free alternatives. You should find some good programs in these 2 threads:
https://www.donationcoder.com/forum/index.php?topic=2870.0
https://www.donationcoder.com/forum/index.php?topic=5242.0

Navigation

[0] Message Index

[#] Next page