Need some help in recovery data from a damaged external HDD

[MerleOne]

Hi,

Yesterday, I just came across a strange problem on an external HDD : it is a 200 GB 3"1/2 Maxtor HDD, located in an IDE/USB2 enclosure.  There were 2 primary NTFS partition, P: and Q:.  I was using Q: to store freshly recorded content from DVB-T and Cable TV.  I have a XP Home system.

I was burning, as I do quite often, some MPEG2 files on a DVD, when suddenly, during the verify phase, lots of errors appeared and the verification failed.  I then tried to access Q: when I realize P: and Q: were somehow not reachable any longer, hence the verification error.

Chkdsk returned a strange message saying the MFT was missing on both partitions.  Looking further with tools such as testdisk (opensource), I came to the conclusion that both the MFT and the MFT mirror are gone.  I also ran a HDD surface verification tool for the first sectors, and the surface seems OK, so it doesn't seem like a H/W problem.

I have tried to delete then undelete the partition with Terabyteunlimited's BootItNG (it has helped me in the past for more or less similar situations), to no avail, chkdsk still refused to do anything.

I have tried the demo version of File Scavenger which, after quite some time, managed to find files on the damaged partitions, but for Q:, their names are lost, which complexifies the recovery process.

I have two questions :

1/ which software would you recommend to recover data from this HDD considering its current state
2/ does anyone has a clue as to what could have happened for having MFT+MFT mirrors both damaged on 2 partitions from a same drive.

I know there is a thread on this forum talking about file recovery, https://www.donation...dex.php?topic=5242.0, but since its already more than 3 months old, there may be new solutions.

Thanks.

[f0dder]

If you run into trouble another time, do not try tricks like delete/re-create partition, that can be pretty dangerous!

As to what could have happened, hm. I've experienced that for my USB2 enclosure, sometimes it will lose it's connection for half a second, then re-appear, causing XP to do it's stupid drive scan to see what kind of files are there, and pop up the "what do you want to do" dialog. I don't think that has caused any data corruption (yet?) though.

For firewire (which my enclosure also supports), it's a different story. The explanation is rather long, but google for firewire "delay write" if you're interested - this can lead to quite some data corruption.

The tool I've used with most success so far has been GetDataBack. It's extremely slow, but has given me >90% recovery rate. But ugh, both MFT and it's mirror destroyed?

[MerleOne]

Thanks for the quick reply.

Actually I am afraid I have also done much worse than a simple delete restore with BING : since the restore was immediate and produced no effect, I decided to delete and clear the MBR from the deleted partition.  This time undelete didn't work so I just created a new entry in the MBR (I didn't format it of course) in order to have tools such as GetDataBack scan only the required disk zone.  Not the smartest thing to do I suppose, still it's a good way to learn... what not to do

The tool you propose seems really the kind of software that might do the trick.  Also, it supposedly manages physically damaged drive, so it's nice to have a single tools for this other situation.  Too bad DC doesn't have a rebate for it. 

Regarding the cause, I begin to suspect the enclosure itself or a USB problem (I use another enclosure since the crash) : a few months ago, after having connected another external USB HDD, I got an XP error message saying : cannot update $MFT on P: and Q:

At first I thought the drive was physically damaged, but actually everything was fine after a reboot and having removed the second HDD.  As soon as I reconnected the second HDD, the problem reappeared, and only with this second HDD (I have a few of them...).  Since then, I was careful not to have both activated and everything was fine.  Yesterday, when the problem appeared, I had not anything else attached to the USB ports.  What I find really surprising is that both partitions were hit, and both at the MFT+mirrors.

Another track to explore : I have been using a new HDD defragmenter, JkDefrag, which does something to the MFT, and its mirror, to optimize file access.  I have used it on all my partitions and several PCs, so far I had no problems.  Maybe this + an USB problem are the cause.  Still, if the MFT mirror had been damaged by JkDefrag, chkdsk would have told me so.  I usually check my partition on a regular basis, but of course I cannot remember if I did it after or before JkDefrag.

Thanks again,

[llley]

where can I get getdataback for NTFS license key? thanks.

[jgpaiva]

where can I get getdataback for NTFS license key? thanks.

-llley (July 10, 2007, 02:28 PM)

I guess this'd do: http://www.runtime.org/buy_now.htm
Here at DC we don't advocate illegal use of software.
We can, though, find you a bunch of free alternatives. You should find some good programs in these 2 threads:
https://www.donation...dex.php?topic=2870.0
https://www.donation...dex.php?topic=5242.0

[MerleOne]

where can I get getdataback for NTFS license key? thanks.

-llley (July 10, 2007, 02:28 PM)

I finally found that ActiveFileRecovery Pro was much more useful in the situation I described.  I would advise you to benchmark it before selecting Getdataback.

[brahman]

If you are serious about your data, here is what you need to do:

1.) Never let Chkdsk do anything to a damaged hard drive, it will only make things worst and unrecoverable. 

2.) Attach the drive to a second IDE channel, since HD utilities cannot reliably read all drive data from a USB drive. Especially when you are trying to rebuild the MFT and recover partitions this is absolutely essential, since USB drives give wrong physical information to the OS.

3.) Don't do anything to the harddrive until you have mirrored the drive to another drive with special software (NOT with backup mirror software like Ghost or Acronis TI) that is used for HD recovery (pcinspector clonemaxx, Raw Copy by Roadkil http://roadkil.net/RawCopy.html is the only free util that does reverse copy, which is easier on a failing drive, driveimage xml clones from windows, http://copyr.tetroni...ownload/copyrR13.zip  copyr is the best free clone  util for inaccessible drives - though there are much better commercial ones).

4.) Start the actual recovery process:

Handy recovery has a very capable freeware solution after you have cloned the drive. Commercial: Restorer 2000, Handy Recovery later not free versions. All around HD solution: diyrecovery.nl. Testdisk is also very good but only if you really know the program (and not via USB!).

5.) Suggested further informations:

Here is an exhaustive freeware link collection for hard drive related troubles:

http://www.s2service...iskrecoverylinks.htm

Hope that helps. If you are careful and don't mess up too much, you should get all your data back, though it may take some time. 

Regards,

Brahman

[brahman]

Oh sorry,

just saw that the original question was from Februar and then the thread got revived. Oh well ... 

Maybe it will help some other people with similar problems!

Regards,


Brahman

[f0dder]

1.) Never let Chkdsk do anything to a damaged hard drive, it will only make things worst and unrecoverable.

-brahman

Used to be (very) true on win9x, and does hold for FAT filesystems. With moderate corruption, chkdsk is fine for NTFS filesystems though (ie., a standard BSOD or poweroff - but if you've been dealing with driver development or there's garbled file/folder names, get a better tool).

3.) Don't do anything to the harddrive until you have mirrored the drive to another drive with special software (NOT with backup mirror software like Ghost or Acronis TI) that is used for HD recovery

-brahman

Very important advice - with more-than-minor corrupted filesystems, never do in-place "repairs", always restore files to another drive, or do a mirror first.

Ghost and Acronis are fine for imaging if there's not any physical damage to the drive btw.

[donzonion]

Hi
Had a crash on my Lacie 500gb USB drive – suddenly the files were gone and xp did not recognize the partition. There was about 400gb of stuff on the drive, nothing important so no big deal. Anyway this could happen to more important stuff sometime, so I tried to recover (as an exercise). Borrowed a similar  drive from a friend and did a backup to that drive.  I used freeware tools from http://www.smartpctools.com/products/
Used NTFS recovery to recover the files and had them copied over to the other usb drive. It took over 24 hours! Maybe it’s faster working with drives attached to the mainboard or with other recovery tools – I don’t know, but it seems you must have some patience.
I would say about 99% of the files were recovered and working which was impressing.
Step 2 would be to repartion, reformat and copy the files back to my own drive – which would probably take another 24hours. Anyway Smartpctools had another freeware tool: Smart Partition Recovery. It uses a database of known disks to instantly recover the partition on damaged drives. With my files already safely backed up, I dared to try just that. Smart Partition Recovery found my drive and  I executed recovery. Took less than a second – and everything was back on the drive as normal – totally amazing. And yes, it is still in order 3 weeks later.
Just repeating what’s been said in other posts:
1.   Do no operations on the crashed drive.
2.   Use file recovery software and recover your files to a second drive before you do anything else - if they are important to you.
3.   Copy the files back or try the Smart Partition Recovery software.
Just my own opinion:  large usb drives should only have a small internal, cache max 2mb , to avoid write errors, and wait a few seconds after operation before detachment. Do not activate drive delay on usb drives.
 

[f0dder]

Recovery tools (the ones worth using, anyway) do a bit more analysis than just "copying the files", so the copying process after recovery should be a good deal faster. And connecting the drives "directly" instead of USB should also be a bit faster, and have less CPU overhead.

The "partition table restore" thing sounds interesting - obviously won't work for non-standard partitioning, and won't work if there's more severe corruption than just the partition table being knocked out... but interesting nonetheless.

large usb drives should only have a small internal, cache max 2mb , to avoid write errors, and wait a few seconds after operation before detachment. Do not activate drive delay on usb drives.

-donzonion

I don't agree here, as it would make the drives too slow. Heck, with a very small cache and syncing too often, you might get enough wear&tear on the drive that it'll die early