Hard drive glitched, thousands of files just disappeared. Any suggestions?


Recommended Posts

So, I just discovered my 3TB Seagate hard drive lost a crap-ton of files over the weekend.  I couldn't access certain media on my Plex server and when I logged in, I found only a few folders of MP3s and movies remaining--out of THOUSANDS. Plus no more family videos or photos.  It looked like someone had gone in and deleted everything.  No obvious Windows errors had been thrown, but when I went into the System logs there are dozens of alerts mentioning NTFS errors.

When I use TestDisk, it can't properly identify the disk size and gives warnings about partition conflicts and an MBR error.  I'm thinking if the partitions and MBR can be corrected, my data should still be there. I don't know enough about changing disk geometry, so I am imaging the disk now so I can scrape it for data. I don't want to lose the file structure, though. Having 20,000 music tracks won't help if I don't know what album they go to.

I am trying to avoid spending money I don't have for a data recovery place to recover the files, but I don't know what else to do.

Any thoughts or recommendations? And if it comes down to sending the drive to a third-party for this--anyone have a favorite?

Link to comment
Share on other sites

Is it a ST3000DM001 by any chance? I've had a ridiculous number of them fail on me.

Another vote for Ontrack here, I've had good luck with it in the past. That said, ask yourself how valuable those photos were. It may be better to just pay someone who knows what they're doing in case you risk harming the data further.

Link to comment
Share on other sites

You could try this method:

Put an Ubuntu Distro on a USB drive then boot your machine into that, mount the drive in question and see if the files show up there. I've had success seeing my otherwise damaged NTFS drives & partitions that way, and was able to get 99% of my data back (had a few files that were corrupted, but nothing I couldn't get back). Once you have that data safely backed up to another drive, boot into Windows' recovery tools (through setup -> Advanced Tools -> Command Prompt) and do a chkdsk /[drive] /offlinescanandfix. I forget the exact command switches, so do a chkdsk /? for the available commands. /offlinescanandfix really does a good job, but you have to reboot that drive twice. There's NO guarantee that it'll stay stable!

Hope that helps. 

Link to comment
Share on other sites

Is it a ST3000DM001 by any chance? I've had a ridiculous number of them fail on me.

Another vote for Ontrack here, I've had good luck with it in the past. That said, ask yourself how valuable those photos were. It may be better to just pay someone who knows what they're doing in case you risk harming the data further.

YES it is a ST3000DM001.  I have since read about their huge failure rate. Ugh :(

And I think you're right about the recovery service.  Wish they weren't so expensive.

Link to comment
Share on other sites

You could try this method:

Put an Ubuntu Distro on a USB drive then boot your machine into that, mount the drive in question and see if the files show up there. I've had success seeing my otherwise damaged NTFS drives & partitions that way, and was able to get 99% of my data back (had a few files that were corrupted, but nothing I couldn't get back). Once you have that data safely backed up to another drive, boot into Windows' recovery tools (through setup -> Advanced Tools -> Command Prompt) and do a chkdsk /[drive] /offlinescanandfix. I forget the exact command switches, so do a chkdsk /? for the available commands. /offlinescanandfix really does a good job, but you have to reboot that drive twice. There's NO guarantee that it'll stay stable!

Hope that helps. 

Thanks for the advice.  I'll give it a try.  And as for the drive afterwards, after I Nuke it, it's going in the trash (well, after my son cannibalizes it for the magnets). Seagate has really gone downhill recently.

Link to comment
Share on other sites

You could try this method:

Put an Ubuntu Distro on a USB drive then boot your machine into that, mount the drive in question and see if the files show up there. I've had success seeing my otherwise damaged NTFS drives & partitions that way, and was able to get 99% of my data back (had a few files that were corrupted, but nothing I couldn't get back). Once you have that data safely backed up to another drive, boot into Windows' recovery tools (through setup -> Advanced Tools -> Command Prompt) and do a chkdsk /[drive] /offlinescanandfix. I forget the exact command switches, so do a chkdsk /? for the available commands. /offlinescanandfix really does a good job, but you have to reboot that drive twice. There's NO guarantee that it'll stay stable!

Hope that helps. 

Thanks for the advice.  I'll give it a try.  And as for the drive afterwards, after I Nuke it, it's going in the trash (well, after my son cannibalizes it for the magnets). Seagate has really gone downhill recently.

Link to comment
Share on other sites

I used OnTrack Easyrecovery Enterprise in a situation much like yours. Easier to use than TestDisk.

It might even have an option to correct the partitions. 

Heard good things about that.  Of course if I buy the Enterprise edition, I could just pay another company to do it for me for that price. :)

Link to comment
Share on other sites

You could try this method:

Put an Ubuntu Distro on a USB drive then boot your machine into that, mount the drive in question and see if the files show up there. I've had success seeing my otherwise damaged NTFS drives & partitions that way, and was able to get 99% of my data back (had a few files that were corrupted, but nothing I couldn't get back). Once you have that data safely backed up to another drive, boot into Windows' recovery tools (through setup -> Advanced Tools -> Command Prompt) and do a chkdsk /[drive] /offlinescanandfix. I forget the exact command switches, so do a chkdsk /? for the available commands. /offlinescanandfix really does a good job, but you have to reboot that drive twice. There's NO guarantee that it'll stay stable!

Hope that helps. 

I'll give it a shot! Thanks for the suggestion.

Link to comment
Share on other sites

When something like this happens the safest way to try to get stuff back is making a sector by sector image and work with the image instead of the actual hard drive, but because yours is a 3TB it could be complicated to find space for that. That's because when plugged in, if you or some program writes data in the hard drive it may override sectors where your data used to be and the content would then be permanently lost (mostly, unless expensive equipment is used).

What I'd do is, within Windows see if the filesystem metadata is actually corrupt, for example executing in an elevated command prompt "chkdsk x:" where 'x' is the letter assigned to the harddrive volume. Since it is read only it wouldn't correct any errors it finds potentially destroying data but reports if there was any. That's only for you to know, but the causes, etc. you may never know. S.M.A.R.T. data may shed some light into it but still it wouldn't be conclusive. And if you use Linux a nice tool to check the health of a drive is GSmartControl (should be in the repos of your distro of choice).

To try to recover stuff I find R-Studio (paid) to be very good, you can use the demo version to make a scan of the disc (although it will take time given its size, I recommend using the simple view during scanning to speed things up a bit).

If you do the procedure is something along these lines:
 - Do a scan of the disk, since you know the partition was NTFS disable the other filesystems to speed things up.
 - Save the scan file so that you won't have to do it again should you do it intermittently.
 - Open one of the detected partitions and navigate through the detected file structure, try to recover whatever you can.
 - There are also files detected by their magic number but without the underlying structure, so you only get unnamed and unorganized files which could be a nightmare to sort out give the size of the HDD.

If you didn't delete the partition or touched the partition table you may be able to skip the scan by double clicking directly the partition within R-Studio, I'd try this first since it would be quicker than scanning the whole drive.

I hope this helps and you get some memories back.

Link to comment
Share on other sites

I appreciate everyone's advice.  I also appreciate that there were no, "You should have been backing up your stuff if it was that important!" comments. haha

I usually DO maintain good backups.  However, I've been doing a bunch of "housekeeping" and organizing of my media and I replaced a drive without restarting my back up. (I know, I'm an idiot)  The irony is that I have been preaching backups to family and friends since the days of the old 3M tape drives, and I was taken down by carelessness and complacency.  Sigh.

Live and learn, eh?

Link to comment
Share on other sites

The other thing I've learned about this is how important backups are from an organizational point of view.  I've recovered a few hundred media files from the image I made, but the filenames are not preserved nor or the directories.  If you're an OCD-type organizer like I am, you know what it's like to spend countless hours getting folders organized, collecting meta data for media, etc.

That's one of the reasons why I will probably end up sending this to the pros, because I'm hoping an engineer can rebuild the logical structure, and all my data will be in their neat and tidy little houses. haha

The other thing I've learned about this is how important backups are from an organizational point of view.  I've recovered a few hundred media files from the image I made, but the filenames are not preserved nor or the directories.  If you're an OCD-type organizer like I am, you know what it's like to spend countless hours getting folders organized, collecting meta data for media, etc.

That's one of the reasons why I will probably end up sending this to the pros, because I'm hoping an engineer can rebuild the logical structure, and all my data will be in their neat and tidy little houses. haha

The other thing I've learned about this is how important backups are from an organizational point of view.  I've recovered a few hundred media files from the image I made, but the filenames are not preserved nor or the directories.  If you're an OCD-type organizer like I am, you know what it's like to spend countless hours getting folders organized, collecting meta data for media, etc.

That's one of the reasons why I will probably end up sending this to the pros, because I'm hoping an engineer can rebuild the logical structure, and all my data will be in their neat and tidy little houses. haha

The other thing I've learned about this is how important backups are from an organizational point of view.  I've recovered a few hundred media files from the image I made, but the filenames are not preserved nor or the directories.  If you're an OCD-type organizer like I am, you know what it's like to spend countless hours getting folders organized, collecting meta data for media, etc.

That's one of the reasons why I will probably end up sending this to the pros, because I'm hoping an engineer can rebuild the logical structure, and all my data will be in their neat and tidy little houses. haha

Link to comment
Share on other sites

So you didn't have a backup?
Oh well everyone loses data before they start to take backups seriously.

Happened to me back in the early 90s. Ever since then I only get more storage when I can afford to backup that data also.

  • Like 1
Link to comment
Share on other sites

I appreciate everyone's advice.  I also appreciate that there were no, "You should have been backing up your stuff if it was that important!" comments. haha

That's because Budman hasn't been here yet :laugh:

Link to comment
Share on other sites

No reason to bring it up now that the OP has brought it up themselves ;)

Not sure where your going to send for recovery - but I find it highly unlikely the media is worth that much!!  Unless your talking home movies or something??  While you might of spent lots of time organizing it, etc..  These data recovery places don't make any promises but most likely there will be a hefty fee if you get 1 file back or not.

It is good idea to take an sector copy and try and recover that for sure.

I hope that these were just movies and tv shows not your son's first bday party or steps, etc.  If so then Yeah you learned a very costly lesson about backups and DR!!  I have multiple multiple copies of those files in lots of different places ;)  Could loose my house to OZ in a tornado and still have my pictures and home movies.

Doesn't matter what brand of disks you have -- I have that exact model of that drive.. Wonder what your LCC (load cycle count) was/is via smart - they seem to have a bug with parking heads constantly!!!  I got mine rma'd after it hit 300K in less than a year.   The all can take a ###### at any given moment..  So don't think your next brand of disk couldn't do the same thing, etc.  Just because its "enterprise" or nas rated..

 

Link to comment
Share on other sites

Ever since then I only get more storage when I can afford to backup that data also.


Given the ever lowering prices of hard drives it's great a great policy for in-site backups! Not so much for off-site ones though haha.

Regarding the recovering of organized data, since it was an NTFS filesystem the metadata regarding structure, ACLs and all resides in a table called MFT so as long as that is not corrupted you should be able to access files along with their structure (to some extent). And even if it were damaged, there is a mirror of the MFT but if I recall correctly is only for a small amount of data, it isn't a full mirror of the former.

It's hard when this happens, specially with large drives like OP's, but I think data loss has happened to most of us at one point or another (and even now I don't have everything backed up :laugh:).

Link to comment
Share on other sites

I always keep a cloud backup of anything that's not disposable. With all the great services (dropbox, google drive, etc), it's well worth doing it. As for recovering your files, I concur with BetaguyGZT's advice. Booting up a linux distro will eliminate the OS from the equation

  • Like 1
Link to comment
Share on other sites

I concur with simplezz. In fact, paid Cloud Storage plans with Google Drive, OneDrive, Dropbox, etc is the way to go because you get support options above and beyond free plans; even up to file versioning in some cases. Just make sure you're following all of your local and regional laws and regulations ... don't want to get knackered up for something you forgot you had.

Link to comment
Share on other sites

Oh, and once you have that data recovered and safely backed up? No need to throw away that drive! Format it! You'd be amazed what a fresh format will accomplish. Use the live USB Linux you made (if you made one) or Windows' built-in tools to fresh-format it. It'll skip over those bad sectors (if any) and that drive can be used for other things.

If you're feeling particularly adventurous (and since it's slated for the rubbish heap) use the opportunity to check out whether a HD firmware update is a good idea or a bad idea .. you never know, it might sort the thing out. Of course, it could brick it. That's the beauty of EOL'd hardware that's still *sort-of* working ... Mad Science it. :D

Have fun. :)

Link to comment
Share on other sites

This topic is now closed to further replies.