Recovery software needed

[Technique]

Can be paid for if needs be. I don't really care at the moment, I just want my files back.

 

I'm looking at EaseUS data recovery: https://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm

Not the free one of course.

 

Am I ok to be using this software, should I use an alternative software? Should I use something else entirely before I even do this?

 

I'm freeing up space on a drive right now so you have about an hour before I just go ahead with it.

 

Basically I had a hard drive that showed in Computer but wouldn't let me access it. It's 6TB in capacity (Seagate Ironwolf) and It had something like 500GB-1TB of free space on it before this.

Disk management said it was now RAW with 100% available.

 

Chkdsk /r was ran, took about 7-8 hours and at the end of it it gave me a small fraction of what's on the drive.

 

When you went in to the drive (we'll call it D. It's I but I looks like 1 so it can be D for this). There would've been say 10-15 folders & in these folders, countless subfolders.

 

Now when you go in to D, there's 2 folders & those 2 folders have various subfolders & files missing.

 

Now Computer (Windows 7) says 4.41 TB free of 5.45 TB. So that's about 1TB I need to back up right? Yet when i highlight the folders, right click & go properties, it says about 472GB. Stumped me at first.

 

I then open Recycle Bin on my C drive for something else but I get bombarded with the Recycle Bin on Drive D is corrupt messages. I click no to them & then it goes away. As I look in the Recycle Bin, I see various files & folders ...... all which were on my D drive. In fact the path for them says that ... and I never deleted them!

 

And for the record, I have 'show hidden files & folders' turned on, so it's not like all my stuff is hidden & I'm worrying over nothing.

 

 

That's where I'm at right now.

 

I know there's various recovery programs out there. I don't know if anything needs doing before that or what. So before I jump in with both feet on EaseUS data recovery, do you have any advice?

I assume the drive is somewhat corrupt, yet CrystalDiskInfo says good?

[+InsaneNutter MVC]

1. Don't write / do anything else to that hard drive as other have mentioned.

 

2. Have another hard drive ready to dump any recovered data on to.

 

Recuva worked great when I've needed to recover some photos from an SD card that got corrupted.

[+Warwagon MVC]

One that i really like is called "Active file recovery"

 

https://www.file-recovery.com/recovery.html

[farmeunit]

I used Easy Recovery years ago for this same thing.  Just copied the files off, reformatted drive and copied them back.  Not sure what happened but never really had it happen again. 

 

https://www.ontrack.com/en-us/data-recovery/software

[Technique]

Well I think there's some bad news here.

 

Just had EaseUS remotely checking over my PC.

 

Basically they said if I hadn't ran chkdsk then I would've been able to recover everything. Very likely.

 

But the fact that I HAVE ran chkdsk means this is likely to not be the case or is certainly not going to be the case.

 

Now whether that is specific to THEIR program and another program will work around the fact I've ran chkdsk, I don't know.

[+Warwagon MVC]

I think you are ok, I doubt chkdsk did much writing to the disk. Unless a program wrote 0's on the drive you should be ok. I think you should be able to use the trial version of Active file recovery, I think you really only have to buy it if you want to recovery more than 1 thing, which you obviously want to do, but the trial version should be enough to see  if it found any thing.

[Technique]

On 30/06/2022 at 22:46, warwagon said:

I think you are ok, I doubt chkdsk did much writing to the disk.

I've no idea but I can only tell you what they said to me.

About 4TB has disappeared and the guy said running chkdsk has been the difference between getting everything back and being thankful for whatever if anything I can get back basically.

 

The guy put a program called WinHex v19.7 on my PC & was using it to pull up various things. He was able to access photos that SHOULD be on the drive but I can't access. But he also pulled up files that SHOULD be on the drive yet had an X through and I know something is wrong with them as the file size is not what it should be (for example, I know it should be a bluray rip of a movie & 20-30GB yet it's like 5MB or something).

[Dick Montage]

If you lose data from a disk… STOP. Don’t try to find it, don’t run check disk. Just eject that disk, plop it onto another machine and do a retrieval immediately.

 

for what it’s worth - I have always got results from Easus

[spikey_richie]

On 01/07/2022 at 08:26, InsaneNutter said:

1. Don't write / do anything else to that hard drive as other have mentioned.

 

2. Have another hard drive ready to dump any recovered data on to.

 

Recuva worked great when I've needed to recover some photos from an SD card that got corrupted.

+1 for Recuva. 

[Technique]

On 01/07/2022 at 08:02, Dick Montage said:

If you lose data from a disk… STOP. Don’t try to find it, don’t run check disk. Just eject that disk, plop it onto another machine and do a retrieval immediately.

 

for what it’s worth - I have always got results from Easus

Well it's too late now. Running chkdsk was the start of the problem.

The issue was I had no clue what to do. Hopped on to forums & my first reply was a link to a video showing a guy using chkdsk so first off I Googled whether chkdsk can cause loss of data. The result was 99% of people saying no but 1% saying yes.

 

I went with the balance & ran chkdsk. This was before I even posted this thread here of course.

 

Thankfully (whether it makes a difference or not I don't know) this isn't an OS drive, it's just a data drive - where I dump photos, audio, videos etc. It's just a storage drive. There's no programs on it for example. The only stuff that gets written to the drive are when I save a file to the drive either direct from the internet or when I'm transferring something over from another drive.

 

So as I can't/couldn't access it, I couldn't write anything to it .... beyond chkdsk doing its thing - but as said, that's already done.

 

I'm currently running Stellar Data Recovery as it seemed to tick the box a little more than EaseUS from reviews.

I went to bed with 9 hours to scan.

7 hours later I wake up with 17 hours to scan. Deep scanning obviously.

Currently on phase 3 of 5, 41% done, reading cluster 563101696 of 11720779768.

 

Their guide says to remove from the PC, put the drive in to an enclosure, connect to a different PC via USB cable.

I contacted their live chat & explained this isn't an OS drive, it's literally just a file-dump drive for pictures, videos & audio files. The only stuff getting saved to it is what I choose to put there. Am I ok to leave it connected internally in this PC & just scan on it that way, rather than disconnecting?

 

They said in this scenario, yes.

 

I imagine if it was an OS drive or a drive where I had software running from - so Program File folder etc, then they would've said to remove it.

[Dick Montage]

Good luck man, please don't take my comments as an attack, I am hopeful that you get your data back!

[Steven P. Administrators]

On 01/07/2022 at 11:37, Technique said:

Their guide says to remove from the PC, put the drive in to an enclosure, connect to a different PC via USB cable.

I contacted their live chat & explained this isn't an OS drive, it's literally just a file-dump drive for pictures, videos & audio files. The only stuff getting saved to it is what I choose to put there. Am I ok to leave it connected internally in this PC & just scan on it that way, rather than disconnecting?

 

They said in this scenario, yes.

Yeah if it was your C (Windows) drive then the OS would interfere with the process by writing data to it during the scan. This can happen with a D drive too if you are running any software programs from it, but not if it is just a storage drive.

[Technique]

On 01/07/2022 at 10:48, Dick Montage said:

Good luck man, please don't take my comments as an attack, I am hopeful that you get your data back!

Sorry pal. I think maybe my "well it's too late now" maybe came across as a bit on edge.

 

Didn't mean it like that & also didn't take your post as an attack.

 

I'm trying to remember what was on the drive now. There's 2 folders in particular that I'll be devastated if they're gone-gone.

 

I have a bad feeling that they will be, just purely because you don't appreciate how 'luck' lands for me (it doesn't!). It'll be typical that they'll be the only 2 folders I CAN'T get back. Off the top of my head if the rest has gone it's not overly bad, unless I've forgotten something which is very possible. Maybe it's just that these 2 folders in particular mean that much to me that I can't think straight where the rest are concerned at the moment & it'll only come to me later.

 

50% & 17hours in.

17hours to go...

cluster 1588576256 of 11720779768.

Don't mind me putting these random numbers, I'm just using them as references in case I come back in a few hours wondering if it's moved any or frozen.

[+Warwagon MVC]

On 01/07/2022 at 02:37, spikey_richie said:

+1 for Recuva. 

I must be the only person who has never had any luck with Recuva.

On 01/07/2022 at 10:01, Technique said:

 There's 2 folders in particular that I'll be devastated if they're gone-gone.

 

Don't give up hope, until you've tried everything.

[+Warwagon MVC]

On 01/07/2022 at 10:01, Technique said:

50% & 17hours in.

17hours to go...

cluster 1588576256 of 11720779768.

Don't mind me putting these random numbers, I'm just using them as references in case I come back in a few hours wondering if it's moved any or frozen.

Can't imagine how long a 6TB data recovery would take, and I thought a 1TB drive was bad.

 

I don't mean to rub salt on the wound, but in the future if you buy 1 data drive (example 6TB) buy 2, 1 to backup the other. 

[Technique]

On 01/07/2022 at 16:34, warwagon said:

I must be the only person who has never had any luck with Recuva.

Don't give up hope, until you've tried everything.

Once this is done (and I really hope to god that it doesn't freeze on me or anything!) then I don't really know what else there is to try - beyond just paying for similar type software.

 

The EaseUS guy who remotely accessed my PC & was playing around left WinHex on my desktop. It was quite interesting him using that and what he could pull up with it but I obviously don't know what I'm doing with it, plus I wonder whether it's just a technical version of say Revua / EaseUS / Stellar etc. where it'll get the exact same results ... just without the nice looking GUI.

OR...whether it's more in-depth and it'll get better results. I don't know.

 

On 01/07/2022 at 16:48, warwagon said:

Can't imagine how long a 6TB data recovery would take, and I thought a 1TB drive was bad.

 

I don't mean to rub salt on the wound, but in the future if you buy 1 data drive (example 6TB) buy 2, 1 to backup the other. 

Yeah 6TB is being a PITA.

I'm not sure if it's good for the PC / CPU / SSD / hard drives to be running constantly like this?

Ok I'm not playing an intense game in 30c+ heat but still. This is just my ignorance showing though. Perhaps it's perfectly fine to run 24/7 (well, not /7, hopefully less than that, maybe 24/2).

 

And yes, that's what the 8TB drive that I bought at the start of the week was for.

Was discussing with Budman yesterday as I'm wanting to implement a better backup setup.

 

 

[Technique]

I forgot to ask guys -

 

Moving forward once I've established whether anything can or cannot be recovered from the drive...

 

How would you treat the drive from here on?

 

All this has obviously happened for some kind of reason. As a know-nothing, my thought now is - is this hard drive useless, fit only for the bin, cannot be trusted, or is it entirely possible it's just had 'a moment' & this data loss is 'just one of them things'.

 

So basically would you continue to trust it & use it, or would you stick it in the bin?

Or maybe a 3rd option of continue to use it but not fully trust it - as in would only use it for throwaway 'who cares if it happens again' files?

Or a 4th option?

 

 

[Technique]

I'm now wondering at what point you make the decision the program is frozen/has crashed.

 

So the time elapsed was as normal. It got to about 20 hours. The time remaining was all over the place but this I expected. The time elapsed was consistent with what it should be. NOTE: ELAPSED TIME does not increase in exact seconds on this software. It does not go 01sec, 02sec, 03sec. A period of time will pass & then it'll update accordingly, 'pause' for a while, period of time passes & then update accordingly again.

 

I'd used the PC on & off to do various browsing tasks. Stellar said this was ok but try not to do anything intensive.

 

So again, i'm at about the 20 hour mark.

 

I then finish my tasks, go downstairs & watch TV. Call it 2 hours.

 

As I return, I check to see how the scan is going, expecting it to say 22 hours elapsed & hopefully something less than before for remaining. This is when it got strange ....

 

It said 15 minutes elapsed and like 9 minutes  remaining, but the percentage scanned part showed what I would expect at that point and it was still on phase 3 of 5 as it has been for the past couple days.

 

Now here's what I can't remember - as I went to bed whether it was 55% or 56% but it was certainly one of them.

 

I went to bed at 11pm with the elapsed time saying 40 something minutes.

 

I wake up at 4am for the toilet. Call in to see how it's doing - & this is where I start to wonder if something isn't right as it's only at 56% and the time elapsed is only 50something minutes. I take a screenshot of where it's at so that I can see whether it's on any new cluster by the time I next wake up.

 

Back to sleep, it's now 8am, I check to see the progress & it's on the exact same cluster.

 

Now I don't know whether the software is hanging or whether this one particular cluster is just so bad that it's taking a looooooooooooooooooooooooooooong time to move past. I open task manager & it doesn't say "not responding" but this is a long long time for seemingly no progress.

 

 

 

So at the moment, not really sure what to do. I'm about to head out to the gym so that'll be a couple hours more in total but I suspect no change.

 

One thing this has shown me is I can't just give up the PC for such period of time. I'm halfway contemplating stopping this scan, buying a cheap second hand PC off Facebook Marketplace, setting it up in the spare room & just leaving it totally to scan.

Thought process being:

 

I can then just LEAVE IT totally.

Plus my PC is 12 years old. I suspect even a not so great 2nd hand PC will be faster than mine (AMD Phenom 2 2.80Ghz / 16GB RAM / ASUS M4A88TD-V EVO/USB3 mobo).

 

Though I don't particularly want a 2nd tower. A second hand laptop would be a consideration BUT I'm not convinced this would be a good idea leaving the laptop to scan the HDD. It would need to be connected via a HDD enclosure & USB whereas with a second tower I could have it connected internally for max possible speed.

[goretsky Supervisor]

Hello,

I have had good results with Runtime Software's GetDataBack line of data recovery software on hard disk drives.  It's not free, but at least the trial version will tell you if it can read this drive and recover any files.  On the open source side, Christophe Grenier's TestDisk is supposed to work very well, but I have not personally used it myself.  Back when CDs and DVDs were more commonly used, I had good results with Naltech's data recovery software for those, but they no longer seem to be in business.

Once a drive has begun to fail, I would be very cautious about using it again.  At the very least, I would run the driver manufacturer's most thorough diagnostics against it, and perhaps even some third party utilities like Hard Disk Sentinel, HDDGURU, HDDScan and so forth, just to see what they report.

Regards,

Aryeh Goretsky
 

[Technique]

On 03/07/2022 at 09:39, goretsky said:

Once a drive has begun to fail, I would be very cautious about using it again.

I would agree.

Question is - is the drive 'failing'

OR

did the drive just have 'a moment'?

Is the drive actually ok and it was me hitting reset when it initially started running chkdsk that's caused the problem of lost files (hitting reset).

OR

did simply just running chkdsk or chkdsk /r cause this issue. For example - if no chkdsk had been ran at all, would everything be A-ok?

 

That's what I wonder. Especially as if you look at the cmd window image I uploaded there - it says 0KB in bad sectors. Does that mean there's no bad sectors on the drive, or that there may be bad sectors, there's just nothing stored in them?

 

 

Anyway.....

 

@warwagon I'll tag you here. I know you've been helping me a lot via PM but I'm just updating everyone. Feel free to respond either here or PM.

 

There had been no action on the scan. It had frozen for so long that I gave up.

Remember ... it was at phase 3 of 5.

 

So I hit stop, it warns me that it cannot resume scan from where I'm stopping it, I click no problem.

But then instead of stopping, it jumps straight to phase 5, seemingly bypassing phase 4 & throws up a list of what should be on the drive.

 

 

 

I take the hit to the pocket & pay up for premium. Not cheap.

 

I download one of the most important folders. It was late and it appeared like everything was there, thankfully (yeah, read on...).

 

I select the folders to recover & go to bed, hoping it'd be done by the morning ... it wasn't. Typically it started with the largest folder first - my Plex folder.

 

So I wake up & check out folders which is when I noticed some folders had been downloaded at the same time, which I thought was worryingly weird...

 

 

You'll see they're not the only examples. Jurassic World & Maleficent. Then various at 1:22am.

 

So I open the folder....

 

It's a dead file.

 

I go to the other folder....

 

So basically when a load of them have the same download time stamp - only 1 will be working.

And I know I mentioned blu-rays so you may think the above is faulty as it's only 4.75GB but that one was actually a DVD rip so it's correct.

 

This then fills me with a sickening feeling.

 

I go back to the initial folder I downloaded right at the start.

 

Sure enough - I notice at least one subfolder totally missing.

In some of the other subfolders, MOST of the files appear to be there. The image files appear to be ok BUT some of the video files are just no good, like Killzone in the attachment above - they just read 0bytes. Not all video files but some.

 

 

Now whether this is because the scan froze & i hit stop

Or whether it's because the file is just gone forever ... I don't know.

 

 

If you look at the initial tree, there's 2 curious folders - found.000 and Lost Folders. I have no idea what these are.

I hope they contain what I'm missing, though I highly doubt it. I suspect the EaseUS guy was correct (I know - this is Stellar program) and that some files are just gone forever because of running chkdsk.

 

I did try to just copy everything but it said no room on destination drive which I thought strange. It appears there's 8.5TB in total (on this 6TB drive!)

[bledd]

Rule number 1 if it's valuable data.

 

Disconnect the power and send off to a data recovery company.  Will be ~£600 ish.

 

Used, these before for another foolish person who didn't have backups

 

https://www.ontrack.com/en-gb

[Technique]

On 03/07/2022 at 12:45, bledd said:

Rule number 1 if it's valuable data.

 

Disconnect the power and send off to a data recovery company.  Will be ~£600 ish.

 

Used, these before for another foolish person who didn't have backups

 

https://www.ontrack.com/en-gb

(Going forward...)wont need them.

 

This is going to be lesson painfully learned where I'll have a backup system in place whereby the only way I'll lose anything is if my house & the offsite gets rocketed at the same time.

 

I am probably also going to break my own rule of not subscribing to something - as in I am considering cloud storage now.

 

Too late for this scenario I know.

[aphanic]

Just read through the thread, I may be too late to the party but I'll throw my opinion anyway.

 

Many of the things that were said already are case, for example the bit about stopping to work on the drive that experienced data loss. I wouldn't go as far as suggesting it being disconnected and plugged into an external enclosure or as a secondary drive in another computer since it's already a secondary one for you, but I'd certainly disable access to it. Since we're in Windows, through the disk management GUI, diskpart, etc. remove the letter associated to it. The disk would still be online, and using the benefits of being accessed through its native interface (not through a USB bridge), but no 3rd party program would be able to access it regularly, modify structures or copy data to it, possibly overwriting the important things one has.

 

After that's done, I would probably assess how the disk is doing, @goretskyposted several options for it, I'm partial to Hard Disk Sentinel. GSmartControl could be useful too, the idea is to gauge whether the disk is failing (e.g., there are way too many remapped sectors to those reserved as spares, many uncorrectable errors which could point to a problem with the interface perhaps, ...). If it were in a bad state, depending on how important the data was for me I'd evaluate if it would be better to send it off to a data recovery company, but I'd still go through some basic recovery myself if the disk is responding well to commands.

 

Different filesystems have different data structures to keep track of things, but there's always a ledger of sorts, that keeps track of the logical structure of what's inside (folders, files, where they begin, in which sectors they are, etc.). In NTFS filesystems it's called MFT, it's placed roughly at the beginning of the partition at a fixed location, there's a mirror of it too placed somewhere else too, its location varies depending on which program formatted the partition. Anyway, running chkdsk on it would examine those structures making it harder to recover things in an orderly fashion, it's too bad you went through it, but it's understandable, it's the utility to "check the disk" after all, except it's not read only.

 

Your files won't be deleted by using it though, it doesn't deal with files, it deals with the metadata of the partition (e.g., that ledger I described), so the data would still be there. Same goes for quick formats, they don't overwrite the data, if I recall correctly the first ~300 entries in the MFT are blanked in that process. But when MFTs are corrupted or the mirror one inaccessible, you end up needing to go through analysis of the data. Each file type has a specific format, for example, PNGs start with 89 50 4E 47 0D 0A 1A 0A (hexadecimal bytes, raw data) so a program reading through the whole disk when it stumbles upon that magic number knows it's the beginning of a PNG image. It's what you referred to as deep scanning, trying to find files that match known signatures.

 

After such a scan is finished, you'd be able to "recover" those files to a different location and examine them, that's where the algorithms come into play and depending on the program you may end up with a good file, or a corrupted one. Continuing with the simplified example I gave, we know how a PNG starts and after that header there are several chunks of data comprising the image ending in an IEND (I think it was) chunk. If all is good, once a program locates the start of the file it's easy to find its end and you end up with a perfectly recoverable file. No name or anything, it'd be something like 00000001.png, but it's be OK.

 

Unless... the file were fragmented in the disk, if MFT or its mirror were damaged, the program would have no way to know which sectors actually belong to that file it found. That ledger not only contains the tree structure of the makeup of folders and files in that partition, but also where (physically) each file is located. If a file is stored contiguously in the disk, recovering it based on its signature is easy (sometimes there's no end marker, depends on the file type), but if part of it is at some sectors, part of it in others, etc. you could end up with recovered files that aren't actually readable. They may be valid files, but their contents could be scrambled, missing a part (for example, if it were a picture upon opening it maybe you see just the top part up to a point), ... It's complicated. I bet that's what's up with the files that you posted that were recovered in your earlier post.

 

So now we get into data recovery programs, let me begin by saying in place recovery is generally a bad idea, that is when you use a program to reconstruct the file structures of the drive in the actual drive. It is useful sometimes, for example if what was damaged was the partition table and only that, but given the chance to either restoring in another disk, or creating an image (a full dump, bit-by-bit) of that drive somewhere else and work on that image instead I would always recommend the latter.

 

One of the best tools in this category, if not the best in my opinion, would be R-Studio. I've used it previously for data recovery and forensics analysis and I've found its algorithms to be pretty good, specially if the mirror MFT is at least partly usable. Without resorting to plugging in the disk through specialized tools like PC3000, the best way would be to have it connected as is, if it is a SATA drive through a SATA cable, USB bridges often hang if there's a problem in the drive controller or stop sending requests; it could also happen through the native disk interface, but if it does there won't be anything for you to do and you'd need to send it to a data recovery company.

 

Once opened, you can either create an image of the disk to work on that later on, but if the disk is OK-ish since you won't be writing data to it as there's no drive letter assigned you could just scan the disk directly. Scanning will take time, it'll be as fast as the storage layer is able to read data (don't worry about the speed of your computer parts, the disk speed is likely going to be the bottleneck) and you could do partition searching on the drive itself or go straight for deep analysis. In any case you can choose to save the scan data in a file to be able to stop the scan and continue later on where you left off, or use the scan data at a later moment not to need to scan the drive every time you wanted to recover something.

 

If it finds several partitions that are possible matches to what you had before, examine them all, reading into the partitions uses metadata so things would be ordered, otherwise you always have the possible files that were recognized during the scan, but given the size of your drive it may be nuts sorting through it all.

 

By the way, you won't be needing to pay for the program until you want to recover the files, the demo option allows you to do all of the hard work for you to see if it's useful to you (I think it also allowed you to recover small files, or see previews of some), if all is good you can always license it later on and recover the files. But yes, it will take some time to read through it all regardless of the program you choose, they have to read through all of the contents of the drive. Having Hard Disk Sentinel in the background could be useful throughout the procedure, because even in the unregistered state it would track the different SMART attributes and you could see if new read errors occur, or remapping operations, etc.

 

As for how to treat the drive afterwards, for me it would depend on its state, Hard Disk Sentinel already gives you some insight on how it is (running 24/7 isn't necessarily bad, especially since it is not subject to vibrations from other things), but you can always post a picture of the SMART attributes from any program that can read it for us to see and evaluate. Hard Disk Sentinel by default shows the data of each attribute in hex, right click it for it to be in decimal so it's easier to read. Similar thing in GSmartControl.

 

Now, if the disk were alright, or if the problem were caused by the SATA cable or something unrelate to the disk, I'd probably use the disk as usual, perhaps use HDS to do a surface test or reinitialization run (read-write-read sort of thing to all sectors to ensure they're readable) and see if it all checks out. I.e., no more errors logged by SMART. The disk can also run internal tests too, from a quick one to an extended one, GSmartControl should be able to recover the outcomes of previous tests if they were ever run and execute new ones. But that goes *after* the data is recovered or not recovered, but deemed infeasible to recover.

 

I hope some of it helps 😟

[Technique]

Ok guys, an update...

 

So I downloaded (I guess recovered is the correct term but since I haven't recovered everything then I'm saying downloaded...) every folder of value.

I also downloaded "folder.000" and "Lost Folders".

have a thum

Now this isn't an exact science as I can't remember precisely what was in there to the very last file BUT I would say very roughly speaking, I have got lucky and got back maybe 90% of what I should have.

 

Whether that final 10% can be got back via different methods (that don't involve sending off to companies or learning to read code myself) I don't know. This may well be the end of the road.

 

In the found.000 folders there were some useful files.

 

I would say the vast majority of my images have come through ok. Some have taken a hit but he vast majority appear to be ok. When I say that, I mean the file sizes seem ok AND they return a thumbnail when going in large icon view. I have opened up many random ones and of these - they ALL displayed the appropriate image on the screen.

The images that didn't work were those that appeared obviously duff - file size showing as 0bytes for example or there being no thumbnail displayed.

 

Audio files I also seem to have gotten quite lucky. I have a lot of rare / impossible to re-get audio. It's all well & good people online saying just download it again. You just have to trust me when I say that isn't really an option. It's gone.

Some audio files have taken a hit but from what I can see, they are mostly/all re-downloadable files.

Like with images, I opened various files at random, skipped through at random & the tracks played. Whether this remains when listening from start to finish, I don't know.

 

Then there's the video files. These took the biggest hit. A lot made it through ok but there were also a lot that didn't and typically including the 1 video file that I probably wanted more than any other and it wasn't even a huge file (size). The movies are just an annoyance - I can get them again. Some will cost money, others will cost time. It's the irreplaceable videos that I'm gutted about - moments in time that you cannot rewind a clock & re-do.

 

Some of the found.000 / Lost Folders files are a little strange. They'll have random file names but some of the files work, or say it'll be a video file that'll have a thumbnail from one video or photo yet the actual video will be of something totally different.

 

Step now - a 6TB hard drive is due today. I will clone the 6TB problematic drive and then take a rest and come back to it another time when my head isn't so fried. As I say, i don't know if any more can be rescued than what already has been or whether this is it.

 

Thank you to those that helped.

[Technique]

Hmm, not too sure about this cloning lark.

 

Reading more online about people going sector-by-sector and it taking dayS. One case I read, a guy was 4 days in & still only at 18%. I can't give the PC up for that duration.

[aphanic]

On 06/07/2022 at 09:52, Technique said:

Hmm, not too sure about this cloning lark.

 

Reading more online about people going sector-by-sector and it taking dayS. One case I read, a guy was 4 days in & still only at 18%. I can't give the PC up for that duration.

I'm afraid if you want to be able to attempt any kind of data recovery after cloning the drive into the new one, you'd have to do it sector-by-sector. Cloning and imaging (making a full copy of the contents of a disk or partition into a single file) could be done at least in two ways:

 

- What some programs call "intelligent" or logical cloning, it is useful if there is no problem in the original media and as long as the program doing the copy understands the filesystems in use. Thinking of NTFS, for example, the program would need to understand and use its structures (like the MFT at least) to make a copy of just the files that are registered as being there. Think of this way of imaging as opening the drive in explorer, selecting it all, Ctrl+C + Ctrl+V (except to a file or other disk).

 

- Sector by sector: this way of proceeding is the only one available when the imaging program doesn't understand the logical structure of the partition (e.g., say it knows what NTFS is, but it doesn't know any of the macOS filesystems and your drive is formatted as one and can't even rely on the OS for it) or when you need to for forensics / recovery purposes, basically what the program does is: read sector 1 (or 0, if you start counting at 0) in one drive, write its data in the exact same location in the other (or in a file containing the image) and continue one by one. You'd end up with a 1:1 copy of the original disk.

 

There are downsides of the second method, for example needing a medium that is at least as big as the original, so 6TB in your case, but it is the only way to be able to do any kind of analysis of it as if it were the original disk. For example, note that the first method doesn't copy files that were deleted and therefore are not present in those ledgers anymore, the files are still there (physically, in space marked as free), but that's it. Because copying it all would ensure all data is copied over, you'd be able to continue examining the structures, recovering data, etc. in the new disk that is expected to be physically stable and undamaged.

 

General procedure is to do so actually, image or clone the disk we're to recover data from and work on that instead of the original one. In legal proceedings two copies are made in fact, one that's safeguarded by the courts / police, sometimes another is given to the suspect as well, and one we work on (although we use cloners, physical machines that can do sector by sector cloning from one drive to several), but there is no escaping the time it takes: that's why I mentioned that the computer you had was more adequate, you the bottleneck would be the drive itself.

 

-----

 

Now, the information you could recover was already recovered somewhere else and you have the problematic disk and a new one you'd use to dump the information on, right? If that's the case I would suggest proceeding in a different manner.

 

1. I'd use R-Studio, so that'd need to be installed, the demo version is perfectly fine for imaging so no need to pay for it so far (so far, you may for recovery later on if you wanted to).

2. Have the damaged drive connected to the computer internally, not through USB, ensure it's not accesible to Windows. In the disk manager (Win+K for example) ensure there's no drive letter assigned to the partition, and if there is, remove it (right click, change drive letter... remove)).

3. Have the new drive, or one that is known to be good and has enough free space for it all connected too. Ideally internally as well, but it's not critical here, if it's good any translation bridge would do fine, like an USB enclosure. This drive would be formatted and accessible just as it was any other drive: I'd dump there a sector-by-sector image of the damaged one.

 

4. Now, inside R-Studio you'd select the damaged drive and choose to create an image of it:

 

 

 

In the dialog that appears, choose to do a byte yo byte image and put it somewhere in the new drive. Because I'd be reading it all, I'd take advantage of it and enable scanning as well, it's just a bit more processing and it wouldn't meaningfully slow the transfer, just more CPU consumption and the scan information is useful for recovery later on so all the better. You can change the filesystem selection if you want and leave NTFS alone it was probably the one in use before, Exts are Linux', HFS and APFS are macOS'.

 

Clicking OK would start the process, and if you want or need to shutdown the computer, or do something else instead you can just stop the imaging process.

 

 

5. Choose stop, because whenever you feel like continuing, by selecting the same parameters and location you'd be prompted whether you want to continue where you left off or override the file.

 

 

And that's it, after it all finishes eventually you'd have a big ass file containing all of the data that was in the old drive (or rather, all that could be cleanly read, if there were damaged sectors after several read attempts those bytes are replaced by placeholders). The scan information should be saved too and saves you time every time you want to do some restoration, you need but to open the image, scan information, and work on it: explore it all, see if you can recover something else, etc.

 

 

 

I didn't leave it much scanning, the resulting files was... ~7GB for me, but you can see that it could recognize some partitions (by their signature). They could be old partitions, remnants that were there, or they could be the interesting one for you (if based by the mirror MFT). Because my drive was perfectly fine, they one I'd double click to access and recover something would be Recognized1, the one in black starting at 1MB and spanning across 931.51MB. There seems to be a small Ext4 partition in there too, leftover from a Linux installation most likely.

 

But yeah, that'd be the gist of it, imaging / cloning, scanning and examining. R-Studio does imaging as a plus, but I think they have R-Image when it comes to disk cloning, not only imaging.