Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Short version

  • I probably need software to run a deep-scan recovery (ideally on Linux) to find files on NTFS filesystem.
  • The file data is intact, but the references are no longer present.
  • Analogous to recovering data from a "quick-formatted" partition.
  • Hopefully there is a smarter way available than deep-scan, one which would recover filenames and possibly paths.
  • Just under 2TB of data went missing on a 3TB disk. I will be using a second disk to dump the recovered files obviously, and will be mounting the source filesystem read-only if the best solution can run on Linux (or if someone can tell me how to make Windows mount a filesystem read-only).

Long version

I have a 3TB disk containing a load of backups. Windows 7 SP1 refused to detect the disk when plugged in directly via SATA, so I put it on a USB/SATA adaptor which seemed to work at first.

The SATA/USB adaptor probably does not support disks over 2.2TB though. Windows first asked me if I wanted to 'format' the disk, then later showed me most of the contents but some folder were inaccessible. I stupidly decided to run a CHKDSK on my backup disk, which made the folders accessible but also left them empty.

I connected this disk via SATA to my main PC (Arch Linux). I tried:

  • testdisk
  • ntfsundelete
  • ntfsfix --no-action (to look for diagnostically relevant faults, disk was "OK" though)

to no avail as the files references in the tables had presumably been zeroed out by CHKDSK, rather than using a typical journal'd deletion).

If it is useful at all, a majority of the files that I want to recover are JPEG, Photoshop PSD, and MPEG-3/MPEG-4/AVI/MKV files. If worst comes to worst, I'll just design my own sector scanner and use some simple heuristic-driven analysis to recover raw binary blocks of data from the disk which appears to match the structures of the above file types.

I am unfamiliar with the exact workings of NTFS but used to be proficient at recovering FAT32 systems with just a hex-editor, so I can provide any useful diagnostic information if you let me know how to find it!


My priorities in ascending order of importance for choosing the accepted answer:

  • Restores directory structure
  • Recovers many filenames in addition to the file data
  • Is free / very cheap
  • Runs on Linux
  • Recovers a majority of file data

The last point is the most important, but the more of the higher points you match the more rep you'll probably get :)


UPDATE X-Ways and Auslogics are running on images of the disk, the former doing some fancy forensic stuff and the latter probably doing the MFT-scanning and bit-tweaking that we could once do by hand when recovering FAT filesystems...

share|improve this question
    
Note that I already have a "shopping list" of potential recovery software to use, I am mainly hoping for some easier way (e.g. flipping bits in the MFT), or to hear warning about useless, mis-sold recovery products... –  Mark K Cowan Nov 6 '13 at 1:10
    
Partition Find and Mount. It's not free (in the practical sense) and doesn't run on Linux, but it works very well, at least it did for me. Only caveat is that, since it doesn't modify the damaged disk in any way, is that you have to have at least a temporary storage device onto which to copy the recovered data. –  martineau Nov 6 '13 at 2:00
    
Thanks, but the MBR and partition is largely intact. CHKDSK just removed the MFT entries corresponding to around 2TB of files. The disk still reports the space as used, but the total size of all files (using du -BG) is only 1TB instead of the expected 3TB. I either need something which understands NTFS and can repair it in-place, or a good heuristic-guided sector scanner which can dump the recovered data to a spare disk. –  Mark K Cowan Nov 6 '13 at 13:54
    
Partition Find and Mount could still be useful because it totally understands NTSF and can the files for you -- it doesn't just find missing partitions. I suggest you try the speed-limited free version and check-out its capabilities (assume you can't find something that fits your priorities even better). –  martineau Nov 6 '13 at 18:28

2 Answers 2

up vote 1 down vote accepted

I've used photorec to recover files from a drive that windows saw as unformatted.
Unfortunately it doesn't satisfy your top 2 priorities, but it satisfies the rest of the priorities.

It will require a 2nd disk to store all of your recovered data on as well as it doesn't modify the original disk.

share|improve this answer
    
I thought that photorec only did photos, but after checking the specs, it handles almost all the formats that I want to recover. I intend to use a second disk anyway for recovery - and I hope that no-one in their right mind would write to a damaged file system that they're simultaneously trying to recover! A friend with X-Ways is currently having a go at it for me, but I'll try Photorec too after he's imaged the drive. –  Mark K Cowan Nov 6 '13 at 13:47
    
Fingers crossed ! –  Lawrence Nov 7 '13 at 0:38
    
Cheers for the recommendation! Auslogics did the job though! Marking your answer as accepted anyway though, as it was a valid answer and would have been my next step had Auslogics not worked. –  Mark K Cowan Nov 7 '13 at 15:24

ZAR: Zero Assumption Recovery didn't achieve anything. Auslogics recovered everything - not a single file missing and no files so far have turned out to be corrupt. X-Ways appears to be the top piece of recovery software, which would explain why it was nowhere near completion by the time Auslogics had finished.

After the data had been recovered and dumped onto another disk, I put the subject disk into a Windows Server 2003 x64 system and ran a CHKDSK. This CHKDSK appears to be recovering all the files in-place, undoing the damage done by the Windows 7 CHKDSK which (along with a dodgy USB/SATA bridge) caused the problem in the first place.

Lesson learnt:

  • Never write to the only remaining backup before it has been restored, even if the disk appears corrupt. Linux had no problem accessing what was left after CHKDSK initially "hid" 2TB of data, and I'm guessing that my Linux PC would have been able to see all 3TB of the data initially anyway.
  • I need to figure out how to tell Windows to mount a filesystem as read-only, so it doesn't insist on creating Recycle Bin, ReadyBoostTest, etc on the next damaged disk I put onto a Windows machine... To begin with, how do I even configure how Windows mounts filesystems, since it does so automagically... Time to peruse the StackExchange network again!
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.