Correcting tree from messed up file tree in NTFS partition

Question

It's a real messed situation, but I'm quite at the end of my options.

It's my personal hardrive, so it's very important for me, and yes, I have no backup =(

The short story:

1. I have two discs. One with Windows, and another where I had a bit of empty space at the front of the disk, so i could install Linux. The rest was occupied by a 1.8TB NTFS partition filled with data.

2. I installed Linux, and after a while realized there was not enough space for everything, so I tried using Gparted, and told it to re-size the NTFS partition, to a lesser size.

3. The system jammed. I had to reboot and broke the Resizing operation.

Here's what I did to fix it:

1. Rebooted into Linux Live, and used Testdisk,to deep analyze the disk, and recover the possible partitions. It found several versions of the NTFS partitions, probably made during the resizing. I told Testdisk to open every one of them, and only one could list its files. When trying to open the other options on Testdisk, it showed an error message. I assumed the one without errors, to be the correct one, and I told Testdisk to recover the partition, and write a new MBR.

2. The partition had errors, and Linux has a NTFS fixing tool, used it, but the system still had errors.

3. So I booted into windows and use chkdsk to correct all errors in the partition.

4. Everything seems fine, but now, back in Windows, when I open one file, it opens another file, or part of another file. As in, some files took up the position of other files.

What I think happened is that I recovered an old tree, and not the most current one. And that one just happened to be intact, while the most recent one was damaged. As such, the files that were moved during the failed resizing, were now, during the automatic correction, assumed wrongly to be in their correct places.

So when I open a file, it tries to open another one. Radiohead - Creep.mp3 will open and it will actually be a bit from another song, or even code from a jpg. Some files seem to be all right, but others have seemed to have had their position taken by others.

Anyone knows of something really powerful that can help me solve this?

Answer 1

This thing saved a lot of data for many users that asked me to help 'em out: Handy Recovery.

The great thing about it - it can recover deleted partitions! Although it takes a lot of time to find all the stuff you've lost, and of course you'll need a second hard drive to restore to.

Answer 2

You have thoroughly loused up your disk. One never does partition changes without taking a backup first, as the least error will mean loosing the disk, but you did several.

Some of the files may still be recoverable, but you need a utility that analyzes the disk and searches for files without using the disk structure, because there is none now.

Below are listed some free recovery utilities. Try all of them, one after the other. Just remember to copy the potentially saved files to another drive than the formatted one. Don't write on that disk until you recover the data!

You will also need to check each and every "recovered" file to verify that some parts are not missing.

PC INSPECTOR File Recovery
Recuva
DiskDigger

Answer 3

The question was if someone knew something, software or procedure, that could help recover a very messed up partition and files.

After experimenting a lot, here's what I find works best in a situation where you compromised both the files and the file tree:

1. Use a raw recovery tool to get all files you want, directly from the disk. Photorec http://www.cgsecurity.org/wiki/PhotoRec is a really nice tool that allows you to get most file extensions out of the disk. It does a raw recovery, so you won't get your filenames back, but mostly anything that can be recovered, will be.

2. Use something like DMDE http://softdm.com to detect and browse through old/deleted/corrupt partition tables, and again get all your files out.

3. Use something like Testdisk, to actually interfere with the disk and try to recover the old partition

4. Use default file system correcting tools (ex: CHKDSK) to correct your file system.

5. So, reviewing 1) is raw files, 2) is recovered files from recovered tree structure, 4) is files from recovered partition. Now for some deleting. Use something that will delete duplicates. What you want is to: compare 1) to 2) and delete all duplicates on 1), compare 1) to 4) and 2) to 4) and delete all duplicates on 1) and 2).

6. Now you can safely combine the file structures from 2) and 4), always renaming files (notice: at this point, one of them will always be corrupt if they have the same name). You can code something for this or just do it manually.

7. Finally, you can use something like Trid http://mark0.net/soft-trid-e.html to get rid of corrupt files. And, spend a lot of time seeing what you got from 1), and manually organizing it.

Regarding the other answers:

The "learn your lesson, always use a backup" advice is nice, but in the end pointless as a problem solver.

The "make an image before you start recovering" advice is also rather pointless if you know what you are doing, and simply don't write on the disk you're trying to recover from (yes, I know even stuff like last accessed/last modified stamps can be dangerous, but not really). There simply isn't a solid reason to do so if your disk's mechanical/electronic integrity is not compromised.

That's it.

All the tools I used were free at the time I wrote this.

This whole procedure will take easily more than a week. Hope this answer helps anyone. :)

Answer 4

First, before keep trying anything else, do (yes: now) a low level bit-for-bit backup (I think Norton or Clonezilla allow you to do this).

Now you have secured what you currently have, let's try: You can use your partition recovery software again, check if the other partition tables are still there, and try to recover another, check if it works, then recover another, etc, you can always return to original state with your copy.

If none of this works, you can consider contacting a data recovery enterprise, they are great professionals which maybe can reconstruct your offsetted pointers, because surely it's a metter of offsetting block indexes. This will have an elevate cost (approximately, a few hundreds $), but only you know how much you price your data.

Good luck.