3

Yesterday I booted my XP system, and as I looked up a minute later I saw the light blue screen and tail-end of that pre-boot diskcheck Windows sometimes does if it finds an error (or was previously told to run a diskcheck drung the next boot). I didn't worry about it at the moment...

But then I looked at my "scratch" disk, which was a 70% full, 750GB hard disk...and it now looks like it has been freshly formatted. It doesn't have a single file on it, just the hidden "System Volume Information" file and 750GB of freedom from data.

I looked at some of the recovery tools from the Free NTFS partition recovery question and decided to try PC INSPECTOR™ File Recovery 4.x initially. It ran overnight and afterwards returned a list of thousands of files it could recover. The odd thing was that the filenames were lost, but the file extensions were not (WTF?). And all of the files were exactly 1,472kB in size. I recovered a dozen PDFs as a test, and 80% of them displayed OK despite being padded out to 1.5MB (though I assume any files > 1472kB are hosed).

My primary question is: Is this the best I can expect from any file recovery software when trying to recover NTFS files? Or is there perhaps something better out there? I assume this is as good as it gets, but wanted to check in with the experts first.

Bonus questions:

  1. What might have happened to my drive? I didn't intentionally format it. I've never seen a disk error cause the drive to suddenly become a clean, reformatted drive. Could some malicious/confused software have told my PC to format my disk on reboot? Is that even a function Windows XP has?
  2. Why can the file extensions be recovered but not the filename? Does NTFS really treat them as separate entities? I thought I had 8.3 naming turned off, but maybe that had something to do with it. Or maybe it looks at the data in the file and guesses the extension?

4 Answers 4

4

on a 750Gb drive, GetDataBack will take an age, but is one of the best out there.

a drive i work with recently lost it's entire partition table for no explicable reason. GDB did a pretty good job of recovering it after several other progs failed.

1
  • 1
    GetDataBack for NTFS seems to have worked very well. I only say "seems" because it will take ages before I know with complete certainty that all the recovered data is error-free. However what I'm seeing so far is that anything in a directory that has its original directory structure all the way to the root is GOOD. Files in the GDB auto-generated "recovered" directories (["000315]", "[000442]" or similar) seem to be pot luck - some files and entire directory trees seem perfect, others are garbage. Bottom line is I think I have 99.9% of my data back - it was $80 well-spent. Thanks! Dec 12, 2009 at 8:45
3

Although the Master File Table (MFT) is corrupted, your disk may contain an MFT mirror which might still contain the lost file data.

TestDisk is open-source software and is advertised as capable of :

Fix MFT using MFT mirror

As this is a partition problem, I would hope that such a partition-oriented recovery product may prove more successful than the file-oriented PC INSPECTOR.

2
  • I never got around to trying TestDisk since it seems like it would modify my original disk. So it was a last resort (or something I'd try after I imaged the raw disk to a different disk). Watching GDB do its thing, I think I saw it refer to a mirror or backup MFT. In any case, it certainly found all the filename and directory data! Thanks. Dec 12, 2009 at 8:56
  • 1
    I accidentally overwrite a NTFS partition with the Linux mkswap command and TestDisk got it back for me in under a minute!! Such a great tool.
    – billc.cn
    Nov 17, 2011 at 15:27
1

I haven't tried it personally, but a fairly savvy friend of mine had good success (considering the circumstances) recovering nearly 400GB of mostly 2GB+ sized files with NTFS Undelete. It might be worth a try. Convar, the maker of PC INSPECTOR™ File Recovery, is in the business of selling their professional data recovery services -- that alone would make me distrust the software.

As for the file extension strangeness, it appears that the recovery software you are using does attempt to "guess" the file's format from the data available.

2
  • +1 for good point on Convar - in retrospect and by comparison to (at least) DGB it was pretty anemic. Maybe there are some circumstances where it would have been useful, but not this one. I did try NTFS Undelete. It may be great in its intended application (undeleting a file after you've emptied your trash), but it saw my disk as completely empty, so didn't offer a single file to recovery. I imagine the format (or whatever happened to my disk) deleted the trail left by a standard "empty trash" command. Thanks anyway. Dec 12, 2009 at 8:50
  • In case you're not dyslexic, first line above should have read: ...in retrospect and by comparison to GDB (at least) Dec 12, 2009 at 8:52
1

Or is there perhaps something better out there?

there is indeed, meet WinHex, the ultimate in computer forensics and data recovery:

Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...

Native support for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF

Built-in interpretation of RAID systems and dynamic disks

Various data recovery techniques

RAM editor, providing access to physical RAM and other processes' virtual memory

Data interpreter, knowing 20 data types

Editing data structures using templates (e.g. to repair partition table/boot sector)

Concatenating and splitting files, unifying and dividing odd and even bytes/words

Analyzing and comparing files

Particularly flexible search and replace functions

Disk cloning (under DOS with X-Ways Replica)

Drive images & backups (optionally compressed or split into 650 MB archives)

Programming interface (API) and scripting

256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, ...)

Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy

Import all clipboard formats, incl. ASCII hex values

Convert between binary, hex ASCII, Intel Hex, and Motorola S

Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)

Instant window switching. Printing. Random-number generator.

Supports files >4 GB. Very fast. Easy to use. Extensive online help.

p.s.: this is the stuff many major players in the IT and finance industry as well as law enforcement, the military and intelligence agencies all over the world swear by , check their Corporate Info.

1
  • Thanks for the suggestion. WinHex might have worked well, too - I didn't try it since GDB worked so well. Dec 12, 2009 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .