I have a 1TB NTFS single-partition non-OS hard disk drive on my Windows Server 2012 PC, about 80% full, that has gone bad after a couple years of use. The drive retains the entire (now empty) directory structure, but all the files have disappeared, at least in Windows Explorer view (except for one folder that has files, likely because it's cached somehow due to a command prompt window with current directory at that location; however, attempting to copy these files fails because Windows isn't acknowledging their presence).

Disk Management reports a healthy partition and checking drive Properties via the Computer view in Windows Explorer shows used/free space as it should, as if nothing were affected. However, some data recovery programs like Recuva fail to read the drive (although they detect it) while some others like EaseUS painstakingly scan through the entire drive just to report 0 files found. TestDisk reports "Partition: Read Error" as well as read errors on every block it attempts to read; also System Logs show a large number of warnings with the message "The IO operation at logical block address ### for Disk 1 was retried." and a few warnings with the message "The system failed to flush data to the transaction log. Corruption may occur in VolumeId: D:, DeviceName: \Device\HarddiskVolume3. (A device which does not exist was specified.)".

I haven't run chkdsk /r yet for fear of causing further damage to the drive, neither have I rebooted since the issue started. There is a rare occasional light whirring sound from the drive that lasts maybe 5 mins or so, especially when I attempt scans. I'm not sure what to do -- I don't really care for the disk as much as I do about a few select folders of <50 MB worth of data I need to salvage but am not knowledgeable enough to. I don't want to do anything intrusive to the drive (such as a chkdsk) until I can somehow make a copy of the data on the drive bit by bit to another location, lest anything were to go wrong.

Experts, assuming this is possibly an MFT corruption/bad sector issue, please can you assist with 1. While the disk is still online, what program should I use to make an image of my drive (bit-by-bit copy) to a shared network location? &, if possible, but optionally 2. What recovery program might best suit this particular use case?

P.S.: I have tried the recovery tools listed here (Recovery Data for FAT & NTFS: says "End sector should be bigger than start sector") and here (GetDataBack), as well as others listed above without success.

  • I'd run checkdsk. If that's not an option take it into an IT shop for data extraction. – ejbytes Oct 5 '16 at 4:46
  • sure, I'd like to do that @ejbytes. But I'm looking for the best way to image the disk before I do anything intrusive -- "protect before correct" :) – dreamcatcher Oct 5 '16 at 5:23

The damage is already done, not rebooting won't change anything as all the folders are empty. The drive may/may not register as a drive letter, but it is useless in its current condition.

Professional data recovery will cost a bundle but usually it they can do it.

You could try RStudio demo, it will do a full sector scan.

As far as getting your data back spinrite by grc.com has a good track record, but can take ages(real months) to run if there are a lot of bad sectors. You need an imaging software. You need a disk larger than the source to dump the target to. If you disconnect is device manager the drive you could connect a source hdd and destination, use virtualbox to boot almost any linux, then use dd to clone the sectors. Large numbers of bad sectors will slow this progress to a crawl.

  • thank you for affirming that rebooting won't make a difference; it's one more thing I know now. Will check with RStudio demo and post an update soon. – dreamcatcher Oct 5 '16 at 4:49
  • Just wanted to post a quick update -- I can't image the drive yet since R-Studio doesn't seem to accept a network share as the backup location somehow; I will try to arrange for another storage location, perhaps another local drive, tomorrow. However, I did notice something rather shocking -- when I use "Tools > View/Edit" to view the hex values on the problem drive, I see that all blocks of all sectors have the value 00 in them. Does this mean all is lost, or could this just be a side effect of the disk not being able to be read because of bad sectors? – dreamcatcher Oct 5 '16 at 6:26
  • also, attempting to scan the drive produces lots of messages like this: "Read disk D: at position 770629206016 failed after 1 attempts. The system cannot find the file specified (2)" – dreamcatcher Oct 5 '16 at 6:28
  • @dreamcatcher those are physically bad sectors. Very few programs can recover data from bad sectors. Spinrite can in some cases, but many times the data in the bad sectors are just gone. Keep in mind sectors are only 512 bytes is the standard size so losing a sector isn't that bad. A few have 4k sectors. Also if your hdd has a lot of bad sectors spinrite can take months to run. Unless you spend $1000 on a drive recovery service. – cybernard Oct 6 '16 at 2:42
  • Update: looks like I'm going to give up. Thanks everyone for your help. @cybernard, I'm marking yours as the best answer for the advice + educating me about a new tool viz. RStudio. Thanks. – dreamcatcher Oct 7 '16 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.