1

Windows 7 Chkdsk searched my flash drive for bad sector recovery, and it deleted hundreds of my most important folder and files. unfortunately I have not any new backup from them.

The file system is NTFS.

Using R-studio Recovery tool, I found 112GB files from the 16GB flash drive with ~5GB used space. Recovered files doesn't include their path (and their names). between those recovered files, there are multiple copies of most of files and some previously deleted files are also found in there, some corrupted and some healthy.

I hope to find almost all lost files in there, but organizing these huge number of files, manually, without their name and path is not just pain, but it is also not possible.

Unfortunately there is not much of my lost files in the found.000, in the root of chkdsk-ed partition, just about 30 of them.

But when I looked at chkdsk log file, there seems that all of them recorded. Most interesting information in the log file, are entries from 3 types, example entries of first type of are such as:

Deleting orphan file record segment 20386.

and the numbers varies for each entry, sorted but they are not in a row.

second series of entries are in the format of:

The object id index entry in file 0x19 points to file 0x4bce
but the file has no object id in it.

here also just the second hex number at the end of line one, changes in the series of the entries.

And the last series of entry, include names of files and folders and some index number and file hex address, example of them provided here:

Index entry Release of index $I30 in file 0x3b2a points to unused file 0x4bce.
Deleting index entry Release in index $I30 of file 15146.

Release is the name one of lost folders, 15146 is the Decimal representation of 0x3b2a. Other entries include name of one file or folder. There is not matches for all of entries in part 2 and 3, but some of them matches like above examples.

Interestingly, the Recovery tool (R-Studio), named those recovered files to numbers in 3-5 digits, I was hopping that this numbers to match to the numbers in log entries, in somehow...

Points in the question:

  • How could I recover deleted file entries after windows chkdsk in NTFS partition with their path(or atleast their name), using information provided in generated log file?
  • Is there sufficient information to recover them? like NTFS journal or chkdsk log?
  • I can and I'm ready to write an application for this purpose, if needed. but I don't know where should I start and what that program should do to recover the lost files.
  • You're disk/file-system was corrupted, Chkdsk did it's best to recover what it could. There's no way for the computer to know what the index looked like before it was damaged and before Chkdsk corrected/recreated it; if it could then it'd have been able to find the parents of the orphans during the disk check. Basically AFAIK you're out of luck; pick stuff out by hand and take it as lesson learned: make backups, and don't run chkdsk without having one (unless you don't care about the data). – Ƭᴇcʜιᴇ007 May 19 '15 at 19:08
  • 1
    Look at R-Studio's log file (if it created one or you allowed it to do so). It may have information that can match the numbering it uses to the information in the chkdsk log. There might be other data recovery programs that can do a better job recovering the files with their original paths, but that would be a question for softwarerecs.stackexchange.com. – Karan May 19 '15 at 19:22
  • the log file doesn't exist, it's a scan session information with .sch extension and binary style data in it. Thanks for trying to help anyway. – 2i3r May 19 '15 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.