?
Solved

Hard drive data is not visible in windows explorer - MFT or Data recovery?

Posted on 2011-10-08
18
Medium Priority
?
1,096 Views
Last Modified: 2012-05-12
Setup: 1TB Sata Hard Drive, Sata-usb adapter, Laptop running Win XPSP3.
Data: Hi Res images, log files. Approx 850GB of data.
Available resources: Win7 & Server 2k8 virtual machines, blank cds & burning software for making linux rescue cd (if that turns out to be a possible solution)

Problem:

Hi Guys, hope you can help.

I have a 1TB external hdd, which I think may have got over heated. I removed the hdd from its enclosure and connected it to my laptop using a usb adapter.

Key point: The hdd can be mounted, and browsed in windows explorer, but only the recycle bin shows. However, in Disk Management in Computer Management, the drive is showing as having only 6% of free space.

So, I'm assuming that the data is still there on the hdd, but is not showing in windows explorer owing to some problem with the MFT.

Testdisk: Tried this program. Unfortunately, the mft and its mirror were detected as being fine, without any problems or differences between the two. So from that, I'm guessing that:

-The data is still there on the hard drive, but marked as available to be overwritten
-The data is fairly likely to be undamaged/recoverable
-The MFT has been somehow corrupted and overwritten

Other software I've tried:
VirtualLab Client 6 - This can 'see' the data (mixture of NTFS and FAT) but the scan has been running for 3 days, still hasn't finished and will cost me $240 if the scan actually finishes and shows a realistic chance of recovering the data. The estimated time countdown will go down to 5 or 7 hours and then go back up to 29 hours!! End users are starting to chase me for the data so I think I will have to give up on this software. The software is good, but not $240 good!

Recover My Files v.4 - Can see the hdd, but won't let me select it to start a scan, has red err msg saying no readable media, even though Windows can mount the drive.

I read another question on EE about data recovery & MFT, which initially was about rebuilding the MFT but ended in an argument when the guy asking the question suggested not giving the points after he found a data recovery software himself. A bit unfortunate, but a useful reminder on phrasing questions carefully and of course, treating Experts with the high respect that they deserve.

Question
Okay, so given my scenario, I am hoping you can clarify the best approach to take. I understand that in some cases it isn't possible to rebuild/restore a MFT. Perhaps that may not even be most relevant to my primary need - to recover the data from that hard drive?

Can you possibly advise/recommend a data recovery software that has a good chance of scanning and recovering 1TB of data within 24-72 hours and runs on Windows XP, 7 or 2k8.
I'm looking for a software with/without a gui that will scan the hdd reliably, and then recover the data. Happy to pay for the software if it does the job, but obviously some of them out there are very expensive. Hoping you can help me hit the middle ground!

Many thanks in advance Experts, look forward to hearing from you :)
0
Comment
Question by:ammartahir1978
  • 8
  • 4
  • 3
  • +2
18 Comments
 
LVL 88

Accepted Solution

by:
rindi earned 2000 total points
ID: 36935968
The best tool I've used for similar issues was runtime's getdataback. Try that to scan the disk. As far as I know it is also less expensive than the other tool you tried:

http://runtime.org

Something else I'd suggest is to attach the disk directly to a desktop PC, not via USB, as the scans should then be faster.
0
 

Author Comment

by:ammartahir1978
ID: 36935977
Thanks rindi.

Getdataback - I had a look on their web site - it has got different download links for ntfs and fat. Thing is, this hdd has both types of files. Which one should I try - ntfs?
0
 
LVL 22

Expert Comment

by:chakko
ID: 36936022
I would just like to add that the GetDataBack (very great program) is also pretty slow too during the initial scan of the drive.  And as Rindi suggested I would put the disk into a computer since USB will slow it down

I have had good results with Active undelete also and it scans the disk much faster.
If the GetDataBack is going to take a long time then you might want to try the Active product.  If it can't see the data then follow up with GetDataBack
http://www.active-undelete.com/
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 88

Expert Comment

by:rindi
ID: 36936060
Are you sure you had both types of file-systems on the disk? When you mounted it in Windows explorer, where you saw the recycle bin, what file-system does it show in there under disk management? Is it possible that when you mounted it in windows that the OS re reformatted the disk?

The problem is that without knowing what it was originally formatted as it is difficult to say what file system had been used. Generally if you bought the disk formatted, and you didn't change anything with the format at that time, it'll likely have been fat32 as that file-system can be easily used by more OS's. NTFS was only usable for Windows NT type OS's for a long time, while Fat32 could be used by OSX and Linux etc. On the other hand if you saved files that are larger than 4GB on that drive, then it'll likely have been using NTFS, as you can't save files above 4GB size on Fat32. So based on that you should choose the GDB version you'll try first.

0
 

Author Comment

by:ammartahir1978
ID: 36936099
Thanks guys.
The hdd was formatted in ntfs when we originally put it on our network. It was used by designers who would store their hi res images on it. They work off macs. The VirtualLabs software scan showed ntfs and fat files on there.

I had a look on the product info, fat looked too basic so I went for the ntfs version. Got the license key and about to download the sw. Contemplating whether to run the scan connected to usb now or connect the hdd to the desktop sata bus as you suggested when I get back to the office on Monday (I'm connected to it remotely).  In your experience, how long roughly has 500gb/i1tb taken when connected to desktop sata bus?
0
 
LVL 88

Expert Comment

by:rindi
ID: 36936134
I haven't needed to scan drives of that size yet so I can't say.
0
 
LVL 22

Expert Comment

by:chakko
ID: 36936156
If your connected remotely and can start the scan via USB then I would do that.  You can see the results via remote connection before you get into the office.  I would guess a few hours?  Last time I used it was on a 140GB partition on an old server with SCSI disks.  That took over an hour to do a scan I think.
0
 

Expert Comment

by:BigMick63
ID: 36936335
You could also try SpinRite from www.grc.com
GREAT program.
Has saved me a couple of times!
0
 

Author Comment

by:ammartahir1978
ID: 36936512
Thanks Mick, Chakko & Rindi. Just give you a heads up, Windows stopped seing the drive, neither can getdataback. I've tried rebooting, rescan disks (disk mgmt) & scan for hw changes (device mgr) but no joy. I'm going to have to carry on with this on Monday. Sorry for the wait, will keep you guys posted. Thanks for all your advice, appreciate it.
0
 

Expert Comment

by:BigMick63
ID: 36936527
I've had them do the same thing and was able to recover them with SpinRite!
0
 
LVL 22

Expert Comment

by:chakko
ID: 36936763
I will second the mention of Spinrite.  It may get the disk working enough to get the data off of it.

Spinrite (from www.grc.com) will take a long time though.  For a 1 TB disk on level 2, it may take 1/2 a day or more.  If there are a lot of bad sectors (for example) it could longer to process the disk.  If you decide to use it then you can let it run for a while and if it will take too long, you can stop it during the process.  Then check if the disk is any better.  You can restart Spinrite where you left off (you specify where it should start from) if you need to.

If that data is really important then the last resort is a data recovery company, but it will probably take a couple of days and could be a little expensive.
0
 
LVL 5

Expert Comment

by:GirardAndrew
ID: 36936779
Hi ammartahir1978,

I know the feeling of losing data. I don't trust enclosures anymore.

I was able to recover the data using only one software, Paragon (http://www.paragon-software.com). It really works but it took hours to recover the data. It was worth the wait though.

I hope you get your data back.

Regards,
GirardAndrew
0
 

Author Comment

by:ammartahir1978
ID: 36940995
Hi Guys. Sorry for the delay. I've got gdb scan running now. After reconnecting the hdd the os and app can now see it. It's extracting found MFT's (1% done) and I can see the filenames of some of the log files I had on there so, fingers crossed!
0
 

Author Comment

by:ammartahir1978
ID: 36941897
Hi Guys. This is one for gdb support, but I thought I'd pick your brains as well . Again.

So about 12% into the 'extracting found MFTs' scan, I'm getting an error msg from gdb saying that it's unable to read certain bad sectors on the hdd. I was thinking to try windows chkdsk /f but I'm worried that this will write data to the hdd which will make the problem worse. What do you reckon?
0
 
LVL 88

Expert Comment

by:rindi
ID: 36941932
chkdsk will probably not run, you need a driveletter for that.

You should rather run the HD manufacturer's diagnostic on it. It'll tell you the state it is in, and sometimes when the errors it finds aren't too bad or too many it will also offer to repair them. After that you could scan with GDB again.

You'll find the manufacturer's diagnostics on the UBCD:

http://ultimatebootcd.com

Another tool you could try is what has already been suggested, spinrite (but I prefer another tool, it seems better and cheaper, the Hard Disk Regenerator):

http://dposoft.com

This tool can revive bad sectors on the disk and doesn't do any harm. But also here, depending on the disk size and errors it finds, it can take very long.
0
 

Author Comment

by:ammartahir1978
ID: 36943544
Thanks Rindi, Girard & All of you, appreciate the great tips. Scan is still running, I'll keep you posted asap.
0
 

Author Comment

by:ammartahir1978
ID: 36998570
Hi Guys. Many thanks for all your help. After a few days, finally mission accomplished. Used getdataback and I got my data back!

Rindi, Chakko, Mick & Girard - Thank you so much for all your replies with very useful tips.
0
 

Author Closing Comment

by:ammartahir1978
ID: 37308334
Thanks Rindi for solution & advice. GDB worked great.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A look at what happened in the Verizon cloud breach.
"Any files you do not have backed up in at least two [other] places are files you do not care about."
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question