NTFS Data Recovery from Hard Drive

Hi Everyone, OK - I had some computer problems recently (I think caused by a defective Seagate 1.5TB drive (failed badly)). I also have a 500GB IDE hard drive divided into 4 partitions (which appears to be working fine (no clicking or smoke). Somehow the partitions disappeared on the 500GB, I managed to recover two using Partition Commander 10. However the two others are showing as unallocated space and RAW. I have run every file recovery software program I could find from TestDisk to Recuva etc. none of which seem to "see" any data on the missing partitions. When running TestDisk it shows lots of partitions including one for Macs! I have not formatted or saved or defragmented etc. so I believe the data should still be there. I run a dual boot system XP and Vista (neither system restore worked). I therefore have the following questions… What could have caused this situation? Why could I recover two but not all the partitions? Why does the recovery software not see any files? Is there a way to rebuild the two damaged partitions (I was thinking of a quick format) to better facilitate the file recovery process? Could this be a problem with heads and sectors? All of my "IT" friends are claiming ignorance of MFT's, Partition Tables and file recovery (including putting the 1.5TB hard drive in the freezer and recovering 100% of the lost data (worked like a charm)) so I am hoping someone may be able to help via the interweb!

Wow.. I just spent a half hour typing up an in depth article for you just to have it disappear on me.

I will attempt to type up everything again a second time, which is absolutely ridiculous.

The proper way to perform a data recovery procedure is to first clone the hard drive to another drive. You do this because if you make a mistake on the drive you are only working on the cloned data and not on the original. You can re-cloan and start again. The second reason you want to clone is because if the questionable drive has bad sectors it can make it nearly impossible to "repair" any partitions or file systems, and also make it very difficult just to extract the data. By cloning the drive you can take the bad sectors out of the picture and get the data off the drive as quickly as possible before you lose any more data.

The program I use to clone a hard drive is called DiskPatch. It is likely the best investment in software I have ever made. DiskPatch is designed to quickly clone a drive, skipping bad sectors efficiently and effectively, to get the data off the drive before any more is lost. You will need a second hard drive of equal or larger size in order to clone the data to.

Its imperative that you perform a surface scan on this hard drive in order to make sure that it is not failing from bad sectors. Becasue your drive "suddenly" acted up, it is likely that there are bad sectors at the root of it. The best program ever created, by far, to scan for, and recover from, bad sectors is called SpinRite. It is able to scan the entire drive, regardless of its current condition, and allow you to ensure that there are no bad sectors, or lock out bad sectors if they are found. More than a few and the drive is bad. Replace it.

Now, I am going to assume that this is not mission critical data. I am going to assume that it is only "convenience" data. It would be convenient if you could get the data off the drive. Therefore, you probably don't want to buy another 500Gb HD, DiskPatch, SpinRite, and the next program I am about to tell you about.

It is likely that you already did too much damage to the drive to actually recover your original partitions. Remember, every time you make changes to the drive you reduce your chances of being able to recover any data from the drive.

There is a program called FileScavenger that I have had nearly 100% success with in recovering data. It will not repair your partitions, but it can access any part of the file system that is still intact, and even scan the RAW data of your hard drive rebuilding files such as documents, pictures, and music. When you use FileScavenger you will want to tell it to do a long scan on the specific drive causing you problems. It will give you options to scan valid partitions and drive letters such as C:, D:, E:, but it will also list Drive0, Drive1, etc. You will want to scan the entire drive looking for your data. I believe they have a demo you can try to prove to yourself if it can find and recover the data you are looking for. If there are bad sectors, FileScavenger will have trouble and report errors to you. (Read errors on certain sectors = bad sectors)

Regardless of what you do to get the data off the drive, you will want to make sure you perform the surface scan on the hard drive, or it could continue to give you problems or fail all together in the near future. Once the data is off the drive, you can repartition, and reformat the hard drive. You can then use the built in Windows "chkdsk" command in order to scan the hard drive for bad sectors. You will need to issue the chkdsk /r command on all drive letters corresponding with each partition of the questionable drive. Be patient while chkdsk scans the drive for bad clusters (a group of sectors), and keep your eye open for "Windows replacing bad clusters." More than a few of these and you can be nearly certain the drive is failing. Time to see if it has a warranty.

Remember, you should not be experimenting on this drive such as you have if you have any critical data on this drive. It should be taken to a place that has the necessary software, tools, and experience to get the data off the drive without doing more damage. Although, I would be careful, as I doubt most local computer shops would meet the above criteria.

Using the programs I mentioned above, I have been nearly 100% successful recovering important data including drives that have thousands upon thousands of bad sectors and are completely trashed.

If you have any questions, please feel welcome to ask.

My original post was much better but there is something about trying to type the same thing twice!

Cheers for answering so quickly! I am running File Scavenger now but I am doubtful of any useful results (I think I will have the same problems I had with Recuva, Getdataback, Recover My Files, Zero Assumption Recovery etc. etc.). Data is not critical - just movies and music. So I have time to investigate and try and resolve the problem - you only learn how things work once they are broken! My friends in IT's usual response is "it sounds screw-ed" "buy a new one" (I think of them a medieval surgeons… they have a "chop the arm off" mentality). I am sure there are others out there who would just reformat the drive or throw it out but from what I have read it does seem possible to reconstitute the partitions (in similar scenarios) but I am very wary of anything that may damage the data. What I find really unusual is that all the recovery programs don't work (see any files). I am fairly certain whatever happened did not damage 200Gb of hard disk (especially as I was able to recover two partitions). Would a quick format help ie. by re-establishing the partitions as NTFS (I understand a quick format does not overwrite any data just clears the MFT etc.)?

File Scavenger has just hit 38% and found files from the already recovered partitions - as suspected it did not find any files in the "missing" partitions. Once File Scavenger is complete I will attempt a cloning of the Raw partition (Raw recovery software has not worked) which makes me doubtful cloning will help. Just as a note (clarification) some of the recovery software has found parts of files (unplayable, strange sizes etc.) but not recovered anything close to the 200Gb that is missing. The fact that some data is still on the drive makes me think it should all be there but it is not being seen by my OS's or any specialist software. Which begs the question "what has happened to cause this"? MFT? LDM? Partition table? Combination of the above?

Apologies - File Scavenger worked for 8x videos from one of the missing partitions!! But did not see anymore (well over two hundred). So I can say with confidence the data is still there otherwise at the very least it would be corrupted as per the previous file recovery programs. What is causing them not to see all the files?????

Formating, whether quick or full will damage files. The general rule when attempting to recover lost file data is to allow "as little as possible" activity on the drive you wish to recover. Even opening an Office application risks overwriting disk space that "appears to Windows" as free or unallocated space, but may actually be the location of one or part of the files you wish to recover. It is "essential" that you run your recovery application from a different drive, and not from the same drive that you wish to recover from. Same reasoning as above.

Well, I hate to say it.. But if you have told FileScavenger to do a long search on Drive1 or whatever, and told it to include deleted files, it will find those files if they are there. It may not recover the whole thing, but they will show up because all it needs to do is recognize a small header in the file that identifies it as a music file, video file, word document, etc. If FileScavenger is not finding it. That's it. There isn't anything more you can do. Sorry. You must have already overwritten the data.

The files that I have recovered (avi's) between 600-700mb are perfect (the filenames were not there but that is an easy fix). Why did File Scavenger find these when other recovery software didn't? Also to overwrite 200Gb of data takes some time - it is much quicker for the MFT to be corrupted/overwritten which is what I believe happened. Files can be recovered post-format which makes me believe that is not the issue. If I had "saved" files over the drive surely they would show up when running the recovery software. What can partially corrupt 200Gb over two partitions?

Its hard for me to tell you what happened. I can only speak from my own experience with FileScavenger, knowing how it works for the most part. If the data is on the drive, anywhere, it will recognize it. It just may not be able to rebuild the entire file. So, at the very least, the file would show up. However, have you verified that the "Unknown" files and folders are not your data? FileScavenger always locates "Unknown" files when it has no filename or folder name information available.

Thats about all I can say. What you say about it taking a while to overwrite that data is correct. And, to be honest, it doesn' t make a whole lot of sense that you wouldn't have known something was going on during that time period. File table and partition table corruption is the most likely cause. However, again, FileScavenger works in such a way, to where if the data was there, it would make sense to me that it would at least identify there was a file, even if it couldn't tell you the name, location, or be able to recover the entire file.

The file table is like a map to where your important data resides physically on the hard drive. If the file table becomes corrupted, the O/S no longer knows where the file is located, although it is still physically on the drive. The problem here is that when a file is "fragmented," portions of it are broken up in different locations on the drive. The file table is what stores those different locations and allows the O/S to piece the file back together when you need it. File scavenger, I believe, can even attempt to recover files that are fragmented by determining what portions of data go with what file. But, a fragmented file is MUCH LESS likely to be able to be recovered if the file system is corrupted. Movie files, 600-700Mb are very likely fragmented if the drive was fairly full. Large files like this are the most unlikely files that you will recover.

That is why these programs work well with critical data like pictures, and documents, because those files are often small, not effected by bad sectors located close by, and not fragmented. But, for large files like movies it is much less likely that you will be able to recover them. Hopefully, these movies are not videos of your baby children growing up. Which would be a shame.

I'm sorry that I don't have anything else to suggest. I can assure you that the programs I mentioned are amongst some of the best, and work miracles. I am almost always successful recovering important data using those tools. But, the circumstances of your problem are not clear, and it is hard to say what kind of damage was created here. If a program like FileScavenger, and many others that you have tried, are unable to locate files on the drive, they probably aren't there. Possibly, whatever caused the file/partition table corruption also overwrote those files when you did not know anything was going on. Privacy programs, and other "drive scrubber" programs are notorious for causing these kinds of problems when they attempt to "remove" old deleted data but mistakingly, or by bug, overwrite good files.

Also, as Doug mentioned, but I already assumed you knew. THe drive needs to be a slave in a working computer, and the recovered files need to be placed on an alternative drive. If you are attempting to recover the data on an active, booted drive, or are trying to recover the files back to the same drive you are trying to located them on you have probably destroyed your data that way. From your "language" in the previous posts I received the feeling that you already had your drive hooked up like this. I hope that is the case. My original post, before it got erase mentioned this. I'm not sure if my second post did.