I had problems with two of my hard disks, one which I could deal with easily, the other, not so much so because I did not backup. If you want to know about how to scan disks for errors, or if you see a partition/drive missing in Windows, read on. If you don't, you definitely should backup data you don't want to lose anyway.
Victim 1 - ~1 year old 3TB Seagate Barracuda)
It started when I was watching an episode of The X-Files. The video froze and didn't resume until I closed the media player and started it again. I have seen this happen before and usually it means that the video file is somehow corrupt. This can be either a problem with the download/copy but it can be a sign that the disk has errors - if you see videos that you play off your hard disk freeze often, its definitely worthwhile doing a full disk scan. So I did one over-night. And since I was doing it for one, I thought I will do it for all my disks. I run Windows 10 currently (I would have run Linux but I play video games and they are still mostly Windows only). These are the steps I followed for my logical disks D:, E:, and F: (I skipped C: as you need to do it as part of boot as it is a system disk).
Victim 2 - ~6 years old 320GB Hitachi
So the D: drive I mentioned above that I scanned and didn't find any problems with? Well I hadn't actually scanned it in a long time and maybe it was so old that it didn't like a torch being shined at its dark places. One fine day, I found that D: was gone. I open up Windows Explorer, and where there was a Pictures (D:), there was nothing! As the name suggests, it had my photos, a decades worth of them. So that made me slightly sad. I am pretty religious about uploading photos to Google photos and Facebook so I do have some backup, but other than that, I only backed up my other personal files. I excluded my photos because they were about 30GB. I think I had copied them over to my external hard disk sometime back but then did other things with the external disk and deleted them. So on to recovery.
I opened up the Windows disk management service (press the Window key and type in disk, then pick Create and format hard disk partitions. It should show you all your connected hard disks, even the ones that don't have any partitions. This is what it looked like:
This is after I bought another hard disk (Disk 1) and recovered all my photos (see below). But see Disk 2 of 298GB? That was what my Pictures (D:) had changed into. A blob of Unallocated nothingness! If you search for data recovery, you will find free software. I personally am very grateful to PC Inspector File Recovery and have used it to recover photos from an camera SD card after an accidental format. But it couldn't find any logical drives in the Unallocated blob that was the 320GB hard disk now. Most recovery software I tried could see the 320GB drive, but they couldn't recover the partition. So I started searching for partition recovery software. I was pretty sure my data was intact - drives don't usually fail so completely that all data is lost forever. The problem usually is that certain critical parts of the drive become corrupt and so the operating system can't figure out what kind of logical partitions are present on the hard disk.
My search found a free tool called TestDisk. It let you choose your disk (you can figure this out by looking at the size of the disk), choose a partition type (Intel/PC is what old disks will have, newer ones could be EFI/GPT), and then lists the partitions it finds (which was nothing - the same Unallocated blob shown non-graphically as a sad empty table), and then provides a Quick Search option:
Sadly the Quick Search didn't yield any partitions and neither did an in-depth search option that was suggested after the quick one failed.
My further searching found something called MiniTool Partition Wizard. I had actually used this once to resize my logical drives and it was pretty nice. It apparently had an option to recover lost partitions and so I gave that a go. There was a Partition Recovery Wizard that let me choose my 300GB disk and then let me choose either a Quick or a Full Scan similar to TestDisk.
But sadly again neither scan was successful in recovering the partition. I had just one partition on the disk but it wasn't found. This tool recommended that if I didn't find any partitions, I should probably try Power Data Recovery free from www.powerdatarecovery.com. This turned out to be another tool from the same company, MiniTool. I started it up and chose the Lost Partition Recovery option, selected the Hitachi 320GB disk that showed up and clicked Full Scan. The Total Files Found count started going up and I got excited! Things were finally being found! So I turned in for the night happy. The next morning I got up and checked the results.
It had found everything on the drive in exactly the way I remembered it - all my folders as they had been before the blob took over! So I selected a folder and then saved it to another disk and yes(!) the photos were all there! My hunch about things being recoverable had been correct. Then I saw that I could only recovery 1GB of data for free. If I wanted to do more, I had to buy an upgrade. And it cost $70. That is a price that I could afford but I knew that if this tool could recover my files and even my folders, there should be some tool out there that can do so for free. If it had been $30, I would have paid up. I actually donated $5 to the TestDisk author because I thought what he did was cool. But $70 was about the cost of a small hard disk and I didn't want to pay that price for my not backing up data stupidity. Not just yet. I knew I could recover my photos, so I thought I will dig around a bit more and try a few more things before I ponied up.
I thought I will try gparted, a Linux partition utility, a try I created an Ubuntu 15.10 bootable USB disk again using the nice WinSetupFromUSB, booted into Ubuntu and ran gparted. But after a long scan, like TestDisk, and MiniTool Partition Wizard, gparted didn't turn up anything either. I tried testdisk on Ubuntu just for kicks but it was the same. I then tried a companion application to TestDisk called PhotoRec. It actually started recovering files from the disk but the names of the files themselves were not recovered and neither was the directory structure. I found photos that I had taken in 2006 mixed with photos I had taken a few years later all with randomly generated names in randomly generated directories. I almost gave up then and paid the $70 but slept on it.
The next day I did a final bit of searching around and found a tool called scrounge-ntfs. It is a command line tool and it needs you to input things like an MFT offset, cluster size, and the start and end sectors of the partition. I did a bit of research and found that the MFT was a table that recorded the locations of all files/directories in a partition - so if you find it you can basically find all your files, directories and their names. I gave it a go:
C:\Users\akarollil\Downloads>scrounge-ntfs -l
Start Sector End Sector Cluster Size MFT Offset
==================================================================
Drive: 0
2048 204800 8 68264
206848 486344704 8 6291456
486551552 921600 8 307200
487473152 921600 8 307200
Drive: 1
1 4294967295
Drive: 2
Drive: 3
2048 3907027119 8 6291456
This kind of told me the drive I was interested in was Drive: 2 as it was the only one that did not have a start or end sector displayed. And a Guessing Partition Info page told me what input to give to the program. So I tried d (the drive) as 2 for Drive 2, m (the MFT offset) as 32 (I didn't remember having Windows XP), c (cluster size) as 8, 63 as the start sector and since the disk size was 298.09, the last sector should be 2048 x 298.09 * 1024, so about 625139710:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 32 -c 8 -o d:\scrounge 63 625139710
[Scrounging via MFT...]
scrounge-ntfs: invalid mft record
scrounge-ntfs: couldn't read mft: No error
So that didn't work. I then tried an MFT offset of 6291456 just in case, but that didn't work either. The MFT couldn't be found. I searched around a bit again to find a way to locate the MFT but didn't get anywhere.
I then gave up on scrounge-ntfs and tried one last tool called Active Partition Recovery For Windows. It actually was much quicker than Power Data Recovery tool that I had success with previously but again though advertised as free, you actually have to pay to recover files. But I saw something interesting. The software displayed the start and end sectors for the partition that it saw and though my end sector calculation was correct, the start sector was not. I had picked 63 as recommended by the scrounge-ntfs page but it was apparently 2048.
So I tried that with scrounge-ntfs:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 32 -c 8 -o d:\scrounge 2048 625139710
[Scrounging via MFT...]
scrounge-ntfs: invalid mft record
scrounge-ntfs: couldn't read mft: No error
No luck there, then I tried the other recommended MFT offset of 6291456 without much hope:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 6291456 -c 8 -o d:\scrounge 2048 625139710
[Scrounging via MFT...]
[Processing MFT...]
\System Volume Information
\System Volume Information\Chkdsk
\System Volume Information\Chkdsk\Chkdsk20150805170834.log
\System Volume Information\Chkdsk\Chkdsk20151014173753.log
\$TxfLog.blf
\$TxfLogContainer00000000000000000001
\$TxfLogContainer00000000000000000002
\$RECYCLE.BIN
\$RECYCLE.BIN\S-1-5-21-3069350414-2868921435-653063844-1000
\$RECYCLE.BIN\S-1-5-21-3069350414-2868921435-653063844-1000\desktop.ini
\System Volume Information\tracking.log
\2 wheelers
\2 wheelers\1980 Bajaj Chetak
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_19bb383db626d517.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_2eefcc7e52095a5a.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_964fbbea532c24c1.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_b6a65d91ff1ce5ac.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_e62d1a6e72615288.jpg
\2 wheelers\1984 Suzuki GS 750E
\2 wheelers\1984 Suzuki GS 750E\00012.jpg
\2 wheelers\1984 Suzuki GS 750E\1980_GS750E-L_USleaf2_800.jpg
\2 wheelers\1984 Suzuki GS 750E\IMGP1215.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1216.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1217 - Copy.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1218 - Copy.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1219 - Copy.JPG
........
BAM! Jackpot! Nothing sweeter than to see all those files with their names and their folders getting copied from the old broken disk to the new disk that I had bought to replace it :)
So for those of you who skipped to the bottom, moral of the story: BACKUP! Get an external hard disk, or an internal one dedicated to just storing backups of things you would dearly miss if a disk fails. And disks will fail. They just will.
Victim 1 - ~1 year old 3TB Seagate Barracuda)
It started when I was watching an episode of The X-Files. The video froze and didn't resume until I closed the media player and started it again. I have seen this happen before and usually it means that the video file is somehow corrupt. This can be either a problem with the download/copy but it can be a sign that the disk has errors - if you see videos that you play off your hard disk freeze often, its definitely worthwhile doing a full disk scan. So I did one over-night. And since I was doing it for one, I thought I will do it for all my disks. I run Windows 10 currently (I would have run Linux but I play video games and they are still mostly Windows only). These are the steps I followed for my logical disks D:, E:, and F: (I skipped C: as you need to do it as part of boot as it is a system disk).
- Opened up notepad and paste the following lines
- chkdsk.exe /R /X D:
- chkdsk.exe /R /X E:
- chkdsk.exe /R /X F:
- Saved the file as diskcheck.bat in C:
- Pressed the Window key and typed in cmd, then right clicked on the Command Prompt shortcut and chose Run as Administrator
- Navigated to where I saved diskcheck.bat:
- C:
- diskcheck.bat
Victim 2 - ~6 years old 320GB Hitachi
So the D: drive I mentioned above that I scanned and didn't find any problems with? Well I hadn't actually scanned it in a long time and maybe it was so old that it didn't like a torch being shined at its dark places. One fine day, I found that D: was gone. I open up Windows Explorer, and where there was a Pictures (D:), there was nothing! As the name suggests, it had my photos, a decades worth of them. So that made me slightly sad. I am pretty religious about uploading photos to Google photos and Facebook so I do have some backup, but other than that, I only backed up my other personal files. I excluded my photos because they were about 30GB. I think I had copied them over to my external hard disk sometime back but then did other things with the external disk and deleted them. So on to recovery.
I opened up the Windows disk management service (press the Window key and type in disk, then pick Create and format hard disk partitions. It should show you all your connected hard disks, even the ones that don't have any partitions. This is what it looked like:
This is after I bought another hard disk (Disk 1) and recovered all my photos (see below). But see Disk 2 of 298GB? That was what my Pictures (D:) had changed into. A blob of Unallocated nothingness! If you search for data recovery, you will find free software. I personally am very grateful to PC Inspector File Recovery and have used it to recover photos from an camera SD card after an accidental format. But it couldn't find any logical drives in the Unallocated blob that was the 320GB hard disk now. Most recovery software I tried could see the 320GB drive, but they couldn't recover the partition. So I started searching for partition recovery software. I was pretty sure my data was intact - drives don't usually fail so completely that all data is lost forever. The problem usually is that certain critical parts of the drive become corrupt and so the operating system can't figure out what kind of logical partitions are present on the hard disk.
My search found a free tool called TestDisk. It let you choose your disk (you can figure this out by looking at the size of the disk), choose a partition type (Intel/PC is what old disks will have, newer ones could be EFI/GPT), and then lists the partitions it finds (which was nothing - the same Unallocated blob shown non-graphically as a sad empty table), and then provides a Quick Search option:
Sadly the Quick Search didn't yield any partitions and neither did an in-depth search option that was suggested after the quick one failed.
My further searching found something called MiniTool Partition Wizard. I had actually used this once to resize my logical drives and it was pretty nice. It apparently had an option to recover lost partitions and so I gave that a go. There was a Partition Recovery Wizard that let me choose my 300GB disk and then let me choose either a Quick or a Full Scan similar to TestDisk.
But sadly again neither scan was successful in recovering the partition. I had just one partition on the disk but it wasn't found. This tool recommended that if I didn't find any partitions, I should probably try Power Data Recovery free from www.powerdatarecovery.com. This turned out to be another tool from the same company, MiniTool. I started it up and chose the Lost Partition Recovery option, selected the Hitachi 320GB disk that showed up and clicked Full Scan. The Total Files Found count started going up and I got excited! Things were finally being found! So I turned in for the night happy. The next morning I got up and checked the results.
It had found everything on the drive in exactly the way I remembered it - all my folders as they had been before the blob took over! So I selected a folder and then saved it to another disk and yes(!) the photos were all there! My hunch about things being recoverable had been correct. Then I saw that I could only recovery 1GB of data for free. If I wanted to do more, I had to buy an upgrade. And it cost $70. That is a price that I could afford but I knew that if this tool could recover my files and even my folders, there should be some tool out there that can do so for free. If it had been $30, I would have paid up. I actually donated $5 to the TestDisk author because I thought what he did was cool. But $70 was about the cost of a small hard disk and I didn't want to pay that price for my not backing up data stupidity. Not just yet. I knew I could recover my photos, so I thought I will dig around a bit more and try a few more things before I ponied up.
I thought I will try gparted, a Linux partition utility, a try I created an Ubuntu 15.10 bootable USB disk again using the nice WinSetupFromUSB, booted into Ubuntu and ran gparted. But after a long scan, like TestDisk, and MiniTool Partition Wizard, gparted didn't turn up anything either. I tried testdisk on Ubuntu just for kicks but it was the same. I then tried a companion application to TestDisk called PhotoRec. It actually started recovering files from the disk but the names of the files themselves were not recovered and neither was the directory structure. I found photos that I had taken in 2006 mixed with photos I had taken a few years later all with randomly generated names in randomly generated directories. I almost gave up then and paid the $70 but slept on it.
The next day I did a final bit of searching around and found a tool called scrounge-ntfs. It is a command line tool and it needs you to input things like an MFT offset, cluster size, and the start and end sectors of the partition. I did a bit of research and found that the MFT was a table that recorded the locations of all files/directories in a partition - so if you find it you can basically find all your files, directories and their names. I gave it a go:
C:\Users\akarollil\Downloads>scrounge-ntfs -l
Start Sector End Sector Cluster Size MFT Offset
==================================================================
Drive: 0
2048 204800 8 68264
206848 486344704 8 6291456
486551552 921600 8 307200
487473152 921600 8 307200
Drive: 1
1 4294967295
Drive: 2
Drive: 3
2048 3907027119 8 6291456
This kind of told me the drive I was interested in was Drive: 2 as it was the only one that did not have a start or end sector displayed. And a Guessing Partition Info page told me what input to give to the program. So I tried d (the drive) as 2 for Drive 2, m (the MFT offset) as 32 (I didn't remember having Windows XP), c (cluster size) as 8, 63 as the start sector and since the disk size was 298.09, the last sector should be 2048 x 298.09 * 1024, so about 625139710:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 32 -c 8 -o d:\scrounge 63 625139710
[Scrounging via MFT...]
scrounge-ntfs: invalid mft record
scrounge-ntfs: couldn't read mft: No error
So that didn't work. I then tried an MFT offset of 6291456 just in case, but that didn't work either. The MFT couldn't be found. I searched around a bit again to find a way to locate the MFT but didn't get anywhere.
I then gave up on scrounge-ntfs and tried one last tool called Active Partition Recovery For Windows. It actually was much quicker than Power Data Recovery tool that I had success with previously but again though advertised as free, you actually have to pay to recover files. But I saw something interesting. The software displayed the start and end sectors for the partition that it saw and though my end sector calculation was correct, the start sector was not. I had picked 63 as recommended by the scrounge-ntfs page but it was apparently 2048.
So I tried that with scrounge-ntfs:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 32 -c 8 -o d:\scrounge 2048 625139710
[Scrounging via MFT...]
scrounge-ntfs: invalid mft record
scrounge-ntfs: couldn't read mft: No error
No luck there, then I tried the other recommended MFT offset of 6291456 without much hope:
C:\Users\akarollil\Downloads>scrounge-ntfs -d 2 -m 6291456 -c 8 -o d:\scrounge 2048 625139710
[Scrounging via MFT...]
[Processing MFT...]
\System Volume Information
\System Volume Information\Chkdsk
\System Volume Information\Chkdsk\Chkdsk20150805170834.log
\System Volume Information\Chkdsk\Chkdsk20151014173753.log
\$TxfLog.blf
\$TxfLogContainer00000000000000000001
\$TxfLogContainer00000000000000000002
\$RECYCLE.BIN
\$RECYCLE.BIN\S-1-5-21-3069350414-2868921435-653063844-1000
\$RECYCLE.BIN\S-1-5-21-3069350414-2868921435-653063844-1000\desktop.ini
\System Volume Information\tracking.log
\2 wheelers
\2 wheelers\1980 Bajaj Chetak
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_19bb383db626d517.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_2eefcc7e52095a5a.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_964fbbea532c24c1.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_b6a65d91ff1ce5ac.jpg
\2 wheelers\1980 Bajaj Chetak\bajaj-chetak-1471058_b_e62d1a6e72615288.jpg
\2 wheelers\1984 Suzuki GS 750E
\2 wheelers\1984 Suzuki GS 750E\00012.jpg
\2 wheelers\1984 Suzuki GS 750E\1980_GS750E-L_USleaf2_800.jpg
\2 wheelers\1984 Suzuki GS 750E\IMGP1215.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1216.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1217 - Copy.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1218 - Copy.JPG
\2 wheelers\1984 Suzuki GS 750E\IMGP1219 - Copy.JPG
........
BAM! Jackpot! Nothing sweeter than to see all those files with their names and their folders getting copied from the old broken disk to the new disk that I had bought to replace it :)
So for those of you who skipped to the bottom, moral of the story: BACKUP! Get an external hard disk, or an internal one dedicated to just storing backups of things you would dearly miss if a disk fails. And disks will fail. They just will.
Comments