Recovering a lost 4TB NTSF Partition.

Hardware and technical stuff
1

I have/had a 4TB HGST SATA drive in an external USB 3.0 Docking bay.
Today it stopped appearing, with loads of ntfs error messages in event viewer.
Device manager showed 100+ ‘ghosted’ Generic Volumes.

Cleaning up the ghosted devices, rebooting and starting the external HD docking bay again, the disk shows up in DiskPart, as a 4TB disk, but with 2 partitions, a 2GiB full one, and a 1.6GiB empty unfortatted. Trouble is, before everything broke, it was a 4TB partition at 97% capacity full of content.

Using TestDisk 7.1 it finds the disk with 1 Partition, the question is if you can trust it to recover this partition and thus make the files accessible again. Or if I need to ‘recover’ every single file - which usually end up giving them “File00000.bak” etc Generic file names => basically lost.

Ideas to tools that can be used or is Testdisk the best option? - Curently scanned 02%.

2

Ooof, that hurts. I wouldn’t trust mounting the partitions on the disk as read/write, which might rule out Windows.
It could be anything, the OS, the dock, or the drive (maybe even memory, motherboard…). It’s worth booting a linux disk and see what errors pop up, or another dock, but no one has spares. Maybe try another port?
As far as I recall, you’re free to change the the partition table as it’s in a reserved space, but again, don’t mount it as read/write as the OS will start writing access times and other things.

The safest advice would be to Image the whole drive to free storage space somewhere and recover from that, but free 4TB aren’t usually hanging around.

SystemrescueCD comes with a bunch of tools, but you need to figure out how to use them, but AFAIK, if TestDisk doesn’t get the files out, nothing can.

Sorry, you just can’t trust HDDs.

3

My theory is that some issue with Win10 and Intel Rapid Storage drivers hozed the disk, as before I ran W10 there were no issues… or just an unlucky coincidence.

Haven’t mounted anything in Win, just have it “found” as a disk.

So far used RawCopy to make a image, took 9 hours to do so before I noticed I forgot a switch, so had to do it all over again.

Then using TestDisk (on the disk at first, but then on the image)to see if I could find missing partitions, which finds several. I wrote one of them and then tried to repair the MFR, but it seems that both the primary and backup MFR were corrupted, or they broke when I wrote a EFI GPT parttition to the disk (it found one that covered th entire disk, which should have correct).

Running a more thorough scan for MFT now… but do not think it will work.
image

I guess tomorrow I’ll do another 9 hour copy to make a new image and try different ‘fixes’ on that one.

I suppose if I had made ‘sfv’ files for everything I could in theory have restored all the files with generic “File0000” file names, as the checksums should be different enough to identify the correct files that I could then rename. Wonder if there are some tools for that.

Would be great if backup solutions offered granular options such as MFR/GPT backup etc, instead of just ‘everyhing/files’. I suppose I could use rawcopy to take selective backups of a drive, say block 1-2048 etc, if I could identify where the information was located.

Found a .python script that supposedly should work well with recovering files, called “RecuperaBit”, so might try that one as well.

Bought a 8TB drive to clone the 4TB drive to…

Really annoying losing so much data, it was my most recent purchae and the drive that contained all my non-steam games from ca 1995 to now (migrated from system to system). But on a positive note, I no longer have to complete them :)

First time I’ve had an issue with a HGST drive, previously lost 3 WD ‘green’ drives.

Discovered a new reddit for data restoration and looking for some tips there also.

So in sum, a shitty, but learning, experience. :)

4

It seems you’re well on your way. I probably never went that deep in recovering something because, at some point, it’s was just too many files that didn’t matter enough - it did make me care more about backup of stuff that I do care about.
I’d certainly rather hoist the jolly roger than worry about keeping old stuff around.

Anyway, I still think it’s worth seeing if it’s a hardware failure in some part of the connection. Hardware fails in mysterious ways…

Good luck.

5

Found an app called “DMDE” in a comment section for file recovery, that lets you recover 4000 files for free.
Had it scan the disk-image I made earlier, and after several hours it managed to list a complete file tree, including a lot of ‘extra’ folders that I have no idea how got there (from a windows installation)…

Anyway, tried it out and it seems to work, so I paid 16$ for a 1-year-1-OS license and recovering files as we speak :) - So far gotten about 400GB back in proper folder/file names.

Hopefully I can get back all my old documents/pictures etc, the games will be just a bonus. Even just having the list without paying anything was a help as I couldn’t remember all I had on the drive.

6

I once had to buy something called iSkySoft Data Recovery for like $100 to recover some old photos from an external drive where the partition failed.

The entire process felt like i was being taken for a ride or willingly signing up for some EE scam software, and it was one of many many generic partition managers that you’ve never heard from and lure you in and then charge you an arm and a leg. And i can’t say for sure if what it did was particularly easy or hard with the right knowledge/toolset (i did try Disk Utility and i’ve long ago lost my external Linux boot disks.)

But i did get all my photos back.

7

Yea, if I wanted just pictures or something I’d probably have used PhotoRec and gotten random file names back, but for complete folder structures I guess this was the only option left; except for running a Unix OS where I could’ve used another tool that probably would do the same. I found a bunch of tools that promised to restore files with ToyUI™ meant to mislead users into thinking they’re working, a lot of them were in the near 100$ range.

What is interesting is that according to DMDE, the partition is mostly intact, and, since it manages to repair it, surely it should’ve been possible to rewrite the missing boot-mfg-partition information to create a fully working partition that windows could access, instead of having to go through this.

Another interesting thing is that according to SMART information, there were no errors on the disk, which leads me to believe that some rogue element in Win8.1 or Win10 ruined it by mistake - or possibly during shutdown. A lot of threads spoke of a 2TB limit with Intel storage drivers, so it could’ve been those at fault. And it seems plausible in that after bootup when the drive was gone, it showed up as a 2TB/1.6TB partitions… the only OS where those were installed recently was Win10 (as I’ve had the drivers running for years on Win8.1 already). But even Win10 shouldn’t have installed old drivers with a 32-bit issue (esp under 64-bit OS) so… who knows.

The restore progress takes forever, and one downside to this is that I moved my computer to my bedroom a while ago… but it will be impossible to sleep with this thing running, luckily DMDE lets you save a filelist that it can access next time without having to scan the image all over again.

Anyway for this restoration journey I used:

TestDisk wasn’t involved in the recovery process though, I just ran it several times to try and find information that it couldn’t find, which DMDE found “easily”. But that could just be because I didn’t know how the tool worked properly.

With a linux unstallation I’d probably have run DD for the image work, then RecuperaBit (Which runs under Python).

  • Managed to restore 1GB of video from the AQ opening in World of Warcraft, a philips tv calibration guide and a HTML verison of Anna Karenina, well worth the 16$ for that software to get all these random files back… :D
8

Well, Win10 trashing partitions is not unheard of at all.

9

Happened again today.

So happy with Windows 10.

If G-sync on Freesync worked in 8.1 I’d go back. Even without DX12.