External HDD Restoration

[PJ_in_FL]

Well, I've finally gotten off all the files I could from an external 500GB HDD. I've recovered 346,774,970,368 bytes of files of 420,759,625,728 bytes used on the HDD, so I'm only missing 74 GB or so. Now for the next step, I'd like to solicit some advice from the others who may have experience with this before blindly stumbling on.

The situation: I have a white-box running XP SP3. After shutting down yesterday while some of Florida's famous thunderstorms rolled through, I rebooted the PC. My explorer of choice, xplorer2, threw the following alert:

Code: Select all

Event ID = 26
Description = Application popup: xplorer2_UC.exe - Corrupt File : The file or directory F:\$Mft is corrupt and unreadable. Please run the Chkdsk utility. 

After googling what the heck that meant I stopped doing anything that would write to F: and started copying files off the HDD. I backed up all the files that could be copied by using standard Windows copy within xplorer2, which logs the errors but continues copying, and got the files onto another external HDD.

Ran CHKDSK /I F: and received about 60 of these ...

Code: Select all

Deleting corrupt attribute record (128, "")
from file record segment 373930.

... and about 1500 of these ...

Code: Select all

Deleting orphan file record segment 376728.

... before CHKDSK stopped with ...

Code: Select all

Errors found. CHKDSK cannot continue in read-only mode.

I purposely did not use options /F or /R for CHKDSK as I'm still in discovery mode and don't want to muck things up more than they already are.

For what it's worth, FSUTIL DIRTY QUERY F: also returned that F: is dirty.

Which sums up where I am now.

My questions are:

1. Will running another file recovery program like RECVUA, PartedMagic or Easus Data Recovery be worth the time spent to try to get some more of the file off the drive before moving on to trying to correct the corrupt $MFT file? Perhaps the obvious answer of "It can't hurt" is the answer, but I don't have enough additional storage to save duplicates of the 340 odd gigabytes already saved. Perhaps if there's a method to copy only files that haven't already been copied, then it may make sense to give it a try.

Although I'd like to recover as much as possible, I also need to finish this and move on in a reasonable time, thus my desire to get some feedback.

2. Does anyone have comments or experience using TESTDISK from http://www.cgsecurity.org? It proclaims it can fix the $MFT using the mirror $MFT. Anyone actually use it or another utility successfully?

Thanks in advance for reading this, and for any suggestions offered.

[StuartR]

I have had very good results with RECUVA.

If you have a copy of Acronis True Image, or similar, you could create a sector-by-sector backup before you do anything else. This would enable you to restore the disk to its current state if you make things worse.

[PJ_in_FL]

Stuart,

Thanks for the input. I had originally dismissed trying to create an image as I am running low of spare terabyte drives (when I say that it's almost feels like I'm saying "Scotty, arm the photon torpedoes!"), but your note caused me to reconsider. Sure glad Office Max had a sale on 1TB HDD's on Black Friday!

After locating a HDD that I could clean enough off to get 500 GB or so free, I'm using Macrium Refection to create a full image backup with "Intelligent Copy" turned off so the entire drive is include in the image. That should complete by tomorrow morning, then I'll start up RECUVA and see what I can do with that.

I would still be interested in opinions or war stories concerning the restoration process after all the file recovery options are exhausted -- to CHKDSK /R or not, TESTDISK or not, or both, or something else.

Call now. The lines are open!

[Argus]

Since you now have more space, one other option is try PC INSPECTOR File Recovery, though it might take some time to finish. I didn't mention that one since it could mean that you would get copies of things already recovered, and being low on space you didn't want that. It has been used with quite some success at different times.
http://www.pcinspector.de/Default.htm?language=1" onclick="window.open(this.href);return false;

My copy of Easeus Partition Master also has some partition recovery that can work with individual files etc. Don't know if it's the same as the "Data Recovery" you mentioned.

I know that TestDisk has also been included in the Ultimate boot CD, but I have never used it. It uses the backup boot sector, or the MFT mirror, and if different it can restore the backup. I don't know how successful it is, but if you have recovered all, it might be worth a "test".
Here is some comments on TestDisk, don't know if you have seen them:
http://www.pcstats.com/articleview.cfm? ... 139&page=8" onclick="window.open(this.href);return false;

It is possible that CHKDSK perhaps can repair the MFT if you run it in non-write protected mode, once you have recovered all files or cloned the partition as you whish. I would try that before any third-party tools, and use CHKDSK via the Recovery Console (remember that it uses /P and /R, instead of /F and /R as in the command prompt; and as you probably know /R implies /F or /P). On the other hand, since not the system drive, and if all files are recovered, why not format the partition, since time also was important.

[PJ_in_FL]

Thanks for all the feedback and suggestions!

Sorry for the delay responding. Yesterday was a full day of thunderstorms and tornadoes in central Florida, so everything was unplugged for safety.

I'll be posting the complete process I've used in case someone else finds it helpful.

I did make a full image backup using Macrium Reflect, then recovered all the files I'll probably want off the drive that didn't copy off in my original file-by-file copy.

Turns out I had many, many files from old HDD back-ups that needed to be lost (old \WINDOWS, \INTERNET\TEMP, etc. folders). RECUVA was helpful, if a bit awkward to use unless you let it scan the entire drive.

Now I'm off to solve another "windows" problem - a broken window pane yesterday. Didn't happen during all the storms, but after the storms passed. Did I ever tell you the one about the neighbor and her tiki torch? It was a "smashing" failure.

Thanks again for the suggestions and advise!

Oh, and the Better Half has a virus on her Win 7 laptop! Google click-hijacker that also disables MSE. <Sheesh>

Will start another topic about that later!