3

Yesterday I booted my XP system, and as I looked up a minute later I saw the light blue screen and tail-end of that pre-boot diskcheck Windows sometimes does if it finds an error (or was previously told to run a diskcheck drung the next boot). I didn't worry about it at the moment...

But then I looked at my "scratch" disk, which was a 70% full, 750GB hard disk...and it now looks like it has been freshly formatted. It doesn't have a single file on it, just the hidden "System Volume Information" file and 750GB of freedom from data.

I looked at some of the recovery tools from the Free NTFS partition recovery question and decided to try PC INSPECTOR™ File Recovery 4.x initially. It ran overnight and afterwards returned a list of thousands of files it could recover. The odd thing was that the filenames were lost, but the file extensions were not (WTF?). And all of the files were exactly 1,472kB in size. I recovered a dozen PDFs as a test, and 80% of them displayed OK despite being padded out to 1.5MB (though I assume any files > 1472kB are hosed).

My primary question is: Is this the best I can expect from any file recovery software when trying to recover NTFS files? Or is there perhaps something better out there? I assume this is as good as it gets, but wanted to check in with the experts first.

Bonus questions:

  1. What might have happened to my drive? I didn't intentionally format it. I've never seen a disk error cause the drive to suddenly become a clean, reformatted drive. Could some malicious/confused software have told my PC to format my disk on reboot? Is that even a function Windows XP has?
  2. Why can the file extensions be recovered but not the filename? Does NTFS really treat them as separate entities? I thought I had 8.3 naming turned off, but maybe that had something to do with it. Or maybe it looks at the data in the file and guesses the extension?
Community
  • 1
Fred Hamilton
  • 2,280

4 Answers4

4

on a 750Gb drive, GetDataBack will take an age, but is one of the best out there.

a drive i work with recently lost it's entire partition table for no explicable reason. GDB did a pretty good job of recovering it after several other progs failed.

geocoin
  • 1,066
3

Although the Master File Table (MFT) is corrupted, your disk may contain an MFT mirror which might still contain the lost file data.

TestDisk is open-source software and is advertised as capable of :

Fix MFT using MFT mirror

As this is a partition problem, I would hope that such a partition-oriented recovery product may prove more successful than the file-oriented PC INSPECTOR.

harrymc
  • 498,455
1

I haven't tried it personally, but a fairly savvy friend of mine had good success (considering the circumstances) recovering nearly 400GB of mostly 2GB+ sized files with NTFS Undelete. It might be worth a try. Convar, the maker of PC INSPECTOR™ File Recovery, is in the business of selling their professional data recovery services -- that alone would make me distrust the software.

As for the file extension strangeness, it appears that the recovery software you are using does attempt to "guess" the file's format from the data available.

Kenneth Murphy
  • 343
1

Or is there perhaps something better out there?

there is indeed, meet WinHex, the ultimate in computer forensics and data recovery:

Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...

Native support for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF

Built-in interpretation of RAID systems and dynamic disks

Various data recovery techniques

RAM editor, providing access to physical RAM and other processes' virtual memory

Data interpreter, knowing 20 data types

Editing data structures using templates (e.g. to repair partition table/boot sector)

Concatenating and splitting files, unifying and dividing odd and even bytes/words

Analyzing and comparing files

Particularly flexible search and replace functions

Disk cloning (under DOS with X-Ways Replica)

Drive images & backups (optionally compressed or split into 650 MB archives)

Programming interface (API) and scripting

256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, ...)

Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy

Import all clipboard formats, incl. ASCII hex values

Convert between binary, hex ASCII, Intel Hex, and Motorola S

Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)

Instant window switching. Printing. Random-number generator.

Supports files >4 GB. Very fast. Easy to use. Extensive online help.

p.s.: this is the stuff many major players in the IT and finance industry as well as law enforcement, the military and intelligence agencies all over the world swear by , check their Corporate Info.