Source
r/datarecovery•
amedeus

Is there any recovery software that grabs everything regardless of whether the paths are intact - like PhotoRec - but still organizes what it's able to into the original file structures?

I made a ddrescue drive image of an NTFS HDD, then used ddrutility to see which files and folders have issues. I'm lucky, most of what falls in the unrecoverable spots is easily expendable, but a few folders popped up that aren't.

ddrutility's wiki tells me that the files in those folders are likely still recoverable, but that something like TestDisk wouldn't be able to find them. On the other hand, I was recommended PhotoRec and found that while it seemingly pulls everything regardless of the folders, the original names and file structure are fully gone from the output. For 820gb of files. I'd have to check every file to see if they're one of the relatively few I'm missing.

Is there something that dives through everything like PhotoRec, but still arranges things in their proper folders with their proper names whenever possible? Then I could just sift through what remains for what I need.

Posted May 10, 2022, 8:34 PM UTC · edited

39
seven-ooo-seven•

For example ReclaiMe does file system and RAW (photorec type) scan. If it finds a file via both file system and RAW scan, it removes the RAW result. So in effect you'll have each file that can't be 'connected' to the file system under RAW results. I think you have a similar selection method in R-Studio too where you can skip RAW files that were already included in the virtual file system.

You could also consider the scenario that resulted in the data loss. For example you formatted an NTFS drive then you can assume that close to 100% is recoverable using a file system reconstruction (assuming non TRIM hard drive), and you can safely ignore all RAW results.

3
amedeusOP•

Thanks for the reply. There was a blue screen which resulted in the HDD no longer booting, and neither startup repair nor chkdsk could fix it. ddrescue was able to pull 99.99% of the HDD, however, so it sounds like maybe file system reconstruction could work here. Would you still recommend ReclaiMe / R-Studio for that? Any preference between the two, if so?

1
seven-ooo-seven•

I normally suggest ReclaiMe by people who describe themselves as not every experienced in this stuff. Otherwise R-Studio or DMDE would not be a problem. I you can find your way around in DMDE, it's only$20.

Yes, I'd assume file system reconstruction is possible until proven otherwise.

1
fzabkar•

Try DMDE:

https://dmde.com/

In the initial Partitions window, d-click your NTFS volume and expand the $Root. Navigate to your damaged folder. Do you see your files? If so, r-click the folder and Recover it to another drive.

That said, ddrutility appears to be telling you that the metadata for those folders/files is damaged, in which case the file/folder names will be lost.

One other thing you could do is to mount the recovered image using OSFmount. OSFmount defaults to readonly mode, which is what you want. If OSFmount is successful, then you could run Windows CHKDSK (in readonly mode) against the mounted volume. That would at least test the file system's metadata, but not the file contents. Normally it is inadvisable to mount a recovered image (due to the possibility that the OS may write to it), but I think it would be OK in readonly mode. I would prefer that you recover your files before doing this, though.

I'm assuming that the drive's file system was OK at the time of the drive's failure.

2
amedeusOP•

Looks like DMDE's not seeing anything. I got a 4tb external drive to perform various backup attempts to (original drive was 1tb, so that gives me some leeway), so I could copy the disk image to that to and then run chkdsk on the copy in case of any issues.

chkdsk did have issues finishing on the original drive after it originally blue screened, and $MFT is listed among the files ddrutility noted as being attached to bad sectors. I don't see any MFT backups on the list, though, and now that the system isn't trying to actually boot from the disk, maybe chkdsk will do a little better with it.

1
fzabkar•

DMDE places all the NTFS metafiles immediately under the $Root. That's where you should find $MFT.

1
amedeusOP•

Ah yes, there is a $MetaData folder with $MFT in it. Sorry, by "on the list" I meant the ddrutility list. But looking at how much smaller $MFTMirr is than $MFT, I was clearly wrong in assuming it was a backup of $MFT (which is what I meant by "MFT backups").

Looks like I kind of confused myself into speaking nonsense in that previous comment.

1
Zorb750•

GetDataBack, R-Studio, ReclaiMe, UFS Explorer, Recovery Explorer, DMDE.

2
amedeusOP•

Awesome, thank you! I'm glad there are plenty to choose from.

1
[deleted]•

[removed]

1