I just lost around 300 GB of my files

[grancharov]

Hello.

I was downloading some files(video and photo/zip) via Opera 9.64. At some time I noticed some error on one of the downloaded files. I clicked the button "Resume", but nothing happened. Then I clicked "Redownload again" and then the browser froze for several seconds. Then the browser recovered and continued the process, but shortly after that I noticed, that the download folder was under 40 GB and there should be around 300 GB.

I tried with Recuva and another one program of this kind, but it recovered under 3 GB.

I ran chkdsk H: /f.

OS is Win 7 Home

I'm not sure what exactly happened. I have some programs like datarescuedd, testdisk and dmde, but I don't know what to use and what exactly to do.

I tried with UndeletePlus and it shows many video and zip files, but most of them are marked as overwritten. Is this really possible? I mean - there was maybe some seconds between browser recovering from freeze-state and the moment, where I stopped.

[jaclaz]

Well, to "zap" huge numbers of sector addresses/file allocation tables/MFT records is actually almost instantaneous.

 

I doubt that the issue was caused by Opera (by itself) or even by the Windows 7 filesystem driver , what you report is "queer", Opera (or any other browser for that matters) simply has not the kind of "direct" access that would explain what happened.

 

Running chkdsk /f might have NOT been a smart move in this case (but it is well possible that it did not change anything).

 

It is difficult to provide some advice unless we understand the cause of this event. and what were the "low level" effects on the filesystem.

 

I would try checking in DMDE the (I am assuming NTFS) cluster map, depending on how much the filesystem was fragmented (the more it was fragmented, the worse) it may be possible to understand if there are chances to recover the files that UndeletePlus marks as "overwritten" (if the issue after all is related to cross-linked clusters or something connected to them).

 

As always, BEFORE anything else, making a whole disk image is strongly suggested.

 

 

jaclaz

[grancharov]

Earlier today I opened the partition with DMDE - I saw there some large files, but they were also marked as 0 bytes. How bad is this? So I have to copy the partition to another HDD as a file(via DMDE). Copy sectors > Source - partition(H:) > Destination - File(in partition L:)? The drive with botched partition has 8 GB unallocated space at the beginning and the drive where I will place the backup has single partition on the whole space(there are some files and I will move them partially or completely to other HDD).

[jaclaz]

So I have to copy the partition to another HDD as a file(via DMDE). Copy sectors > Source - partition(H:) > Destination - File(in partition L:)?

Yep , that's the idea.

I personally prefer to make "whole disk" images, but making a partition image is also fine in this case . Make anyway a separate backup of the MBR.

The drive with botched partition has 8 GB unallocated space at the beginning and the drive where I will place the backup has single partition on the whole space(there are some files and I will move them partially or completely to other HDD).

As long as you have enough space on the target volume, there is no need to move the existing files to another hard disk (or just move enough files to have enough space for the image), a good idea could be however to make sure that the destination volume filesystem is thoroughly defragmented, this way the image will be made contiguous or at least as contiguous as possible, something that while not really *needed* may speed up operations IF file carving is needed on the image.

What I am not really sure to advise you on is whether to attempt recovery from the original device or from the image, IF the cause of the issue is *something* connected to a failure of the actual "original" hard disk, fiddling on it might not be such a good idea , all in all I would rather see what happens during the imaging process and if the "original" hard disk behaves, I would attempt the recovery on it, keeping the image as a "safety" backup, after all if the imaging is successful, should the original disk be proved to be failing you would have anyway the option to restore the untouched image to a new disk.

jaclaz

[grancharov]

How to backup the MBR?

The destination HDD was recently formatted.

[jaclaz]

How to backup the MBR?

In DMDE?

Tools->Copy sectors

Choose as source device and choose the "right" physical drive.

Start 0

End 0

Sectors 1

as destination choose file and save on the new disk volume.

jaclaz

[grancharov]

OK - I have volH_lba0_1.bin - 512 bytes on drive/partition L:

Now what should be start and end sectors for the partition - from 1 to 3890650304, or from 0 to 3890650304? Or I just have to click Source > Partition and then Destination > File?

Edited November 8, 2014 by grancharov

[jaclaz]

Or I just have to click Source > Partition and then Destination > File?

If you want to make a partition image, yes, you select the partition as source:

otherwise, if you want to make the whole disk image you select the device physical as you just did and DMDE will provide you with the full size of the disk in the relevant fields, and that would be in your case:

from 0 to 3890650304

If you check, (try accessing the physical device) you will see how the actual partition starts on your disk at sector 2048+the 8 Gb unused/unallocated, possibly around sector 16779264.

jaclaz

Edited November 8, 2014 by jaclaz

[grancharov]

I'm not sure. I open window Copy sectors, and then I open Select Device/Disk - Logical Disks/Volumes - Volume H: I click OK an appears window Partitions - DMDE. There are two rows - Volume H:\ and under it - $Noname 01 (H:) and both are with size 1,99 TB - is this normal? Maybe these TB are decimal and not binary? Does it matter if I select the first row(Volume H:\), or the second($Noname 01)?

[grancharov]

It turned up, that there isn't enough space on the destination drive to copy the partition - even if it is 8 GB smaller. Anyway I managed to recover around 30 GB.

Thank You!