Question Drive permissions issue causing lost files and access issues

[sli4]

On Win11 after doing a windows update (1 security update installed) I restarted my computer to find my main external storage drive was not accessible and the icon was a white sheet of paper instead of the drive icon.

• I could not eject it at first - it said it was in use by something.
• After disabling/enabling the drive and restarting I was able to eject and power cycle the drive. - same result.
• I noticed the permissions were weird - they were all blank and the owner was unknown. I changed the permissions to be the same as my other drives (owner: SYSTEM with full access for admin. added users, added everyone. It scanned all the files and gave me a few errors: like "Failed to enumerate objects in the container. Access is denied" D\found.000\30000000-$boot, D\found.000\310000000-(foldername), d\found.000\340000000file.chk..etc...
• after the permissions change I could open the drive but I can only see a few files and folders - almost everything is gone even though it says most of the drive is full. All the files that were within the folders that could not be enumerated in the previous step are not visible or accessible.
• I tried system restore from a week ago and it did not fix it.
• chkdsk finds no errors.
• I checked system event viewer and I see at the exact same time that the windows update finished

Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.389.2544.0)

that two errors popped up from Ntfs (microsoft-windows-ntfs) and ntfs(ntfs), respectively:

Volume D: (\Device\HarddiskVolume14) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

and

A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0xb00000000000b. The name of the file is "<unable to determine file name>".

both chkdsk and repair volume say no errors...but also only take ~10 seconds when its an 8tb drive.
cyrstaldiskinfo says the drive is in good health.
Explorer shows 1.5tb free of 8tb but windows only shows about 1.2tb of actual files.

Any tips to get proper access back so I can see and use these files again?

 

[kerberos_20]

• I could not eject it at first - it said it was in use by something.
• After disabling/enabling the drive and restarting I was able to eject and power cycle the drive. - same result.

• A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0xb00000000000b. The name of the file is "<unable to determine file name>".

since you said you breaked it, the only recovery from this would be format drive and restore files from backup

 

[sli4]

since you said you breaked it, the only recovery from this would be format drive and restore files from backup

I'm not sure I said I "breaked it" -That error happened when the windows update finished installing and after disabled/enabled the drive the error stopped popping up at windows start.

The drive still shows all of the data is there in explorer - windows is just not showing or allowing me to set the permissions correctly for those files. Formatting and restoring seems like a last resort/ worst case scenario.
chkdsk and crystaldisk info show the drive is healthy and has no errors.

 

[kerberos_20]

I'm not sure I said I "breaked it" -That error happened when the windows update finished installing and after disabled/enabled the drive the error stopped popping up at windows start.

The drive still shows all of the data is there in explorer - windows is just not showing or allowing me to set the permissions correctly for those files. Formatting and restoring seems like a last resort/ worst case scenario.
chkdsk and crystaldisk info show the drive is healthy and has no errors.

mft corruptions usualy happens when you have loose cable, disconnecting drive while in use has same effect as "i dont want my data anymore"

if chkdsk says its all clean, then data should be in found.xxx folders

All the files that were within the folders that could not be enumerated in the previous step are not visible or accessible.

those are corrupted, they should be there taking up space, but content would be just garbage

 

[sli4]

The mft curruption error I posted happened after the windows update installed but hours before I safely ejected the hard drive and power cycled it.
While I did disable and then enable the drive after a few restarts so that I could safely remove it, This was hours after the mft curruption error happened. I safely removed the drive via windows safely remove hardware feature. I did not pull any plug or power down the drive until I was able to safely remove it.

When I try to grant full permission to the folders on the drive - it scans all the files and stops at all of those found.xxx folders saying access is denied and asks me to continue (skip) or cancel. I'd like to know a way to get access to those files that it is finding but denying access to.

 

[kerberos_20]

okay, mft corruption has nothing to do with windows defender update, it means drive failure
if you say it happened before you started to toy with it, then your drive may have damaged sectors or if its external then it coul be connection issue (lost power from usb)
can you post your s.m.a.r.t. info say from crystal disk info?

 

[sli4]

I understand that an mft corruption is drive based. My concern with the windows update is the very curious fact that the error was thrown at the exact second (in the event viewer) as the update completed and there were no warnings or errors prior.

The drive is external usb. There are no (and did not seem to be any) intermittent issues or noticable air gaps in connection or cable - both power and data cables. This is an AC powered desktop drive.
I've now tried the drive in a second computer and it shows the same 1.19tb free of 7.29tb but only shows a few files and folder when I open them.

Here is the crystal disk info

 

[sli4]

When I run chkdsk it says:
7630867 MB total disk space.
6378467 MB in 94646 files.
28816 KB in 4308 indexes.
0 KB in bad sectors.
418195 KB in use by the system.
65536 KB occupied by the log file.
1282011516 KB available on disk.

so chkdsk is even seeing that 6tb+ of used space and files.

 

[sli4]

So clearly there was some kind of corruption but for what ever reason chkdsk won't acknowledge it now. There is no mention of mtf corruption now. The data is still on the drive and is found by both chkdsk and the permissions scan. BUT I can't access or view it. What kind of recovery software would I be looking for to help with this? Most software I find like GetDataback does scans for "deleted" files or for missing partitions. It doesn't seem this fits the case for recovering deleted files (since chkdsk and permissions scan sees the files) or for a drive that won't mount or is missing it's drive letter since the drive is mounted and shows healthy without having done any formatting or partitioning.

 

[ex_bubblehead]

You're not going to recover anything from that drive after all the gymnastics you've performed on it. Your only option at this point is to wipe and restore from the latest backup. Anything named "found.xxx" is only a file fragment that is not usable in any way.

 

[USAFRet]

Any tips to get proper access back so I can see and use these files again?

This is why we peach backups so strongly around here.

 

[sli4]

You're not going to recover anything from that drive after all the gymnastics you've performed on it. Your only option at this point is to wipe and restore from the latest backup. Anything named "found.xxx" is only a file fragment that is not usable in any way.

most of the files seem to be the full size and the preview option shows me the few I tested are still intact. I get from your posts that you believe all is lost and there's no way to get this data back but it seems the files exist (in their original form not just raw data).
I'm also not certain what gymnastics you're talking about - I've tried not to write any data to this drive or format anything since the issue. Aside from restarting the computer and ejecting the drive I have run chkdsk and I have run a scan with easus file recovery software - which should not be destructive to the drive or files.

This is why we peach backups so strongly around here.

I have backups but my backups span much longer and larger than this drive. So selecting the other 3k files that I can't fit on the drive or don't want on this drive individually would take longer than doing a recover.

 

[USAFRet]

most of the files seem to be the full size and the preview option shows me the few i tested are still intact.

Recovery only counts when the file exists in its full glory, on a different storage media, outside any "preview".

I have backups but my backups span much longer and larger than this drive. So selecting the other 3k files that I can't fit on the drive or don't want on this drive individually would take longer than doing a recover.

I don't know what you're doing for 'backups', but a recovery of a 1TB drive that is 2/3 full takes me about 90 minutes. Far shorter than what you've been messing with here.

 

[sli4]

It seems running data recovery software was not necessary in my situation - although it gave me a clearer understanding of what was going on. It showed the found.000 folder was "existing" vs "lost" or "deleted" which helped to point out the files were still on the drive (no need to recover files that are not actually lost). I used Easus data recovery to do a scan and check this - you don't need the full version to scan.

For anyone else running into the issue where you can't get permissions/access the found.000 folder and your drive/partition has not been completely corrupt or been deleted:

The folder is not a general hidden folder. It is an OS system folder that is hidden. You can access it by disabling the "hide protected operating system file and folders' in addition to the show hidden files and folders option in explorer.
If you're still having issues accessing the folder you can boot the drive in a linux environment and the windows permissions should be ignored.

Furthermore - the files in the found.000 folder may be a mix bag of corrupt, completely fine or just mislabeled files.
In my case 99% of the files were fine but all jumbled around into mislabeled folders within the found.000 dir folders.

Having a mirrored backup would obviously save a lot of trouble here but if you're lucky and the files are not just jumbled around you can probably just copy back all the files you need to their "correct" folders without having to move files to/from the drive and then sync the rest with your backups.
...This is probably a temporary step since odds are something went wrong with the drive to cause this issue in the first place so, at the very least, it is a good idea copy the files to a different drive so you can format the drive before putting everything back.

Hope this helps the next person who stumbles upon this issue.