How can I find lost files on Toshiba hard drive

[bubkybucky]

I'm really desperate. Here is my story:
I bought a Toshiba hard drive (500gb) and it worked perfectly with mac and windows OS then suddenly two files got lost just disappeared . And whenever I plug it it shows a message that says I must backup and format it as soon as possible also when I try copying anything to it it won't allow it. so I tried scanning it with data recovery softwares (Data rescue 3 is one of them)assuming the files were deleted but nothing shows up after that I tried to show all hidden files assuming they're hidden or something didn't work either.

so, should I back it up then format it do you think the files will show up after formatting???
what do you experts suggest? please I'd really appreciate any thought.

 

[mjmacka]

Do not format the drive. The files will be harder to recover if you format.
I would remove the driver from your computer. Attach the drive to a second computer as a secondary drive and use a file recovery utility to attempt to recover the lost files.

 

[bubkybucky]

Do not format the drive. The files will be harder to recover if you format.
I would remove the driver from your computer. Attach the drive to a second computer as a secondary drive and use a file recovery utility to attempt to recover the lost files.

Thanks for replying!
Just to be clear it's an external hard drive so I did attach it to two different computers and now i'm scanning it with Recuva but still nothing. ok yes i'll not format it but if the files weren't deleted where would it just disappear! ;(

 

[mjmacka]

Okay, the fact that it's an external makes your life easier. Rescuva works best if there hasn't been any read/write activity on the drive. If there has been a lot of activity, the cleared 1/0's will be written over by the new files being added to the drive.

 

[fzabkar]

If Recuva finds nothing, then I would stop and examine your drive with a disc editor (eg DMDE freeware). Start by trying to read sector 0.

It would also be a good idea to get an idea as to the physical state of the drive by examining its SMART report. You could use HD Sentinel or CrystalDiskInfo for this purpose.

 

[bubkybucky]

Okay, the fact that it's an external makes your life easier. Rescuva works best if there hasn't been any read/write activity on the drive. If there has been a lot of activity, the cleared 1/0's will be written over by the new files being added to the drive.

No nothing was written on the drive because it won't allow me.
it's still scanning. thanks a lot

 

[bubkybucky]

If Recuva finds nothing, then I would stop and examine your drive with a disc editor (eg DMDE freeware). Start by trying to read sector 0.

It would also be a good idea to get an idea as to the physical state of the drive by examining its SMART report. You could use HD Sentinel or CrystalDiskInfo for this purpose.

Ok I've never done this before but I tried examining its smart report and the health status was Caution on the following aspects:
*Relocated Sector Count raw value is 0000000000A0
*Current pending sector count raw value is 000000001420

I have no idea what these mean but I continued and Started running the dmde
and I don't know how to use it/no idea what to do with the result its giving me.
Thanks in advance

 

[fzabkar]

Your drive has 160 (= 0xA0) reallocated sectors. These are bad sectors that have been replaced with spares. There are also 5152 (= 0x1420) "pending" sectors. These are weak sectors that will be replaced at the next opportunity.

As for DMDE ...

uncheck the Show Partitions box
select your Physical Drive and click OK

You should now see LBA 0. Upload it to a file sharing service, eg http://postimg.org

 

[bubkybucky]

Your drive has 160 (= 0xA0) reallocated sectors. These are bad sectors that have been replaced with spares. There are also 5152 (= 0x1420) "pending" sectors. These are weak sectors that will be replaced at the next opportunity.

As for DMDE ...

uncheck the Show Partitions box
select your Physical Drive and click OK

You should now see LBA 0. Upload it to a file sharing service, eg http://postimg.org

sorry it took me a while to get back to you
ok yes i followed your instructions yes i see LAB 0
here you go: http://postimg.org/image/fw0a8kjl1/
http://s10.postimg.org/nbzjud7ah/rec.png
do you want me to take screen shots to the entire result?
I'll be more than happy to do so.

 

[fzabkar]

Sector 0 looks like a standard MBR. The partition table has 3 NTFS partitions. Unless you are using third party utilities, Mac OS cannot write to NTFS volumes. They will be read-only. That said, it does sound like your file system is corrupted. However, it is odd that you cannot see any of the 3 partitions.

The first has a size of 105MB, the second is 105GB, and the third is 95GB. That's a total of 200GB.

The sector range at the top of the screen indicates that your drive has 390721968 sectors which confirms that the drive's capacity is 200GB.

390 721 968 x 512 = 200 049 647 616

 

[bubkybucky]

If Recuva finds nothing, then I would stop and examine your drive with a disc editor (eg DMDE freeware). Start by trying to read sector 0.

It would also be a good idea to get an idea as to the physical state of the drive by examining its SMART report. You could use HD Sentinel or CrystalDiskInfo for this purpose.

Sector 0 looks like a standard MBR. The partition table has 3 NTFS partitions. Unless you are using third party utilities, Mac OS cannot write to NTFS volumes. They will be read-only. That said, it does sound like your file system is corrupted. However, it is odd that you cannot see any of the 3 partitions.

The first has a size of 105MB, the second is 105GB, and the third is 95GB. That's a total of 200GB.

The sector range at the top of the screen indicates that your drive has 390721968 sectors which confirms that the drive's capacity is 200GB.

390 721 968 x 512 = 200 049 647 616

what do you suggest me to do now? do you think the files are still there somewhere?
thank you for bearing with me

 

[bubkybucky]

QUOTED SPAM REDACTED - SS
I didn't format it.
thanks!

 

[fzabkar]

@bubkybucky, the first thing I would ask is whether your DMDE screen shot is of the correct drive. It is showing a physical size of 200GB rather than the 500GB in your first post.

 

[bubkybucky]

@bubkybucky, the first thing I would ask is whether your DMDE screen shot is of the correct drive. It is showing a physical size of 200GB rather than the 500GB in your first post.

oh sorry ;-; I'm really embarrassed here it is
http://postimg.org/image/6acf0i32f/
http://s15.postimg.org/lj2ce9wqz/reee.png

 

[fzabkar]

Your drive has a single FAT32 partition (type 0x0C) with a size of 0x3A384441 sectors. That corresponds to 500GB.

0x3A384441 x 512 = 500 104 200 704

http://www.google.com/search?q=0x3A384441+x+512+in+decimal

Both Windows and Mac OS can write to FAT32 volumes (Mac OS cannot natively write to NTFS volumes), so it would appear that your file system is corrupted in some way, possibly due to bad sectors, especially if you have tried to "repair" the problem using CHKDSK.

My next step would be to examine the boot sector (sector 2048).

In DMDE ...

Select Editor -> Goto Offset
Sector = 2048
Sector Offest = 0
From Start/End
Dec
click OK

You should now see sector 2048.

Show us the Mode -> Hexadecimal and Mode -> FAT32 Boot Record views.

 

[bubkybucky]

Your drive has a single FAT32 partition (type 0x0C) with a size of 0x3A384441 sectors. That corresponds to 500GB.

0x3A384441 x 512 = 500 104 200 704

http://www.google.com/search?q=0x3A384441+x+512+in+decimal

Both Windows and Mac OS can write to FAT32 volumes (Mac OS cannot natively write to NTFS volumes), so it would appear that your file system is corrupted in some way, possibly due to bad sectors, especially if you have tried to "repair" the problem using CHKDSK.

My next step would be to examine the boot sector (sector 2048).

In DMDE ...

Select Editor -> Goto Offset
Sector = 2048
Sector Offest = 0
From Start/End
Dec
click OK

You should now see sector 2048.

Show us the Mode -> Hexadecimal and Mode -> FAT32 Boot Record views.

Ok yes yes I'll definitely give this a try ASAP and I'll get back to you
Thank you fzabkar

 

[bubkybucky]

Your drive has a single FAT32 partition (type 0x0C) with a size of 0x3A384441 sectors. That corresponds to 500GB.

0x3A384441 x 512 = 500 104 200 704

http://www.google.com/search?q=0x3A384441+x+512+in+decimal

Both Windows and Mac OS can write to FAT32 volumes (Mac OS cannot natively write to NTFS volumes), so it would appear that your file system is corrupted in some way, possibly due to bad sectors, especially if you have tried to "repair" the problem using CHKDSK.

My next step would be to examine the boot sector (sector 2048).

In DMDE ...

Select Editor -> Goto Offset
Sector = 2048
Sector Offest = 0
From Start/End
Dec
click OK

You should now see sector 2048.

Show us the Mode -> Hexadecimal and Mode -> FAT32 Boot Record views.

Here are the two modes:

Hexadecima/text
http://postimg.org/image/o7k8eowgb/

FAT32 Boot Record
http://postimg.org/image/5l8d23txr/

 

[fzabkar]

@bubkybucky, I'm a little confused. You began this thread by saying that you had lost 2 deleted files, then you stated that Recuva couldn't find anything. Presumably this means that Recuva couldn't find any files at all, or did you mean something else?

Anyway, your boot sector appears to be OK. I would now examine the first sector of your root directory. This is where you should see your file and folder names.

According to the information in the boot sector ...

Hidden sectors = 2048
Reserved sectors = 32
Big sectors per FAT = 119220
Number of FATs = 2

Using the above numbers, the root directory should be located at sector 240520:

2048 + 32 + (2 x 119220) = 240520

Could you now examine sector 240520? Do you see any file/folder names?

 

[bubkybucky]

@bubkybucky, I'm a little confused. You began this thread by saying that you had lost 2 deleted files, then you stated that Recuva couldn't find anything. Presumably this means that Recuva couldn't find any files at all, or did you mean something else?

Anyway, your boot sector appears to be OK. I would now examine the first sector of your root directory. This is where you should see your file and folder names.

According to the information in the boot sector ...

Hidden sectors = 2048
Reserved sectors = 32
Big sectors per FAT = 119220
Number of FATs = 2

Using the above numbers, the root directory should be located at sector 240520:

2048 + 32 + (2 x 119220) = 240520

Could you now examine sector 240520? Do you see any file/folder names?

what I meant is that I scanned the drive by recuva, but it showed some deleted files but not the ones that I want which are 2 that disappeared (they weren't deleted).
I'm confused too where would files disappear when the drive is working fine.

anyway, I examined sector 240520. One of the files I'm looking for is named U.S. or U.S. 2012 I don't remember
I thought it could help to know at least one file's name!
http://postimg.org/image/am9u8jrkb/

 

[fzabkar]

I'm very sorry, it seems I've wasted your time. I misunderstood your original statement. I took it to mean that the situation had become worse and that you were no longer able to see anything. This sometimes happens when you thrash a failing drive with a full surface scan.

Anyway, you can see your root directory structure. Each file or folder has an entry for its short 8.3 file name, plus one or more entries for its long file name.

For example, there is SPOTLI~1 and Spotlight.

When a file is deleted, the leading character is replaced with E5.

See http://www.cnwrecovery.com/html/fat32.html

In short, if Recuva can't find your deleted file, then this would suggest that it is unable to locate its directory entry, perhaps because it has been overwritten. I presume it would have checked the Recycle Bin. The only other possibility would be if the body of the file were still intact, and if you could search for a known sequence of bytes.

For example, if your file contains some text, then you could search the drive for this text string using your disc editor.

 

[bubkybucky]

I'm very sorry, it seems I've wasted your time. I misunderstood your original statement. I took it to mean that the situation had become worse and that you were no longer able to see anything. This sometimes happens when you thrash a failing drive with a full surface scan.

Anyway, you can see your root directory structure. Each file or folder has an entry for its short 8.3 file name, plus one or more entries for its long file name.

For example, there is SPOTLI~1 and Spotlight.

When a file is deleted, the leading character is replaced with E5.

See http://www.cnwrecovery.com/html/fat32.html

In short, if Recuva can't find your deleted file, then this would suggest that it is unable to locate its directory entry, perhaps because it has been overwritten. I presume it would have checked the Recycle Bin. The only other possibility would be if the body of the file were still intact, and if you could search for a known sequence of bytes.

For example, if your file contains some text, then you could search the drive for this text string using your disc editor.

No don't be sorry!!!!! I really appreciate what you're trying to do here.

no the files weren't text files. The files contained some pictures and videos.

so, do you suggest that I simply search one of the lost (disappeared) videos name and it might appear?
or check in the directory if a file leading character is replaced with E5?

 

[Dementor2]

Hi bubkybucky

You Can Use This Soft Maybe Helpful For You

Link Address

http://www.easeus.com/?ad&gclid=CMLusIXG37wCFYYBwwodqiUABg

Available For Mac ,& Win Good Luck

 

[bubkybucky]

Hi bubkybucky

You Can Use This Soft Maybe Helpful For You

Link Address

http://www.easeus.com/?ad&gclid=CMLusIXG37wCFYYBwwodqiUABg

Available For Mac ,& Win Good Luck

Thank you. I will definitely try it.