Question I need help with Data recovery on 4TB drive if possible

[kris_hm]

So this happened to me a couple months ago and i stopped screwing with it for a while because i needed to do some other things but now im back to mess with it again.
I have a 4TB drive installed in my computer that i was using to store many things, i was using about half the drive to store movies, pictures, software and whatever else i had on there. One day i logged into my computer and the drive was not showing up in the computer. I opened disk management and the whole drive was showing as unallocated and when i clicked on it i couldnt even make a partition, instead i was being prompted to initialize the disk.
Anyway at the time i was doing some research to try and figure out how to fix it without losing my data, but in the end i initialized the disk which erased everything. It wasnt what i wanted to do but i was thinking at the time it was going to come down to data recovery regardless so i just went ahead and initialized the disk so i could get started.
Since then i have left the drive in my computer (probably not the best idea since i wanted to recover it) but i have not put anything on the drive since then in hopes of possibly recovering the data. I say possibly because back then i did run recuva to try and get the data, i did the deep scan, but the files it found werent what i was looking for. I mean i found some stuff i recognized, most of the file names were gone and replaced with numbers but i could hardly find anything i was really looking for. I cant remember much about that attempt, but last night i decided to do it again. I let recuva scan the drive over night, took 8 hours, and i was sifting through the list this morning but again, i saw some files i recognized that definately were on the drive at one point, but i didnt really see anything i was truly wanting to recover.
Is my data just gone forever? Or is there a better way to try and recover it?

 

[jimmysmitty]

https://www.easeus.com/data-recover...re/free-hard-drive-data-recovery-software.htm

Try this and also they have a Partition Recovery that might be better to use as you might be able to recover the entire partition.

 

[fzabkar]

I would clone your drive, sector by sector, with a tool such as HDDSuperClone or ddrescue, and then run data recovery software against the clone.

However, I would first determine the physical state of the drive by retrieving its SMART report with a tool such CrystalDiskInfo or smartmontools. Look for reallocated, pending or uncorrectable sectors.

 

[kris_hm]

https://www.easeus.com/data-recover...re/free-hard-drive-data-recovery-software.htm

Try this and also they have a Partition Recovery that might be better to use as you might be able to recover the entire partition.

I was able to do this running a recovery that lasted 10 hours. It says the recovered files amount of data is worth 2.7TB, which sounds about right. I was using about half my drive. But im sitting here scrolling through the recovered files now and while these files have size none of them work properly. Video files refuse to play, pictures do not display. All the files are named FILE000, FILE001, etc inside each folder. I looked at the properties for some of the files and theres no data in the details like where it usually gives the length of a video, or the height and width of the window. Same for pictures, the file is present with an unrecognizable name but i cant open them and theres no data in properties about windows size, resolution, stuff thats usually there. I imagine if not all of my data is here at least some of it is, if i can salvage it i would like to.
Do you know a way i can fix this?

 

[kris_hm]

I would clone your drive, sector by sector, with a tool such as HDDSuperClone or ddrescue, and then run data recovery software against the clone.

However, I would first determine the physical state of the drive by retrieving its SMART report with a tool such CrystalDiskInfo or smartmontools. Look for reallocated, pending or uncorrectable sectors.

I would have tried this also but i do not have another drive big enough to do the clone. I have two 4TB drives in my computer, one is for my OS and the second was for my data which got corrupted somehow. Since i had intended on attempting to recover the corrupted drive in the mean time i was using my OS drive to store data. I just cant clone it with the hardware i have. The disk checks out fine, i use hirens to check the disk and it passes. Both these drives are only about a year old. Seagate 4TB drives.

 

[jimmysmitty]

I was able to do this running a recovery that lasted 10 hours. It says the recovered files amount of data is worth 2.7TB, which sounds about right. I was using about half my drive. But im sitting here scrolling through the recovered files now and while these files have size none of them work properly. Video files refuse to play, pictures do not display. All the files are named FILE000, FILE001, etc inside each folder. I looked at the properties for some of the files and theres no data in the details like where it usually gives the length of a video, or the height and width of the window. Same for pictures, the file is present with an unrecognizable name but i cant open them and theres no data in properties about windows size, resolution, stuff thats usually there. I imagine if not all of my data is here at least some of it is, if i can salvage it i would like to.
Do you know a way i can fix this?

Get another large drive and recover all the found data to it and sort through it. The problem that happened is your MFT probably got corrupted, dmagaed or lost. Without the MFT the drive knows files are there but has no idea where or what they are.

https://www.easeus.com/format-recovery/fix-corrupt-master-file-table-error-without-losing-data.html

You can attempt to use that to try and fix the MFT which if successful may just return the drive to how it was but I suggest backing up what was found first in case the drive takes a dump.

 

[fzabkar]

Can you show us the Partitions window in DMDE?

https://dmde.com/

If you double-click your data partition and expand the Root, do you see your file/folder structure? (probably not)

 

[kris_hm]

Get another large drive and recover all the found data to it and sort through it. The problem that happened is your MFT probably got corrupted, dmagaed or lost. Without the MFT the drive knows files are there but has no idea where or what they are.

https://www.easeus.com/format-recovery/fix-corrupt-master-file-table-error-without-losing-data.html

You can attempt to use that to try and fix the MFT which if successful may just return the drive to how it was but I suggest backing up what was found first in case the drive takes a dump.

So, its too late for me to recover to another drive. When the process finished the first time i went ahead and recovered to the drive i was recovering thinking that id have my data. I imagine since i overwrote 2.7TB that even if i recovered again the majority of the data has been overwritten now. What is MTF?

 

[kris_hm]

Can you show us the Partitions window in DMDE?

https://dmde.com/

If you double-click your data partition and expand the Root, do you see your file/folder structure? (probably not)

I can see the file tree, its only the recovered files. Heres a pic if that helps but i think i probably screwed myself by recovering the data already. Also not entirely sure if this is what youre wanting to see
.dmde
Just clicked the link myself, picture quality after the upload us horrible but you can see it. Let me know if you need it to be better than this.

 

[jimmysmitty]

So, its too late for me to recover to another drive. When the process finished the first time i went ahead and recovered to the drive i was recovering thinking that id have my data. I imagine since i overwrote 2.7TB that even if i recovered again the majority of the data has been overwritten now. What is MTF?

MFT is the Master File Table. Basically a table on the drive that keeps information for the files.

And yes now that you have recovered to the drive any other recovery attempts will become even harder. You will not be stuck looking through all the data to verify what it is. The biggest downside is you might also find multiple versions of the same file. I do wish you the best of luck though.

 

[kris_hm]

MFT is the Master File Table. Basically a table on the drive that keeps information for the files.

And yes now that you have recovered to the drive any other recovery attempts will become even harder. You will not be stuck looking through all the data to verify what it is. The biggest downside is you might also find multiple versions of the same file. I do wish you the best of luck though.

Yea i mean thats fine, the files are sorted by file extension. Im not really understanding why i cant open any of them though. I mean maybe theyre corrupted and its just useless data at this point. But do you know if there is a way to edit the files details? Like im pretty sure the data i want is here, mostly video files and pictures. The file names are all file000, file001, etc, and they all have extensions like .mp4, .mv4, .jpg, the system seems to know what they are whether its a video file, a picture, text document or whatever. But for the majority of the files when i go to open them whatever program is used to open them, for instance windows media player for a .mp4 file, windows media player comes back with an error saying " Windows Media Player cannot play the file. The Player might not support the file type or might not support the codec that was used to compress the file." I say the majority because i have looked and there are a few files that work. Windows media player has the correct codec installed, i can play other .mp4 files so its not that. Theres just something muffled with the file. I dont mind sifting through them all but is there a way to make the files that arent opening openable? Even if i have to go through each one doing a guess and check thing. Most of the data i would need to input is probably the same for each file. If its even possible to do that.

 

[fzabkar]

When a file is recovered in raw mode, the first part will usually be OK (that's where the "signature" is located). However, the rest of the file may have been subject to fragmentation, or the file may have been deleted and partially overwritten. Use a hex editor (eg HxD, freeware) to view the headers of your media files.

Here are several tools that can sort through your recovered files using various metadata:

https://www.cgsecurity.org/wiki/After_Using_PhotoRec

For example, if you examine your camera photos, you may find the name of the camera and a date/time stamp. Your audio files may have the name of the song and/or artist.

 

[jimmysmitty]

Yea i mean thats fine, the files are sorted by file extension. Im not really understanding why i cant open any of them though. I mean maybe theyre corrupted and its just useless data at this point. But do you know if there is a way to edit the files details? Like im pretty sure the data i want is here, mostly video files and pictures. The file names are all file000, file001, etc, and they all have extensions like .mp4, .mv4, .jpg, the system seems to know what they are whether its a video file, a picture, text document or whatever. But for the majority of the files when i go to open them whatever program is used to open them, for instance windows media player for a .mp4 file, windows media player comes back with an error saying " Windows Media Player cannot play the file. The Player might not support the file type or might not support the codec that was used to compress the file." I say the majority because i have looked and there are a few files that work. Windows media player has the correct codec installed, i can play other .mp4 files so its not that. Theres just something muffled with the file. I dont mind sifting through them all but is there a way to make the files that arent opening openable? Even if i have to go through each one doing a guess and check thing. Most of the data i would need to input is probably the same for each file. If its even possible to do that.

As said a lot could be overwritten data. Since you just recovered directly yo the drive there is a chance of not only recovering your files but what was deleted before hand. Also in recovering directly to the same drive you also could have overwritten files.