Question MBR Recovery ?

robburne

Distinguished
Jul 31, 2005
40
0
18,540
I recently pulled some cables behind my desk which knocked over a station which houses my 1gb SATA drive which I use as extra storage on my Win10 machine.

After the incident the drive couldn't be read, I was getting:

"the file or directory is corrupted and can't be read"

I ran chkdsk which took several hours to run, I was then able to read the disk and any files in the root are fully accessible. The folders in the root however are all empty if I try to open them.

It this point I cloned the drive and then ran some file recovery software, it seems that all the content of the drive is available in subfolders of "found.000" but since each archive in its own unique folder it's nearly impossible to manually piece it all back together.

I've read that maybe the MBR is corrupt and as they drive is NTFS there should be a duplicate of the table at the end of the diek? I've tried to Google the problem but all I get are tutorials which lead to links to another file recover program to download.

Is there any hope of recovering the content and structure of the folders on my drive. Since the incident all I have done in terms of writing or changing the disk is the initial run of chkdsk. Given that the content is available (albeit in the founb.000 folder) I am hopeful but would appreciate any pointers.

Thanks!
 

Misgar

Respectable
Mar 2, 2023
1,906
510
2,590
Best of luck trying to recover anything usable from the FOUND.000 folder.

The best option would have been to send the drive off to a data recovery lab ASAP, without running anything that might write back to the disk. I hope you ran CHKDSK in read-only mode and not with /F and /R switches, until after you cloned the drive.

You've probably already tried some of these options:
https://www.thewindowsclub.com/recover-files-from-found-000-folder-in-windows-10

P.S. Any attempts at data recovery should be on the cloned drive, not the original.
 
  • Like
Reactions: Phillip Corcoran
I ran chkdsk which took several hours to run, I was then able to read the disk and any files in the root are fully accessible. The folders in the root however are all empty if I try to open them.

It this point I cloned the drive and then ran some file recovery software, ...
If you had no intention of sending your drive away to a DR company, the most prudent approach would have been to clone it with HDDSuperClone (now forked into OpenSuperClone). Microsoft's philosophy behind CHKDSK appears to be that it should restore the integrity of the file system, even if it necessitates sacrificing your files to this end.

This tool can automatically rename those .CHK files whose signatures it recognises:

https://web.archive.org/web/20220701101030/https://trcdatarecovery.com/software-apps/chk-back

For example, if it detects a JPEG signature in FILEnnnn.CHK, it renames it to FILEnnnn.JPG.
 
Last edited:

robburne

Distinguished
Jul 31, 2005
40
0
18,540
By the way, I should add that I have already managed to recover the most valuable content from the drive.

The content in question are images that are for an as yet unpublished blog. Since I had a db table which stored the file name and location I was able to write a PHP script which parsed the found.000 directory and sub-folders for each image and then using the copy file function I was able to restore to the original location. I'm supplying this information since replies above suggest that what would be recovered would be useless fragments.

What remains in not essential but it would be a good exercise to learn from I think (for me!).

I may try recovery with: TestDisk
 

Misgar

Respectable
Mar 2, 2023
1,906
510
2,590
Wouldn't it have been far less hassle if you'd backed up all important data several times before things went wrong.

I know we harp on about the importance of multiple copies to guard against drive failure, but why chance fate?

Most skydivers don't jump out of a plane without a backup shute.