Question Secondary HDD shows as "Unallocated" after mobo swap / OS reinstall ?

[BQR]

I recently replaced my motherboard, GPU, and CPU. However, at some point during the move, my secondary drive became Unallocated according to Windows Disk Management (pic) and now I cannot access it:

The drive has important stuff on it (I know I know, I'm a fool for not having more recent backups) and I've been trying to resolve this by reading and learning about the data recovery process by going through what appears to be highly regarded tools documentations (DDRescue, DMDE, R-Studio, etc) and previous forum posts, but this level of technical understanding is beyond my abilities and I'm worried about doing something stupid and irreversible.

For context, when I replaced my hardware and booted for the first time, the new motherboard's BIOS displayed some briefly strange behavior (not appearing on my monitor until a forced restart), and I suspect my computer tried to boot to my secondary drive (which was plugged in at the time), instead of my primary OS drive, before I set the correct boot order. This is only a suspicion though, because I've never seen this happen before, and I do not know how to confirm it, except that there is a "Microsoft reserved partition" on the drive now according to DMDE (which I think means it is trying to act like a boot drive?)

However, I don't know if my assumption is correct, or what to do with that information. I've used DDRescue to clone the failed drive to another external drive just in case (not an .img, just a full clone, if that is the correct term), but I'm not sure what else to do from here.

Opening the volume gives me a "There are no any valid MFT Start Cluster" warning. And I can select either Auto Detect FS parameters, or Continue with these parameters. If I choose continue, then it shows me this:

I'm guessing it is reading the NTFS record wrong, but I'm not sure about that.

DMDE SMART shows this:

Testdisk results, if they help:

Hardware / specs of the new computer:

• CPU: Intel i7-14700K
• MOBO: MSI B760 GAMING PLUS WIFI
• RAM: CORSAIR Vengeance 32GB (2 x 16GB) DDR5
• GPU: ZOTAC GeForce 3070 Ti
• The failed harddrive: Western Digital 6TB 3.5" SATA
• I'm currently running my OS off a 1TB SSD, which was reformatted without issue during the reinstall.
• OS: Windows 10

To be clear, the failed harddrive showed no signs of issues before the swap, nor was it dropped / tampered with. I've gone through the basic troubleshooting things like rebooting, swapping SATA cables and mobo ports, checking mobo drivers / windows updates. I am hoping that means the data is recoverable on there, and not damaged or overwritten beyond salvaging.

At this point I feel I am in over my head and would deeply appreciate some assistance before I mess something up permanently. I've already shot my whole weekend trying to assess this on my own, and I know there are smarter people than I on this forum, ha.

 

[fzabkar]

DMDE's Partitions tab is showing that your drive has been reinitialised. The Indicators for the NTFS volume (xCxx) are telling us that the boot sector ("B") has been zeroed, and your $MFT (Master File Table) has been at least partially wiped.

In DMDE you would perform a full scan. If DMDE can find remnants of the $MFT, you may be able to recover some file and folder names. If not, then the best you can hope for is raw results, ie raw files grouped by file type, without their original file names.

R-Studio should have similar options.

BTW, attribute 0x10 in DMDE's SMART report is showing a Current normalised value which is less than the Worst value. This seems strange to me. Perhaps WD's Dashboard can shine some light on this mystery attribute?

 

[BQR]

Thank you for the reply, fzabkar. You're a legend on these forums, I've been reading your replies on other posts from years ago for similar issues to this one over the past few days, ha.

DMDE's Partitions tab is showing that your drive has been reinitialised. The Indicators for the NTFS volume (xCxx) are telling us that the boot sector ("B") has been zeroed, and your $MFT (Master File Table) has been at least partially wiped.

In DMDE you would perform a full scan. If DMDE can find remnants of the $MFT, you may be able to recover some file and folder names.

Ouch. Well, I will perform that scan ASAP and keep my fingers crossed. I'm going to make another clone of my drive, however (I made the first one on a much larger drive, so now scanning it takes 3x longer).
Could you tell me how to utilize the MFT remnants, if I do find them? Or will DMDE inform me if it finds them?

If not, then the best you can hope for is raw results, ie raw files grouped by file type, without their original file names.

Do you know if this will turn up file types that Windows not native to Windows (program specific files such as Photoshop .psd files)? Most of what I'm hoping to recover are such files.

BTW, attribute 0x10 in DMDE's SMART report is showing a Current normalised value which is less than the Worst value. This seems strange to me. Perhaps WD's Dashboard can shine some light on this mystery attribute?

Is that ID 10, with a blank Name? I apologize, but I'm not sure what that is, so I'm not sure what to look for within WD Dashboard. I ran a SMART diagnostic from WD Dashboard and it said there were no errors, but I don't see any significant information whatsoever in the WD Dashboard.

 

[fzabkar]

When you select a full scan in DMDE, you can limit the scan to the specified start (0) and end (11721045167) LBAs.

DMDE also runs on Macs and Linux boxes. When you click the "Raw: File Signatures" box, you will see the supported file types. PSD files are listed under the Graphics category.

 

[fzabkar]

Here are more SMART data for another WD6001F4PZ:

https://www.smartmontools.org/attachment/ticket/1012/smartctl-WesternDigital-WD6001F4PZ-49CWHM0.txt

Vendor Specific SMART Attributes with Thresholds:
63    ID# ATTRIBUTE_NAME          FLAGS    VALUE WORST THRESH FAIL RAW_VALUE
64      1 Raw_Read_Error_Rate     POSR-K   200   200   051    -    0
65      3 Spin_Up_Time            POS--K   100   253   021    -    0
66      4 Start_Stop_Count        -O--CK   100   100   000    -    4
67      5 Reallocated_Sector_Ct   PO--CK   200   200   140    -    0
68      7 Seek_Error_Rate         -OSR-K   200   200   000    -    0
69      9 Power_On_Hours          -O--CK   071   071   000    -    21796
70     10 Spin_Retry_Count        -O--CK   100   253   000    -    0
71     11 Calibration_Retry_Count -O--CK   100   253   000    -    0
72     12 Power_Cycle_Count       -O--CK   100   100   000    -    4
73     16 Unknown_Attribute       -O---K   038   162   000    -    683669541157
74    183 Runtime_Bad_Block       -O--CK   100   100   000    -    0
75    192 Power-Off_Retract_Count -O--CK   200   200   000    -    0
76    193 Load_Cycle_Count        -O--CK   188   188   000    -    36939
77    194 Temperature_Celsius     -O---K   124   119   000    -    28
78    196 Reallocated_Event_Count -O--CK   200   200   000    -    0
79    197 Current_Pending_Sector  -O--CK   200   200   000    -    0
80    198 Offline_Uncorrectable   ----CK   200   200   000    -    0
81    199 UDMA_CRC_Error_Count    -O--CK   200   200   000    -    0
82    200 Multi_Zone_Error_Rate   ---R--   200   200   000    -    0
83                                ||||||_ K auto-keep
84                                |||||__ C event count
85                                ||||___ R error rate
86                                |||____ S speed/performance
87                                ||_____ O updated online
88                                |______ P prefailure warning

It appears that attribute 16 (= 0x10) adds the Current and Worst values to get 200, so they have a different meaning.

Also ...

38 / 162 -- 683 669 541 157 = 0x9F2DE15125 -> 0x009F / 0x2DE1 / 0x5125
14 / 186 -- 0x003C / 0xF7B7 / 0x017D