please help me with data recovery after paragon disaster :(

Vesper8

Senior member
Apr 29, 2005
253
0
0
Hi everyone,

I don't know what to do anymore... I've tried troubleshooting this myself but I need help now.

Two weeks ago I tried to do what I thought would be an extremely simple operation. On my 2TB caviar green drive I had a small unallocated partition of ~500mb. I felt like it was being wasted so I installed Paragon Disk Manager Suite 2011 and I tried to merge the two partitions. I thought this was going to take a few minutes but it ended up taking ~40 hours. During this extremely long operation which I was afraid to interupt, the computer actually crashed twice so it had to pick up where it left off. It was saying that the percentage to completion was something silly like 45235256%

Anyway I was worried but felt fairly confident that Paragon would somehow manage to fix it and not totally screw me over.. well I was wrong and I've learned my lesson.. never going to use that software again.

Anyway.. this left me with a drive that still showed all my original folders, but I couldn't enter any of them at all.

On the next reboot, chkdsk ran automatically and it found and "fixed" a gazillion errors. When it was done, I could now fully explore my partition with intact folder structure and filenames.. however sadly about 80% of my files are now corrupt and unreadable (rough estimate).

I've been trying to recover my files ever since and have had little to no luck. My first try to was to use Easeus Data Recovery Wizard. This took forever to scan the drive because of how big (and slow) the Caviar Green 2TB is.. but in the end it was able to find something like 30 "deleted" partitions. I looked into many of these partitions and they all seem to contain the same set of files. I can either recovery "raw data" or recovery the "lost files" which I already have access to. The "lost files" are no more playable then what is sitting on my drive currently. The raw files however are fully playable.. but they have generic filenames numbered from 000.extension to 999.extension etc... you get the idea.

So.. this gave me hope.. I know the files are somehow retrievable.. but so far I can only recovery them as raw data.

At the same time.. I know the filenames and folder structure is also still available. The problem is I can't find a software that will actually restore the raw data while matching them with their original filenames.

I understand my MFT is hosed... and I think my boot sector is also troublesome. I've tried DiskTest... Spinrite.. Diskpatch..

Spinrite was running fine but then around 20% it ran into an error it couldn't recover from. It hadn't "recovered" anything until then but it was processing alright. Diskpatch stalled while "trying to fix simple bootsector issues" near the very beginning of its run. And DiskTest wouldn't go as far as the option that attempts to repair the MFT because it was complaining about an issue with the boot sector not matching its mirror.. and when I tried to fix that it gave an error saying it couldn't write to the bootsector.

This was before I ran chkdsk a 2nd time (manually this time) with chkdsk /f /r options. When I ran that it said something about "repairing Usn journal files". It also showed 0 KB in bad sectors.

So here I am before you... any tips? Do you know what is the best and most efficient data recovery software out there that could deal with a hosed MFT? Is there a software that can somehow match the filenames and the raw data (I know both of those ARE available.. they're just not... linked I guess?).

Any and help is greatly appreciated.

Oh and... I'm not going to take this drive to experts. The data is not that important.. it sucks majorly to lose it.. but it's mostly just videos (that are going to be next to impossible to get back).

I'd really like to fix it but I need to be able to do it myself.

Thanks for the long read (if you made it this far) and thanks for helping me in advance!
 

kmmatney

Diamond Member
Jun 19, 2000
4,363
1
81
I think you are going to just have to go through the playable files, and rename them one by one and recover what you can, then then reformat. At least that's what I'd probably do at this point. For partition resizing and moving, I always use GParted and have never had issues. You can also use it to align partitions.
 

Vesper8

Senior member
Apr 29, 2005
253
0
0
Hi, thanks for taking an interest.

Before, the unallocated space (~500MB out of 2TB) was before in Disk Management. Now it shows as being after and still unallocated... so it never actually completed its task of merging the two.

I hope this can somehow help you give me advice on a possible workaround
 

VirtualLarry

No Lifer
Aug 25, 2001
56,571
10,206
126
If your hardware is unstable, I wouldn't use it to recover the data. Make a sector-by-sector image using a stable computer onto another HD, and then work with the copy.
 

Cerb

Elite Member
Aug 26, 2000
17,484
33
86
After cloning to a new drive, using stable HW, maybe check out some Linux forensics discs, which often have all manner of file recovery tools on them (might be the best way to clone the drive, too).

Then, use that new 2TB drive for backups, so that this happening again would only be a minor annoyance.
 

ElenaP

Member
Dec 25, 2009
88
0
0
www.ReclaiMe.com
Vesper8,

If the small partition was before the large one, then expanding the large partition involves either renumbering all clusters or moving all the data. If either of these processes is interrupted midway, the result is not easily recoverable.

At this point, the best looking course of action is to try a different recovery software in turns, to try to find something that can extract at least part of the files. Due to variations in algorithms, different software will produce different results in your case, as the damage is significant.

Also, an unstable hardware is really bad to do a recovery on. You should set about isolating whatever hardware issues there are ASAP.
 

Zap

Elite Member
Oct 13, 1999
22,377
7
81
If your hardware is unstable, I wouldn't use it to recover the data. Make a sector-by-sector image using a stable computer onto another HD, and then work with the copy.

wayliff, I take your :thumbsup: and raise you another :thumbsup: .

Vesper8, how important is that data to you?

Of utmost importance = Pay a pro to retrieve data for you at a cost possibly going over $1000.

Reasonably important = Do as VirtualLarry suggested with using a computer that doesn't crash, and usnig a sector by sector image onto another hard drive.

Not important at all = Keep futzing with it, because the more you try on the original drive, the less data you will recover.