Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
missing data and disk space
#1
WD MyBook (Green) 1.5TB, badly buggered, raw read errors - the data is now recovered as best can be and returned to client.

However, in the process of recovery I noticed some oddities with reported disk space

From the outset the recovered data was 335GB obtained by using testdisk on the original drive

TreeSize showed me the disk should have had around 5000GB, in fact two of the largest folders respectively reported 250GB and 150GB each, yet test disk was only able to recover 150GB and 50GB respectively for each

I imaged the original disk with HDDsuperclone to a 4tb external drive (30 odd hours to complete), test disk was then able to recover more, from those two folders 250gb and 150GB iirc.  I have also run a free space scan with Photorec on the cloned drive to recover any missing/deleted files etc 

at this point I also took a Macrium Reflect image of the cloned drive. 
 
and here is where it gets weird, the Macrium Reflect image is reporting around 500GB in size when mounted in windows (893GB free of 1.36TB) when Macrium Reflect is supposed to image only the data  and ignores free space.  The image file itself is also 500GB

But when I open that MR image and get the size of all contents it is only around the 335GB mark, same as testdisk recovered. Somewhere there is 150GB+ unaccounted for in that image file... Recycle bin and system volume info are negligible and  accounted for 

So somehow or rather MR must know that the extra data is there and including it even though it isn't there...
I ran photorec freespace scan on the mounted MR image just in case but it found no files in that extra space?

I'm not sure if this is likely to be real data and how to go about finding it in a more meaningful way than Photorec which bastardised the file names, or is it just the reporting of the partition sizes that has got a  bit messed up... 

Sorry its a bit rambling but wouldn't mind any thoughts on this, client is happy with the data, I just wouldn't mind some clarity around this extra/missing space
This world would be a perfect place if it wasn't for the people.

Sharesies | Buy Crypto | Surfshark VPN | Cloud Backup
#2
Give this a go, if the drives readable run Windirstat https://windirstat.net ( you can attach the drive as 2nd drive and select which to scan)

It shows every single file and exactly where it is. Being a damaged drive may or may not work, but could take a few hours to scan.
Upgrades = Old bugs replaced with new Bugs.
#3
(15-06-2024, 04:48 PM)Wainuitech Wrote: Give this a go, if the drives readable run Windirstat  https://windirstat.net  ( you can attach the drive as 2nd drive and select which to scan)

It shows every single file and exactly where it is. Being a damaged drive may or may not work, but could take a few hours to scan.

Thanks for that, it's only seeing the 335GB that the file system reports as well.  

But that got me thinking about chkdsk which I don't usually run on badly buggered drives, but one of its steps is finding orphaned files so i thought what the hell...

So I mounted the macrium image for the drive with write access, then ran a chkdsk e: /f on it and what do you know, finds a bunch of orphaned files and when I check 50GB folder that should be 200GB or so, suddenly the file size is where it should be.  On closer inspection there was one folder that was empty before that now has 150 odd GB...

So i'll take that as a win...
This world would be a perfect place if it wasn't for the people.

Sharesies | Buy Crypto | Surfshark VPN | Cloud Backup


Forum Jump:


Users browsing this thread: 1 Guest(s)