Recuva found files but doesn't seem to recover them

[timwtheov]

Hi,

 

I've done a scan of an external hard drive that had file-system errors on it, and while I can see all the files (a mix of video, audio, and documents: mp3, wmv, flac, docx, etc.) in the Recuva window after the scan, when I try to recover to either my C drive or another external hard drive, all I get are a few random text files, bin files, and so on--none of the mp3s, flacs, etc. I had Recuva set to recover the external hard drive's folder structure, and while I can see this folder structure on the C and other external hard drive, the files within those folders are not the same. I've tried recovering every found file, and then a couple of selected files, but all to no avail. Basically, I just get the same few text and bin files mentioned above any way I do the recovery. Hopefully, I just have something set wrong, but if so, I can't find it. Help!

[DennisD]

Hi tim, and welcome to Piriform.

 

Have you selected "Scan for non-deleted files" in "Options\Actions"?

[timwtheov]

No--I'll try this and report back.

[timwtheov]

Wait--I take that back. I had checked that box. I have a number of non-deleted files showing up in the window that pops up after a scan. I just tried to recover some of the audio files again, and I was told that the system could find none of those I had checked (approximately 300-400 mp3s).

[DennisD]

that had file-system errors on it

 

I wonder if that could be your problem?

 

What happened with your drive to give you the file system errors, and have you tried anything to fix them?

 

Maybe run "ChkDsk" on that drive, and it may fix some of them. Right click the drive and select "Properties\Tools\Check Now" ...

 

 

... you can either do only a scan by leaving the boxes unchecked, or tell it to fix file system errors.

 

I believe Recuva uses the MFT (Master File Table) to initially scan for files (if I'm wrong on that someone will surely put me right),, and if that's damaged then you have a problem.

 

I'm not the most clued up guy on here with Recuva, but I'm sure the member who is will chip in if he can add anything more positive.

 

In your shoes, I would also consider trying a rescue CD to get at your files. Some thing like "BootMed", which can get files from damaged systems/drives. You burn it to CD as an Image, and then boot your PC with it.

 

There's also Test Disk/PhotoRec, which are companion programs, and can get stuff recovered from even the most serious scenarios.

 

See here for PhotoRec:

 

TestDisk:

 

Hope that helps.

 

 

EDIT: You don't mention your Operating System, but I don't think it makes much difference here. This is based upon my XP Home.

[timwtheov]

Thanks for the suggestions.

 

I'm not sure how the drive was corrupted--it just stopped working properly last week (going really slow when transferring files, and sometimes locking up altogether). And I did a chkdsk with both boxes checked initially, then one at a time after both boxes checked failed more than once. I now keep getting the message from Windows 7, 64 bit Home Premium (sorry for leaving that out) that the hard drive needs to be reformatted after running chkdsk succeeded (I think the top box checked was the last one I did).

 

After my initial post, I did have success recovering about 8 mp3s, but after that Recuva wouldn't recover any more. I'll try BootMed and the other programs (if it doesn't work) sometime soon.

[DennisD]

Just remembered PhotoRec and TestDisk are in the Bootmed package, although you can try them initially from your system drive.

 

There are quite a few free programs around for recovering data, so post back if you aren't having much success with the suggestions above.

 

You do know how to burn an "Image" to a CD?

 

Not being cheeky here, but I don't know your level of knowledge. You can do this with freeware like "Imgburn".

[Alan_B]

Do you have adequate free space.

 

I Played around with Ctrl'C - Ctrl'V to copy several GByte around the contents of a VMWare Virtual Machine located on my Secondary HDD.

When I closed the VM I was alarmed to observe that Windows Explorer no longer showed "My Computer" as it had been.

There was a great big RED solid bar the entire length of System C:\ on my primary HDD,

and horrendous warnings that the partition was unusable and needed formatting.

I had less than 200 MBytes free space - I was not sure that would be enough for a Reboot.

 

TreeSize found 9 GBytes of Virtual Machine files in my %TEMP% folder which VMWare had borrowed for the Ctrl'C Ctrl'V copy,

and it failed to remove after the copy.

Simply deleting that %TEMP% junk restored normality.

I am so glad I saw this before I trusted VMWare to keep any malware out of my REAL system.

I now use Oracle VBOX instead.

[hazelnut]

Alan this thread has nothing to do with using Virtual machines. Please just keep to the subject of the thread.

[Alan_B]

Alan this thread has nothing to do with using Virtual machines. Please just keep to the subject of the thread.

True, but there are many ways of getting terrible warnings about the state and usability of the System Partition,

and this was how I got hit with one.

[hazelnut]

Yes but this thread is not about you.

[timwtheov]

Hi Dennis D,

 

Yes, I do know how to burn an .img file. I did so with BootMed, and the disc has been running for about 36 hours straight, trying create the image of the corrupted external harddrive on another external harddrive. That seems like a long time to me, but a) the corrupted external may have extensive corruption and it is 300 gb (give or take) of data. I did note that on the cmd window in Ubuntu, it keeps saying that there is an input/output error and "Block damaged" or something like that (I'm not in front of that computer right now); if you know anything about the messages in this tool when it's working, and this looks like it's not going to recover an image of the drive, let me know, and I'll stop it immediately when I get back home (I did a search in the BootMed forum and in their manual, but found nothing on these messages).

 

Anyway, in the Ubuntu boot, I was actually able to see all the files on the corrupted drive and was even able to copy a few folders over; but it kept hanging up and stopping, so I've tried the dd_rescue/create image tool. If it doesn't finish by tomorrow morning, though, I'm going to have to stop it, as I need my laptop back!

[DennisD]

Hi tim.

 

To be honest, this is one of the programs quite a few of us have laying there ready on CD, but luckily have never had the misfortune to have to use in a situation such as yours, so I've no idea what the error messages would be about.

 

I wouldn't have thought making a complete image of the damaged disk would have been necessary, I was hoping you would simply be able to copy your data off that drive. Saying that, if you're having difficulty with simply copying your data over, I can see the thinking behind making an image.

 

My Macrium Image Backup of my system drive can be "mounted" as a drive and would appear in "My Computer" as a hard drive with an assigned drive letter, and can then be accessed as you would a normal hard drive.

 

Your problem, as you clearly explain, is the physical size of that drive you're trying to "Image".

 

What I'll do shortly is boot my computer with Bootmed and check out it's various file recovery features, and see if there's anything positive I can feed back to you.

 

I'll also sort out some other file recovery packages which may give you more success than you're getting at the moment. As to the Image you're trying to create, maybe let it run a while longer, but if you're not confident in it completing call it a day and we'll try with some other software to try rescue your data.

 

Have you had a try with "TestDisk" or "PhotoRec" at all? They look daunting, but worth a try.

 

I'll get back to you later.

[hazelnut]

Can I just add to the list that Dennis is going to give you.

 

If all else fails in getting the files off the corrupted drive give this a try

 

http://www.roadkil.net/support.php?ProgramID=29

[Alan_B]

Is it possible that a vital clue has been omitted ?

 

I cannot see if it has been established whether the external drive was formatted NTFS or FAT32.

[DennisD]

@ Alan

 

You're right Alan, but TestDisk and Photorec, as well as other recovery software, can work with either ...

 

TestDisk can

 

Fix partition table, recover deleted partition

Recover FAT32 boot sector from its backup

Rebuild FAT12/FAT16/FAT32 boot sector

Fix FAT tables

Rebuild NTFS boot sector

Recover NTFS boot sector from its backup

Fix MFT using MFT mirror

Locate ext2/ext3/ext4 Backup SuperBlock

Undelete files from FAT, exFAT, NTFS and ext2 filesystem

Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.

 

It's a good spot all the same.

 

@hazel

 

That's a good link hazel, and thanks for jumping in with it. When it was first mentioned on here a wee while back I didn't bookmark it, and you know what my memory's like. My bad.

 

@tim

 

I dunno if it was a bad install, or a duff copy of Bootmed, but the only thing I could run was GParted and the windows explorer type file handler.

 

That worked fine, and easily copied files from my 320gb USB hard drive to another, but your drive must be pretty messed up.

 

TestDisk and Photorec failed to launch at all. I kept getting "in/out" error messages.

 

The "Applications" menu wouldn't load at all. As soon as I selected that option from the toolbar, I got what looked like a close down and relaunch of the shell. Very strange.

 

hazels link above looks a very good bet, and apologies that I didn't have that in my bookmarks. I would go with that next if you're not flagging and too disheartened yet.

 

There's also "Paragon Rescue Kit 11 Free Edition" ...

 

Rescue Your Data

 

In case of a system malfunction, caused either by a virus attack or file corruption, you can retrieve valuable information from your disks and copy it to another local drive, partition or save the data to CD/DVD. The File Transfer Wizard helps you to export data as easily and conveniently as possible.

 

Lets hope you have some success with these alternatives.

[timwtheov]

Sorry to not include the file system type on the corrupted external: it's NFTS.

 

I'm pretty much fed up by the dd_rescue, so I'll try a couple of these alternatives, which I thank you all for.

 

Oh, and I was going to try TestDisk and PhotoRec, but each said they were going to take about 56 hours to complete, a daunting amount of time.

[DennisD]

That is a long time tim, but sometimes these projected countdown timers can be pretty way out, and come down pretty quickly before they settle to anywhere near accurate.

 

I just hope you can get your stuff back at the end of the day.

 

Maybe just try getting a small amount back at a time. I've had experience of that working better than a mass recovery of a lot of data.

 

Good luck with it.

[timwtheov]

@DennisD

 

Yes, I think small amounts are what I'm left with, since neither program recommended on here works. I think what happened was the Chkdsk repaired something and made the file system not show up in Windows, for when I went to Disk Manager just now, the file system said "RAW" and not NTFS, as it should. Possibly that's why everything is so slow. Or it could just be the errors. At any rate, I was just able to recover a few mp3s, so that's something.

[hazelnut]

Roadkill also does a Raw copy app

 

http://www.roadkil.net/support.php?ProgramID=22

[martita]

Hello

I was recovering my files with RECUVA, and I recoveredthem, but now I have no idea wherethey ended up

when I started the program, it didn't oblige me to create a new folder. I simply recovered them and now I have no idea where they are - I did several new scans but they don't appear!

thx

[Guest johnccleaner]

Most likely, then, these files were not recovered.

You will be asked specifically where you want these files to be recovered, and would be required to choose the folder that you wanted the files to be recovered to.

It sounds more like Recuva scanned for files but was not instructed to actually recover them, if you didn't select a folder to recover to. (You can create a new folder, but are not obligated to, and can recover to an existing folder. There is no 'default folder', however, for Recuva. Additionally, we recommend that you recover to a different drive than you're recovering from for best results.)

I'd recommend taking a look at these articles:
https://support.piriform.com/hc/en-us/articles/204044064
https://support.piriform.com/hc/en-us/articles/360048864871
https://support.piriform.com/hc/en-us/articles/360045667371

In that order, that should walk you through the recovery process, complete with how to select the files you want to recover.