50 replies to this topic

[steveyg777]

As i came across this post http://reboot.pro/to...-repairrebuild/i decided I might actually get some help that I'm looking for in how to figure out how to rectify my hard drive problem.

Basically i was using my external hard drive on my mac using an ntfs driver from paragon. Anyway i accidentally moved my music folder into a sub folder. Normally you can't do that but finder froze up and i had to relaunch it. After that the folder had vanished and i can only assume that it actually performed enough of the move operation to mess things up!

I can send info on the verification and repair logs for you to see if you want. My question is how can i look at the mft (preferably in a way i can understand lol), find the reference for that folder and edit where that folder is located?

[steveyg777]

this is more info

my external hard drive (ntfs format) may have been a little in need of a scan but finder seemed to be misbehaving. anyway, i accidentally dragged my main music folder onto a subfolder. at that point finder began not responding. i waited a while but it didn’t come back to life.

I relaunched finder and it seems my main music folder has now vanished!!!! instead of finder asking me if i wanted to actually move the folder or, more likely, tell me that this operation wasn’t aloud. the dumb thing would appear to have moved the folder or lost it or something (?)

i did a verify on the drive and got this:




FIRST REPAIR CYCLE:

Code:
Repairing file system.

Checking Volume /dev/rdisk1s1...

Type of the filesystem is NTFS.

Volume label is: Seagate Backup Plus 5Tb Drive.

Volume is marked as dirty.

Fixing corrupt attribute 0x80 in file 0x212bb.

Fixing corrupt attribute 0x80 in file 0x212bc.

Fixing corrupt attribute 0x80 in file 0x212be.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffe000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x212cc.

Fixing corrupt attribute 0x80 in file 0x212ce.

Fixing corrupt attribute 0x80 in file 0x212dd.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffc000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x212e4.

Fixing corrupt attribute 0x80 in file 0x212f8.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffe000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x21315.

Fixing corrupt attribute 0x80 in file 0x21326.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffc000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x213a7.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffc000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x213be.

Fixing corrupt attribute 0x80 in file 0x213c0.

Fixing corrupt attribute 0x80 in file 0x213e0.

Fixing corrupt attribute 0x80 in file 0x213e9.

Fixing corrupt attribute 0x80 in file 0x21400.

Fixing corrupt attribute 0x80 in file 0x21407.

Fixing corrupt attribute 0x80 in file 0x2140c.

Fixing corrupt attribute 0x80 in file 0x2141d.

Fixing corrupt attribute 0x80 in file 0x214ae.

Fixing corrupt attribute 0x80 in file 0x214b1.

Fixing corrupt attribute 0x80 in file 0x214b6.

Fixing corrupt attribute 0x80 in file 0x214be.

Fixing corrupt attribute 0x80 in file 0x214e4.

Fixing corrupt attribute 0x80 in file 0x2150b.

Fixing corrupt attribute 0x80 in file 0x21515.

Fixing corrupt attribute 0x80 in file 0x2151c.

Fixing corrupt attribute 0x80 in file 0x21581.

Fixing corrupt attribute 0x80 in file 0x21586.

Fixing corrupt attribute 0x80 in file 0x2158d.

Fixing corrupt attribute 0x80 in file 0x2158f.

Fixing corrupt attribute 0x80 in file 0x21596.

Fixing corrupt attribute 0x80 in file 0x21598.

Fixing corrupt attribute 0x80 in file 0x215ad.

Fixing corrupt attribute 0x80 in file 0x215b6.

Fixing corrupt attribute 0x80 in file 0x215ba.

Fixing corrupt attribute 0x80 in file 0x215be.

Attribute 0x80 has inconsistent TotalAllocated 0xffffffffffffe000 > 0x10000.

Fixing corrupt attribute 0x80 in file 0x215c3.

Fixing corrupt attribute 0x80 in file 0x215cb.

Fixing corrupt attribute 0x80 in file 0x2162e.

Fixing corrupt attribute 0x80 in file 0x21631.

Fixing corrupt attribute 0x80 in file 0x21642.

Fixing corrupt attribute 0x80 in file 0x21e09.

Fixing corrupt attribute 0x80 in file 0x21e0d.

Fixing corrupt attribute 0x80 in file 0x22a32.

Fixing corrupt attribute 0x80 in file 0x22a35.

Fixing corrupt attribute 0x80 in file 0x22a38.

Fixing corrupt attribute 0x80 in file 0x22a3d.

Fixing corrupt attribute 0x80 in file 0x22a48.

Attribute 0x80 error "cross-link"

Delete it from file 0x2c598.

File 0x2c598 "C59CD5349CFDB689-5CF9F35E01E3ABED.itc" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x8ea47.

File 0x8ea47 "iChat Icons" does not contain data attribute.

Attribute 0xa0 $I30 error "cross-link"

Delete it from file 0x91d68.

Attribute 0x80 error "cross-link"

Delete it from file 0x126ccc.

File 0x126ccc "02. They Still Gafflin.mp3" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x243138.

File 0x243138 "C59CD5349CFDB689-C11722F0F9DBAEA3.itc" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x2438a8.

File 0x2438a8 "C59CD5349CFDB689-DA5D1BE72BAC900B.itc" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x243971.

File 0x243971 "C59CD5349CFDB689-60FBD1FB58A8D45F.itc" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x27ae29.

File 0x27ae29 "0000000000.lij" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x27ae2a.

File 0x27ae2a "0000000000.lij" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x294c21.

File 0x294c21 "WC and The Maad Circle - West Up! (Feat. Ice Cube & Mack 10).mp3" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x2950f8.

File 0x2950f8 "09 - Catch 22.mp3" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x2950f9.

File 0x2950f9 "10 - Indiscretions In The Back Of The Limo Ft. T.I..mp3" does not contain data attribute.

Attribute 0x80 error "cross-link"

Delete it from file 0x2952f7.

File 0x2952f7 "11 - Fat Joe - Misery Needs Company.mp3" does not contain data attribute.

Deleting entry 0x80cf9 "!!!Dupes - Removed" from index 0x5 ".": MFT record does not contain indexed attribute.

Deleting entry 0x27a8b4 “a.jpg" from index 0x4aa0 "!New Media - To Sort": MFT record is free.

Skipping further messages about deleted entries from "!New Media - To Sort".

Total deleted 84 enties from "!New Media - To Sort".

Deleting entry 0x2bbb8 "C59CD5349CFDB689-DFA59EE25701D297.itc" from index 0x2bbb7 "02": MFT record reference is not expected.

Deleting entry 0x28f865 "C59CD5349CFDB689-05EEED9B2CCF258A.itc" from index 0x80355 "05": MFT record is free.

Deleting entry 0x275030 "C59CD5349CFDB689-20DC32A05FD7E6E2.itc" from index 0x80552 "06": MFT record is free.

Deleting entry 0x23aea4 "C59CD5349CFDB689-9591D159830FE766.itc" from index 0x8057b "07": MFT record reference is not expected.

Deleting entry 0x80589 "C59CD5349CFDB689-240FF4A5F2E27E60.itc" from index 0x80588 "14": MFT record reference is not expected.

Deleting entry 0x274179 "C59CD5349CFDB689-95C17C9D169ADD8F.itc" from index 0x808a2 "13": MFT record is free.

Deleting entry 0x808bd "C59CD5349CFDB689-88AD02A9B50883A7.itc" from index 0x808bc "03": MFT record reference is not expected.

Deleting entry 0x80a99 "C59CD5349CFDB689-1B58C603BBD54D76.itc" from index 0x80a9d "13": MFT record reference is not expected.

Sorting index 0x30 "$I30" in file "!To Sort" (0x80d0a).

Deleting entry 0xb3f9e "02 Quality Control Part II.mp3" from index 0x80d0a "!To Sort": MFT record does not contain indexed attribute.

Deleting entry 0x27a46f "C59CD5349CFDB689-957F225AF6B112F7.itc" from index 0x80d82 "02": MFT record reference is not expected.

Deleting entry 0x27a46e "C59CD5349CFDB689-2C03BEEB6169D034.itc" from index 0x80dee "00": MFT record reference is not expected.

Deleting entry 0x27a59a "MiniKeePass — Secure Password Manager.tmp" from index 0x80fd9 "Downloads": MFT record reference is not expected.

Deleting entry 0x27502f "C59CD5349CFDB689-7E9B9EBEF8474152.itc" from index 0x81068 "01": MFT record is free.

Deleting entry 0x28f86e "C59CD5349CFDB689-933A29DA460544AD.itc" from index 0x812df "04": MFT record is free.

Deleting entry 0x8570b "C59CD5349CFDB689-15AA5A76AF4F1176.itc" from index 0x813f2 "01": MFT record reference is not expected.

Deleting entry 0x27a46d "C59CD5349CFDB689-16EA7290CDF9C589.itc" from index 0x83295 "05": MFT record reference is not expected.

Deleting entry 0x856fe "C59CD5349CFDB689-E2F64CE4AC848B17.itc" from index 0x837ab "11": MFT record reference is not expected.

Deleting entry 0x27a46c "C59CD5349CFDB689-56DF35A4718BAA84.itc" from index 0x837b3 "10": MFT record reference is not expected.

Correcting error in index 0x30 "$I30" for file 0x838c8.

Record 0x838c8, Update bitmap attribute "$I30".

Sorting index 0x30 "$I30" in file "!!!Manually DeDuped" (0x838c8).

Deleting entry 0x1ad746 "08 Find It Now.mp3" from index 0x838c8 "!!!Manually DeDuped": MFT record does not contain indexed attribute.

Deleting entry 0x28fd24 "C59CD5349CFDB689-A1C62EE6BCD29F76.itc" from index 0x8395c "15": MFT record is free.

Deleting entry 0x85707 "C59CD5349CFDB689-6F65D7EABEAFDEE7.itc" from index 0x83e4f "14": MFT record reference is not expected.

Deleting entry 0x1b15a6 "01 Morceau 1.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15a7 "03 Morceau 3.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15a8 "04 Morceau 4.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15a9 "05 Morceau 5.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15aa "06 Morceau 6.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15ab "07 Morceau 7.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15ac "08 Morceau 8.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15ad "10 Morceau 10.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x1b15ae "11 Morceau 11.m4a" from index 0x8405b "!Not Sure Needs Deleting!": MFT record does not contain indexed attribute.

Deleting entry 0x85706 "C59CD5349CFDB689-77C79C26AF42717C.itc" from index 0x84e9b "01": MFT record is not base.

Deleting entry 0x8570a "C59CD5349CFDB689-C228E3DF30F41C12.itc" from index 0x85443 "12": MFT record reference is not expected.

Deleting entry 0x856fe "C59CD5349CFDB689-B4466BEA9A6300AA.itc" from index 0x856fd "00": MFT record reference is not expected.

Deleting entry 0x85709 "C59CD5349CFDB689-939FCAF82243B13B.itc" from index 0x85708 "01": MFT record reference is not expected.

Deleting entry 0x23aea4 "sync.ffs_lock" from index 0x8ea4a "!New Pix [To Sort]": MFT record reference is not expected.

Correcting error in index 0x30 "$I30" for file 0x91d68.

Record 0x91d68, Delete orphan bitmap attribute "$I30".

Sorting index 0x30 "$I30" in file "App Dock" (0x91d68).

Deleting entry 0x2700f4 "01 Happiness.m4a" from index 0x123db6 "!!!Dupes": MFT record does not contain indexed attribute.

Deleting entry 0x26d4b7 "02 In Complete Darkness.m4a" from index 0x123db6 "!!!Dupes": MFT record does not contain indexed attribute.

Deleting entry 0x26d4b2 "05 Breaking Free.m4a" from index 0x123db6 "!!!Dupes": MFT record does not contain indexed attribute.

Deleting entry 0x26d4b0 "06 Dam Tuff.m4a" from index 0x123db6 "!!!Dupes": MFT record does not contain indexed attribute.

Skipping further messages about deleted entries from "!!!Dupes".

Total deleted 28 enties from "!!!Dupes".

Deleting entry 0x27a46b "sync.ffs_lock" from index 0x127811 "!New Videos": MFT record reference is not expected.

Deleting entry 0x27a471 "Wheel of Musical Impressions with Ariana Grande.mp4.ffs_tmp" from index 0x127811 "!New Videos": MFT record does not contain indexed attribute.

Deleting entry 0x23aeaa "sync.ffs_lock" from index 0x1d0c82 "Pix": MFT record is not base.

Deleting entry 0x27a800 "Screenshot 2016-04-25 at 1.58.29 am.png" from index 0x220b73 "Screenshots": MFT record is free.

Skipping further messages about deleted entries from "Screenshots".

Total deleted 178 enties from "Screenshots".

Deleting entry 0x26bc94 "C59CD5349CFDB689-6819DCC75AC31585.itc" from index 0x26bc93 "05": MFT record reference is not expected.

Deleting entry 0x270a8b "C59CD5349CFDB689-7A4FE6783571417B.itc" from index 0x270a89 "01": MFT record reference is not expected.

Deleting entry 0x28fdbe "10D88E13F8C953BA52-4A5B9FC2B28727D2.itc" from index 0x28fdbd "10": MFT record is free.

Minor inconsistencies detected on the volume. 907 files contain incorrect links count.

Recovering 907 orphan files...

Recovering orphaned file "Lightroom" (0x75c) into directory "App Dock" (0x91d68).

Recovering orphaned file "Google Photos Backup" (0xc03f) into directory "App Dock" (0x91d68).

Recovering orphaned file "Fotobounce" (0x1bc1f) into directory "App Dock" (0x91d68).

Recovering orphaned file "FaceFilter" (0x1bc26) into directory "App Dock" (0x91d68).

Recovering orphaned file "Dropbox" (0x1bc2c) into directory "App Dock" (0x91d68).

Recovering orphaned file "00 - Gettin' Aggressive [Moby & Mystikal - Blade II].mp3" (0x2840d) into directory "!!!Dupes" (0x123db6).

Recovering orphaned file "!Not Sure Needs Deleting!" (0x8405b) into directory "!!!Manually DeDuped" (0x838c8).

Recovering orphaned file "4Media DVD Ripper" (0x91d34) into directory "App Dock" (0x91d68).

Recovering orphaned file "Aperture Library.aplibrary" (0x91d38) into directory "App Dock" (0x91d68).

Recovering orphaned file "Icon" (0x91d69) into directory "App Dock" (0x91d68).

Skipping further messages about recovering orphans.

Recovered 682 orphans.

Detected 1 cycle(s) in directories tree.

File system check exit code is 11.

Updating boot support partitions for the volume as required.





SECOND REPAIR CYCLE:

Code:
Repairing file system.

Checking Volume /dev/rdisk1s1...

Type of the filesystem is NTFS.

Volume label is: Seagate Backup Plus 5Tb Drive.

Volume is marked as dirty.

File 0x2c598 "C59CD5349CFDB689-5CF9F35E01E3ABED.itc" does not contain data attribute.

File 0x8ea47 "iChat Icons" does not contain data attribute.

File 0x126ccc "02. They Still Gafflin.mp3" does not contain data attribute.

File 0x243138 "C59CD5349CFDB689-C11722F0F9DBAEA3.itc" does not contain data attribute.

File 0x2438a8 "C59CD5349CFDB689-DA5D1BE72BAC900B.itc" does not contain data attribute.

File 0x243971 "C59CD5349CFDB689-60FBD1FB58A8D45F.itc" does not contain data attribute.

File 0x27ae29 "0000000000.lij" does not contain data attribute.

File 0x27ae2a "0000000000.lij" does not contain data attribute.

File 0x294c21 "WC and The Maad Circle - West Up! (Feat. Ice Cube & Mack 10).mp3" does not contain data attribute.

File 0x2950f8 "09 - Catch 22.mp3" does not contain data attribute.

File 0x2950f9 "10 - Indiscretions In The Back Of The Limo Ft. T.I..mp3" does not contain data attribute.

File 0x2952f7 "11 - Fat Joe - Misery Needs Company.mp3" does not contain data attribute.

Recovering 225 orphan files...

Recovered 0 orphans.

Detected 1 cycle(s) in directories tree.

File system check exit code is 11.

Updating boot support partitions for the volume as required.





So I am thinking it moved the folder because of the "Detected 1 cycle(s) in directories tree” line. I don’t know what "File system check exit code is 11” is (?) and it seems that some issues couldn’t be sorted the first or second time around.

My obvious question is What can i do to fix all of this?

I seriously hope there is a smiple solution because that folder is about 3.5tb big and i don’t have another massive drive to copy the information to. Can I edit the folder structure so that the folder is back where it originally was or rebuild it somehow?



Please help asap!

Steve

[Wonko the Sane]

Whatever you are doing, STOP doing it, NOW.

 

You experienced - for whatever reasons - a serious corruption of the filesystem, and running "file system check" (whatever it is) BEFORE having made a disk image has been (with all due respect ) NOT the smartest idea.

 

The procedure is:
1) make a dd-like or "forensic sound" on another (new) disk drive with ddrescue or similar.

2) possibly make TWO of such images, i.e. an image from the original and an image from the copy [*]

3) analyze one of the copies with a recovery tool such as DMDE:

https://dmde.com/

 or the other "reference" tool, File Scavenger:

http://www.quetek.com/download.htm

 and see if the files or at least most of them are recoverable by "simply" copying them to (yet another) hard disk

4) if the files (as often happens with a "data" disk holding music or videos) are NOT fragmented this will (largely) succeed, the general idea is to save as many "good" files as you can get BEFORE attempting to modify ANYTHING on the disk, it is also possible that the filesystem structures are good enough to recover also the fragmented files, but this way, particularly if you made no image or only one image in steps #1, #2 allows to recover the recoverable before writing anything to the disk (which may possibly make matter worse).

5) Once the non fragmented files have been recovered you can try running the actual CHKDSK (and NOT ANY other program) to see if it manages to rebuild correctly more files and their indexing

6) if this fails re-copy image1 (untouched) over image2 and try with this other (excellent) tool:
http://www.ntfs.com/...ery-toolkit.htm

7) if the above doesn't work, re-copy the image1 to image2 and try with some other tool

 

I don't want to put it down more difficult than it is, hopefully you will be able to recover all your files in step #3 or #4 , but if this doesn't happen you will have the possibility of running other tools/try alternative methods.

 

Anyway, it won't likely be "simple" nor "fully automated" and definitely not "quick" . 

 

Depending on the value you attribute to your data you may want to consider to look for a professional data recovery service, and having one or two images allows you to do some experiment while leaving the possibility of giving the original disk to such a service, without losing any chance due to changes to the disk made by the failed attempts.

 

Rule of the thumb is that every single byte written to disk after a file system corruption while may well solve the problem, may well also make it a much bigger one.

 

Wonko

 

[*] Please understand how we do not really know the root cause of the corruption, it could be a hardware (actual disk drive) originated issue and IF this is the case you may have only one chance to image it

 

 

 

[steveyg777]

Thanks for the advice wonko. I am currently imaging the drive with software called "hdd raw copy tool" for Windows as i realised that ddrescue was for Linux and i haven't got a clue how to use it and haven't the time to mess around figuring it all out. This windows software is also "dd" software so should give the same result

I'll report back as to how i get on.

Ps- is there not any software that i could use to identify the music folder and change its location in the folder structure? Theoretically this would reverse what i think had happened?

[Wonko the Sane]

Yep , I understand, however "ddrescue" or similar are just a "further precaution", very likely *any* raw copy tool will do fine, the issue with those is IF (and I hope it is not your case) an error happens during the clone operation the operation might not be resumed correctly (or resumed at all and you would need to start again from scratch) it is only an "added prevention measure".

The issue in your case is that it is not clear what exactly happened (both the effects of the "stalling" you reported and of the consequent "attempt to fix"), and the risk with operating on a "live" filesystem is that *something* (like the OS "in background", some services, an update, etc.) may overwrite areas on disk that are currently un- or mis- indexed.

Greatly simplifying, a filesystem is like a book.

As an example imagine that you just printed a multipage document with chapters, index and all, then someone gets the not yet bound together pages and cuts away the bottom right corner (where the page numbers are), then another one comes by and inserts randomly a few tens pages coming from another document (printed with the same font, on same kind of paper, by the same printer and also without page numbers), and if this was not enough yet another one replaces a few random pages with blank sheets, and finally another one leaves the window open and a strong raft of wind scatters the pages all around the room.

Would you try to attempt to fix the mess immediately (as soon as you can, i.e. after first or second "sabotage") or you would wait until the other (mad) people can make the issue much worse?




Wonko

[steveyg777]

Lol very poetic

You didn't answer (i think?) about if i could find and edit the location of the folder from the mft though?

I have made a clone of the drive now but will take a while before i can look at it as when i last used my pc a few months back it was in a bit of a state and the user accounts had gone a bit doolally so I'm having to fix them / repair install win 10 again....

[Wonko the Sane]

You didn't answer (i think?) about if i could find and edit the location of the folder from the mft though?

I did (but you didn't notice it.

The issue is not much about finding the "location of the folder" (which is possible, of course) it is about the fact that possibly the folder doesn't exist anymore (or at least it doesn't exist in a coherent, verified to be "sound" - if you pardon me the pun - state).

The "verify on the drive" log you posted seems to contain the kind of errors that one would expect after a failed/not completed move operation, until the filesystem can be examined we cannot say how large or relevant the issues are, it may be a trifling issue that can be solved, a serious matter that will need a lengthy recover process or it could even be a "total disaster" .

In theory when you move a file on the same volume the file is not actually moved, i.e. it is not physically read from source location and written to target location, only the pointers to it are changed (this is the reason why moving a file even a very large one is very fast).

In the case of a folder (containing a zillion subfolders and/or files) the "move" operation is more complex as the OS needs to make a list of all the files involved, and then starts making changes to their indexes, seemingly (for *whatever* reason) your system bombed out halfway in the process and the result is an "undetermined" state, cannot really say what the result maybe, the "parent" folder might be still accessible but contain only a part of the files or ot could be "vanished" but the contents findable, or whole contents might be un-indexed, no way to know.


Wonko

[steveyg777]

I would upload a photo of what my pc is saying about the cloned drive but i can't seem to find an upload button. Is there a way to do this?

[Wonko the Sane]

I would upload a photo of what my pc is saying about the cloned drive but i can't seem to find an upload button. Is there a way to do this?

No, the attachment system is disabled until you have reached (cannot remember) 50 or 100 posts.

Use a free file hosting and post a link, example:

http://www.zippyshare.com/

 

Wonko

[steveyg777]

ok here you go. it seems maybe that the drive wasn't/cpuldn't be cloned properly? or maybe windows just interprets it that way?

 

http://www31.zippysh...NunQF/file.html

 

http://www31.zippysh...NunQF/file.html

Edited by steveyg777, 05 June 2016 - 03:38 PM.

[steveyg777]

When i plug in the original drive windows reports this (unsurprisingly):

 

http://www31.zippysh...ylPUH/file.html

 

and macrium reflect gives this overview of the two drives (the top one being the cloned drive):

 

http://www31.zippysh...YjSuY/file.html

 

when i tried cloning the drive macrium reflect it wouldn't give me the choice to copy all sectors (forensic mode) and reported that something was wrong (can't quite remember what it said) and could only clone in intelligent sector mode (basically copies only the sectors that have data on - I THINK????)

[Wonko the Sane]

 

when i tried cloning the drive macrium reflect it wouldn't give me the choice to copy all sectors (forensic mode) and reported that something was wrong (can't quite remember what it said) and could only clone in intelligent sector mode (basically copies only the sectors that have data on - I THINK????)

Well, then, for *whatever reason* that "clone" is NOT a clone (and its being not a clone means that it is perfectly useless and you need to make a "real" clone).

 

As a rule of thumb, whenever you find "automated", "intelligent" or "magic" in a software, the result will most likely be completely unlikely what you actually want .

 

You can use DMDE alright to make the clone, it is a little difficult/not really intuitive, but doable.

Run DMDE.

At the dialog to select device/disk choose "Cancel".

Go to the top menu ->Tools->Copy Sectors

Select Source and target. BE VERY CAREFUL, DOUBLE CHECK to have selected correctly the devices.

 

Given the HUGE size of that disk, the issue might be the time it takes, DMDE is not the fastest tool around, you may want to use Clonedisk:

http://reboot.pro/to...8480-clonedisk/
http://labalec.fr/erwan/?page_id=42

 

Which should be faster.

If you have doubts or questions abut the use of the one or the other software, ask for assistance/support BEFORE doing something you may later regret.

 

Wonko

[steveyg777]

Ok I'll give them a go. However i didn't actually use macrium reflect to clone the disk i was just seeing what it said if I tried to use it that's all. I used that "hdd raw copy tool" for Windows to do it. But anyway, even though i thought it would have done it right cos it finished the process it seems, like you say, it wasnt done correctly. I will try your recommendations. Can i use them even for free? I don't wanna pay for them when i don't know if it will be a waste of my time... And money

[steveyg777]

nope it gave the same results using clonedisk. i think I will have to use recovery software don't you?

[Wonko the Sane]

Sure,

Clonedisk is Free (as in free beer).

Dmde is a Commercial tool but has a Free version (with some limitations in the "file recovery part", that won't affect the "cloning part").

 

But if you used this:
http://hddguru.com/s...-Raw-Copy-Tool/

it should have worked .

 

Maybe that tool (that normally works) is not suitable for such a big hard disk (maybe it is a "native 4k" disk or - more likely - an AF or "512e" disk, and *somehow* the tool can't deal with non-512 or "translated" disk sectors) . 

 

Try and see what happens with either Clonedisk or DMDE, if neither can create a "good" clone, there is the possibility that the disk itself (hardware) has some issues (and that would "absolve" the MAC's finder and the Paragon driver), if this is the case, next step would be ddrescue (it's not like it can make miracles, but at least we will know from the log the specific areas that can - or cannot - be copied).

 

As a side note (and as a general rule) when cloning disks (particularly such big ones that will take a lot of time) it is a good idea to make sure that both source an target do not overheat, it is not a bad idea to have a fan cooling them.

 

Wonko 

 

P.s. saw your reply while replying to your previous post.

I don't know.

if both the hd raw tool and the clonedisk failed, it might really be that there is a hardware issue.

 

DMDE might be able to load partially the volume (or find some of its contents) but if the disk is not functioning  correctly it is really not a good idea, it may take ages (and hardly with positive results).

 

Which make/model is the disk?

Can you run on it the coresponding "manufacturer diagnostics" program? 

[steveyg777]

It's a Seagate Backup Plus desktop drive. I don't think heat during cloning was a problem. Both drives seemed quite quiet in the operation too. There is an app called Seagate tools (both Windows and dos versions, dos is the better more comprehensive version i gather). I could try running it but I'm guessing only to examine the disk with it and not to try to repair with it?

[Wonko the Sane]

It's a Seagate Backup Plus desktop drive. I don't think heat during cloning was a problem. Both drives seemed quite quiet in the operation too. There is an app called Seagate tools (both Windows and dos versions, dos is the better more comprehensive version i gather). I could try running it but I'm guessing only to examine the disk with it and not to try to repair with it?

Yes, that Seagate tool (or similar "manufacturer diagnostics" tools) only check that the disk is working correctly, typically they have a "short test" and a "long test".

You normally run the SMART test (that will normally reveal nothing of interest)

 

Then you run the "short test" and if result is OK you also run the "long test":

Of course if the "short test" fails there is no need to run the long one.

 

BUT, can you provide the actual EXACT model?

 

I mean, it is a "normal" disk inside a which make/model external case (or no-name or el-cheapo) or is it a Seagate "factory made" USB disk?

At least Western Digital, maybe Seagate also , make disks that have not any SATA connection but a direct USB one on the disk.

 

If you have some suitable hardware, (and if it is a "normal" SATA disk) it would be better/faster to connect it "directly" (not through USB) to a motherboard.

 

The Seagate guys say that you need to set "power options" appropriately to run the tests (if USB):

http://knowledge.sea...?language=en_US

 

Wonko

[steveyg777]

I really shouldn't need to mess around with taking it out of the caddy as it's only a few months old. Its the factory default caddy and drive:

http://www.argos.co....ber/3571093.htm

To my knowledge i don't think it would be some strange 'usb port on pcb' version (i hate them).

I will run the Seagate tools on it to see what result i get

[Wonko the Sane]

Maybe the issue is with sector size.

It is very likely that your (corrupted) USB disk drive is a "native 4k" (i.e. made of and exposing 4096 bytes sectors).

IF the "target" is a AF disk (particularly if directly connected, as an example connected to a SATA port) it will expose 512 bytes sectors (even if nternally it is 4096 bytes). 

 

It is possible that the image after all was successful, but simply the Disk Manager (and the other tools you tried) did not manage the "mismatching" of sector size.

Try using DMDE, try opening the "original" disk (Physicaldrive) and the "clone".

DMDE will provide automatically the "sensed parameters" of the disk, but you will be able (IF sector size is sensed differently) to "force" a sector size on the clone, so that (within DMDE) it will appear having the same contents.

 

Wonko

[steveyg777]

Oh ok. That's useful to know lol. I'll try that

[steveyg777]

" "force" a sector size on the clone"

 

ok im trying to use dmde. how do i do that?

 

should i just do a full scan first? how to change sector size?

[Wonko the Sane]

When you start dmde, you are asked to choose the device to work with.

You want to choose the "right" PhysicalDrive, typically if you have a single internal disk (from which you boot) that disk will be PhysicalDrive0 (first disk) and the "attached" disk via USB will be PhysicalDrive1 or second disk, etc..

The thingy will briefly autoscan the disk and show any partitions/volumes in the MBR partition table (or in the GPT one), hopefully with a green EBCF string next to each.

 

At this point (if you cannot see the same partitions as you see in the "original") you can try to open again the drive (Drive->Select Drive).

 

Now in the bottom of the popup dialog there should be a small pointed down arrow next to "Disk Parameters", if you click on it the dialog will enlarge.

On the right you will find "bps" (in this case it means "bytes per sector", if it is 512 change it to 4096 or viceversa, if it is 4096 change it to 512.

 

What happens next?

 

Wonko

[steveyg777]

ok thanks for the guidance. i've actually set a full scan going and is currently on 92%. Will this help?

 

it has found a lot of data (hopefully all!). the app claims to be able to repair file/folder structure doesn't it? is this what i could try to do?

[steveyg777]

well the scan found files but because it was scanning with the wrong sector size it wasn't worth it i don't think. when i did what you said and changed the sector size to 4096 the following happened!:

 

http://www24.zippysh...UDBbi/file.html

 

http://www24.zippysh...0Kuau/file.html

 

should i try to rebuild the structure (and if so how?) or do a full scan or something else?

[steveyg777]

i opened the volume but where the music folder should be it still wasn't there (probably as expected). can i rebuild the structure?