HDD crash, but healthy, SMART okay, help recover data, chkdsk orphan

[Iyceman]

Hey everyone. I need some help. Kindly excuse the long post, i'm trying to include as many details as possible. Also a bit shaken, so memory is a bit foggy. Please forgive if i have not used the exact terms for dialogues.

TLDR: Need to recover missing data, chkdsk did "deleting orphan file record segment", HDD seems physically fine

Preface:
I put computer to hibernate, or I left computer, and it went to sleep (hybrid). I don't recall, probably the first one. I had a few windows open, notepad, explorer, chrome, and a video paused. When i came to restart, it started and went to a bank screen. This happens once in a while, when some stuff is open and it sleeps, and it loads in about 5 minutes. It's an old install, maybe 7 years. I did not force restart, since i had things open. It ran with blank screen for about an hour while i did something else. Ctrl+Alt+Del or Ctrl+Shift+Esc did nothing. So i listened for any disk activity and held down the power button.

Trouble:
On startup, it gave me the resume or start normal options, don't recall exact words. I selected resume and it tired and went to BSOD. Next start, it went to widows startup repair. It ran for a bit but i didn't see any progress. In the remaining menus, i could see that the drive letters were all mixed up. I had C (windows), D & E. But it was trying to boot from E and repair windows on E.

At this point, i think i tried the other options in there. Nothing worked. I don't remember exactly how, but chkdsk was run and it did "deleting orphan file record segment" a lot. I stopped it as soon i saw a lot of scrolling. Tried a few restarts, but it always went to startup repair. So i installed windows on an empty SSD and booted up.

Troubleshooting:
I installed Defraggler and checked SMART on the problem drive. It was showing healthy. Drive does not make any new noise.

199 UltraDMA CRC Error Count 49 200 200 0 0x000000000031 has been the same since. All the other danger ones are at 0. Crash happened 3 days ago.

My C D and E is now showing as F G and E, it's in the wrong order. C, now F moved to the middle. My new windows is on the current C, and D,E,F,G on problem drive. D is the System reserved.

Now, the data on my D and E (original names) seemed fine. I ran chkdsk and then chkdsk /f on each. D and E finished without any bad remarks. C, with chkdsk /f started the "deleting orphan file record segment" scrolling again. So i quit.

I got another hard drive and copied all i needed from D and E. But C has me stumped. This is where i need help.

I opened C (original name) and there were some folders missing. I had a folder called downloads that was setup to be opened on the network. The Users folder and downloads folder could not be opened. "you need permission" I clicked okay. It took some time but opened. Things were missing.

I tried to take ownership on some folders but i get errors like, cannot find "x file", or it gets stuck on a file and drive makes a buzzing noise. I cant quit that, i have to log off.

In Users/My name/ Desktop, files and folders are missing. Some folders say location not found, corrupted. In the meanwhile, after a few restarts, C shows more folders. Some more items showed up in the downloads folder. Same with the default downloads folder. Some more files showed up.

Recuva cannot see anything new. And the problem folders give the same corrupt dialogue in Recuva.
Even folders i can open, that have some of the files, Recuva sees nothing new.
Forgot to add that every restart chkdsk comes on, and i quit. I checked, and only C (original) is marked dirty. I disabled the chkdsk in startup for c. (chkntfs)

I have tried to not do any write operations to C, except trying to take permission and ownership.
In startup repair, under diagnostic and repair details, the root cause is "System volume on disk is corrupt."


Please help me recover my data. Or what steps i have to follow. My order of priority would be : Data on desktop and Library folders.
Then, if possible, boot windows to get application data as well, like bookmarks and settings from some other apps.

I was a bit disorganised the past few years, because i was procrastinating a backup and reset. So i thought i'd do it all together and this happened. I don't know for sure what i lost, but most of it is important. I don't have many photos or videos on C. It's mostly documents.

Any help would be greatly appreciated. Thanks in advance.

 

[Iyceman]

I'd like to add that this is a 500 GB regular hard drive, WDC, and the problem partition is 70GB with about 65GB filled, which includes windows and other software installation. I'll add more information as i gather it. I'm on a different time zone to most of you, so please excuse any delayed replies.

 

[samuria]

Welcome to the forum. The problem is if check disk finds bad blocks it marks them as bad so any disk check won't report any errors as it does test the blocks mark bad so it gives a false idea. There is no point stopping check disk as the files can't be accessed anyway. Goto makers website and download there disk check you need to know how many bad blocks there to see if the is disk going to fail

 

[Iyceman]

Welcome to the forum. ...

Thank you for the quick response.

I'm not sure if i understand properly. Do you mean to say that the SMART program may be mistaken? I stopped chkdsk because i was afraid it would make more files inaccessible. I don't really know what "deleting orphan...." means. I just wanted the partition to be in as preserved a state as possible. I'm afraid that if i let chkdsk run, it will certainly make more files vanish. At this point, even getting file names is a relief. Just so i know what i lost.

As for the disk failing, it had zero problems copying the the other partitions, about 200GB each.

Last part is, go to Western Digital and get a disk check utility?

In the meanwhile, any recommendations to backup the problem partition? I'd like to make it clear that most of the files i can see, i can open. But files and folders are missing.

 

[samuria]

If the files are orphen they are lost as it doesn't know we're the file is like your house address missing no one would find you. Have you had bosd as lost files are down to shut down with files not written to disk. There two types of errors on disk bad blocks which is hardware and can't be fixed and file system errors which means disk is ok but files are screwed. That's why you want makers test to see which is the problem

 

[Iyceman]

.... Have you had bosd as lost files are down to shut down with files not written to disk. ...

Thank you for the continued support. I am having a bit of problem understanding you clearly.

1) What kind of recovery software should i use? I'm assuming / hoping they can find the "orphans".
2) I am not only looking files that i was working on when shut down. I don't think i had any. I'm looking for lots of other files.
3) Are you saying my files are lost either way?
4) Software and Firmware Downloads | WD Support This is what i'm looking for right? Will this edit / further damage data on the drive?

At the moment, im going folder by folder and backing up what i can see and is useful. Only the C:/Users/My Name folder is left to be done. Drive works normally as of now.

 

[samuria]

You could try recovery software but I don't hold out much hope if check disk can't find it then it's unlikely anything will. Again if you lost your home address you wouldn't know we're to look it could be anywhere in a city there is no clue street name or anything

 

[SIW2]

chdsk was repairing the filesystem. That doesn't necessarily indicate a physical problem with the disk.

Drive letter assignments are differnt form booted media ( recovery environment) no need to worry about that.

I would suggest booting windows repair media and letting chkdsk run on your windows partition ( whatever letter that is shown as from booted media).

Maybe that will fix the problem.

If not, then you can try data recovery software.

 

[Iyceman]

You could try recovery software but I don't hold out much hope if check disk can't find it then it's unlikely anything will....

...
I would suggest booting windows repair media and letting chkdsk run on your windows partition ( whatever letter that is shown as from booted media)....

Thanks, for the replies.

I've just finished copying all that i could find and see from my C (old). But things are still missing. I could be wrong, but i feel chkdisk is what caused my problem in the first place.

What i understand is, i should try repairing C (old) with a windows DVD (or pen drive), correct? Should i do chkdsk or startup repair? or both? in what order?

My current plan is to run a pass of recovery software on the drive as is. Before i run anything that will write to the drive. Should i not?

I have planned to use PhotoRec. Any suggestions? By the time i wrote this, i did a pass of PhotoRec with Whole and Unallocated only. (But PhotoRec does not recognise or recover *.xps files. I have a lot of those.)

Next i plan to try repair using TestDisk, then see. And then Windows Startup Repair. Please let me know if i need to change the order or do something else.

My files are more important that the OS.

Also,

4) Software and Firmware Downloads | WD Support This is what i'm looking for right? Will this edit / further damage data on the drive?

Thanks again.

 

[SIW2]

It sounds like there was damage to the filesystem. chkdsk does not cause that. On the contrary, it tries to fix it where possible.

You could try running some data recovery software beforehand, how successful it is it will depend what and where the damage is. Maybe one of the free programs will do the job, but that is not always the case.

If you end up deciding to get paid data recovery software, Find & Restore Lost Files: Undelete deleted files and recover damaged disks has done well for many on this forum and is about half the cost of the others. The paid programs will scan first. Then if it finds the data, you need to purchase a license for it to do the recovery.

 

[Iyceman]

It

Quick question:
Is this correct? I have attached a screenshot. The * is on the 100MB partition. My Win7 was on the second one. Should i interchange them? i.e. P and *