Files lost after chkdsk - set to zero

[Nennad]

Hello,
If anyone can help me with the problem i have with few of my files and how to restore them. My OS is Windows XP, NTFS filesistem, 160 gb hdd (happily, windows is located on second hdd, so damaged disk is not so much exposed).
After i restarted computer CHKDSK checked for problems and did some changes involving:
....
Deleting corrupt attribute record (128, "")...
and
Inserting data attribute into file 36015...
....

After boot, some of my very important files (about 10mb each before loss, 10 of them in same folder) are listed as zero byte files - they contain 0 bytes!

I learned afterwards that that zero files are those from chk log, so their attributes have been changed/replaced by chkdsk, so probably that is what caused my files to became unusable, zero bytes. Is there a way to recover them? To "undo" what chkdsk has done, or to repair those files?

Thanks

[Nennad]

Something from my recent thoughts... the files that i lost have always same header readable by plain text editor :

{
version
 {
 number 8
 }

Is it possible to find lost file content by searching whole disk with some app for that text string?


?

[Tom]

You can try an iRecover run to see if files come up, but i'm not confident they will. Be sure to use the trial before buying, the trial allows files to be recovered so you can see if the program can help you. The trial may even be all you need if you have just a few files to recover. Be sure to check the settings in the advanced configuration menu; you may need to tweak some things when looking for files that are now chk files. The settings are mostly self explanatory, just use your common sense to change settings if needed, or ask about them here.
It is possible to search the disk using a hex or disk editor but putting the files back together after you've found the strings is next to impossible without specific information about these files; doing this manually is not going to work.
In all, I don't think you have a good chance to get these files back, but try iRecover. And get working on a backup regime, it's not good practice to lose important files by not having copies of them somewhere safe.

[Nennad]

Hello Tom thanks for your reply. As far as i can see there are only few of chk files but not related to lost ones...
Problem is that the files are actually not deleted but present with zero value so the recovery programs threat them as OK.

I used hex viewer to search through the disc, and found, if Free Space, parts of my files, but not consistent, not in one piece, as you said, hardly can i reassemble them by hand, though they are human-readable-i can see it start and even i can reckognise the end of file... but they are probably scrambled....
and my worst fear is that they are partially overwritten...or defragmented.

Thanks for clues though

[Tom]

Yes, your assessment seems to be right. I don't think you'll get this fixed, although the iRecover run is still recommended; you have nothing to lose. iRecover may still find the original versions of those files as doubles, or something may turn up when scavenging the lost files. Worth a try. Make sure to set the options to include what you need it to find.

[Nennad]

Good guess, maybe the file clusters i have seen are some doubles or fragments that are not connected to maybe existing and preserved files   
Ill give it a try... problem may be if the system scan is long, my computer will restart (i noticed that last nights on various long scans)...
Please what do you reccomend me for config of iRecover run?

I repeat that it seems that my disc has not any mayor "burning" malfunctionality (bad sectors etc.), i would like to focus software on maybe existance of multiple MFTs, cross chains, attributtes and other tricky issues and what not...

Anyhow i contacted my client that i am failing on contract - deadline clausule  and they are very unhappy... but if i could turn back time with iRecover it would shurely make me buy the software... 

[Tom]

In 'common filesystem analysis' change the 'filter out' settings to make sure you get to see everything. This will lead to a polluted file tree, but at the same time gives you the best chance of seeing everything that is found. Enforcing the file system type will make the scan a little quicker. You can tweak the NTFS/mft settings if you want, but iRecover handles things very well with default settings there.

[Nennad]

Hmm something always went wrong during scan while im sleepin or i am not present... in the morning i found that probably computer restarted (but there is no serious recover error?) or application closed. Today i went to work and left iRescue to scan, even set my IP camera to monitor situation, but when i arrived at work and looked computer was shut down(!).

Anyway, i peered into a log file and found something of interest, maybe. The record mention some attribute mess so it may be something to do with my data loss. what do you say?

ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3082

I am noob at this, but could this attr type, real size=0 and found 3082, that attribute disagreement message etc be link to my missing files? 

Thanks, Nenad

Start part of the log:

CF=2: 99,1%
Determined CF=1
Simple volume - Detect parameters started
Solver purged 0 B
Performance: Ident data query (1323 of 118103) 0s
Performance: Ident data query (79289 of 118103) 0s
Volume information:3.1,Dirty
ALERT!: $DATA attribute disagreement @ FRSID hint 305
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3082
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1676
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3082
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 4794
ALERT!: $DATA attribute disagreement @ FRSID hint 421
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8406
ALERT!: $DATA attribute disagreement @ FRSID hint 424
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7217
ALERT!: $DATA attribute disagreement @ FRSID hint 449
ALERT!: $DATA attribute disagreement @ FRSID hint 2597
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8406
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7217
ALERT!: $DATA attribute disagreement @ FRSID hint 12548
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 4692
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8717
ALERT!: $DATA attribute disagreement @ FRSID hint 12562
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 21777
ALERT!: $DATA attribute disagreement @ FRSID hint 22091
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1453
ALERT!: $DATA attribute disagreement @ FRSID hint 33891
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3059
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7392
ALERT!: $DATA attribute disagreement @ FRSID hint 35936
ALERT!: $DATA attribute disagreement @ FRSID hint 35936
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 101565
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 102871
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 104879
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 106376
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 108220
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 109720
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 110961
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 111682
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 99043
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 101565
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 102871
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 104879
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 106376
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 108220
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 109720
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 110961
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 111682
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7184
ALERT!: $DATA attribute disagreement @ FRSID hint 33796
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1453
Volume information:3.1,Dirty
MFT regions dump

[Joep]

Hello,

The piece of log doesn't expain the hang. Indeed they reflect inconsistent MFT entries, we can't recover those files. maybe the last hundred lines of the log can explain why iRecover is hanging/crashing. Can you paste those please?

Regarding the lost files: Do you have a bunch filennnn.chk files? What kind of files were the lost files?

The PC shutting down is something I have never observed and may indicate some more structural (hardware) problem (broken memory - maybe the cause for the corruption as well?).

[Nennad]

Hey Joep,
Im pretty sure that system estar was not caused by application. I believe that it have to do with power line here or simmilar issue... maybe poltergeists . Computer never chrashes when i am present, and i am tormenting him with heavy 3d app/photoshop mnipulating/rendering. RAM is good quality Mushkin memory, mb and power supply are also new, and processor too (45nm dual core, intel). For now im blaming HD where data were, cause he stops the sistem at boot time from time to time, and asks by chkdsk to be checked, what destroyed files - i studied chkdsk log and my lost zero-bytes files, it can be seen that ChkDsk explecitly Messed attributtes of my files.
I will replace that disk and see if some of problems persist, making sure that i backup more often .
Ill try to run more tests (more for sake of investigation, i have admitted to myself that i lost files).
As for chk files, not many of them and they are not connected to lost files anyway.
BTW. that files were Poser 8 *.pz3 and vawefront *.obj files.

Thanks all for bearing with me

Code:

Init done - logging
Init start - misc
Init done - misc
Init start - types
Init done - types
Init start - caches
Init done - caches
Thread startup: copier, TID 00000CCC
Optimizing for 0 CPU(s)
Init start - files
Init done - files
Init start - ident processing
Performance: Ident data query (3 of 3) 0s
Performance: Ident data query (9 of 9) 0s
Performance: Ident data query (2 of 9) 0s
Init done - ident processing
Init start - physical devices
Init done - physical devices
File management init done with a status of 88
NT 5.1.2600 Service Pack 3; 3454 MB RAM
Open physical drive 00000100 success, 149 GB : Maxtor 6V160E0 - Port 2, Bus 0, Target 1, LUN 0; maxLBA=312581808
Open physical drive 00000101 success, 152 GB : Maxtor 6L160M0 - Port 3, Bus 0, Target 0, LUN 0; maxLBA=320173056
Sector 0, row 1 - 63/312576642 @ base 0 - NTFS
Sector 0, row 2 - 0/0 @ base 0 - Empty
Sector 0, row 3 - 0/0 @ base 0 - Empty
Sector 0, row 4 - 0/0 @ base 0 - Empty
Ldm: started processing of the device 0100
PRIVHEAD dump
Version       : 02.0B
Disk ID       : ffc34b4d-690d-419d-a0be-80c39e281fb8
Host ID       : 1b77da20-c717-11d0-a5be-00a0c91db73c
Disk group ID : d81aaf61-3c0f-433d-adb9-5a0f93d4ff51
Disk start    : 63
Disk size     : 312579697, 149 GB
Ldm: device 0100 shift 63
VBLK dump
Group number        : 0x00000004
Record number/Total : 0/1
Data length         : 84
Record type/flags   : 51/02
VBLK type           : Volume
Object ID           : 0406
Object name         : 566F6C756D6531 (Volume1)
Volume type         : 67656E (gen)
Number of children  : 01
Size                : 12A19671
Partition type      : 0x07
VBLK dump
Group number        : 0x00000002
Record number/Total : 0/1
Data length         : 71
Record type/flags   : 35/08
VBLK type           : Disk Group
Object ID           : 0401
Object name         : 4E656E6164446730 (NenadDg0)
VBLK dump
Group number        : 0x00000006
Record number/Total : 0/1
Data length         : 48
Record type/flags   : 32/00
VBLK type           : Component
Object ID           : 0408
Object name         : 566F6C756D65312D3031 (Volume1-01)
Component type      : 02
Number of children  : 01
Parent ID           : 0406
Sripe size          :
Number of columns   :
VBLK dump
Group number        : 0x00000001
Record number/Total : 0/1
Data length         : 59
Record type/flags   : 34/00
VBLK type           : Disk
Object ID           : 0403
Object name         : 4469736B31 (Disk1)
Disk object ID (r3) : 66666333346234642D363930642D343139642D613062652D383063333965323831666238 (ffc34b4d-690d-419d-a0be-80c39e281fb8)
Disk GUID (r5)      : {00000000-0000-0000-0000-000000000000}
VBLK dump
Group number        : 0x00000007
Record number/Total : 0/1
Data length         : 51
Record type/flags   : 33/00
VBLK type           : Partition
Object ID           : 040A
Object name         : 4469736B312D3031 (Disk1-01)
Start               : 0 (0 B)
Volume offset       : 0 (0 B)
Parent ID           : 0408
Disk object ID      : 0403
Partition index     :
PRIVHEAD dump
Version       : 02.0B
Disk ID       : ffc34b4d-690d-419d-a0be-80c39e281fb8
Host ID       : 1b77da20-c717-11d0-a5be-00a0c91db73c
Disk group ID : d81aaf61-3c0f-433d-adb9-5a0f93d4ff51
Disk start    : 63
Disk size     : 312579697, 149 GB
Ldm: device 0100 shift 63
PRIVHEAD dump
Version       : 02.0B
Disk ID       : ffc34b4d-690d-419d-a0be-80c39e281fb8
Host ID       : 1b77da20-c717-11d0-a5be-00a0c91db73c
Disk group ID : d81aaf61-3c0f-433d-adb9-5a0f93d4ff51
Disk start    : 63
Disk size     : 312579697, 149 GB
Ldm: device 0100 shift 63
Ldm: started processing of the device 0101
Processing volume 566F6C756D6531 (Volume1)
  Found a total of 1 matching component(s); (1 children in volume)
  Processing component 566F6C756D65312D3031 (Volume1-01)
    Found a total of 1 matching partition(s); (1 children in component)
    Processing partition 4469736B312D3031 (Disk1-01); index 0; volume offset 0 B
      Disk GUID {FFC34B4D-690D-419D-A0BE-80C39E281FB8}
      Physical disk ID 0100
Processing volume ID 00000100
-------------------------------------
Volume information for ID 00000100
Origin             : LDM/Dynamic
Partition type     : NTFS
Capacity           : 149 GB
Number of sectors  : 312579697
RAID type          : Simple volume
Stripe size        : 1
Rotation parameters: 0 / 0
Member 00          : 312579697 sectors at LBA 63 on device 0100
---Start S.M.A.R.T. data for device Maxtor 6V160E0 - Port 2, Bus 0, Target 1, LUN 0, ID 0100
                               Attribute - Val -Worst-Thresh- Raw
                            Spin Up Time - 208 - 208 -   63 -  000016F7
                        Start/Stop Count - 253 - 253 -    0 -  00000021
               Reallocated Sectors Count - 253 - 253 -   63 -  00000000
                         Seek Error Rate - 253 - 252 -    0 -  00000000
                   Seek Time Performance - 251 - 238 -  187 -  0000BDC8
                    Power On Hours Count - 241 - 241 -    0 -  000010BD
                        Spin Retry Count - 253 - 252 -  157 -  00000000
               Recalibration Retry Count - 253 - 252 -  223 -  00000000
                       Power Cycle Count - 253 - 253 -    0 -  00000030
                 Unknown attribute (189) - 100 - 100 -    0 -  00000000
                 Unknown attribute (190) -  79 -  46 -    0 -  15150015
           Power Off/Retract Cycle Count - 253 - 253 -    0 -  00000000
                 Load/Unload Cycle Count - 253 - 253 -    0 -  00000000
                             Temperature -  42 - 253 -    0 -  00000015
                  Hardware ECC Recovered - 253 - 252 -    0 -  0000061D
               Reallocation Events Count - 253 - 253 -    0 -  00000000
            Current Pending Sector Count - 253 - 253 -    0 -  00000000
    Off-Line Uncorrectable Sectors Count - 253 - 253 -    0 -  00000000
                Ultra DMA CRC Error Rate -   1 -   1 -    0 -  0000248E
                        Write Error Rate - 253 - 252 -    0 -  00000000
                     TA Counter Detected - 253 - 252 -    0 -  00000000
                    TA Counter Decreased - 253 - 252 -    0 -  00000000
                 Unknown attribute (203) - 253 - 252 -  180 -  00000000
                 Unknown attribute (204) - 253 - 252 -    0 -  00000000
                 Unknown attribute (205) - 253 - 252 -    0 -  00000000
                 Unknown attribute (207) - 253 - 252 -    0 -  00000000
                 Unknown attribute (208) - 253 - 252 -    0 -  00000000
                 Unknown attribute (210) - 253 - 252 -    0 -  00000000
                 Unknown attribute (211) - 253 - 252 -    0 -  00000000
                 Unknown attribute (212) - 253 - 252 -    0 -  00000000
---  End S.M.A.R.T. data for device Maxtor 6V160E0 - Port 2, Bus 0, Target 1, LUN 0, ID 0100
-------------------------------------
Volume information for ID 00000100
Origin             : LDM/Dynamic
Partition type     : NTFS
Capacity           : 149 GB
Number of sectors  : 312579697
RAID type          : Simple volume
Stripe size        : 1
Rotation parameters: 0 / 0
Member 00          : 312579697 sectors at LBA 63 on device 0100
---Start S.M.A.R.T. data for device Maxtor 6V160E0 - Port 2, Bus 0, Target 1, LUN 0, ID 0100
                               Attribute - Val -Worst-Thresh- Raw
                            Spin Up Time - 208 - 208 -   63 -  000016F7
                        Start/Stop Count - 253 - 253 -    0 -  00000021
               Reallocated Sectors Count - 253 - 253 -   63 -  00000000
                         Seek Error Rate - 253 - 252 -    0 -  00000000
                   Seek Time Performance - 251 - 238 -  187 -  0000BDCB
                    Power On Hours Count - 241 - 241 -    0 -  000010BD
                        Spin Retry Count - 253 - 252 -  157 -  00000000
               Recalibration Retry Count - 253 - 252 -  223 -  00000000
                       Power Cycle Count - 253 - 253 -    0 -  00000030
                 Unknown attribute (189) - 100 - 100 -    0 -  00000000
                 Unknown attribute (190) -  79 -  46 -    0 -  15150015
           Power Off/Retract Cycle Count - 253 - 253 -    0 -  00000000
                 Load/Unload Cycle Count - 253 - 253 -    0 -  00000000
                             Temperature -  42 - 253 -    0 -  00000015
                  Hardware ECC Recovered - 253 - 252 -    0 -  0000061D
               Reallocation Events Count - 253 - 253 -    0 -  00000000
            Current Pending Sector Count - 253 - 253 -    0 -  00000000
    Off-Line Uncorrectable Sectors Count - 253 - 253 -    0 -  00000000
                Ultra DMA CRC Error Rate -   1 -   1 -    0 -  0000249E
                        Write Error Rate - 253 - 252 -    0 -  00000000
                     TA Counter Detected - 253 - 252 -    0 -  00000000
                    TA Counter Decreased - 253 - 252 -    0 -  00000000
                 Unknown attribute (203) - 253 - 252 -  180 -  00000000
                 Unknown attribute (204) - 253 - 252 -    0 -  00000000
                 Unknown attribute (205) - 253 - 252 -    0 -  00000000
                 Unknown attribute (207) - 253 - 252 -    0 -  00000000
                 Unknown attribute (208) - 253 - 252 -    0 -  00000000
                 Unknown attribute (210) - 253 - 252 -    0 -  00000000
                 Unknown attribute (211) - 253 - 252 -    0 -  00000000
                 Unknown attribute (212) - 253 - 252 -    0 -  00000000
---  End S.M.A.R.T. data for device Maxtor 6V160E0 - Port 2, Bus 0, Target 1, LUN 0, ID 0100
Starting raw scanner for a total of 312579697 sectors
Raw scanner starting on disk 0100 from LBA 63 to LBA 312579760
ALERT!: MFT entry with alloc size 0 was encountered during identification; Base record ID 2D6C3B04
QS LSIDE: 79289
QS RSIDE: 7918
AS start
Performance: Ident data query (118103 of 118103) 0s
Performance: Ident data query (0 of 0) 0s
AS done
Object count : Unknown 0
Object count : Physcially bad 0
Object count : FAT16 boot sector 0
Object count : FAT32 boot sector 0
Object count : FAT16 sector 5369
Object count : FAT32 sector 6787
Object count : NTFS boot sector 1
Object count : NTFS MFT entry 79289
Object count : NTFS INDX block 1323
Object count : NTFS RSTR block 2
Object count : NTFS RCRD block 16382
Object count : ext2/3 superblock 1
Object count : ext2/3 inodes 0
Object count : ext2/3 directory start 0
Object count : JFS superblock 0
Object count : ReiserFs superblock 0
Object count : Whole FAT directory 0
Object count : Start of FAT directory 0
Object count : FAT directory run 1031
Object count : GIF image 4499
Object count : JPEG image 1558
Object count : TIFF image 90
Object count : WAV sound 14
Object count : ZIP archive 61
Object count : RAR archive 1
Object count : EXE/DLL DOS/Windows executable module 151
Object count : OLE Structured Storage 118
Object count : MP4 video 33
Object count : Adobe PDF 23
Object count : PNG image 348
Object count : Real Media 0
Object count : LNK shortcut 0
Object count : MIDI 0
Object count : CAB archive 10
Object count : CHM help file 2
Object count : CRW Canon raw image 0
Object count : MOV Quick Time movie 51
Object count : ICM color profile 0
Object count : GZip archive 532
Object count : Olympus RAW (ORF) 1
Object count : AVI video 20
Object count : AMR audio 0
Object count : BMP bitmap image 406
ALERT!: File system type override in effect -> NTFS
Detected filesystem type : NTFS
Simple volume - Detect parameters start
Performance: Ident data query (7918 of 118103) 0s
CF=2: 99,1%
Determined CF=1
Simple volume - Detect parameters started
Solver purged 0 B
Performance: Ident data query (1323 of 118103) 0s
Performance: Ident data query (79289 of 118103) 0s
Volume information:3.1,Dirty
ALERT!: $DATA attribute disagreement @ FRSID hint 305
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3082
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1676
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3082
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 4794
ALERT!: $DATA attribute disagreement @ FRSID hint 421
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8406
ALERT!: $DATA attribute disagreement @ FRSID hint 424
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7217
ALERT!: $DATA attribute disagreement @ FRSID hint 449
ALERT!: $DATA attribute disagreement @ FRSID hint 2597
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8406
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7217
ALERT!: $DATA attribute disagreement @ FRSID hint 12548
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 4692
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 8717
ALERT!: $DATA attribute disagreement @ FRSID hint 12562
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 21777
ALERT!: $DATA attribute disagreement @ FRSID hint 22091
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1453
ALERT!: $DATA attribute disagreement @ FRSID hint 33891
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 3059
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7392
ALERT!: $DATA attribute disagreement @ FRSID hint 35936
ALERT!: $DATA attribute disagreement @ FRSID hint 35936
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 101565
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 102871
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 104879
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 106376
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 108220
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 109720
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 110961
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=574241872; AllocSize=0; RlCount=9; Need 99043, found 111682
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 99043
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 101565
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 102871
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 104879
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 106376
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 108220
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 109720
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 110961
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 111682
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 7184
ALERT!: $DATA attribute disagreement @ FRSID hint 33796
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=0; AllocSize=0; RlCount=1; Need 0, found 1453
Volume information:3.1,Dirty
MFT regions dump
00: FrsId 0 len 47915 @ LBA 6291456
01: FrsId 47916 len 12274 @ LBA 6387288
02: FrsId 60192 len 19096 @ LBA 6411840
Performance: Ident data query (9241 of 118103) 0s
Init done - logging
Init start - misc
Init done - misc
Init start - types
Init done - types
Init start - caches
Init done - caches
Thread startup: copier, TID 00000D94
Optimizing for 0 CPU(s)
Init start - files
Init done - files
Init start - ident processing
Performance: Ident data query (3 of 3) 0s
Performance: Ident data query (9 of 9) 0s
Performance: Ident data query (2 of 9) 0s
Init done - ident processing
Init start - physical devices
Init done - physical devices
File management init done with a status of 88
NT 5.1.2600 Service Pack 3; 3454 MB RAM
TS: Stop validation
TS: Stopped validation
Solver purged 0
Logging - shut down

[Joep]

Hello,

It appears iRecover got as far as dumping the MFT regions to the logfile, it's going to do volume analysis at that point (cluster size and so on). Then log shows an init indicating iRecover was started again. Can't explain what is happening there.

If you do not trust the hd itself it may be a good idea to clone or image it. If you have plenty of space available you can use iRecover to create an image file (to another disk of course), and then analyze the image file using iRecover. Another option is to clone the disk entirely using DiskPatch.

[Nennad]

Hey thanks! Sorry to confuse you. IRecover was started again by me later, and that was includid in log! 

Ill try to run the full scan later, and ill try to be present to see whats happening.
Currently i am "recovering" lost files by making the all work again