Data corruption caused by CHKDSK

[puki]

Hi,

I've come to the same situation as described in this topic http://www.diydatarecovery.nl/forum/index.php/topic,520.0.html

As I have no backup (my BIG mistake), the only possible solution for me is to try iRecover.

I've tried the iRecover demo and it shows the file in red. Which according to the legend means: Presumably invalid (broken) file.
Does this mean that the file can be recovered ?
Is there a way to find out more information ?

Probably this is important also: this is not a hard drive, it's a vmware vmdk virtual drive which is currently mapped to another virtual machine as additional disk.

Thanks,
puki

[Tom]

Probably this is important also: this is not a hard drive, it's a vmware vmdk virtual drive which is currently mapped to another virtual machine as additional disk.

If you access this disk as any other disk (meaning, from VMware or as a virtual disk, not as a file on a disk somewhere) it shouldn't make a difference; VMware treats the virtual disk as any other hardware disk, and therefore so does iRecover.
The red indication doesn't necessarily mean bad things, it just means that the file could not be validated. You have one option: try. Remember, if you buy a license and things don't work out, we have a refund policy. Read more here:
http://www.diydatarecovery.nl/FAQ_custservice.htm#F3

But, as stated in the thread you referenced, be prepared for the worst.

[puki]

Thanks for reply, I'll give it a try.
I will post the results afterwards.

But, as stated in the thread you referenced, be prepared for the worst.

I thought chkdsk is a tool which fixes things. But this was the worst assumption :-)

[Tom]

I thought chkdsk is a tool which fixes things. But this was the worst assumption

Well, it does: it fixes the file system. Unfortunately that means that if files themselves are "in the way" they will simply be deleted. Chkdsk favors the integrity of the file system, not of the files. That's why running chkdsk in a recovery situation is never a good idea.

[puki]

So I tried iRecover and my worst nightmares became true. It does not recover the files. Instead of recovering them, it just copies the zero sized files like many other software I tried.

Any recommendations for settings or something else to try again ?

[Joep]

Hello,

If iRecover lists the files as 0 KB files then they will be recovered as 0 KB files. Did you also include deleted files (in recovery mode selection screen? That could be worth a try.

Other than that: if chkdsk really modified MFT entries for all files and set their size to 0 KB then the only way to recover (unfragmented) files is by using a raw scanner. Rather than relying on file system structures it scans the disk for known file headers. For example, each JPG file starts with a specific signature. If such a signature is found the software will create a file like 'file0244.jpg'. So you'll end up with a lot of files for which no file name is known. You can do this for all kind of files. A utility that can recover files using this method is Davory from www.winhex.com.

[puki]

Hello,

I tried including deleted files also, but no success. I am loosing all hopes.
Are there any other options to try, or is it time to give up with iRecover ?

I already tried raw scanning the disk. I don't know why, but more softwares found a version of the file I'm looking for from 08-2009. I have updated this file (it's an XLS) regularly and last changes before corruption were from 09-2010. I don't remember any copying or moving of this file ever in its history so I don't understand where all these softwares get the old version from.

[Joep]

Hello,

Since it will not take much of your time I'd run iUndelete as well. Chkdsk may simply have deleted the file. But deleted files are the first to be overwritten, so it's just a long shot. If you want us to refund iRecover EMAIL or PM us an order ID.