Recovered files unreadable

[goanddo]

I was unable to delete a file in Windows 10 yesterday so I tried a few things at a command prompt including rmdir. Somehow it deleted half the folders in an entirely different directory... well over 1,000 files that I'd spent the better part of a week working on.

It's an external drive only used for storage - no programs on it or accessing it, and except for a handful of files Recuva said they were all recoverable. So I ran it and got about 100 of them back (I restored from the external D: drive to a folder on the C: drive), but the rest got a drive not ready error. So I ran it again and this time had Windows Explorer open so I could click the external drive every minute or two (for six hours) so it wouldn't go to sleep. It worked! And all the files were recovered.

I notice, however, that about 100 of them have 0KB file size, and at least another 100-200 have a file size much smaller than it should be. Even worse than that, however, is that all of the files seem to be unreadable... video files can't play the file because it's unsupported, incorrect extension, or is corrupt (for media files); graphic files open to a blank screen; PDF files just say We can't open this file, something went wrong.

So nothing has been saved or work done on the external drive other than viewing it in Explorer, the files say they recovered, but something is wrong with them all.

I'll keep looking for answers, but any input is appreciated; I have one week to finish writing a book and having this taken care of would be a great help! Thank you.

[abolibibelot]

Quote

I was unable to delete a file in Windows 10 yesterday so I tried a few things at a command prompt including rmdir.

Chances are, the drive was faulty to begin with and that was the cause of the deletion issue... In which case, chances are you only made it worse with each attempt.

Quote

Somehow it deleted half the folders in an entirely different directory...

How the Hell did that happen ? O_o

Quote

It's an external drive only used for storage - no programs on it or accessing it, and except for a handful of files Recuva said they were all recoverable. So I ran it and got about 100 of them back (I restored from the external D: drive to a folder on the C: drive), but the rest got a drive not ready error.

Recuva can only assess if files appear to be in good condition from a logical / filesystem standpoint, it can not assess if their sectors are physically accessible.

Quote

So I ran it again and this time had Windows Explorer open so I could click the external drive every minute or two (for six hours) so it wouldn't go to sleep. It worked!

And you strained a most likely defective drive a whole lot more...

Quote

Even worse than that, however, is that all of the files seem to be unreadable... video files can't play the file because it's unsupported, incorrect extension, or is corrupt (for media files); graphic files open to a blank screen; PDF files just say We can't open this file, something went wrong.

To assess what is actually contained in those files you can open them in a hexadecimal editor — HxD is freeware and sufficient for that purpose, WinHex is not free but is much more complete (merely viewing files is possible with no license though) ; but it requires some experience to instantly see whether a file of a given format appears as it should or not (for instance a JPG picture always begins with "FF D8 FF", an EXE file always begins with "4D 5A 90" and so on) — although, obiously, if it contains only "00" bytes then there's nothing to read whatsoever.

Now... to assess the physical condition of the drive, run anything that will show you its "SMART" status — free tools like CrystalDiskInfo (be sure to select the right drive based on its brand / model / serial number if you have several connected), or the free version of HDTune (click on the "Health" tab), or better but not free HD Sentinel (which has the advantage of issuing warnings at the first sign of trouble, hopefully letting the user deal with it before it's too late — which is probably where you are right now). If every line has an "OK" status in HDTune, or if every line has a blue dot and the global condition is “Good” in CrystalDiskInfo, then the drive should be physically fine, and the cause lies somewhere else. If there are warnings, especially concerning the lines "Reallocated sector count", "Current pending sector count", "Uncorrectable sector count", then the drive is physically failing. Depending on how many defective sectors it currently has, you may or may not be able to attempt a do-it-yourself recovery (I would say that it's safe if there are less than about 10 bad sectors, tricky but doable if there are up to 100, hazardous if there are up to 1000, and beyond that it's a recipe for disaster). To do that as safely as possible, it is necessary to first perform a clone or image of the whole drive ; tools of choice for this are ddrescue (Linux command line program) and HDDSuperClone (Linux GUI program) ; this ISO (a custom Lubuntu distribution made by the author of HDDSC) contains both, as well as a few complimentary tools to assist with the recovery process. But if you already created a whole other issue when trying to delete that one file from the command prompt, no offense, but you might make it worse again trying to fix this yourself (although there may be an explanation other than a screw-up on your part — see below). Best course of action at this point (if there are signs of physical failure, and if the drive indeed contains valuable and non backed-up data) would be to bring it to a dedicated data recovery company (not a general purpose computer repair shop). It's quite expensive, but it will get you the best possible outcome, and depending of how severely damaged the drive currently is, it may be the only option to get something out of it at all.

One possibility, to explain why those files were deleted to begin with, is that there are bad sectors located on the crucial $MFT area, which contains allocation information for all files on a NTFS formatted drive. Attempting to delete a file / folder (which means re-writing the corresponding MFT records) could have added some more strain in that already damaged area and rendered a bunch of other MFT records inaccessible. On a commonly organized partition with a nested folders and subfolders hierarchy, if a single MFT record (which is only 1KB) corresponding to a parent folder in the root directory gets wiped or becomes inaccessible because of a defective sector, then the entirety of the files and folders it contains disappear (not 100% sure of this statement but that's what I would expect). If it's a strictly logical issue, running CHKDSK can in some cases fix it and make a folder which disappeared accessible again with all its former content, but it can create a whole new level of mess all of its own — CHKDSK should never be used on a drive with the slightest hint of physical issue, and should never be used without a proper backup.

I'm only visiting tonight on this forum, and don't come regularly at all (last time was two years ago, to write this — which didn't get a single reply... é_è) so I probably won't see your reply, I hope that you'll get some further feedback, or that I provided enough insight for you to act wisely.