so a few days ago.. i was using two External SAta TO USb Connectors, one was connected to a 1.0 Terabyte Drive, another was connected to a 1.5 Terabyte Drive.
Now i hadn't used them for a long time but for some reason my 1.0 Tera only worked with a specific USB to Sata Adapter.
Both of the adapter/converters used 3.0 external I/O mini controllers that would mount a Media drive of any type that is Sata or EIDE/IDE
and mount its partition info, the MFT, the BITMap and everything else of the partition residing in it and allowing the Operating system to mount it's Volume.
Well i had switched both the Adapters around after disconnecting both of them and my windows 10 Home premium did not properly dismount the 1.5 Volume from the System.
Both of them where set to quick disconnect so caching was disabled so the drives can be hot removed with out loss or corruption of data.
When i put the other adapter onto the 1.0 Terabyte Drive.
the $MFT, $BITMAP, $AttrDef, $MFTMirr, $Volume, and pretty much all Files with $ from the 1.5 Terabyte Drive got Written to the 1.0Terabyte drive.
When I used EaseUS partition master (latest version) and checked the partition (Windows OS Said the entire file system was corrupted and unreadable) It said it was labeled T: BUT it had the Volume Label from the 1.5 Terabyte Drive!!!! the size said the entire drive length itself and i was trying to use GETDataback from runetime to recovery my data.. I seen about 555GBs of data in the Step3 section and i seen pretty much almost all my files i was happily copying files when the system froze.. so i forced rebooted.. THEN When it rebooted i wasnt looking and windows 10 did a chkdsk on my 1.0 Terabyte Drive. it went to 9% I freaked out worrying that it was just deleting all my records from the MFT and the bitmap.. it was deleting a crapton and I have heard horror stories of chkdsk rendering one's drive EMPTY.
I pulled the plug on the laptop, Probably a bad thing to have done as i may have corrupted it more. But i didn't want ti to delete anymore Records of where all my files where located on the partition volume itself. and i was kinda right, because i tried to continue my scan and I am missing an additional 500MBs of data from my original Step 3 scan.
SO great now I lost more records of where my data was.. More MFT Entries where damaged. chkdsk was using the information from the 1.5 Terabyte drive it seems and was correcting (Erasing records of the original 1.0 Terabyte partition table info) and replacing it with the newly copied info that windows had ghosted from my 1.5 Terabyte drive to the 1.0 Terabyte drive..
What in the world do I do..... . ?
Lucky enough: on the first attempt of my data recovery i had decided to Select [NFTS] to recovery EVERYTHING including the Low level information of the partition and its volume itself.. I have copies of the MFT, its mirror, the Bitmap, badcluster file and the $Extended folder with its relative data and a bunch of other data.
it was a copy of the state of the drive that was pretty much just before the chkdsk that went to 9%.
How do I Copy the MFT and the mirror and everything else back to the partition?
I have made a Raw copy byte for byte of the original drive as a back up at least so my data is still all there its just.... .FLoating around...
any suggestions any one know of any tools? anyone know of some form of step by step process where i can directly use a Recovery software editor that works with the MFT file and the Bitmap so I can copy the HEX/decimal data from the Saved NTFS $files to the original drive to get my bloody NTFS Function back to the way it was?
Log Name: System
Source: Ntfs
Date: 4/3/2019 9:23:02 PM
Event ID: 50
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: MariaOman-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file \$Mft::$BITMAP. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="32772">50</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.290180800Z" />
<EventRecordID>480289</EventRecordID>
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>\$Mft::$BITMAP</Data>
<Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
</EventData>
</Event>
-----------------------------------
Log Name: System
Source: Application Popup
Date: 4/3/2019 9:23:02 PM
Event ID: 26
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: MariaOman-PC
Description:
Application popup: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 Parameters 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Popup" Guid="{47BFA2B7-BD54-4FAC-B70B-29021084CA8F}" />
<EventID>26</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.290662500Z" />
<EventRecordID>480290</EventRecordID>
<Correlation />
<Execution ProcessID="688" ThreadID="2004" />
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Caption">Windows - Delayed Write Failed</Data>
<Data Name="Message">Exception Processing Message 0xc0000222 Parameters 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38</Data>
</EventData>
</Event>
----------------------------------
A corruption was discovered in the file system structure on volume T:.
A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
Log Name: System
Source: Ntfs
Date: 4/3/2019 9:23:02 PM
Event ID: 55
Task Category: None
Level: Error
Keywords:
User: N/A
Computer: MariaOman-PC
Description:
A corruption was discovered in the file system structure on volume T:.
A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
<EventID>55</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.416882000Z" />
<EventRecordID>480342</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8668" />
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="DriveName">T:</Data>
<Data Name="DeviceName">\Device\HarddiskVolume11</Data>
<Data Name="CorruptionState">0x0</Data>
<Data Name="HeaderFlags">0x922</Data>
<Data Name="Severity">Critical</Data>
<Data Name="Origin">File System Driver</Data>
<Data Name="Verb">Index Subtree</Data>
<Data Name="Description">A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
</Data>
<Data Name="Signature">0xf0db1b11</Data>
<Data Name="Outcome">Spot Verifier Bypassed On Critical</Data>
<Data Name="SampleLength">0</Data>
<Data Name="SampleData">
</Data>
<Data Name="SourceFile">0x14</Data>
<Data Name="SourceLine">4351</Data>
<Data Name="SourceTag">351</Data>
<Data Name="AdditionalInfo">0x10000000</Data>
<Data Name="CallStack">Ntfs+0x18275d, Ntfs+0xd42e8, Ntfs+0xc1e3c, Ntfs+0xc1359, Ntfs+0xc0dfa, Ntfs+0x145929, Ntfs+0x1450f8, Ntfs+0x1427eb, Ntfs+0x114300, Ntfs+0x20109, ntoskrnl+0xb5b05, ntoskrnl+0x1302d7, ntoskrnl+0x1b1516</Data>
</EventData>
</Event>
Sincerely yours,
EJ
Now i hadn't used them for a long time but for some reason my 1.0 Tera only worked with a specific USB to Sata Adapter.
Both of the adapter/converters used 3.0 external I/O mini controllers that would mount a Media drive of any type that is Sata or EIDE/IDE
and mount its partition info, the MFT, the BITMap and everything else of the partition residing in it and allowing the Operating system to mount it's Volume.
Well i had switched both the Adapters around after disconnecting both of them and my windows 10 Home premium did not properly dismount the 1.5 Volume from the System.
Both of them where set to quick disconnect so caching was disabled so the drives can be hot removed with out loss or corruption of data.
When i put the other adapter onto the 1.0 Terabyte Drive.
the $MFT, $BITMAP, $AttrDef, $MFTMirr, $Volume, and pretty much all Files with $ from the 1.5 Terabyte Drive got Written to the 1.0Terabyte drive.
When I used EaseUS partition master (latest version) and checked the partition (Windows OS Said the entire file system was corrupted and unreadable) It said it was labeled T: BUT it had the Volume Label from the 1.5 Terabyte Drive!!!! the size said the entire drive length itself and i was trying to use GETDataback from runetime to recovery my data.. I seen about 555GBs of data in the Step3 section and i seen pretty much almost all my files i was happily copying files when the system froze.. so i forced rebooted.. THEN When it rebooted i wasnt looking and windows 10 did a chkdsk on my 1.0 Terabyte Drive. it went to 9% I freaked out worrying that it was just deleting all my records from the MFT and the bitmap.. it was deleting a crapton and I have heard horror stories of chkdsk rendering one's drive EMPTY.
I pulled the plug on the laptop, Probably a bad thing to have done as i may have corrupted it more. But i didn't want ti to delete anymore Records of where all my files where located on the partition volume itself. and i was kinda right, because i tried to continue my scan and I am missing an additional 500MBs of data from my original Step 3 scan.
SO great now I lost more records of where my data was.. More MFT Entries where damaged. chkdsk was using the information from the 1.5 Terabyte drive it seems and was correcting (Erasing records of the original 1.0 Terabyte partition table info) and replacing it with the newly copied info that windows had ghosted from my 1.5 Terabyte drive to the 1.0 Terabyte drive..
What in the world do I do..... . ?
Lucky enough: on the first attempt of my data recovery i had decided to Select [NFTS] to recovery EVERYTHING including the Low level information of the partition and its volume itself.. I have copies of the MFT, its mirror, the Bitmap, badcluster file and the $Extended folder with its relative data and a bunch of other data.
it was a copy of the state of the drive that was pretty much just before the chkdsk that went to 9%.
How do I Copy the MFT and the mirror and everything else back to the partition?
I have made a Raw copy byte for byte of the original drive as a back up at least so my data is still all there its just.... .FLoating around...
any suggestions any one know of any tools? anyone know of some form of step by step process where i can directly use a Recovery software editor that works with the MFT file and the Bitmap so I can copy the HEX/decimal data from the Saved NTFS $files to the original drive to get my bloody NTFS Function back to the way it was?
Log Name: System
Source: Ntfs
Date: 4/3/2019 9:23:02 PM
Event ID: 50
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: MariaOman-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file \$Mft::$BITMAP. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="32772">50</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.290180800Z" />
<EventRecordID>480289</EventRecordID>
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>\$Mft::$BITMAP</Data>
<Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
</EventData>
</Event>
-----------------------------------
Log Name: System
Source: Application Popup
Date: 4/3/2019 9:23:02 PM
Event ID: 26
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: MariaOman-PC
Description:
Application popup: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 Parameters 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Popup" Guid="{47BFA2B7-BD54-4FAC-B70B-29021084CA8F}" />
<EventID>26</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.290662500Z" />
<EventRecordID>480290</EventRecordID>
<Correlation />
<Execution ProcessID="688" ThreadID="2004" />
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Caption">Windows - Delayed Write Failed</Data>
<Data Name="Message">Exception Processing Message 0xc0000222 Parameters 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38 0x7fffc7a01c38</Data>
</EventData>
</Event>
----------------------------------
A corruption was discovered in the file system structure on volume T:.
A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
Log Name: System
Source: Ntfs
Date: 4/3/2019 9:23:02 PM
Event ID: 55
Task Category: None
Level: Error
Keywords:
User: N/A
Computer: MariaOman-PC
Description:
A corruption was discovered in the file system structure on volume T:.
A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
<EventID>55</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-04-04T02:23:02.416882000Z" />
<EventRecordID>480342</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8668" />
<Channel>System</Channel>
<Computer>MariaOman-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="DriveName">T:</Data>
<Data Name="DeviceName">\Device\HarddiskVolume11</Data>
<Data Name="CorruptionState">0x0</Data>
<Data Name="HeaderFlags">0x922</Data>
<Data Name="Severity">Critical</Data>
<Data Name="Origin">File System Driver</Data>
<Data Name="Verb">Index Subtree</Data>
<Data Name="Description">A corruption was found in a file system index structure. The file reference number is 0x5000000000005. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
</Data>
<Data Name="Signature">0xf0db1b11</Data>
<Data Name="Outcome">Spot Verifier Bypassed On Critical</Data>
<Data Name="SampleLength">0</Data>
<Data Name="SampleData">
</Data>
<Data Name="SourceFile">0x14</Data>
<Data Name="SourceLine">4351</Data>
<Data Name="SourceTag">351</Data>
<Data Name="AdditionalInfo">0x10000000</Data>
<Data Name="CallStack">Ntfs+0x18275d, Ntfs+0xd42e8, Ntfs+0xc1e3c, Ntfs+0xc1359, Ntfs+0xc0dfa, Ntfs+0x145929, Ntfs+0x1450f8, Ntfs+0x1427eb, Ntfs+0x114300, Ntfs+0x20109, ntoskrnl+0xb5b05, ntoskrnl+0x1302d7, ntoskrnl+0x1b1516</Data>
</EventData>
</Event>
Sincerely yours,
EJ
