So this is an odd one that I still haven't had the chance to get to the bottom of yet. Drive was a Hitachi desktop drive that had a fair amount of bad sectors but nothing major wrong with it otherwise. Partition table shows just a single partition starting at sector 63 and going to the end of the drive.
I decided to image the drive by the NTFS bitmap using DE. Bitmap shows 331Gb of used sectors on a 1Tb disk. So after imaging by bitmap I did an MFT + index scan to be sure we don't have any lost folders from the bad sectors. None were in the MFT, but a few folders may have had damaged structures. MFT and index scan found 330.9Gb of data which pretty much matches what the bitmap shows. So I copied out all 330.9Gb of files and returned to the customer. All pretty standard practice so far, nothing seems out of place.
Yesterday the customer, who's out of state, calls and says that a huge amount of his data is missing. He swears the drive was almost completely full before it failed. I haven't received the original back yet, so I can't investigate too much, but I am finding some anomalies in the data. For example, even though the partition starts at sector 63, the first file isn't until 125Gb into the partition (something I didn't notice before). Perhaps it was just a single huge folder that was copied onto the drive when it was new and deleted more recently, I don't know.
I'm wondering if I'm facing a stupid logical issue caused by a failed attempt to run Chkdsk against a failing drive... that's the only other thing I can think of that would explain it.
I decided to image the drive by the NTFS bitmap using DE. Bitmap shows 331Gb of used sectors on a 1Tb disk. So after imaging by bitmap I did an MFT + index scan to be sure we don't have any lost folders from the bad sectors. None were in the MFT, but a few folders may have had damaged structures. MFT and index scan found 330.9Gb of data which pretty much matches what the bitmap shows. So I copied out all 330.9Gb of files and returned to the customer. All pretty standard practice so far, nothing seems out of place.
Yesterday the customer, who's out of state, calls and says that a huge amount of his data is missing. He swears the drive was almost completely full before it failed. I haven't received the original back yet, so I can't investigate too much, but I am finding some anomalies in the data. For example, even though the partition starts at sector 63, the first file isn't until 125Gb into the partition (something I didn't notice before). Perhaps it was just a single huge folder that was copied onto the drive when it was new and deleted more recently, I don't know.
I'm wondering if I'm facing a stupid logical issue caused by a failed attempt to run Chkdsk against a failing drive... that's the only other thing I can think of that would explain it.
