Gizmo's Freeware Forum

Gizmo's Freeware Forum (https://www.techsupportalert.com/freeware-forum/)
-   General Computer Support (https://www.techsupportalert.com/freeware-forum/general-computer-support/)
-   -   Corrupted drive (https://www.techsupportalert.com/freeware-forum/general-computer-support/15001-corrupted-drive.html)

sicknero 01. Mar 2015 01:05 PM

Corrupted drive
 
I have a Freecom (Samsung) 400Gb external USB drive, and at some point it has become corrupted in some way so that a lot of filenames no longer match the file content.

Basically I'll play a music track and find that it is not what the filename says it should be.

I'm guessing (wildly) that this might have happened while I was experimenting with different defraggers quite a long time ago, but I don't really know. Maybe something to do with the partition table but I'm outside of my technical knowledge there.

Does anybody know if it might be possible to fix this in any way other than the long way ... i.e. checking each file in turn and replacing/renaming those that are misnamed?

Remah 01. Mar 2015 07:58 PM

I can't get my explanation and links past the censor so this is really short. :mad: If I'm not in advanced view then I also lose what I've typed. :mad:

If FAT then AFAIK no chance but NTFS has a log file which can get quite large so the changes may still be in there.

Search for NTFS log file utility:
tracker looks better
p a r s e r (censor :mad:) not so good

sicknero 02. Mar 2015 12:16 AM

Hi Remah thanks very much for the suggestion ... I've found Tracker but it looks like a bit of a learning curve for me, so I'll give it a proper look tomorrow and see if I can work it out.

My initial hurdle is finding the actual log file ... I've found a file on the relevant drive called tracking.log (inside System Volume Information) but nothing like $LogFile. Trying to open tracking.log in Tracker returns a "There is no data" message.

It's possibly three years or more since this corruption happened and there have been many many changes to my drive since then so this might be a dead end for me, but I appreciate your input ... this is something new to me and it's always good to learn.

I'll have a proper look at it when I have more time and will post back. Thanks.

Remah 02. Mar 2015 01:07 AM

Quote:

Originally Posted by sicknero (Post 108521)
...
It's possibly three years or more since this corruption happened and there have been many many changes to my drive since then so this might be a dead end for me, ...

Yes, I'd be surprised if you can get anything back.

You probably already know this but, for anyone else reading this thread, it is good practice when when testing utilities to take a drive image and restore it when you're finished.

sicknero 03. Mar 2015 09:07 PM

Quote:

Yes, I'd be surprised if you can get anything back.
I'll be surprised too : )

It wasn't so much getting stuff back that I wanted, as some relatively easy way of finding out which files have lost their correct filenames/directory paths. I've been sorting through my mp3 collection and it seems that the problem isn't very widespread, but it will take me ages to find out which ones are corrupted, even using an audio intro scanner.

Quote:

You probably already know this but, for anyone else reading this thread, it is good practice when when testing utilities to take a drive image and restore it when you're finished.
I do have multiple back ups of important and/or unreplaceable files, but I lacked the space at the time to duplicate such a large drive. A useless excuse, I know ... I will do it now though, once I've finished sorting out the mess.

It's curious that although I had assumed it to be an artefact of some defragger or other, when I googled the problem I came across a Mac user suffering an identical issue by the sound of it. It seems that their problem arose through using a diskspace analyser, something which I'd never have previously been wary of. Although it seems that their issue came about through analysing an NTFS volume on a Mac, it's still a bit of an eye-opener. Maybe something for Mac/Linux users to be aware of although I don't think the exact software was mentioned in their post.

What has been a lesson here is the potential value of log files ... I've never had a use for them before and I suspect that many have been wiped by various temp cleaners over the years. I will persevere with the NTFS log tracker that I downloaded, as it interests me now to learn exactly what log files are all about.

Thanks again for your input.

Remah 04. Mar 2015 01:51 AM

Quote:

Originally Posted by sicknero (Post 108576)
It's curious that although I had assumed it to be an artefact of some defragger or other, when I googled the problem I came across a Mac user suffering an identical issue by the sound of it. It seems that their problem arose through using a diskspace analyser, something which I'd never have previously been wary of. Although it seems that their issue came about through analysing an NTFS volume on a Mac, it's still a bit of an eye-opener. Maybe something for Mac/Linux users to be aware of although I don't think the exact software was mentioned in their post.

It's not likely to be the same problem that you have. Mac issues with NTFS are usually due to the lack of official Apple support. At one point reading an NTFS volume was fraught with issues. Although I understand reading is OK, as far as I know, writing to NTFS volumes is still not officially supported.

Burn-IT 04. Mar 2015 03:03 PM

Have a look at TESTDISK!
I think that will rebuild file tables for you from the contents of the disk.

Remah 04. Mar 2015 11:07 PM

Quote:

Originally Posted by Burn-IT (Post 108609)
Have a look at TESTDISK!
I think that will rebuild file tables for you from the contents of the disk.

TestDisk might work but the disk and file recovery methods it uses, such as synchonizing FAT/MFT and unerasing files, aren't much help where a file has been renamed. The key information that is needed is the original filename and that was almost certainly discarded when the files were "renamed". That's why on NTFS you would have to look at the logfile which contains records that document what was changed. If too many changes have been made then the relevant log entries will have been discarded.

The other technique TestDisk could use is to unerase files.This could work if the current files were created by copying and deleting the original file then the deleted filenames might exist if the original directory entries have not been reused and overwritten.

Remah 04. Mar 2015 11:18 PM

Quote:

Originally Posted by sicknero (Post 108511)
I have a Freecom (Samsung) 400Gb external USB drive, and at some point it has become corrupted in some way so that a lot of filenames no longer match the file content.

Basically I'll play a music track and find that it is not what the filename says it should be.

sicknero,
I've thought about this further and there is a slight possibility that you might be able to identify some of the problem files by looking at the current filenames.

I assumed that the original file entries were incorrectly linked so all the original file names still existed but linked to the wrong file contents. If that is not the case then what if the changed names were duplicates of correct filenames in other folders? The presence of duplicated filenames would indicate files that need to be checked. You wouldn't have the correct original name but you would be able to identify files to check.

I also assumed that all the filenames were the names of recognizable music track. That is normal. But what if there are filenames that have been converted so they aren't. Have you checked all the filenames in all your music folders to see that they are all as expected?

J_L 05. Mar 2015 05:48 AM

In forensics, the number 1 essential step is to image the drive and work on that instead of modifying the drive itself. That means you'll have a backup and a workspace that won't corrupt any further.


All times are GMT +1. The time now is 04:48 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2020, vBulletin Solutions, Inc.