Guys, I need help.
I have 2 Samsung M3 portable HDD (HX-M101TCB/G) both same model. Late night, I was backing up (actually only a copy-paste process, I never really tried to use backup softwares) some files from the notebook (old Dell Inspiron of my bride). After some files had been copied to my external HDD (let's calle it "A") and the space has been fulfilled (yeah almost 1tb full, I keep a lot of things) I needed my other external disk (let's call it "B") to end the copy-paste night session... But I was sleepy. I called it a day, and went to sleep. I hibernate the notebook (windows 7, very few updates, I really don't like all those updates...). My bride likes to use this feature, and she had some internet browsers open, so I hibernate the notebook so her session would be saved. (and here begins the coicidences only a user could do) I left the disk "A" in the usb port... the notebook hibernate, all the leds went off, as usual.
The next morning, first thing I did was end my copy-past session! Before turning on the notebook from hiberantion I unplugged the disk "A" and inserted disk "B", on the same port (more coicidences... sorry fate! It is really force of habit, we always use the same port). Then I turned it on. It went back from the hibernate of the night before. I went do copy my files... and then paste them on disk "B"... Just to find out that disk "B" had the same folder structure of disk "A". I found that weird... Both disks are the same model, but I remembered I had unplugged disk "A", and then inserted the other disk. I unpluged (now through safe remove option of tray bar) an inserted the other disk... and... same folder structure... It was like both disks ("A" and "B") had the same things. Although I knew they had VERY-different files: Disk A has some personal files, while disk B has my professional works since the year 2000: works from before, during and after my major! A lot of drawings, cad, text and pdf files...
Weird or not, I wanted to try disk "B" in other device. I hadn't my notebook at the time. So I tried the disk "B" on the TV (LG-32LK450). It has a usb port that we use to view some videos directly from usb keys or the external HD. It is a very nice feature: the tv even remembers the last video we watched (it don't "remember" the time where we stopped the video, but it "remembers" the file -never thought about it, but it may be a simple .db file, don't know for sure, maybe it doesn't even records on the disk, but in a built in memory? I really don't know). We only watch videos from disk A, since disk B has very few (and old) videos. I never tested disk "B" on the tv before, but both are the same model, I don't think the tv would have issues with disk "B". I inserted the disk "B" on the tv, turned it on (in this order). And the same folder-file structure of disk "A" showed up again.
I tried reading disk "B" again, on that notebook. After the third attempt I think, maybe the second, windows flashes me a message: "You need to format the disk in drive H: before you can use it. Do you want to format it?" [yes], [no].
I went nuts.
I still am. I mean, 13years of files? work files, old chat history of msn, pictures and all? It was the only place I had an old movie of my grandma, my very last memory of her.
I clicked no, of course. I may be an architect, but I know how a hard disk works: if I write something, he will simply find a place to write it, and it may be where a "deleted file mark" was. If I format it, mbr (or mft nowadays in these efi disks, right?) goes to hell and I loose the "index table"...
Internet never failed me:
-don't use chkdsk h: /f or /r !
-don't write nothing in it !
-backup, backup, backup - ok sorry, I didn't thought about backing up my backup! COME ON!
two days passed, and I got my other two notebooks (old dell vostro 1520 with win7 utlimate, and a brand-new dell inspiron 15r se, also win 7 ultimate). I tried disk "B" on both of them, just to see that same (and wrong) folder structure again. And the "Do you want to format it? [es] [no]". I went a bit further: I tried opening one folder... and nothing inside. It was like just some part of the folder structure of disk "A" had been copied (or overwritten).
Internet led me to this forum! I read, and re-read some posts. I PMed one of the users (James Litten, thank you man), he said to first: send it to a professional. If I wanted to try my luck: check disk integrity. and if all went all rigth, use the GNU ddrescue.
I got pretty confident... and still I hadn't tried anything with the disk "B" to recover the files! but I used some softwares:
First of all, I tried to check disk physical integrity. It hadn't "click'ed", "beep'ed", "risk'ed", or emitted any kind of odd noise... It is also a very new disk, maybe 3months top. I really really think it has nothing in the platters or header. But even so, I tested. I used HDDScan-3.3 and gsmartcontrol-0.8.7-win32. None of them could read the S.M.A.R.T. data. gSMART sent me this report:
smartctl 5.43 2012-06-30 r3573 [i686-w64-mingw32-win7(64)- sp1] (sf-5.43-1) Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net Vendor: Samsung Product: M3 Portable Revision: 3 User Capacity: 1.000.194.400.256 bytes [1,00 TB] Logical block size: 512 bytes Serial number: 00000000011E4A3A Device type: disk Local Time is: Mon Jan 20 21:03:52 2014 ESADT Device does not support SMART Error Counter logging not supported Device does not support Self Test logging
In disbelief, I tried my disk "A" (the one that is intact), it showed me the same messages. I thought it may be an issue of the M3 samsung drive... I want to believe it is a problem of the external drive...
I went with the reading of this forum, and saw that I could make an image... but I had to have another drive, same size or bigger. I went shopping, I bought my disk "C"... same model again, same space. But still I didn't do it.
Since disk "B" is a recent aquisition, I kinda discarded any kind of problem with its integrity. And proceed to another approach: I used "Parted Magic Live CD" (from a CD). It has a Linux OS, already bunched up with great softwares... And linux has some flexible ways to handle the file system (as I read on the forum). I thought maybe he could read correctly my data... I never used linux, but had already used DOS and the command line softwares. Also this Live CD has a user interface, so I gave it a try. I booted the notebook (now in my house, dell inspiron 15r se ) I inserted the usb external drive, I clicked to mount it. I almost went in tears... It had still the same wrong folder structure. I wanted to cry. I was affraid of trying anything with it, and messing with the whole disk B... So I didn't make the image.
But after a week of denial and misery I gather strength and here I'm. Asking guidance. Suggestions. Knowledge. If you could answer these questions, or lead me to someone who could, I would be really glad.
1) If I use the GNU DDrescue of Parted Magic Livec CD is there any chance I (or the software) write something in disk "B"?
2) If using DDrescue is safe to not write anything in the disk, should I proceed with the method of recovering the backup ($MFTmirr) using TestDisk software described by James in his blog? Should I use the deep search option? Or this thing that happend with the hibernate is too complicated for TestDisk to work?
3) If this doesn't work, should I try the full version of GetDataBack? Do you guys know if GetDataBack can read the image created by the GNU DDrescue?
3.1) Are there any other software that is best suited for this task? I mean, this thing that happend with the hibernate?
4) Considering that my MFT got corrupted during the hibernate,does the MFTmirr got corrupted as well? I would like to know (4.1) how often the MFTmirr gets mirroed? please say it is not in every mount! I have already plugged and unplugged (safely and not safely) like 5times!
4.2) If MFT and its backup (as I understand, MFTmirr is the backup that TestDisk uses, rigth?) are both corrupted, will ANY kind of method be able to restore the files? Because if it is "unrecoverable" I will not even send it to the professionals in my town (Rio de Janeiro, Brazil).
5) If there is a way, and some professional can do it, Is there any thing to look for when hiring this kind of professional services ? Two of the enterprises says that they have a cleanroom class 100. Is it a good thing to know in my case? Should I ask if they have any other kind of characteristic? Like, "time in the market", or even require a contact with other clients? or another technical info?
Sorry the wall of text, but I tried to mark in bold the most relevant phrases.