I am aware of methods like ChkBack to scan and convert to mp3 etc BUT Original filenames and structure needed!
Correct. That is because chkdsk
simply looks at the FAT and creates directory entries for orphaned FAT chains, so it has absolutely knowledge about file or folder information (they are orphaned after all).
ChkBack then examines the contents of the files and simply gives them the proper extension for any file-types that it recognizes.
I was once designing my own file-identification program to be the mother-of-all such programs, but then I found TrID. It has support for numerous file-types and Marco keeps adding new ones (the current database was updated just five days ago).
maybe it modified critical FAT information vital for data recovery
Nope, the FAT is simply a chain and it cannot modify it without moving files around, which chkdsk
does not do; it only creates new directory entries corresponding to the FAT chains.
In your opinion - did running CHKDSK with automatic fixing of errors make matters worse (i.e. many data recovery progs. didn't find a trace and they would have done if not for chkdsk) or was the filesystem too corrupt anyhow for regular File Recovery Progs.?
Did you try the other programs before running chkdsk
? While running chkdsk
did make changes, it did not overwrite any directory entries (unless they were in the root directory), so if the files were recoverable before, they should still be recoverable; sort of.
The problem is that once chkdsk
is run and creates directory entries for the orphaned FAT chains, they are no longer orphaned, so other programs will not think there is anything wrong with them (they appear as regular files and directories).
You can still use a hex-/disk-editor to manually edit the drive and recover things (assuming they were not corrupted), but that is somewhat of an advanced task.
If I would be a Professional (i.e. someone paid me for data recovery service) - would I be responsible If I ran CHKDSK - automatic Fixing and it made matters worse/more difficult?
If you were a professional, truthfully yes, you would have been irresponsible. The first task for data-recovery is to prevent writing to the disk at all costs because you increase the likelihood of overwriting something and rendering it permanently lost. Professionals make a byte-for-byte copy of disk in question and work on that because if anything goes wrong, they can just make another copy. (In fact, they work on a copy of the copy because it is not always possible to copy the disk—like with physically damaged disks—so if you manage to get one copy, you should not edit that directly).
Do you know of a better Data Recovery Program than EaseUs Data Recovery wizard - According to my experience I haven't found better
I tried a whole battery of programs in 2011 and the ones that I liked best were PhotoRec because it has the option of scanning for lost files in just the free space and Undelete360 because it was one of the most effective at detecting and recovering file-/folder-names. Both are free.
I just tested Undelete360 on a Sansa Clip after doing Quick Format and it found Nothing! EaseUS found everything.
No data-recovery program will give perfect, effort-free results. They look at the directory entries that are marked as deleted and list everything they find. This means that the list will include a lot of stuff that was (legitimately) deleted a long time ago and are no longer valid. You will need to manually check each and every file to make sure that not only are they not corrupt, but that they are even real files (they could contain chunks of other files, thus making them completely gibberish).
How do you make a byte-for-byte copy of disk?
You can use a disk-cloning program to create a disk image. Drive Snapshot is a great commercial program and DriveImage XML is a great free program. You can even use a hex-/disk-editor to manually copy all sectors to a file. There are two things to note when creating a disk image:
You must select the copy-all function of the program, otherwise it will examine the file-system and copy only clusters that are in-use, which for data-recovery is usually no good. You must check the option so that it copies all clusters, including unused ones (i.e., a true and full clone).
Most such programs have an option to compress the image to save space. This is a good and useful function, but it also means that you will not be able to view the image in a hex-editor and must restore it to a disk or at least mount as a drive in order to access the volume.
Never trust a failing drive with data you care about. Your drive is failing. By the time chkdsk
starts reporting bad sectors, your drive has exhausted all of the reserve sectors it came from the factory with to deal with the small number of "normal" sector failures that occur in otherwise healthy drives. However, once the reserves are depleted, trouble is brewing and the drive is on its way down the tubes.
It's hard to say if the drive will continue its path of self-destruction by reporting more and more bad sectors (corrupting everything in its path along the way), by suddenly refusing to be recognized by your computer, or by some other spectacular failure mode. Regardless, if there's something on that drive you want when this happens, you'll regret having not already moved it to a safer place.
Best Answer
Anytime you have a severe data loss, try to follow these steps:
WRITE PROTECT your drive, if possible. Since you've got a flash drive, this might be easy to throw a switch, if provided. Any attempted recovery, or even allowing Windows to mount the drive will do some writing to the drive, which can cause more losses. FAT32 has ONE file allocation table, (which has the only pointers the which sectors represent which files and folders), so when that gets corrupted, "fixing it" can make matters worse.
Do a complete TRUE IMAGE Backup of your drive's PARTITION to another medium. Do NOT use ANY program that does not offer a complete sector-by-sector copy of that partition. (Suggestions welcome for a free version of reliable backup. Ghost in the DOS days worked pretty well, using it's options). Now, set your corrupted flash drive on the shelf and don't touch it, since it is possible you might need it again, and might want to still use it later to either restore this data, or start fresh.
Make double the amount of room available on a drive you will be able to safely restore to. The perfect candidate might be an unused internal drive, or an external rotating drive. If already formatted, you'll have to reduce the size of one of the partitions, preferably the last one, if there are more than one. I would strongly recommend you don't use any system drive, and you had better know what you are doing when you restore that partition, since it is easy to make a mistake or not understand the backup software, and you inadvertently overwrite whatever was on that drive. Recent versions of Windows can safely reduce the partition size to make room, as well as a number of other free third party tools.
Restore your partition to that (conventional) hard drive, understanding that if you mess up, or the software you are using does, you can destroy whatever was on the drive.
NOW you can use whatever recovery tools you'd like, without fear you'll mess it up, since you can always re-restore that partition and try again. This is very close to what any forensics investigator would do. (Except they would copy from the first sector to the last, and not just the partition. My company made a forensics tool used for this purpose in some notable criminal cases.) If Windows can't recover, then try SpinRite by Steve Gibson. It isn't cheap, but it will recover most anything that is recoverable. (It can also scan and fix many hardware problems on your flash drive, or most any hard drive.)
PREVENT most problems from happening again by:
1. NEVER unplugging ANY USB drive, until and unless Windows has unmounted the drive and said it is safe. There should be an icon, bottom right where you can right click to do this. Or there are a number of other ways to ensure that the drive is not being used.
2. Changing the partition type from FAT32 to NTFS. This NTFS file system is designed to recover from most file system problems. For instance, NTFS keeps three file allocation tables. So if you pull the drive out while writing to one of these tables, (one of the main causes of corruption), the other two will be used instead. NTFS is an amazing file system. However, Apple Macs can have problems when sharing a USB drive with a Windows PC, depending on which versions of both OS's, regardless of using FAT32 or NTFS partitions. (I recommend using a network/internet file sync product, instead.)