Everything on the NTFS partition disappeared

data-recoveryfile-recoveryhard-drive-recoveryntfspartition-recovery

I just rebooted into Windows (I dual boot with Ubuntu), and everything in my D: partition is gone!

First question: How do I best preserve the current state of the hard drive to maximize chances of recovery?

My most immediate priority is preserving what's left of may data until I figure out how to recover as much of it as possible. Right now, I don't even dare move the mouse on that computer because I don't know how that might affect anything and destroy my chances of recovery. Should I just leave it on? Should I shut down "cleanly"? Should I just pull the power? Something else?

Short(-ish) version

Migrated 700GB D: partition from 1TB MBR drive to 2.3 D: partition on 3TB UEFI drive.

Dual boot Ubuntu 14.04 (upgraded from 13.10) and Windows 7, both 64 bit.

Was backing up laptop hard drive to said desktop partition, partition ostensibly ran out of space. Both Ubuntu and Windows reported 1.3TB/2.3TB utilization. Ubuntu explicitly errored not enough space left, Windows errored hard drive is too fragmented.

Analyzed drive fragmentation in Windows, it was kind of high (20-something percent). Started de-fragmentation, but cancelled it because it didn't really make sense.

Checked partition for errors using GUI; it hung at the end. Closed disk checker. I think fix errors was checked.

Ran dskchk /F /V /X D:. It apparently dismounted the partition (/X flag), and finished cleanly. Shut down computer.

Tried to boot into Ubuntu. Ubuntu for some unknown reason hung while booting.

Booted into Windows. Windows continued the check on disk partition on D:. It didn't take long (compared to the first run), and I didn't catch exactly what it said, but it reported removing a lot of "indexes". I'm not sure if those were just search indexes, or something different.

Opened D: partition to check if everything was OK. ALL MY FILES AND FOLDERS WERE MISSING.

Pulled power as per @David Schwartz's recommendation.

More questions

  1. Did I screw myself by trying to defragment the partition?
  2. Can I figure out exactly what chkdsk ended up doing to my partition? Will that help?
  3. How do I mount the partition without changing a single bit on the partition?
  4. What tools can help me recover the data? Do I need a new drive to assist with this?
  5. Any thoughts on getting professional data recovery help? If so, any recommendations for good firms?

Some background

Ironically, I was backing up my laptop hard drive to my desktop partition in question when I apparently ran out of room on the partition in question (D: in Windows, sda4 in Ubuntu). This was very surprising because I had a lot of free space left: both the df utility in Ubuntu and various tools in Windows 7 reported about 1 TB free (2.3TB partition on 3TB drive).

I believe the problem likely (but not certainly) has to do with when I migrated from a 1TB drive to a 3TB drive a few months ago. The migration was a pain since the old drive was MBR and the new drive had to be UEFI to support drive size greater than 2TB. I don't remember the exact details of the migration, but I essentially ended up installing Windows 7 from scratch onto a brand new C: partition (on the new drive), making a couple of extra, small-ish partitions for Ubuntu, then using the remaining 2.3TB for my D: partition. Then I installed Ubuntu 13.10 and copied my old ~700GB D: partition from my old 1TB drive to my new 2.3TB D: partition on my new drive. I don't remember exactly how I did the copy because I tried a lot of tools (both Windows and Linux), and I don't remember which one finally (seemed to have) worked.

Everything worked fine for months.

So fast forward back to now. rsync hung while backing up my laptop hard drive to the sda4/D: partition. Puzzled, I tried to touch a new (empty) file where the partition was mounted in Linux, and it complained that there was not enough space left on the device. df showed 1.3TB/2.3TB utilization.

I rebooted into Windows, and again tried to create an empty file. Windows complained that the drive was "too fragmented" even though it also reported 1.3TB/2.3TB utilization.

Best Answer

Pull the power immediately. You don't want the state of the drive to change at all. It won't get any better.

Boot from a CD, possibly a Linux live CD. Take a snapshot of the hard drive, possibly to an external drive. That way, no matter what happens you can get back to where you are now. That will allow you to try different recovery techniques.

Related Question