HDD imaging and data recovery

Question

I have a 1TB NTFS single-partition non-OS hard disk drive on my Windows Server 2012 PC, about 80% full, that has gone bad after a couple years of use. The drive retains the entire (now empty) directory structure, but all the files have disappeared, at least in Windows Explorer view (except for one folder that has files, likely because it's cached somehow due to a command prompt window with current directory at that location; however, attempting to copy these files fails because Windows isn't acknowledging their presence).

Disk Management reports a healthy partition and checking drive Properties via the Computer view in Windows Explorer shows used/free space as it should, as if nothing were affected. However, some data recovery programs like Recuva fail to read the drive (although they detect it) while some others like EaseUS painstakingly scan through the entire drive just to report 0 files found. TestDisk reports "Partition: Read Error" as well as read errors on every block it attempts to read; also System Logs show a large number of warnings with the message "The IO operation at logical block address ### for Disk 1 was retried." and a few warnings with the message "The system failed to flush data to the transaction log. Corruption may occur in VolumeId: D:, DeviceName: \Device\HarddiskVolume3. (A device which does not exist was specified.)".

I haven't run chkdsk /r yet for fear of causing further damage to the drive, neither have I rebooted since the issue started. There is a rare occasional light whirring sound from the drive that lasts maybe 5 mins or so, especially when I attempt scans. I'm not sure what to do -- I don't really care for the disk as much as I do about a few select folders of <50 MB worth of data I need to salvage but am not knowledgeable enough to. I don't want to do anything intrusive to the drive (such as a chkdsk) until I can somehow make a copy of the data on the drive bit by bit to another location, lest anything were to go wrong.

Experts, assuming this is possibly an MFT corruption/bad sector issue, please can you assist with 1. While the disk is still online, what program should I use to make an image of my drive (bit-by-bit copy) to a shared network location? &, if possible, but optionally 2. What recovery program might best suit this particular use case?

P.S.: I have tried the recovery tools listed here (Recovery Data for FAT & NTFS: says "End sector should be bigger than start sector") and here (GetDataBack), as well as others listed above without success.

Answer 1

The damage is already done, not rebooting won't change anything as all the folders are empty. The drive may/may not register as a drive letter, but it is useless in its current condition.

Professional data recovery will cost a bundle but usually it they can do it.

You could try RStudio demo, it will do a full sector scan.

As far as getting your data back spinrite by grc.com has a good track record, but can take ages(real months) to run if there are a lot of bad sectors. You need an imaging software. You need a disk larger than the source to dump the target to. If you disconnect is device manager the drive you could connect a source hdd and destination, use virtualbox to boot almost any linux, then use dd to clone the sectors. Large numbers of bad sectors will slow this progress to a crawl.