corrupt NTFS filesystem, how to recover files in folder?

I lost a folder with important data, and would like to know what's the best way to procede in order to recover the files.

this is what happened:

after booting up windows (vista), i received the message that the TrashBin on K:/ (the disk in question) is corrupt and needs to be emptied, so i clicked ok.
then i tried to access one project folder on this disk. I couldn't open the folder and got some other message regarding some corruption (forgot the exact message), and after that, the thumbnail of the folder changed from being filled with files, to empty, and no files were found in this folder anymore (other folders on this disk open fine and still contain their files).
so the first thing i did was rebooting the computer into clone-zilla and creating a byte-by-byte copy of the whole disk onto an external harddisk.

That's where i'm standing now. when I reboot the computer with the harddisk connected, windows wants to repair the filesystem. I didn't let it do it so far.

What's the best way to progress in order to get my folders content back?

Mat

Posted 2012-12-13T18:34:55.437

Reputation: 131

7+1 for immediately creating a backup of the damaged filesystem. – Darth Android – 2012-12-13T19:07:22.800

Answers

TestDisk to the rescue! You can use TestDisk to recover/repair the filesystem on the disk, and then proceed to attempt a data recovery. Unlike dd, TestDisk will actually recover things on the filesystem-level (i.e. it will allow you to browse through the disk and select files/folders to recover, and you can set how to handle bad sectors manually).

The basic process would be to scan the drive, select the partitions of interest, restore/fix the partition table & headers (if required), and back up your data. Assuming the filesystem wasn't corrupted, it's much easier to fix the partitions with TestDisk and re-copy your data from your operating system. However, if you suspect any kind of corruption which might make copying under an OS unfeasible, TestDisk can also be used to recover your files.

Breakthrough

Posted 2012-12-13T18:34:55.437

Reputation: 32 927

thank you for this tip. When i startup the computer, windows wants to perform chckdsk on the disk. i skiped it now, but should i let it run before i use TestDisk? – Mat – 2012-12-13T19:42:00.650

@Mat it depends what is corrupted. I would recommend you start with TestDisk, and after you get the partition tables recovered, see if you can browse the files in the partition (in TestDisk). If you can't, you'll probably need to use TestDisk to rebuild the master file table (I believe chkdsk can also recover it, but I think you can do it entirely with TestDisk to save time; TestDisk can also return partially recovered files, I don't know off-hand if chkdsk can as well). It's difficult to simply say "do this", since there's more than one way to solve this issue. – Breakthrough – 2012-12-13T20:13:38.593

Let it attempt to repair. Worst case scenario, you might have boot off a Vista installation disk and open the recovery console to perform a chkdsk -r. If it doens't work on the first try, do it again. I have repaired a few NTFS file sysmtems using chkdsk more than once.

Unfortunately, it may be so bad off that it's unrepairable. Thats when you might try some external tools like ntfsfix from a linux live boot disk. Good luck.

Chad Harrison

Posted 2012-12-13T18:34:55.437

Reputation: 5 759