What does a scan of an external hard drive by Windoes OS mean?

Question

I have connected my external USB hard drive to my Windows computer, I got a notification that some error is detected and it is recommended to perform a scan of the hard drive. It was also written that the detected errors can be caused by an earlier non-safe disconnection of the hard drive.

Before the scan I could also select the following options:

1. Scan and remove the found errors automatically (it was selected by default).
2. Scan and try to restore the lost data.

It was possible to have the both options selected. So, my questions is: What does this scan do exactly? What does it check? What does the removal of the found errors mean? How can the lost data can be restored (where are they located).

I need to know what is happening there since after I made the scan with the first option being selected, I got a notification that some folders were inaccessible and have been removed.

This is actually very annoying that the operating system decided to remove some my folders and did it without my conformation.

I would also like to know what would happen if I cancel the scan? I did cancel it, but now I have some problems with accessing the files on the hard drive.

Answer 1

The message you describe sounds like the drive was not disconnected "gracefully". Sometimes, information that is supposed to be saved to the drive is temporarily stored and then written later. When you "eject" the drive, it forces any cached information to be written, ensuring everything is complete. Also, simply removing the drive could interrupt in-progress writing. If you disconnect the drive without ejecting and waiting for a message that it is safe to remove it, it may contain incomplete files.

Incomplete files can simply be missing a portion. However, if the saved portion is written to a previously used part of the drive, it could end up confused with other files or in the middle of flotsam from old files (deleted files remain on the drive; their file identity is deleted and the old contents are left to be overwritten). So you can have some other current file and your partially saved file both pointing to the same file snippet, looking as if the snippet is part of both files, or get the end of some deleted file looking like it's the end of your partially written file.

If the system sees that the drive was not properly ejected the previous time, it suggests scanning it to check for any corrupted files. It uses CHKDSK for this purpose and you are given several options for how far you want it to go when it finds corruption.

Removing errors would simply delete recognized corruption, like partial files, when it can do so without destroying good files. Restoring files would deal with cross-linked files by duplicating the common snippet to create two separate files. One would be the correct original file and one would be the hybrid of your partially saved file.

In general, you should never cancel a CHKDSK scan since that can create new corruption or file deletion, and the nature of the result would depend on exactly what it was doing at the time you stopped it.

Anything deleted by CHKDSK, like any other file deletion, just removes the file identity and leaves the actual contents on the drive, available to be overwritten at some future time. Prior to its being overwritten, file recovery software could potentially salvage it. Since this material is not good files, it would likely require a low-level file recovery scan that finds snippets of raw data on the hard drive platters and then tries to piece it together. Programs like the popular, free Recuva do this.