- Oct 8, 2012
- 630
- 1
- 19,165
Chkdsk is a great tool. It finds and often fixes corrupted or unreadable files and does a great job of it. Experience has taught me that it's successful much more of the time than OS X and Linux's built in equivalents, and I have saved far more data with it than I have any other built-in recovery tool, but it's actually a terrible 'recovery' tool in the objective sense (and they all are) because it relies patently on a quite vulnerable part of your hard drive. The fact is, it fixes mainly files, not file systems and thus relies quite heavily on data that is also on your damaged drive. So often, you do more damage than good trying deliberately to fix a disk with Chkdsk, because Windows will automatically run Chkdsk when it detects a drive damaged in a way that chkdsk can repair on startup, or bring up a notification box if you plug in a drive while the system is running. if you drive starts disappearing or otherwise fails, then it's already too much of a problem for chkdsk and you are likely further harming your drive trying to fix it with Chkdsk.
ChkDsk really shouldn't be your first port of call in a lot of damaged drive cases.
Basically, it comes down to this. If your drive is physically damaged, then all ChkDsk is doing when it tries to fix the drive is further destroying your data. You see, if the drive managed to break your files whilst reading and writing as it normally does, ChkDsk is going to read the whole drive (which is often many multiples of the amount of data that would usually be written by normal use weekly) then it's going to write on all the broken bits, and in the process, more of your drive is very likely get damaged by the reading and writing, without taking any of those files to a safer place in the process. This will leave your drive more broken than it was when you started, as you've likely done far more of what was breaking it in the first place.
I have written two tutorials on how to use TestDisk to recover your data. TestDisk is a free and open source file recovery tool, it works on Windows, Mac and Linux and this tutorial can be used on any of those systems. Testdisk is NOT related to chkdsk despite the similarity in name. Get it here.
http://www.cgsecurity.org/wiki/TestDisk_Download
So lets work out what you should do:
If your drive is damaged after:
1. A power failure/surge or pulling out the USB/Firewire but drive shows up on the desktop afterward - Use ChkDsk
2. A power failure/surge or pulling out the USB/Firewire but drive doesn't show up on the desktop afterward - Use Guide 1
3. A drop/fall and it shows up on the desktop - ChkDsk (If chkdsk fails, then backup data, no software tools can fix physically damaged drives)
4. A drop/fall and it doesn't show up on the desktop - Guide 2 to get your data, then try Guide 1 to see if drive is still functional.
5. Your drive no longer shows up on the desktop for any other reason, and Accessing "Start>Run>Type compmgmt.msc into the box> elect Disk management from the left side" still shows your damaged drive, with the right size but without a letter, Guide 1 will fix it.
6. A dropped Laptop or other system drive that is damaged, you will have to use Guide 1 if you want the OS to function again, but will not be able to carry out this tutorial without the use of another system to plug that drive into.
7. Anything, and you cannot see it but are only interested in one or two files follow Guide 2.1
Also note that on Windows, the standard Windows version should be used, not the Windows64bit, even on 64bit OS.
Right, this applies to all guides so to save repeating myself I will branch out later
First Steps:
Unzip testdisk as admin, then open the TestDisk program. [Create] log if you wish, any option you select won't make a difference to the tutorial or your drive, it will just save a record of what was done as a file.
Pick your drive (remember that what happens when you press enter is shown at the bottom and changed with the left and right keys so if when you press enter it does down one instead of selecting, you need to move the white box over the words {proceed] with the left and right keys).
Side note for Mac Users: Make sure to use /dev/rdisk/ not /dev/disk and make sure the relevant drives are ejected. in order to determine which is the correct Disk, use the sizes of the drive. If you have two or more drives of exactly the same size and you wish to figure out which one is the correct one to repair, the open a new window in Terminal and type "diskutil list" and a list of all your drives will be shown with the names in the name tab and /dev/diskX (which is the internal system name) on the left side. It will look like this:
Then select Intel if your system is more than 4 years old, or EFI GPT for 2TB+, Mac OS X or, UEFI or Windows 10 drives. Note that it will usually highlight the correct setting by default, so if it highlights EFI GPT then you need to select it. The reason I am telling you which drives need EFI GPT anyway is that your disk may be too damaged for it to work out what setting it should be. In that case, it will highlight the first setting in the list: Intel. If you know your drive is large than 2TB and it doesn't show up on your desktop as two or more drives (because it has multiple partitions), you definitely need EFI GPT.
Next select [Geometry], then select [Heads] and change that to 255 if it does not show a number upon selecting heads like the picture below. Press enter, to return tot he previous menu then hit OK.
Now you have your drive ready to recover: The following sections are split into two guides.
Guide 1. Partition recovery:
Select [Analyse], then select [Quick search].
The test disk will then list the filesystems it finds on your drive. There is usually only one, but if you have wiped your drive recently there may be two.
Then you simply select Write, and on completion, your drive should appear in Windows, if not straight away, it will appear on upon restarting the computer.
Now if it doesn't find a green item like in the above image, you can select [Deep search] and when it does, you can select [Write].
This will recover your partition, but the data on it may still be damaged, so after your drive is found you will want to either run a normal scan on the drive using ChkDsk to attempt to repair your files, or back up the drive using Guide 2.
Guide 2. Backing up a perfect copy of your data.
Select [Advanced], then select [Image Creation]
Next you will see a command line equivalent of your Explorer/Finder/File Manager, basically, all of the listed items are the items on the home folder of your drive. If you are saving this info to another drive, you will be able to access other drives by selecting the ".." file that is second down again and again until you are back at the My Computer folder, this 'item' does the same thing as going 'Up a folder' in Windows does. On Mac, the "root" folder has a folder in it called Volumes that contains all of your other Hard Drives. The image below highlights it.
And that's it! Pick a name for your saved drive, then go make a cup of tea because (unless it's a little Pen Drive), you're going to need to wait a little while.
Now you'll have a file saved with a .dd filetype at the end. This is your whole drive, files and all.
Mac users can just rename that to 'dmg' and it will open just like one. If you don't see '.dd', just ctrl click, then select Get Info, then rename it there where it will have the .dd ending. If that fails, and sometimes it does because the drive is in bad nick, then open terminal, and copy this in:
hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount
Then drag and drop the file onto your terminal window and press enter. You can now Run Disk Utility etc etc on
Windows users will need to grab a tool like OSFMount or DaemonTools. there's a link to OSFMount below.
Opening in OSFMount will allow you to mount the image, this effectively tells Windows to treat the file like your real hard drive, and it will appear in My Computer. This way, you can run ChkDsk and all the recovery tools you want, and be sure that your broken hard drive is not fouling up any further repair/recovery efforts as it's being done.
http://www.osforensics.com/tools/mount-disk-images.html
Guide 2. Backing up an imperfect copy of your data.
Select [Advanced], then select
This should give you a list of the files on your damaged Drive, like this:
As it says in guide 2, this is a command line equivalent of your Explorer/Finder/File Manager, but, all of the listed items are the items on the damaged drive instead. You can copy all files one by one by hitting 'A' to select all and then 'C' to copy, or you can select a file and individually copy it back to your drive. If you need to go up a folder, hit the '..' key that's second item down in every folder.
Remember, as soon as you choose to copy a file, it will ask you where to copy it and a similar looking screen will be presented to you, so try not to get confused between your damaged drive and the rest of your folders.
Right, that's the whole guide I think. Anything missing, I'm a comment away! Good luck and I hope we save a few drives in the process!
Also, this is the first guide I've written in my life, so any comments on how well it's written etc etc would be greatly appreciated. :lol:
ChkDsk really shouldn't be your first port of call in a lot of damaged drive cases.
Basically, it comes down to this. If your drive is physically damaged, then all ChkDsk is doing when it tries to fix the drive is further destroying your data. You see, if the drive managed to break your files whilst reading and writing as it normally does, ChkDsk is going to read the whole drive (which is often many multiples of the amount of data that would usually be written by normal use weekly) then it's going to write on all the broken bits, and in the process, more of your drive is very likely get damaged by the reading and writing, without taking any of those files to a safer place in the process. This will leave your drive more broken than it was when you started, as you've likely done far more of what was breaking it in the first place.
I have written two tutorials on how to use TestDisk to recover your data. TestDisk is a free and open source file recovery tool, it works on Windows, Mac and Linux and this tutorial can be used on any of those systems. Testdisk is NOT related to chkdsk despite the similarity in name. Get it here.
http://www.cgsecurity.org/wiki/TestDisk_Download
So lets work out what you should do:
If your drive is damaged after:
1. A power failure/surge or pulling out the USB/Firewire but drive shows up on the desktop afterward - Use ChkDsk
2. A power failure/surge or pulling out the USB/Firewire but drive doesn't show up on the desktop afterward - Use Guide 1
3. A drop/fall and it shows up on the desktop - ChkDsk (If chkdsk fails, then backup data, no software tools can fix physically damaged drives)
4. A drop/fall and it doesn't show up on the desktop - Guide 2 to get your data, then try Guide 1 to see if drive is still functional.
5. Your drive no longer shows up on the desktop for any other reason, and Accessing "Start>Run>Type compmgmt.msc into the box> elect Disk management from the left side" still shows your damaged drive, with the right size but without a letter, Guide 1 will fix it.
6. A dropped Laptop or other system drive that is damaged, you will have to use Guide 1 if you want the OS to function again, but will not be able to carry out this tutorial without the use of another system to plug that drive into.
7. Anything, and you cannot see it but are only interested in one or two files follow Guide 2.1
Also note that on Windows, the standard Windows version should be used, not the Windows64bit, even on 64bit OS.
Right, this applies to all guides so to save repeating myself I will branch out later
First Steps:
Unzip testdisk as admin, then open the TestDisk program. [Create] log if you wish, any option you select won't make a difference to the tutorial or your drive, it will just save a record of what was done as a file.
Pick your drive (remember that what happens when you press enter is shown at the bottom and changed with the left and right keys so if when you press enter it does down one instead of selecting, you need to move the white box over the words {proceed] with the left and right keys).
Side note for Mac Users: Make sure to use /dev/rdisk/ not /dev/disk and make sure the relevant drives are ejected. in order to determine which is the correct Disk, use the sizes of the drive. If you have two or more drives of exactly the same size and you wish to figure out which one is the correct one to repair, the open a new window in Terminal and type "diskutil list" and a list of all your drives will be shown with the names in the name tab and /dev/diskX (which is the internal system name) on the left side. It will look like this:
Then select Intel if your system is more than 4 years old, or EFI GPT for 2TB+, Mac OS X or, UEFI or Windows 10 drives. Note that it will usually highlight the correct setting by default, so if it highlights EFI GPT then you need to select it. The reason I am telling you which drives need EFI GPT anyway is that your disk may be too damaged for it to work out what setting it should be. In that case, it will highlight the first setting in the list: Intel. If you know your drive is large than 2TB and it doesn't show up on your desktop as two or more drives (because it has multiple partitions), you definitely need EFI GPT.
Next select [Geometry], then select [Heads] and change that to 255 if it does not show a number upon selecting heads like the picture below. Press enter, to return tot he previous menu then hit OK.
Now you have your drive ready to recover: The following sections are split into two guides.
Guide 1. Partition recovery:
Select [Analyse], then select [Quick search].
The test disk will then list the filesystems it finds on your drive. There is usually only one, but if you have wiped your drive recently there may be two.
Then you simply select Write, and on completion, your drive should appear in Windows, if not straight away, it will appear on upon restarting the computer.
Now if it doesn't find a green item like in the above image, you can select [Deep search] and when it does, you can select [Write].
This will recover your partition, but the data on it may still be damaged, so after your drive is found you will want to either run a normal scan on the drive using ChkDsk to attempt to repair your files, or back up the drive using Guide 2.
Guide 2. Backing up a perfect copy of your data.
Select [Advanced], then select [Image Creation]
Next you will see a command line equivalent of your Explorer/Finder/File Manager, basically, all of the listed items are the items on the home folder of your drive. If you are saving this info to another drive, you will be able to access other drives by selecting the ".." file that is second down again and again until you are back at the My Computer folder, this 'item' does the same thing as going 'Up a folder' in Windows does. On Mac, the "root" folder has a folder in it called Volumes that contains all of your other Hard Drives. The image below highlights it.
And that's it! Pick a name for your saved drive, then go make a cup of tea because (unless it's a little Pen Drive), you're going to need to wait a little while.
Now you'll have a file saved with a .dd filetype at the end. This is your whole drive, files and all.
Mac users can just rename that to 'dmg' and it will open just like one. If you don't see '.dd', just ctrl click, then select Get Info, then rename it there where it will have the .dd ending. If that fails, and sometimes it does because the drive is in bad nick, then open terminal, and copy this in:
hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount
Then drag and drop the file onto your terminal window and press enter. You can now Run Disk Utility etc etc on
Windows users will need to grab a tool like OSFMount or DaemonTools. there's a link to OSFMount below.
Opening in OSFMount will allow you to mount the image, this effectively tells Windows to treat the file like your real hard drive, and it will appear in My Computer. This way, you can run ChkDsk and all the recovery tools you want, and be sure that your broken hard drive is not fouling up any further repair/recovery efforts as it's being done.
http://www.osforensics.com/tools/mount-disk-images.html
Guide 2. Backing up an imperfect copy of your data.
Select [Advanced], then select
This should give you a list of the files on your damaged Drive, like this:
As it says in guide 2, this is a command line equivalent of your Explorer/Finder/File Manager, but, all of the listed items are the items on the damaged drive instead. You can copy all files one by one by hitting 'A' to select all and then 'C' to copy, or you can select a file and individually copy it back to your drive. If you need to go up a folder, hit the '..' key that's second item down in every folder.
Remember, as soon as you choose to copy a file, it will ask you where to copy it and a similar looking screen will be presented to you, so try not to get confused between your damaged drive and the rest of your folders.
Right, that's the whole guide I think. Anything missing, I'm a comment away! Good luck and I hope we save a few drives in the process!
Also, this is the first guide I've written in my life, so any comments on how well it's written etc etc would be greatly appreciated. :lol:
Facebook
Twitter
Instagram