0

I'm posting this on AD because I'm using a Mac (Yosemite) to do the job.

This is the situation:

Friend 1 has a 600GB external HDD (FAT 32 formatted) that he has been using with Windows 7.

With hundreds of GB of space already used, Friend 1 gave it to Friend 2 who then used it with OS X Snow Leopard. Friend 2 transferred many more gigabytes to the drive. He then ejected and unplugged it.

Friend 2 now tells me that when he, a few hours later, again plugged the drive into his SL Mac, it appeared to be totally empty, with all the space in it available. He says that all he could see were some weird folders which he claims had Arabic names. The drive was in his physical possession the whole time, and we know that nobody else had physical access to it. Moreover, the SL Mac was never online. He then gave me the drive and asked me to help him recover the data. apparently the data of Friend 1 in there was important (Yeah, I know, that guy should have had a second backup.)

So, since it was FAT32 formatted, I booted into Windows 8 to have a look at it. But Windows 8 wouldn’t even recognize the drive. The OS didn’t even mention the drive in any way.

So I booted into OS X Yosemite. The drive came up, but, just like Friend 2, I found it to be totally empty. Except for the folders .fseventsd, .Spotlight-V100 and .Trashes. Also, OS X says only 371 MB is used, while the data is supposed to be hundreds of gigabytes. I could not see the folders spoken off by Friend 2 with supposed Arabic names.

I ran an app called Disk Drill on the drive. In a mode called Quick Scan, it finds nothing, except for 33 KB in the Trashes folder. That folder contains a single, 33 KB file called journalAttr.3.

In a mode called Deep Scan, it found hundreds of gigabytes of files. But all the file names and folder hierarchy are missing.

File names and folder hierarchy, as well as file metadata, are important. They are a big part of the data. It would be a huge mess without that information.

  1. Is it possible to recover filenames, folder hierarchy and file metadata in this situation?
  2. What is likely to have caused this data loss? How can my friends avoid it in the future? (Except for the obvious precaution of having a second backup of one's data.)
  • 1
    If the entire directory structure is pooched, then that's all a file scavenger is going to be able to extract, by trawling the hard way for file start & end points. Alternative tools you could try might be Data Rescue, TechTool Pro or perhaps DiskWarrior [which would be the go-to solution on an HFS drive, but idk if it can do FAT] – Tetsujin Apr 8 '16 at 8:18
  • @Tetsujin So does the fact that Disk Drill couldn't find anything in Quick Scan mode, (in which it is supposed to be able to find folder hierarchy and file names) indicate that "the entire directory structure is pooched"? – Revetahw Apr 8 '16 at 8:24
  • 1
    It does suggest it, yes. It's not really my area of expertise but that type of utility would most likely try to find any remaining fragments of the directory structure, or the 2nd copy, as part of the quick scan. – Tetsujin Apr 8 '16 at 8:52
  • @Tetsujin Sigh.... Yes, probably true. I wonder what could have caused this sort of problem in the first place. – Revetahw Apr 8 '16 at 9:14
  • 1
    Really not sure - bad dismount, virus, hardware fail... the list is too long & the evidence too slim to make anything more than a vague guess. – Tetsujin Apr 8 '16 at 9:17

You must log in to answer this question.

Browse other questions tagged .