External USB Drive

[m00nw01f@hotmail.com]

Hi all, I'm having a bit of a problem.

I have an external usb western digital drive.

Everything was fine until on sunday when I was shutting done my PC and dismounting the usb devices in windows from the "Safely remove hardware" icon went all bad.

This was the layout of the drive:

[[logical (extended partition1 ntfs ] | [ primary ntfs partition2 ]]

When unmounting an error occurred I don't remember what (not the normal is in use message).

I tried to unmount again, & again, didn't work and after awhile I actually removed the usb cable.

Because I was unsure I plugged in the cabble again, one drive appeared but all the data in it was corrupted the other drive did not appear, and when I clicked on it windows said "disk structure is corrupted and unreadable".

Summarizing, I was abble to get all data from partition2 but from partition one not so lucky, I've been trying with lots off diferente software, some are demos some are free. With one of them at certain point I saw all my files names appearing in a list where the program window said filenamesomething.extension no MFT index, or something like that.

What happens I think, is that I don't have neither MFT nor the MFT mirror, is there anyway I can still recover the structure and the name of the files?

I have personal and company information on the drive (which I shouldn't, but have none the less).

When I'm trying to rebuild the mft with testdisk it says no MFT was found nor MFT mirror.

Write now I'm using testdisk to create a dd image of the drive.

with this I'm asking if there is way for me to recover the files from the drive with the names they had, preferably with the old structure (without an mft it seems a bit hard).

Will your software be ablle to recover any sort of structure?

Windows seems to see the drive in raw mode and some recovery applications get different answer to what was the File system type, I have used this drive in various file system types in the past.

I'm going a bit nuts with this...

[GDH]

Hi,

Taking a DD image is a good move. It means that whatever happens, you cant make the situation worse, and have read only backup. You may like to download Mount Image Pro - Computer Forensics Software: Mount EnCase Images and DD images, which will enable to mount the DD image as a drive on your PC.

I suggest you download Recover My Files and run a "Complete Format Recover". You can follow the instructions in this thread: How to recover a formatted hard drive

If the records in your MFT are corrupt or destroyed, then there is no way to get the file and folder structure back, because this is the only place where the file and folder names are held.

Recover My Files will search for individual MFT records - not just the complete MFT table - so let me know the results of your search as you still have a good chance of getting the file and folder structure back.

If you cannot find the file and folder structure, then your only option is to run a "Complete File Search" for specific file types. Part of this search looks for files by their header and footer and they are returned with names like "Recovered_Word_1". This is not as bad as it sounds, as there are a number of tools available when can help you auto rename files based on the meta data inside the file.