+ Reply to Thread
Results 1 to 5 of 5

Explain Lost and Found vs Lost File Results

This is a discussion on Explain Lost and Found vs Lost File Results within the Computer Data Recovery forums, part of the category; I just did a massive recovery on a Western Digital My Book World Edition. It was a 1TB drive which ...

  1. #1
    PetiePal is offline Junior Member
    Join Date
    Mar 2011
    Posts
    2

    Default Explain Lost and Found vs Lost File Results

    I just did a massive recovery on a Western Digital My Book World Edition. It was a 1TB drive which I, (stupidly) had in max-storage mode instead of Mirror. All my music, a good chunk of ****** and photos were on this drive

    I used the newest technician copy of Recover My Files which took about a week to go through scanning the whole drive and then recovering it all. I noticed that it looks like most everything was recovered. I did notice a few small odd things:

    -In my Songs folder I noticed a TON of album art jpgs showed up in the root folder. Not sure if they were files I copied or cut pasted into their respective folders in the past. Bravo if so, it looks like they still resided somewhere there and got recovered!

    -I noticed the Lost File Results folder which looks like files that were recovered and have a known file type and size but the filename was corrupted or unrecoverable. I may need to go through these one by one and see what they are.

    -What is the Lost and Found folder? It looks like a bunch of files that have no extension...is this just stuff that was found but corrupted??

  2. #2
    GDH
    GDH is offline Administrator
    Join Date
    Feb 2005
    Posts
    3,047

    Default Data Recovery

    Hi,

    That was a very long search.

    Mostly you can recover a drive very quickly - i.e. in only a few hours - if you can find the file system information at the start of the drive.

    The video on this page shows you how: Recover a Formatted Drive with Recover My Files v4

    Lost Files are found using the header and footer of the file type - they do not have original names because the original name is not stored with the file, being only located with the filesystem records at the start of the disk.

    The "Lost and Found" files and folders are "orphans" - files and folders which have been located, but for which the parent folder is no longer know. They can contain valid files.

    I hope this helps.
    Graham Henley
    GetData Support Staff
    www.getdata.com
    www.recovermyfiles.com

  3. #3
    AustinOA is offline Junior Member
    Join Date
    Aug 2011
    Posts
    1

    Default Lost File Results Explanation

    I am wondering more about what it means to have numerous lost file results.

    To give a little background: I have been using RMF v4 to perform multiple searches for most of this summer, trying to recover my 1 TB iomega drive that was somehow erased when I reformatted my computer last year. These searches always seem to be unable to complete for various reasons (power goes out, computer updates and restarts, other people restart it).

    Obviously these things are not really controllable, but I am having a hard time understanding how you can expect drive recovery to take only a few hours (I have read in multiple places on the site, initial partition location ~45mins, searching for files & filesystem records shouldn't take more than about 2 hrs). Of probably the ten times I have tried one of these searches, they have never taken less than 1 1/2 days, even with only ten file types selected.

    This last time that I did a search (which is still about 3/4 done after 40 hrs on the clock), I decided that I would try selecting all of the file types except ones I was pretty sure wouldn't be there, and no text files.

    So far (again, after 40 hrs) it has found over 10 million lost file results, ~30 lost and found files in the regular NTFS partition, all of the files left in the root NTFS partition after the reformat, and has not discovered anything in the "virtual NTFS partition" (it doesn't appear in the list), even though I KNOW that in previous searches, most of the results were in this category.

    My question is, should I start this search over again? I am obviously not gonna search through 10 million lost files when they may not be actually there. Is there a problem with selecting almost all of the file types in the list? Does that confuse it or something, which is why I am only getting lost file results this time?

    Any advice would be greatly appreciated. Thank you.

  4. #4
    GDH
    GDH is offline Administrator
    Join Date
    Feb 2005
    Posts
    3,047

    Default Data Recovery

    Hi,

    There are different methods which can be used to try and recover data from a drive. Depending what has happened to your drive, one or more of those methods may be successful. Depending which methods are successful, will influence how Recover My Files displays the search results and how long you will need to run the search.

    What happens in a Recover My Files Drive Recovery

    When you run a drive recovery, you are asked to:
    1. Select the drive that you want to search (it is ususally better to search the hard disk than the drive letter)
    2. Select whether you want to run in Automated mode or select specific file types (when you run in Automated mode, the program selects common file types for your. If you drive only contains a specific type of file, e.g. MP3, then it is better to manually select that file type only).

    The "Drive Recovery" search is broken up into 3 distinct phases.

    1. A search for existing partitions - The first part of the search looks for the missing partition table (drive letter). This is relatively fast and should take less than 15 minutes to complete.

    If the partition table is found, the file and folder structure will be immediately displayed in the search results screen. You can expand the file and folder structure whilst the search is in progress. If you see your files, the you should stop the search and save them. The total time taken should be less than 30 minutes./

    If the partition is not found, then you should let the search continue.

    2. A search for filesystem records - In the second phase of the search, Recover My Files will start scanning "blocks". This is a sequential search down the disk looking for the selected file types (i.e. the automatically selected ones, or the ones you manually selected).

    The lost files are found by searching for the header and footer specific to the file type (i.e. a JPEG always starts and end the same way. The files are displayed in the search results screen as "LostFiles". Click on them to preview their content.

    The primary purpose of the "Lost Files" search in this part of the search is to assist Recover My Files to find individual MFT Records. Every file on an NTFS formatted disk has a record in a table at the start of the disk (called the Master File Table). The MFT record holds the name of the file and the location of the file data on the disk.

    The Lost Files help the program identify the location of the MFT. You will know when the MFT has been found, because the "Filesystem records" number near the progress bar increases quickly to a high number and then remains stable. If you drive had only one partition, the missing MFT table should be somewhere near the start of the disk, which is why Recover My Files generally only need to run for 1-2 hours to get to this point. If you had two evenly sized partitions on the drive, then you would need to let the program scan until at least half way down the drive to locate the second MFT table.

    So once the "filesystem records" number has reached a high number, then we suggest you stop the search and let the search results rebuild and the file and folder structure will display in the search results screen. However, before you stop the search, it is prudent to note down the "block" number that the search is up to, because you can always use the advanced options to restart a new search from that same block if you wish to (Options > Advanced > Prompt for start sector).

    3. Lost Files - Ok, so lets say that on your drive that filesystem records are not being found. This can be the case if you have written new data to the drive - for example, if you have just copied 50gb of new music to your formatted 1tb drive, then there is a good chance that your missing MFT got overwritten and destroyed by the 50gb of new data.

    If this is the case, then all you have left is the "lost files". Remember these files are found by the unique header and footer - so they will be intact with the data. However, the file name is stored only with the MFT and not with the file data, so if lost files is all you find then you will not get the original file and folder structure back.

    A "Lost File" search will take a long time, because it is a sequential search down the disk looking for file headers (it will take a long time to travel 1tb) - so you may also want to use the stop start technique described above. Also, the more file types that you select, the slower the search will be - each time it finds data on the disk Reocver My Files needs to go through the selected file type list to find a match - e.g. is it a jpg (NO), is it a doc (NO), is it an xls (YES) [move to next data], is it a jpg (NO), is it a doc (NO), is it an xls (NO), is it a ppt (YES), etc.

    The good news is that many file types store meta data inside the file. For example, digital photographs have all sorts of information, such as the date and time of the photo, the camera, etc. There are numerous programs which can help you automatically rename lost files. One I like to use for photos is AMOK Exif sorter, or 123renamer.
    Graham Henley
    GetData Support Staff
    www.getdata.com
    www.recovermyfiles.com

  5. #5
    GDH
    GDH is offline Administrator
    Join Date
    Feb 2005
    Posts
    3,047

    Default Data Recovery

    If you would like my help to run the best type of search possible for your drive, the best thing to do is to use the live support button above to start a chat and ask for me. I can share your screen and run a search with you.

    Thanks.
    Graham Henley
    GetData Support Staff
    www.getdata.com
    www.recovermyfiles.com

+ Reply to Thread

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts