My hard drive suddenly died, and it took me half a month to rescue the data… (with data recovery tools included)

Preface

Last time I mentioned my hard drive failed—it was truly a gut punch. 😅

Since a lot of my work materials were stored on that drive, the data recovery process took nearly half a month and felt like a mental and physical ordeal.

Fortunately, in the end, most of the files were recovered. While it was time-consuming, at least it wasn’t a total loss. 🤣

This experience taught me a valuable lesson, and I’ve put together this note to share the process and takeaways.

👉 If you’re also in need of relevant tools, I’ve compiled the list of software used during this recovery. You can get it by replying with 「数据恢复」 (Data Recovery) in the back end of the public account 「曦远Life」.

Two Approaches to Tools

Before diving into data recovery tools, I've summarized their roughly two operational modes:

1. Scan MFT (Master File Table)
   • Advantages: Preserves directory structure and filenames, restoring files in a more "original" state.
   • Disadvantages: If the MFT itself is severely damaged, some files may be lost, or file content may be incomplete.
2. Scan Data Blocks (Raw Scan)
   • Advantages: Can recover as much file content as possible.
   • Disadvantages: Loses directory structure and filenames, resulting in a large number of file0001.jpg, file0002.doc files, making post-recovery organization very painful.

Most recovery software combines these two approaches, and the choice needs to be flexible based on actual usage.

👉 The tools I used this time (such as DMDE, OSFMount, FinalData, etc.) have been compiled together. To obtain them: reply with 「数据恢复」 in the background of the WeChat official account 「曦远Life」.

About NTFS

NTFS (New Technology File System) is a file system commonly used in Windows. Its advantages include:

• Support for large files and high-capacity partitions
• Permission control and security logs
• Metadata for directories and files are stored in the MFT (Master File Table)

Key Point: The MFT is the master directory table of NTFS.

If the MFT is damaged, the file system experiences a kind of amnesia: the files are still there, but their entry points cannot be found.

Introduction to MFT

MFT (Master File Table) records the following information for each file:

• File name
• Path
• Size
• Timestamps (creation/modification/access times)
• Location of the file data

Therefore, when we perform an "MFT-based scan," we are essentially trying to read this master directory table.

Once this table is corrupted, we can only resort to scanning at the "data block level" (数据块级别).

My Approach This Time

This time, I followed the approach of "protect the scene first, then attempt recovery."

1. Create an image of the partition
   • Used DMDE to create a full image (img format) of the corrupted partition.
   • Reason: To avoid direct operations on the original drive and prevent secondary damage.
2. Mount the image
   • Used OSFMount to mount the image as a virtual disk partition for easier subsequent operations.
3. File system check
   • Executed chkdsk /f /r X:
   • /f fixes errors, /r attempts to recover bad sectors.
   • During the process, the system automatically generated some found.000 folders containing "orphaned files" recovered during the repair.
4. Scan and recovery
   • Used FinalData to perform a deep scan on the mounted drive.
   • Some files were successfully recovered, preserving filenames and directory structures; others were scattered in found.000 and required manual organization.

Results

Recovery Results: Most of the files have been retrieved!

Drawbacks: Some of the directory structures and filenames are disorganized, requiring a significant amount of time for manual sorting and renaming.

Overall Reflection: Successfully rescuing the critical files is already a win; the rest is just meticulous work.

Summary

This experience made me deeply realize:

• Data security must be taken seriously!
• Important data should be backed up in multiple locations: locally + NAS + multiple different cloud storage services.
• Do not rely on a single cloud storage service; even providers can experience issues.

Moving forward, I also plan to upgrade my NAS to address the data security shortcomings and truly be prepared for any eventuality.

Data is priceless; don't wait until it's lost to regret it!

📦 A reminder: I have compiled the tools and resources used in this recovery. If needed, you can reply 「数据恢复」 on the official account 「曦远Life」 to obtain them.