Hard Drive recovery

  tpnewton 11:22 28 Apr 2008


I have lost data on my old Hard Drive and am looking for methods to retrieve it. Judging by the info outlined below, could anyone tell me the severity of my problem and the likelihood of recovery? Is there any way I can fix this myself, or should I take it to a repair centre (PC World)?

Many thanks if you can help....

I attempted to transfer the Hard Drives (‘C’ & ‘D’) from my old PC via a Hard Drive enclosure (model: USB2.0 HD IDE/SATA) to my new PC.

The enclosure installed correctly, but when I restarted, I noticed during startup the PC was apparently deleting files from enclosure systematically. I turned off the HD enclosure to avoid deletions. When I tried to access the C part of the drive, I was told that the drive was corrupted and could not be read. I tried running Check disk as instructed to no avail. I noticed a few folders from the D drive were missing also, but a very minor amount. However, while the Enclosure was plugged in a few days later I was told by my Antivurs (sophos) that spyware/viruses were detected in the Enclosure's D partition, and when I attempted to 'safely remove hardware' I was told that it could not be done as the drive was in use. I turned off the Enclosure. The next time I rebooted, a huge amount of files in the Enclosure's D drive were missing (All files/folders lettered 'E' onwards are missing). When I click on the D drive's properties, it's used/free capacity reads the same as before, yet the amount of viewable files in the drive is minimal.

I would like to recover all data on both partitions of the drive.

  rawprawn 11:27 28 Apr 2008

Try this free program click here

  Diemmess 11:56 28 Apr 2008

A nightmare!

You said ...."I noticed during startup the PC was apparently deleting files from enclosure systematically...."

This must be a software aberration probably malware. To me it is reminiscent of the occasional panics of many years ago.
The Friday 13th virus, or was it the Jerusalem virus, which was activated on a certain date and was supposed to be capable of deleting the entire HD.

Are you sure your current C: drive is absolutely clean?

What happens if you boot first and only when running normally, connect the external drive?

  tpnewton 12:18 28 Apr 2008

Thanks for the replies thus far...

Diemmess: The first instance, where the PC was deleting files at startup was on my brand new PC. I'm fairly sure it is clean and in fact has only been connected to the internet a few times briefly to activate software. The incident with the D drive happened with the PC I use for browsing the internet; possibly riddled with viruses and spyware, even though I am running anti-virus. The old drive I'm trying to recover is definitely swamped with viruses and spyware.

"What happens if you boot first and only when running normally, connect the external drive?"

A pop-up says both drives are corrupted. The C drive is displayed as 'corrupted' when clicked on and can't be accessed. The D drive can be accessed, but no files/folders named 'E..' onwards are visible. When I try to safely remove hardware, I am told that the drive is in use and can not be removed, and I have to turn off the power supply. When I try to cut/paste files from the D drive I am unsucessful.


  Diemmess 14:15 28 Apr 2008

You seem to be in deep water with some "nasty" well into the drives you need to rescure data.

Others may be more help, but could you please confirm:

Your OS = XP or ?
You have two HDs? and Each HD is partitioned into 2 drives?

Your new PC has what AV protection, and is it up to date?
Have you scanned the new PC since the trouble started?

You said:
"The C drive is displayed as 'corrupted' when clicked on and can't be accessed."
I take it that you meant the old C: (1st partition on the old drive).

When the old HD is in the enclosure it should show as say drives F: and G: (depends on how many partitions there are on the new HD and whether you have a CD or DVD connected).

  tpnewton 14:27 28 Apr 2008

I'm running XP Pro on both PCs.

Both PCs have up to date antivirus (Sophos/AVG). I haven't scanned since trouble started, I will try when I get home. I'm fairly certain however that the first PC I tried the external Enclosed drive with was virus free. And as I said the external Enclosed Drive was/is definitely infected from years of internet use.

"The C drive is displayed as 'corrupted' when clicked on and can't be accessed."
I take it that you meant the old C: (1st partition on the old drive)."

Yes, all of this pertains to the external Enclosed drive, not the PCs hard disk. The PCs are running fine.

and the external drives do show up as F & G in the Enclosure.

  tpnewton 14:41 28 Apr 2008

sorry, just to clarify: I wish to recover lost data from the External Enclosed Drive, there is no problem with the drives on my PCs...

  rawprawn 15:19 28 Apr 2008

Did you try using Recuva?

  Diemmess 16:20 28 Apr 2008

Well if the Sophos is up to date and doubt exists over the external drive, it is high time to find and destroy whatever malware is on it.

You can try rawprawn's suggestion first, to see what can be 'recuva'd.

I'm still made anxious by your tale of files being deleted before your eyes. That is what seems like a virus to me.

In the days before Windows when everything was typed in DOS characters, deletion only changed the first character of the filename to "?"

There were programs then like the original
PCTools which found and listed any files with a non alphanumeric character at the begining.
You could restore any file by replacing the ?, with any alphanumeric character or the actual one if you could remember it!

Best of luck, and post back if you can fix it.

  hairymonster100 16:34 28 Apr 2008

try using a usb housing/interface to connect the problem drive to your pc AFTER you've booted up, get your anti-virus to scan and isolate any viruses then do a chkdsk /r on it from the command prompt.

  tpnewton 16:49 28 Apr 2008

hairymonster100: After the initial incident, I only accessed the drive after booting and I have tried check disk, which failed during inspection.

rawprawn: I could try software like Recuva, but I'm worried that any attempts I make myself, or by using free software could risk hindering a full recovery?

The files are very important to me and I don't mind paying to ensure their safety. Of course, if it could be fixed easily by myself without risk of hindering a full recovery it would be preferable.

Does anyone have experience with companies that provide a recovery service such as PC world's? Roughly how much should I expect to spend if I go the professional route?

Is this a hopeless case, or easily recoverable?


This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Alienware 17 R4 2017 review

These brilliant Lego posters show just what children's imaginations are capable of

Mac power user tips and hidden tricks

Comment réinitialiser votre PC, ordinateur portable ou tablette Windows ?