locked
Chkdsk deleted all my files. RRS feed

  • General discussion

  • Chkdsk deleted all my files.

    COmputer: Toshiba Satellite 4GB ram
    OS: Vista Ultimate


    I have a 1 month old 0.5TB USB external drive that I use to backup all my data, work, personal stuff, etc - 10 years of my life.  

    I am running vista ultimate.

    WHen vista starts and the usb is plugged in it usually asks if you would like to check for consistency and gives you about 10 seconds to cancel the check (by pressing any key).  I was walking towards the computer but was too late and windows went ahead and checked for consistency.  

    The log file for the check is below ( http://www.nomorepasting.com/getpaste.php?pasteid=25166&seen=true&langoverride=- )

    WHen vista started I went to the USB drive and saw that it was empty and that I had 0.5TB free space.

    10 years of my life -- how do I get my files back?  

    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++




    Log Name:      Application
    Source:        Microsoft-Windows-Wininit
    Date:          3/22/2009 9:28:03 AM
    Event ID:      1001
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      toshiba-user
    Description:
     
     
    Checking file system on E:
    The type of the file system is NTFS.
    Volume label is My Book.
     
     
    One of your disks needs to be checked for consistency. You
    may cancel the disk check, but it is strongly recommended
    that you continue.
    Windows will now check the disk.                         
    Unable to query LCN from VCN 0x4 for attribute of type 0x80.
    The non resident attribute of type 0x80 is inconsistent.  The valid data
    length is 0x2a5e0000, file size 0x2a5e0000, and allocated length 0x4000.
    The non resident attribute of type 0x80 is inconsistent.  The valid data
    length is 0x2a5e0000, file size 0x4000, and allocated length 0x4000.
    Deleted corrupt attribute list entry
    with type code 48 in file 0.
    Unable to find child frs 0x11 with sequence number 0x12.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to find child frs 0x13 with sequence number 0x14.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to find child frs 0x12 with sequence number 0x13.
    The attribute of type 0x80 and instance tag 0x9 in file 0x0
    has allocated length of 0x2a5e0000 instead of 0x4000.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to locate attribute with instance tag 0x9 and segment
    reference 0x1000000000000.  The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 0.
    Attribute record of type 0x80 and instance tag 0x1 is cross linked
    starting at 0x3a384c0 for possibly 0x1 clusters.
      16 file records processed.                                  
     
      0 large file records processed.                            
     
      0 bad file records processed.                              
     
    Correcting cross-link for file 1.
      0 EA records processed.                                    
     
    Correcting file name errors in system file record segment 0.
      0 reparse records processed.                               
     
    An index entry of index $I30 in file 0x5 points to file 0x7c4b2
    which is beyond the MFT.
    Deleting index entry $drvmig$ in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7c4dc
    which is beyond the MFT.
    Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x56d28
    which is beyond the MFT.
    Deleting index entry d23f38ac476c9a9227d5d6 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x56d28
    which is beyond the MFT.
    Deleting index entry D23F38~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7c31c
    which is beyond the MFT.
    Deleting index entry EMTM in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x16
    which is beyond the MFT.
    Deleting index entry important in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x16
    which is beyond the MFT.
    Deleting index entry IMPORT~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3a3a9
    which is beyond the MFT.
    Deleting index entry linux in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361e0
    which is beyond the MFT.
    Deleting index entry My Computer Backups in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361e0
    which is beyond the MFT.
    Deleting index entry MYCOMP~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3f610
    which is beyond the MFT.
    Deleting index entry Personal in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361ee
    which is beyond the MFT.
    Deleting index entry recycle folder in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3f60d
    which is beyond the MFT.
    Deleting index entry Recycled in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x73263
    which is beyond the MFT.
    Deleting index entry RECYCLER in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361ee
    which is beyond the MFT.
    Deleting index entry RECYCL~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361c2
    which is beyond the MFT.
    Deleting index entry System Volume Information in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361c2
    which is beyond the MFT.
    Deleting index entry SYSTEM~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7329c
    which is beyond the MFT.
    Deleting index entry Trash in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x74690
    which is beyond the MFT.
    Deleting index entry website backup in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x74690
    which is beyond the MFT.
    Deleting index entry WEBSIT~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x5a384
    which is beyond the MFT.
    Deleting index entry Work in index $I30 of file 5.
    Index entry $ObjId of index $I30 in file 0xb points to unused file 0x72e10.
    Deleting index entry $ObjId in index $I30 of file 11.
    Index entry $Quota of index $I30 in file 0xb points to unused file 0x10.
    Deleting index entry $Quota in index $I30 of file 11.
      22 index entries processed.                                 
     
    Index entry $Reparse of index $I30 in file 0xb points to unused file 0x72e11.
    Deleting index entry $Reparse in index $I30 of file 11.
    Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0xce92.
    Deleting index entry $RmMetadata in index $I30 of file 11.
    Index entry $UsnJrnl of index $I30 in file 0xb points to unused file 0x91958.
    Deleting index entry $UsnJrnl in index $I30 of file 11.
      0 unindexed files processed.                               
     
    Creating object id file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 17.
    The object id in file 0x3 does not appear in the object
    id index in file 0x11.
    Inserting an index entry into index $O of file 17.
    The object id in file 0x5 does not appear in the object
    id index in file 0x11.
    Inserting an index entry into index $O of file 17.
    Creating reparse point file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $R for file 18.
    Creating quota file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 19.
    Creating index $Q for file 19.
    Inserting default quota record into index $Q in file 19.
      24 security descriptors processed.                          
     
    Cleaning up 96 unused index entries from index $SII of file 0x9.
    Cleaning up 96 unused index entries from index $SDH of file 0x9.
    Cleaning up 96 unused security descriptors.
    Inserting data attribute into file 0.
      4 data files processed.                                    
     
    The MFT mirror is different from the MFT.
    Correcting errors in the Master File Table (MFT) mirror.
    Correcting errors in the Master File Table (MFT) mirror.
    The second MFT starting LCN in the boot sector is incorrect.
    The actual value is 0x3a384c0 while the expected value is 0x2.
    Correcting errors in the master file table's (MFT) DATA attribute.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.
     
     488384000 KB total disk space.
            20 KB in 8 indexes.
             0 KB in bad sectors.
         80900 KB in use by the system.
         65536 KB occupied by the log file.
     488303080 KB available on disk.
     
          4096 bytes in each allocation unit.
     122096000 total allocation units on disk.
     122075770 allocation units available on disk.
     
    Internal Info:
    10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00  ................
    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    b8 1f 56 00 48 01 56 00 d0 08 00 d8 b0 86 57 00  ..V.H.V.......W.
     
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
        <EventID Qualifiers="16384">1001</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-03-22T13:28:03.000Z" />
        <EventRecordID>61973</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>Application</Channel>
        <Computer>toshiba-user</Computer>
        <Security />
      </System>
      <EventData>
        <Data>
     
    Checking file system on E:
    The type of the file system is NTFS.
    Volume label is My Book.
     
     
    One of your disks needs to be checked for consistency. You
    may cancel the disk check, but it is strongly recommended
    that you continue.
    Windows will now check the disk.                         
    Unable to query LCN from VCN 0x4 for attribute of type 0x80.
    The non resident attribute of type 0x80 is inconsistent.  The valid data
    length is 0x2a5e0000, file size 0x2a5e0000, and allocated length 0x4000.
    The non resident attribute of type 0x80 is inconsistent.  The valid data
    length is 0x2a5e0000, file size 0x4000, and allocated length 0x4000.
    Deleted corrupt attribute list entry
    with type code 48 in file 0.
    Unable to find child frs 0x11 with sequence number 0x12.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to find child frs 0x13 with sequence number 0x14.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to find child frs 0x12 with sequence number 0x13.
    The attribute of type 0x80 and instance tag 0x9 in file 0x0
    has allocated length of 0x2a5e0000 instead of 0x4000.
    Deleted corrupt attribute list entry
    with type code 128 in file 0.
    Unable to locate attribute with instance tag 0x9 and segment
    reference 0x1000000000000.  The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 0.
    Attribute record of type 0x80 and instance tag 0x1 is cross linked
    starting at 0x3a384c0 for possibly 0x1 clusters.
      16 file records processed.                                  
     
      0 large file records processed.                            
     
      0 bad file records processed.                              
     
    Correcting cross-link for file 1.
      0 EA records processed.                                    
     
    Correcting file name errors in system file record segment 0.
      0 reparse records processed.                               
     
    An index entry of index $I30 in file 0x5 points to file 0x7c4b2
    which is beyond the MFT.
    Deleting index entry $drvmig$ in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7c4dc
    which is beyond the MFT.
    Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x56d28
    which is beyond the MFT.
    Deleting index entry d23f38ac476c9a9227d5d6 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x56d28
    which is beyond the MFT.
    Deleting index entry D23F38~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7c31c
    which is beyond the MFT.
    Deleting index entry EMTM in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x16
    which is beyond the MFT.
    Deleting index entry important in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x16
    which is beyond the MFT.
    Deleting index entry IMPORT~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3a3a9
    which is beyond the MFT.
    Deleting index entry linux in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361e0
    which is beyond the MFT.
    Deleting index entry My Computer Backups in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361e0
    which is beyond the MFT.
    Deleting index entry MYCOMP~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3f610
    which is beyond the MFT.
    Deleting index entry Personal in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361ee
    which is beyond the MFT.
    Deleting index entry recycle folder in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x3f60d
    which is beyond the MFT.
    Deleting index entry Recycled in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x73263
    which is beyond the MFT.
    Deleting index entry RECYCLER in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361ee
    which is beyond the MFT.
    Deleting index entry RECYCL~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361c2
    which is beyond the MFT.
    Deleting index entry System Volume Information in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x361c2
    which is beyond the MFT.
    Deleting index entry SYSTEM~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x7329c
    which is beyond the MFT.
    Deleting index entry Trash in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x74690
    which is beyond the MFT.
    Deleting index entry website backup in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x74690
    which is beyond the MFT.
    Deleting index entry WEBSIT~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x5a384
    which is beyond the MFT.
    Deleting index entry Work in index $I30 of file 5.
    Index entry $ObjId of index $I30 in file 0xb points to unused file 0x72e10.
    Deleting index entry $ObjId in index $I30 of file 11.
    Index entry $Quota of index $I30 in file 0xb points to unused file 0x10.
    Deleting index entry $Quota in index $I30 of file 11.
      22 index entries processed.                                 
     
    Index entry $Reparse of index $I30 in file 0xb points to unused file 0x72e11.
    Deleting index entry $Reparse in index $I30 of file 11.
    Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0xce92.
    Deleting index entry $RmMetadata in index $I30 of file 11.
    Index entry $UsnJrnl of index $I30 in file 0xb points to unused file 0x91958.
    Deleting index entry $UsnJrnl in index $I30 of file 11.
      0 unindexed files processed.                               
     
    Creating object id file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 17.
    The object id in file 0x3 does not appear in the object
    id index in file 0x11.
    Inserting an index entry into index $O of file 17.
    The object id in file 0x5 does not appear in the object
    id index in file 0x11.
    Inserting an index entry into index $O of file 17.
    Creating reparse point file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $R for file 18.
    Creating quota file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 19.
    Creating index $Q for file 19.
    Inserting default quota record into index $Q in file 19.
      24 security descriptors processed.                          
     
    Cleaning up 96 unused index entries from index $SII of file 0x9.
    Cleaning up 96 unused index entries from index $SDH of file 0x9.
    Cleaning up 96 unused security descriptors.
    Inserting data attribute into file 0.
      4 data files processed.                                    
     
    The MFT mirror is different from the MFT.
    Correcting errors in the Master File Table (MFT) mirror.
    Correcting errors in the Master File Table (MFT) mirror.
    The second MFT starting LCN in the boot sector is incorrect.
    The actual value is 0x3a384c0 while the expected value is 0x2.
    Correcting errors in the master file table's (MFT) DATA attribute.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.
     
     488384000 KB total disk space.
            20 KB in 8 indexes.
             0 KB in bad sectors.
         80900 KB in use by the system.
         65536 KB occupied by the log file.
     488303080 KB available on disk.
     
          4096 bytes in each allocation unit.
     122096000 total allocation units on disk.
     122075770 allocation units available on disk.
     
    Internal Info:
    10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00  ................
    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    b8 1f 56 00 48 01 56 00 d0 08 00 d8 b0 86 57 00  ..V.H.V.......W.
    </Data>
      </EventData>
    </Event>
    Sunday, March 22, 2009 4:05 PM

All replies

  •  

    Hi zquad, I fully understand the inconvenience you have encountered regarding this issue. I have some tips for you:

     

    1.       Please do not format/write any new data on the external hard drive.

    2.       You can try some third party data recovery tools, such as Easy Recovery Pro, Final Data, etc.

    3.       If your hard drive or external hard driver always asks to perform consistency checking, this can be a sign that it has bad cluster or other physical damage. We'd better backup data and use another storage device instead.

     


    Sean Zhu - MSFT
    Tuesday, March 24, 2009 8:22 AM
    Moderator