Arch Linux

tjanson

Member

Registered: 2012-04-04

Posts: 7

[Solved] Using Testdisk to recover disappeared files [exFAT]

Hi,

I have a 3TB external HDD, a WD MyBook, consisting of a single exFAT partition. It was intended for files that we rarely need; exFAT was chosen so all computers in our Linux/Win/Mac household could use it directly. I bought the drive 8 months ago and pretty much filled it up at the beginning with software & movies (nothing mission-critical, but nevertheless stuff I wanted to keep); that is, apart from this initial bulk write it has only seen very occasional use (like once a month).

Today I reattached the drive for the first time in over a month, to the Arch machine it’s used with 90% of the time. It mounted just fine and I successfully retrieved a file that I needed, but I noted that a folder appeared empty.

ls: reading directory .: Input/output error

Now, this folder contained 2 TB! The disk usage read as if the data was still present, i.e., the disk appeared to be almost full.

I attach the drive to my Mac and run both a quick and full SMART test (using Western Digital Drive Utility), and verify the partition table (Mac OS Disk Utility), all three are passed – no errors; but again the folder appears empty.
So I figure maybe Microsoft can handle this exFAT stuff and attach it to a Windows machine (told you it’s a multi-platform household ). It immediately “encounters a problem” with the disk and offers to repair it. I accept and it quickly supposedly succeeds – but still the files are missing; the only difference: the “phantom” disk usage of the lost files is gone, the disk is now reported to be fairly empty.

So what do I do now? I’ve looked at the file recovery wiki entry, and if no other solution emerges, I’ll try my luck with PhotoRec. However, I feel like I’m in a somewhat different situation: As far as I can tell, the HDD is in good physical condition, has no file system problems, I didn’t accidentally delete the files or format the disk, etc. I have a feeling the data isn’t damaged, but simply not visible.

More than anything I’m wondering: Why the heck did my data disappear? Any suggestions other than PhotoRec? Also, should I now distrust the drive, even get rid of it? It’s less than a year old.

Thanks for any help, it’s much appreciated.

[Update]
Okay, so my working hypothesis is that the Mac OS exFAT driver is at fault and corrupted the partition table (this apparently happens a lot). I’ve mounted the drive read-only and am using testdisk – which has already found two data partitions. I know nothing about testdisk, but maybe it can recover the correct table…? I’ll update as I go along.

[Update 2]
Yes! Testdisk is able to list some if not all of the lost files! I’m following the TestDisk step-by-step guide to try to recover the files. (Feel free to chime in with advice; I’ve updated the title accordingly.)

[Update 3]
Looks like Testdisk is recovering the files just fine! I’ll mark this as solved. Lessons learned: Testdisk is great; exFAT sucks. (… And it’s 2015 and there is still no file system with solid out-of-the-box cross-platform support.)

Last edited by tjanson (2015-01-18 17:28:02)