Partition suddenly became empty, any way to restore it?

Question

I shutted down my o.s. and while it was shutting down I pressed "Cancel" the exact moment it shutted down, so it kept shutting down and I think this corrupted in some way the partition table. The O.S. automatically run a chkdsk and when windows turned on, the partition resulted as empty.

Notice that this is not the O.S. partition table, but my secondary hdd, which however contains my profile and a lot of programs (games/softwares/media files).

I can see the partition which now results empty (and definitely it shouldn't), I can access it from explorer, control panel and even from my debian installation, is just empty.

Are there any chance I can restore it? The disk has no issues, I can clearly see it in debian disk utility, and it's rather new (1 year). I think it's like an MBR corruption.

When chdsk was run, I read it was a corruption of MFT/MBT something like that (don't remember the exact name, but it wasn't MBR, I'm sure, because I know what MBR is). I hope this information can help

Update 1: chkdsk /r D:

The first test I tried is this one:

Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Users\TEMP>chkdsk /r D:
Il file system è di tipo NTFS.

Impossibile eseguire chkdsk. Il volume è utilizzato da un
altro processo. Smontare il volume per eseguire chkdsk.
TUTTI GLI HANDLE DEL VOLUME APERTI CESSERANNO IN QUESTO
MODO DI ESSERE VALIDI.
Forzare lo smontaggio sul volume? (S/N) S
Volume smontato.  Tutti gli handle del volume aperti non sono più validi.
L'etichetta del volume è Main.

Verifica dei file in corso (fase 1 di 5)...
  256 record di file elaborati.
Verifica file completata.
  0 record di file di grandi dimensioni elaborati.
  0 record file non validi elaborati.
  0 record EA elaborati.
  0 record reparse elaborati.
Verifica degli indici in corso (fase 2 di 5)...
  282 voci di indice elaborate.
Verifica indici completata.
  0 file non indicizzati analizzati.
  0 file non indicizzati ripristinati.
Verifica dei descrittori di sicurezza in corso (fase 3 di 5)...
  256 descrittori di protezione/SID di file elaborati.
Verifica descrittori di sicurezza completata.
  14 file di dati elaborati.
CHKDSK sta verificando il journal USN...
  1744 byte USN elaborati.
Verifica del journal USN completata.
Verifica dei dati dei file in corso (fase 4 di 5))...
  240 file elaborati.
Verifica dei dati del file completata.
CHKDSK sta verificando la spazio disponibile (fase 5 di 5)...
  Cluster liberi elaborati: 488341107.
Verifica dello spazio disponibile completata.
Verifica del file system effettuata.  Nessun problema rilevato.

1953512447 KB di spazio totale su disco.
     21640 KB in 11 file.
        36 KB in 15 indici.
         0 KB in settori danneggiati.
    126343 KB in uso dal sistema.
     65536 KB occupati dal file registro.
1953364428 KB disponibili su disco.

      4096 byte in ogni unità di allocazione.
 488378111 unità totali di allocazione su disco.
 488341107 unità di allocazione disponibili su disco.

"No sectors damaged", I'm almost sure that the hdd is not damaged, but a sequence of bad actions corrupted the MFT.

Solution 1

I recovered maybe 99% of my files, the only thing I've lost is the top level directory structure: I had D:\Users\Francesco... now all directories inside D:\Users\Francesco are in the root (with correct name and correct file paths anyway), I can easily rebuild directory structure. What I really do not understand if it's my drive is faulty or not at this point, because SMART values show it's healthy.

I used EaseUs Data Recovery to recover all data (it's not marketing message), I tried with testdisk and with commands suggested by nate with no luck. Easeus data recovery managed to solve the issue.

Solution 2

Run chkdsk /R, that should fix it. Make sure you check your second volume, it will check the c drive by default. If chkdsk doesn't work, then run the commands fixboot and fixmbr. Here is a link that will explain more. link

You can tell it which drive letter like this: \fixboot d:

Comments

[Ramhound]

The first thing you should is disconnected the hdd. Any furthermore modification to the hdd itself will result in unrecoverable data loss. There is no such thing as MBT so what you read had to be the Master File Table which indicates the location of every file on your disk. Data Recovery software of your choice is your best option at this point. You can also try the proposed solution to this questionhttp://superuser.com/questions/237852/hdd-is-not-acc‌​essible-possible-mft‌​-corruption-how-do-i‌​-proceed your hdd is failing its also time to replace it.

[Francesco Belladonna]

Thanks for suggestion, I'll test with chkdsk /r before it, anyway I'm quite sure I corrupted in some way the FS (I was downloading an avira rescue cd while shutting down), I'm quite sure the HDD it's fine, it's a chain of events that brought me to the FS corruption. Anyway I'll monitor it.

[Francesco Belladonna]

@Ramhound: Any greater way to check if HDD is failing? SMART data looks okay and I didn't lost any file (I actually have just copied all of them on a new drive).

[Ramhound]

The fact you were unable to run the tools you tried indicate the hdd is about to fail. S.M.A.R.T only reports digital information the HDD knows about, if there is a mechanical problem, its unlikely to report that.

[Francesco Belladonna]

I was able to run all the commands, the problem was that the MFT was too corrupted for that. And I didn't hear any "failing sound" on the HDD.

[Ramhound]

When I experience corrupt MFT it normally happens again. Your MFT should become corrupt and does not become corrupt on a normally working hdd.

[Francesco Belladonna]

Can't it happen also for a software issue? At least if there is a chance, I know I should make some tests before just "discarding" the HDD.

[Ramhound]

You can run a tool like SpinRite it will attempt to write, read, and write every single bit on your hdd. If it detects an error it will attempt to correct the problem. Beyond that tool ( or something similar ) your limited to S.M.A.R.T tools which again only report on the digital data the hdd knows about. If there is an underline mechanical problem S.M.A.R.T will NOT report that problem.

[Francesco Belladonna]

Thanks a lot, at least I can try running tests for a week and see if something breaks.

[Francesco Belladonna]

Thanks a lot, I run chkdsk /r D: and is performing a very long task, so I'll tell you the result once has finished.

[nate]

Yeah it will take about an hour, sorry should have told you that.

[Francesco Belladonna]

chkdsk /r D: didn't work, I'll try with fixboot and fixmbr, but as I stated the problem is with the MFT, not the MBR.