Short story: I accidentally deleted a NTFS partition and now I can’t figure out how to recover it. It was a single partition covering the whole drive and I did not create anything on top of it (I realized the mistake before reformatting). So I was hoping there was a quick and simple way to get it back.
Long story:
I’ve been using an old 500GB external drive for photos (many RAW files) which was running out of space, so recently I decided to buy a WD My Passport Essential 1TB. I ran the firmware updater, used the VCD manager to get rid of the VCD and uninstalled WD Smartware. I have NTFS-3G installed in my Mac so I kept the partition format as NTFS for Windows compatibility (in case I bring the drive to some friend’s computer).
So far, so good, but I started noticing some strange quirks. I have unplugged the drive while Lightroom was running and some strange think happened. The catalog file ended up locked (resource busy) and another file with extension .lock also appeared. I could list and rewrite both files, but somehow the system behaved as if they did not exist when I tried to delete, move or rename them. That was very annoying and I started to fear for my pictures. I thought this could be some incompatibility of NTFS-3G so I decided to delete the partition in order to re-format it in a Mac friendly format. I had the backup of the photos in the old drive so it should be no problem. I went ahead and deleted the partition in Disk Utility, and a split of a second later I realized I actually had about 16GB of data from two photo sessions that were only available in this new drive.
Since I have VMWare running Win XP, I tried Active Partition Recovery. It took several hours to do a “quick” scan and it did not find any partition information. Now I am running GetDataBack NTFS and in the last estimate it said it would take 15 hours (I already left running overnight). I have no idea why these things are so slow… I admit 1TB is a lot of data, but 15 hours seems way too much.
GetDataBack is now “Searching for NTFS file systems”, 12% done. It reported quite a few lines saying:
(…snip…)
Mft entry found @ sector 6459992:‘’
(…snip…)
Like that, with the empty quotation in the end, so I am afraid a filename should be listed inside there and it has now been lost. If so I start to suspect either Disk Utility destroyed some information on the MFT, or maybe WD system encode things in some unconventional way (because of the hardware encryption perhaps). GetDataBack also says it found 1 $MFT and 136751 MFT entries (like the one above). This sounds good, but at the top it says “Files identified: 1 starts, 0 usrdef” which sounds really bad.
Anyway, sorry for the long history. I just thought that perhaps going into the details could help in understanding the problem. I hope someone has some good advice on how to recover these files.
