Did chkdsk make it harder to restore files?
My friend asked me to try and fix his loaded Sansa Clip + which wasn't playing. After opening it in MSC mode I discovered that the Music directory was empty and total of all files was only a few MB. However Disk properties showed me that it was 7Gb full. I then ran Tools -> Error Checking and Windows dutifully informed me that disk was corrupt and I should run again Allowing Windows to Fix Errors. I did that and it told me everything was fixed and that all files were placed in FOUND.000 Dir. FOUND.000 was about 7.5 GB with FILE0000-1546 . CHK. (I am aware of methods like ChkBack to scan and convert to mp3 etc BUT Original filenames and structure needed!)
Now I started getting worried that I made things worse! I have plenty of experience with Data Recovery Programs - Recuva, Restore My Files etc. and I was anyhow planning to use them to scan the drive. But NOW after CHKDSK "fixed" the drive maybe it modified critical FAT information vital for data recovery. So I run these programs and 0!!!. No trace of files! I tried a ton of Recovery Programs with same results TILL EaseUS Data Recovery Wizard found all files and I purchased program for $55!
My Question
In your opinion - did running CHKDSK with automatic fixing of errors make matters worse (i.e. many data recovery progs. didn't find a trace and they would have done if not for chkdsk) or was the filesystem too corrupt anyhow for regular File Recovery Progs.?
If I would be a Professional (i.e. someone paid me for data recovery service) - would I be responsible If I ran CHKDSK - automatic Fixing and it made matters worse/more difficult?
Do you know of a better Data Recovery Program than EaseUs Data Recovery wizard - According to my experience I haven't found better
I am aware of methods like ChkBack to scan and convert to mp3 etc BUT Original filenames and structure needed!
Correct. That is because chkdsk simply looks at the FAT and creates directory entries for orphaned FAT chains, so it has absolutely knowledge about file or folder information (they are orphaned after all).
ChkBack then examines the contents of the files and simply gives them the proper extension for any file-types that it recognizes.
I was once designing my own file-identification program to be the mother-of-all such programs, but then I found TrID. It has support for numerous file-types and Marco keeps adding new ones (the current database was updated just five days ago).
maybe it modified critical FAT information vital for data recovery
Nope, the FAT is simply a chain and it cannot modify it without moving files around, which chkdsk does not do; it only creates new directory entries corresponding to the FAT chains.
In your opinion - did running CHKDSK with automatic fixing of errors make matters worse (i.e. many data recovery progs. didn't find a trace and they would have done if not for chkdsk) or was the filesystem too corrupt anyhow for regular File Recovery Progs.?
Did you try the other programs before running chkdsk? While running chkdsk did make changes, it did not overwrite any directory entries (unless they were in the root directory), so if the files were recoverable before, they should still be recoverable; sort of.
The problem is that once chkdsk is run and creates directory entries for the orphaned FAT chains, they are no longer orphaned, so other programs will not think there is anything wrong with them (they appear as regular files and directories).
You can still use a hex-/disk-editor to manually edit the drive and recover things (assuming they were not corrupted), but that is somewhat of an advanced task.
If I would be a Professional (i.e. someone paid me for data recovery service) - would I be responsible If I ran CHKDSK - automatic Fixing and it made matters worse/more difficult?
If you were a professional, truthfully yes, you would have been irresponsible. The first task for data-recovery is to prevent writing to the disk at all costs because you increase the likelihood of overwriting something and rendering it permanently lost. Professionals make a byte-for-byte copy of disk in question and work on that because if anything goes wrong, they can just make another copy. (In fact, they work on a copy of the copy because it is not always possible to copy the disk—like with physically damaged disks—so if you manage to get one copy, you should not edit that directly).
Do you know of a better Data Recovery Program than EaseUs Data Recovery wizard - According to my experience I haven't found better
I tried a whole battery of programs in 2011 and the ones that I liked best were PhotoRec because it has the option of scanning for lost files in just the free space and Undelete360 because it was one of the most effective at detecting and recovering file-/folder-names. Both are free.
I just tested Undelete360 on a Sansa Clip after doing Quick Format and it found Nothing! EaseUS found everything.
No data-recovery program will give perfect, effort-free results. They look at the directory entries that are marked as deleted and list everything they find. This means that the list will include a lot of stuff that was (legitimately) deleted a long time ago and are no longer valid. You will need to manually check each and every file to make sure that not only are they not corrupt, but that they are even real files (they could contain chunks of other files, thus making them completely gibberish).
How do you make a byte-for-byte copy of disk?
You can use a disk-cloning program to create a disk image. Drive Snapshot is a great commercial program and DriveImage XML is a great free program. You can even use a hex-/disk-editor to manually copy all sectors to a file. There are two things to note when creating a disk image:
You must select the copy-all function of the program, otherwise it will examine the file-system and copy only clusters that are in-use, which for data-recovery is usually no good. You must check the option so that it copies all clusters, including unused ones (i.e., a true and full clone).
Most such programs have an option to compress the image to save space. This is a good and useful function, but it also means that you will not be able to view the image in a hex-editor and must restore it to a disk or at least mount as a drive in order to access the volume.