I've got myself some sh*t with a 64GB UPD. In the heat, my Win7 notebook slows to an unusable crawl (needs more RAM I expect), so I was swapping between the notebook and my still-under-development Linux tower (and a EeePC netbook running Win7 Starter) using said UPD as working storage.
I was importing the UPD contents into my notebook for safety, when the UPD stopped working. I wasn't even writing to it! It would no longer mount, and although Windows gave it a drive letter it said there was no file system. Investigating, I forget which utility told me the superblock is stuffed.
Everything was easily recreatable or existed elsewhere except one file, where the best I had was an auto-save from the last session which was a week out of date.
I have taken a binary image of the UPD (on my Linux system), before risking any "repair".
A google came up with "4Card Recovery", which offers a free download and the first 1 GB of data for free. I set it loose on the UPD and after about an hour (of ostensibly an 18+ hour scan) it had reported FAT structures (I expected NTFS, but not all that surprised if it's FAT) and a few hundred files located, so I stopped the scan to see what's what. The desired file was listed with a correct-looking file length, but exporting it only resulted in about 60% of the actual content.
Maybe that's because I terminated the scan early. it's now running again. I doubt it should need to run to completion because I doubt I've actually used much of the 64GB capacity, but I have no idea how long to leave it this time.
If that fails. I think it should be possible to examine the binary image and search for a known file name to locate the FAT directory and file pointer structures. This should be easier than if it were NTFS. The difficulty will be working with a 60GB binary image. This will be best done using my Linux tower, but I'm not familiar with the tools. I hope there is a hex editor...
Now, the questions are these:
- Anybody hazard a guess how a UPD can get corrupted when all you're doing is reading from it? It was literally in the process of using a file manager to copy a block of files from the UPD to my notebook's HDD.
- NTFS is a journalling file system, which means the OS leaves a breadcrumb trail of what file system alterations are about to be made, then makes them, then tidies up. This is so that a crash in the middle results in the file system unaltered, or a record of what alterations were in process. It would be nice to think that if I had formatted the UPD as NTFS it would have been protected from this insult, but I suspect that if the superblock can be corrupted even while being read, even NTFS would have got corrupted (and be harder to unpick).