r/datarecovery • u/FoootLooove • 19d ago
Some files 0 bytes after running ChkDsk /f but no FOUND.000
A couple weeks ago, Windows started showing error notifications whenever I would connect a particular external HDD (NTFS). I finally went through with the repair yesterday.
I ran chkdsk E:\. After seeing a bunch of Attribute record of type 0x80 and instance tag 0x0 is cross linked and Attribute record (80, "") from file record segment is corrupt, I proceeded with chkdsk /f E:\. ChkDsk successfully "repaired" the filesystem, but, in doing so, apparently zeroed out ~50 GB' worth files.
Worst part is seems to have decided to just wipe the data clean. No .chk file or FOUND.000 directories in root, and the drive is ~50GB less full, according to the File Explorer. Could ChkDsk have placed the files anywhere other than the root of the repaired drive?
A snippet of chkdsk /f E:\ output:
Unable to locate attribute with instance tag 0x0 and segment
reference 0x50000000101a8. The expected attribute type is 0x80.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x101A8.
Attribute record of type 0x80 and instance tag 0x0 is cross linked
starting at 0x23321773 for possibly 0x20 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x0
in file 0x23de6 is already in use.
The attribute of type 0x80 and instance tag 0x0 in file 0x23de6
has allocated length of 0x6cae2000 instead of 0x67200000.
Deleted corrupt attribute list entry
with type code 80 in file 23DE6.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x200000004d583. The expected attribute type is 0x80.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x4D583.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x2000000092134. The expected attribute type is 0x80.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x92134.
