NTFS drive - all file names appear but all docs corrupt

Komatsu,

Have you looked for encrypted volumes on the external USB hard drive? I am curious if there is a TrueCrypt volume on the external USB hard drive that when mounted and opened, created the "corrupt" file listings you are able to access.

What file sizes are the "corrupt" files you are seeing on the external USB hard drive? Are the file sizes 0 kilobytes?

Do you see any hidden system file names that start with a "$" that could indicate recently opened files on the external USB hard drive?

I have not heard of anyone imaging a "Smart TV", but I would imagine that depending upon the TV model, the operating system is Android or a flavor of Linux. Could you try to extract out the built in computer within the "Smart TV" to see if any data is stored locally within the TV itself? I would imagine that there is some data saved from session to session.

Thanks for your reply UC.

There was no encryption on disk.

File sizes appear to be normal.

User external 500GB USB drive to a USB port on a SMART TV.

What brand and model? What does that TV expect such USB drives to be? Backup-drives? Something else? Are there any reports of that kind of device thrashing USB drives?

Then what happened? What operations were performed? Either manually or automatically.

Now all documents are visible but ALL are corrupt.

ALL? How many files are affected?

Sounds as if the Master File Table has been rewritten or modified in some way. Exactly how? Does any information remain?

GetDataBack and the usual programs find files but all corrupt.

I tried TestDisk but it reported a corrupt MFT and corrupt $MFT.

Where to from here?

Depends on where you want to end up. What is your goal?

I'd want to talk with the tech support for the TV, and possibly try to find a technical manual that describes what disks/file systems are supported, and also what kind of operations are allowed to take place.

And I'd want to look at the MFT records to figure out just what has happened to them.

Then, I'd may want to verify by repeating the action, keeping log of the activities.

Run data carving on the disk.

If it finds files it would indicate there may be an error with the file system. For instance if the MFTs are pointing to the wrong location.

One slightly complex technique I do at times is to data carve the disk and find a JPEG, making sure that your carving program has generated the correct exact size (and possibly correct date). Then look at the corrupt directory (log) for the same file. If you repeat this with a few files, you see a fixed difference between actual and expected locations.

If carving does not find any files, then you think about a plan 'B'

If you know what has gone wrong, you can then fix it.

ok thanks for all the suggestions. It was a Samsung TV btw.

Photorec is now recovering the files in raw format.

Some files are finally appearing nameless but thankfully uncorrupted.

It should take around another 24hrs to finish.

mscotgrove, thanks for suggestion on file carving - i might use that as a last resort but so
far Photorec is doing an ok job.

Thanks again.