Folders wiped on an external HDD

[mihaimunt]

Alright, this is very tough, I'm still in shock as I never experienced such a thing before... I need help to figure out what happened with my files.

Yesterday, I was organizing my media library (photos, music, backups from my phone, and other documents) using 2 external HDDs attached to an OWC drive docking station. At some point, I decided to move a big folder (about 400 GB) from drive 1 to drive 2 while I was looking online (hiclipart.com) for some transparent PNG icons to customize few folders. I downloaded a bunch of PNG icons, and then I moved that Icons folder from Downloads to the external drive 1 to one of the folders there. Well that's the time disaster happened: 3 of my folders (one with photos, one with resources, and one with music) suddenly vanished with no warning or any notification!!!

On drive 1 I had 9 main folders and the 3 ones that got vanished had a "+" character in front of the actual name (ex. /Volumes/MEDIA LIBRARY/+ DIGITAL MUSIC LIBRARY/) (I have named it like that to be easier to identify while organizing my stuff). I didn't notice the actual wiping out immediately, only after a while (I don't know, 10 to 30 minutes maybe)... 


The storage of the missing folders (about 600 GB or maybe more) is now shown as available on drive 1 like it was deleted and the trash emptied. I have not a single clue what happened, and you can imagine that I wasn't that idiot to delete my own files. 6 of the folders which are now left on the HDD are intact and contains RAW data that I used to extract and organize into the 3 folders that I mysteriously lost.

Besides that, when you delete such a big amount of files
1. you'll get notified and
2. it will take a while to be completed
3. with a regular delete process will go into the Trash and then
4. you should manually empty the Trash for files to completely be gone.

None of these steps occurred! In fact, I'm always careful when I'm deleting folders and files from the trash looking always at the size of the files and folders that I will wipe.

After this scary event, I immediately stopped working with the drive and I installed a few recovery apps in this order:

Recoverit Data Recovery and then EaseUS Data Recovery, both totally useless as none of them discovered any deleted folder. Not even a trace, like never been there or existed! The hard drive is NTFS formatted, and I'm using it on Mac with the help of Paragon NTFS for Mac.

Right now I'm scanning it with Runtime GetDataBack (on my Windows Notebook) but to be honest I have no hope anymore. The scan will take like 56h to be completed using the Level 5 - Deep Scan (first 3 levels discover nothing but only the remaining folders). The HDD is brand new (Seagate 16 TB HDD Exos X16, ST16000NM001G - retail, verified, with genuine SN) and is working flawlessly - I'll check later for bad sectors, but I doubt I'll find any - I've checked it also with CrystalDiskMark and looks good.


Where can I see the event viewer on Mac (like a log for when files were moved, copied or deleted) to see exactly the moment when it happened? I had installed Bitdefender and I did also a scan with Malwarebytes but no virus or anything suspicious has been found...

I'm really desperate, and I have no idea what can I do to recover my files...


Please help!
Thank you!

 

[chscag]

Welcome to our forums.

Question: Was the Seagate 16 TB drive encrypted? Was encryption software included with it? We ask because generally with that type of drive Seagate includes its own software to lock and unlock the drive.

Since the drive is formatted to NTFS you will need to use recovery tools that work with NTFS not something with the Paragon software.

There have been other reports of data lost when using Paragon software but generally it's safe to use. However, a 16 GB drive is a different matter.

Our advice is not to use the drive at all until you can recover your data.

If recovery software doesn't work for you, what you will need to do is send the drive to a recovery service to get your data back. It depends on how important that data is to you whether or not you want to do that.

If you decide to use a data recovery service we recommend this one:

https://www.300dollardatarecovery.com/

They are the most economical and highly recommended. Note: They are closed until after the holidays.

 

[ferrarr]

Have you ejected the drive, and reconnected it? Have you restarted the iMac?

Which macOS version are you running? macOS usually has separate Trash for each connected drive, so the items don't show in the Trash in the Dock. I've never used Paragon, as I have always had winOS Pc's and usually use my network to transfer files between systems, and never that amount of data. If I had that much, I would use a separate drive formatted as exFAT/FAT32. And I would never have the data in only one location.

 

[MacInWin]

To follow up on chscag's comments, you should try to recover the files on a Windows system using tools for NTFS drives, not on the Mac. I don't have any recommendations because I don't know what Windows tools work well, but there are options available, I'm sure.

 

[mihaimunt]

I'm using now GetDataBack for NTFS. I'm on Big Sure with the latest iMac 2020 (Intel-based). Well, I also have a backup (fortunately) except for my music and latest phone backup. Anything else can be re-downloaded and recovered from the Internet but the thing is everything in those folders was organized so neatly (with tags, categories, and so on). Basically all my organizing work it's gone. I need to redo it from the scratch. And I also had few Lightroom edits and Photoshop files... also gone. All the RAW files I have them backed up on a different drive.
And all the data recovery apps I used even on Windows show me only the existing files and NOTHING I HAVE LOST!!! Like deleted or moved folders and files. I have never overwritten any data since the event happened. So it should be there, somewhere... In the recycle bin it's not, as space it's available. I'm assuming everything happened because of the folder names that was containing the "+" symbol... combined perhaps with a driver error of the Paragon Software, or maybe I was infected with some kind of ransomware...

 

[MacInWin]

No ransomeware, no infection. There isn't anything for the Mac that does that. Something just happened to the files. I would suggest not making any changes to the drive for a while until we can come up with other ideas for you to try. If you do anything, you may make the drive unrecoverable.

 

[mihaimunt]

No ransomeware, no infection. There isn't anything for the Mac that does that. Something just happened to the files. I would suggest not making any changes to the drive for a while until we can come up with other ideas for you to try. If you do anything, you may make the drive unrecoverable.

Thank you, I will just finish the scanning... with GetDataBack... maybe it will see something... and I'll let you know. It's very weird as the HDD is perfectly healthy and functional and all the other folders are intact. I still have 12 TB of data on it (the 6 folders named regularly).

 

[MacInWin]

It is possible that the files are there, but hidden. To see hidden files on the drive, follow the directions in this article: https://osxdaily.com/2009/02/25/show-hidden-files-in-os-x/

To enter the commands to Terminal, copy and paste them instead of trying to type them in. They work exactly as given in the article.

To revert back to the default for Finder, just change the word TRUE to FALSE and enter the same commands.

If the files have become hidden, and you can see them with the hidden files visible, let us know and we can sort out how to make them visible again.

 

[mihaimunt]

Can I convert now the formatted NTFS drives to exFAT without losing any data? I guess not... It's too late... I used NTFS because I'll connect these drives also on Windows machines otherwise I would go for the Mac partitioning type... If the folders are somehow hidden and not deleted then I cannot explain the free space on the HDD.

 

[chscag]

Do not attempt to convert NTFS to FAT or exFAT as that requires writing on the drive which may result in data loss from overwriting.

Actually, choosing NTFS over FAT or exFAT was a good choice as NTFS is a journaled file system whereas FAT or exFAT is not. Besides that, NTFS uses 4K clusters which allows better use of available space on the drive.

It appears that you do have backups for your data which is good. Better to have to reorganize everything again than to lose it permanently.

 

[Rod]

This is probably too obvious but just a suggestion. Have you tried ejecting the drives, restarting your computer then reconnecting them?

 

[jpdemers]

NTFS doesn't play well with all operating systems. You might try connecting the drive to a Win7 PC and having a look.

 

[ferrarr]

This is probably too obvious but just a suggestion. Have you tried ejecting the drives, restarting your computer then reconnecting them?

I had that thought in post #3

 

[ferrarr]

NTFS doesn't play well with all operating systems. You might try connecting the drive to a Win7 PC and having a look.

It works fine with most winOS versions. And Mac OS X/OS X/macOS can read from it without any issues.

I don't know it it performs/behaves differently if the partition scheme is GUID vs Master Boot Record?