sound track deleted with mkvtoolnix backed up anywhere?

[David Banner]

I was removing one of a dual sound track from an mkv with mkvtoolnix and I accidentally deleted the one I wanted as well. Is it saved or backed up anywhere? Undelete tool does not find it. Not in app data \jobs

[davexnet]

It doesn't delete files, it copies your track selection(s) to a new file, original unchanged

[David Banner]

It doesn't delete files, it copies your track selection(s) to a new file, original unchanged

ok i deleted the original

[davexnet]

What was the size if the file? If it's greater
than 4gb it's lost. This does not mean anything smaller
Is necessarily recoverable, it could already have been overwritten, depending on the HDD activity.
Not in the recycle bin?

[David Banner]

no its gone thanks

[abolibibelot]

What was the size if the file? If it's greater than 4gb it's lost. This does not mean anything smaller is necessarily recoverable, it could already have been overwritten, depending on the HDD activity.

Well, it's not entirely true. What is true, as far as I know, is that on NTFS filesystem, when a file with a size above 4GB is deleted, the allocation information in the corresponding MFT record gets wiped (not sure why ; it can also happen occasionally with smaller files, not sure why either). Which means that standard undelete / recovery procedure is impossible (such files appear with a “0 byte” size in R-Studio or DMDE, Recuva displays the correct size but indicates that “File's data could not be found on the disk”).
But the file's contents are still there on the device (unless it's a SSD in which case the contents will get wiped quickly because of the TRIM command), so it's still recoverable by the raw file carving / signature search method, until it gets partially or totally overwritten by newly written files, at least if it was contiguous (not fragmented). Tools of choice for that would be Photorec (free, usually flawless MKV recovery provided that all other file types are disabled, but it will automatically extract any matching file it finds on-the-fly so if there are many other deleted MKV files a lot of space is required to recover just one file), or R-Studio (not free, but very efficient for both filesystem based recovery and signature search based recovery, the advantage is that it first scans the partition, then displays everything that was found, and the user can preview and select and extract just the one file that was accidentally deleted in such a scenario).
Almost a week later, it's probably too late for that, though. I don't come that often on that forum, but I went to the trouble of writing this essay on that subject a few months ago, it would be nice if someone could link to it whenever there's a request about a data recovery issue, rather than replying with half true or misleading statements which will result in accidentally deleted data being lost for good when it could have been recovered by acting wisely in a timely manner.

[davexnet]

I know the data is still there. Have you ever successfully recovered a file >4gb?
What if the original file was in multiple extents? Are you saying Photorec/R-Studio can find all the pieces and put them back together in the proper order?
Or is there some surviving information that facilities this?

[abolibibelot]

I know the data is still there. Have you ever successfully recovered a file >4gb?
What if the original file was in multiple extents? Are you saying Photorec/R-Studio can find all the pieces and put them back together in the proper order?
Or is there some surviving information that facilities this?

Contiguous files, yes, it's usually easy, if it's a file with a specific enough signature (which is the case for MKV files). (I once purchased two 4TB HDDs used, out of curiosity I checked if they contained anything worthwhile — most used HDDs contain "something", as most people are unaware that deleted data is not actually deleted until it's overwritten ! — turned out that they were filled with MKV movies in good quality, some of which I would have never known about otherwise, at least one I found brilliant : Alabama Monroe. One of those drives had the first 25GB completely wiped so any allocation information was lost, but Photorec could flawlessly extract each file, with sizes up to about 15GB. At the time R-Studio performed poorly for MKV raw recovery, but it improved later on, possibly because I reported the issue on the forum, now it's on par with Photorec for that file type.)
Whether a file is written in one extent or many depends on how the partition was filled and if the free space was fragmented when the file was written. In the case of files downloaded simultaneously, they can end up hugely fragmented even if the free space was perfectly contiguous. (I've had a situation where a HDD failed and I had saved almost all files except a few videos which happened to be massively fragmented for that reason, and which had bad sectors. As I was lacking storage space I had made a partial image which contained all the extents / fragments from those files, but the MFT was incomplete, and the drive had become totally unresponsive by then, so I had to use a convoluted trick to piece them together based on information I had retrieved earlier — here for more detail.) It can be a good idea to make a backup of the MFT once in a while, in case some SNAFU like this happens, if no proper full backup is available. In R-Studio the MFT appears in the "Metafiles" virtual directory, in WinHex it's in the root directory. It compresses very well so it doesn't take much space (I recently made a backup of a 2.24GB MFT, it compressed as a ~130MB 7Z archive.)
Photorec attempts to piece together fragments of files it detects as fragmented, but it's a rudimentary approach and I have yet to see it succeed. Perhaps it works in relatively simple cases on small volumes like memory cards (for instance when one picture was deleted and a new one was written with one fragment in the empty "hole" and another fragment located after a bunch of files that stayed in place). R-Studio doesn't make such attempts and usually truncates a file when a new header is found.
There are a few advanced utilities which are specifically meant to recover fragmented files, although I have never tried them. Obviously it would be overkill to recover just one video file unless it's unique and very important.

[davexnet]

Appreciate your thoughtful response and for sharing your experience. Just out of interest, how does one use the MFT backup?
Is it in case the original MFT gets destroyed, restore it from the backup?
The OP never mentioned whether his file was < or > than 4GB, nor did he mention if it was on a dedicated data drive that he'd
frozen all writes to - so it's somewhat moot regarding his file recovery.

I'm still using a 250GB sata drive I bought 17 or 18 years ago; I may be in the market for a drive real soon, after some strange system activity
and slowdowns, I ran the Seagate Tools program and this drive failed on the diagnostic self test - then I ran it again later and it passed

The error in the system event viewer is source - disk, event ID 11. The text says:

The driver detected a controller error on \Device\Harddisk2\DR2.

The odd thing is, I have yet to confirm whether Harddisk2\DR2 is the drive in question. I also have a 128GB PATA disk and a 1TB USB drive attached.
The info in MSINFO32/components/storage/disks
refers to the 250GB sata as Disk #1, while the USB attached drive is Disk #2

Thanks for mentioning the movie, looks interesting

[abolibibelot]

Appreciate your thoughtful response and for sharing your experience. Just out of interest, how does one use the MFT backup?

Well it's certainly risky to attempt to restore the MFT in-place (unless there's a complete backup, but if there's a complete backup there should be no need for such a painstaking approach). But it can be analysed to get a list of all sectors belonging to a specific file, allowing to piece together all its fragments in case of an accidental deletion (either manually if there are only a few fragments / extents, or with a script as I did when I had the aforementioned SNAFU). It doesn't replace a backup but it can be a complimentary safety measure, in situations where having a complete and regularly updated backup feels overkill (for a HDD filled only with movies for instance, as it's not irrepleceable data, for someone with limited resources it can make sense to have a main HDD with the important personal stuff which gets properly, thoroughly and frequently backed up, and then “entertainment” HDD(s) which are considered more or less “expendable”).

The OP never mentioned whether his file was < or > than 4GB, nor did he mention if it was on a dedicated data drive that he'd
frozen all writes to - so it's somewhat moot regarding his file recovery.

Indeed, not enough info to say for sure, apparently the investigation stopped at the recycle bin.

I'm still using a 250GB sata drive I bought 17 or 18 years ago; I may be in the market for a drive real soon, after some strange system activity
and slowdowns, I ran the Seagate Tools program and this drive failed on the diagnostic self test - then I ran it again later and it passed

You should examine its SMART status with CrystalDiskInfo of HDTune (both free) or better yet HD Sentinel (not free but among other things it displays a plain text diagnostic, and does a constant background check of all attached storage devices, keeping statistics which can for instance allow to check if a drive with a few bad sectors remains stable or if it gets worse over time, slowly or quickly). That kind of error could be caused by a connectivity issue rather than an internal failure (although a 17/18 years old HDD is pushing the statistical odds by a large margin !).
I now rarely ever purchase a new HDD, considering that for barely more than the price of a new one I can get two used ones with the same capacity (one being generally used as the backup for the other), and considering that HDDs tend to fail either during the first months of use, or beyond the warranty period. (A long, long time ago some HDDs used to have a 5 years warranty, last time I checked it was 2 years at best.) And it's two less units that are produced, so it's more environmental friendly, even if it's a drop in the ocean of ever increasing over-consumption of manufactured goods, which certainly won't keep going forever at that rate...

The odd thing is, I have yet to confirm whether Harddisk2\DR2 is the drive in question. I also have a 128GB PATA disk and a 1TB USB drive attached.
The info in MSINFO32/components/storage/disks
refers to the 250GB sata as Disk #1, while the USB attached drive is Disk #2

With WinHex (this should work with no licence) you can open each drive either as a physical device or each of its partitions as a logical device, if I'm not mistaken the numbers should be the same as in the Event viewer or elsewhere in Windows, and at least in WinHex the numbers from the “Physical media” section do match those from the “Logical volumes / partition” section (so you can easily see which is which based on the size / drive letter / volume name, and if that's not enough open the partition to check if it contains the expected files / folders). In my experience those numbers can change from one session to the next, even if the drive is attached to the same SATA port.

For more in-depth replies I just found this :
https://superuser.com/questions/538574/which-drive-is-device-harddisk1-dr1

[davexnet]

Thanks for those links - needed WinObj and DriverLetterView to finally prove that DR2 is the USB 1TB drive.
I looked in the log and found 4 or 5 other occurrences of the error dating back 6 months.

I'm going to look at some of the other utilities you mentioned for further troubleshooting -
thanks again