HDD GURU FORUMS

Hi friends
I am recovering data from a overwritten disk ( partition formatted & OS (xp) reinstalled. Both easyrecovery & winhex dont have signatures for sql .Is there any good program other than these two?

Strange enough , No one has encountered SQL recovery so far? I have calculated it myself is it- 01 0F 00 00 08 00 00 00 ?
It will be great help for me if some one confirms it

Well I dont know how those scan tools work, presumably they just look for a signature at the start of the sector (or rather cluster if a ntfs volume)

But the start of a SQL MDF datbase does indeed start
01 0F 00 00
mine then continues 08 02 00 00

It has already been covered in this forum. Use search function and check in the software section.

different softwares needs different signatures. winhex needs it in another way. To add trouble every version of sql has its own signature.I have taken first 8 bits.

Oh, I was thinking of a damaged SQL database.

What file system was on the disk?

I see, (xp) so then why don't you recover the parition first? Instead of trying to do a raw recovery on an mdf file?

Hello quasimodo
thanks . disk was formatted by user & winxp (approx 8gb) reinstalled. now they want sql mdf / ldf files. so raw recovery is the only option.

Lets hope the drive (or rather volume) orgininally had lots of space in- use before they created the database, such that it will tend to have been using clusters further into the volume

Probably would have been if they also orginally had installed SQL on the drive, and havent reinstalled it since the format and OS reinstall

But your going to need to get lucky

I'd search for a left over MFT entry (File Record entry) for the mdf file first
and if that hasnt been reused, it will show the original cluster used
for the data, and you can see if any have been reused and if they still contain the mdf data

NB Is it NTFS or FAT32 ?

tons of thanks xsoliman
disk volume was 20gb NTFS but customer has copied similar named ldf / mdf files & occupied file size is 8gb. got few files from winhex and easyrecovery.

This is getting more complicated and much less chances of success

So sounds like they have put another database with the same mdf name onto the drive
(presumably an older backup copy)

Formatting it was a mistake
Reinstalling the OS on it was a mistake
But putting another copy of the large database on it makes recovery very unlikely


How big is the new mdf (and the lost mdf)? Sounds like both were about 4GB
and drive now has 8GB's worth of data on it and 12GB of space

And they are hoping that the orginal MDF file is in the spare space ...


Very unlikey that you can find the MFT entry for the original mdf file entry
(and need to make sure you dont get distracted by the new MFT entry for the new copy of the file with the same name)

Search every other sector (as MFT entries are 1K long) extensive search, for any that contain the filename.mdf (in unicode), and that start 'FILE*' (in ascii)
This will give you the unimportant MFT entry for the new copy of the file, and if you are lucky will also bring back an older, left-over, MFT entry for the previous one

I agree, your chances therefore are alot slimmer. Make sure you know exactly what version of SQL the customer was running, then re-create a sql database or two with the same version of SQL. Check and confirm not only the header, but also the footer of the MDF and LDF files. Perform a search for both header and footer in winhex. Also check for fragmentation of the database files. Although this can be a very big pane in the @$$ to try to patch a fragmented database back together.

Good luck

thanks xsoliman & quasimodo
database created using same version was on another partition but both ldf /mdf files have same signature. only one file of 1.37gb was copied from old backup.Both easyrecovery & winhex have recovered lot of files.
It seems method you have suggested is only right & will give it a try.
thank you so much