HDD GURU FORUMS
http://forum.hddguru.com/

4GB of 2TB hdd is overwritten, how to recover the rest
http://forum.hddguru.com/viewtopic.php?f=7&t=40872
Page 1 of 1

Author:  atuovu [ January 23rd, 2021, 9:05 ]
Post subject:  4GB of 2TB hdd is overwritten, how to recover the rest

Hi

A friend has accidentally formatted an 2TB Seagate external drive with Rufus when trying to create a Windows installation USB.

I don't know the original filesystem (maybe NTFS or exFAT?)

Rufus overwritten the original partition table and created an 32GB FAT32 partition.

The new partition has 4GB Windows installation files written in it.

I guess rest of the disk is untouched.

What is the best approach/ best software for recovering files out of it? Recuva, R-studio, testdisk...?

I'm creating an image right now, will start recovery tomorrow.

Thanks

Author:  MasterT [ January 23rd, 2021, 10:22 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Partition Table is gone. So you won't recover any data with structure as it was before.

You can use any data recovery software to scan in raw recovery mode targeting specific file types.

Author:  atuovu [ January 23rd, 2021, 10:45 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Oh, shoot. I guess it has Autodesk files etc. but no idea what else. I'll see if the owner can give more precise description.

Author:  fzabkar [ January 23rd, 2021, 15:22 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Can you show us the Partitions window in DMDE?

https://dmde.com/

Author:  atuovu [ January 24th, 2021, 4:13 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

fzabkar wrote:
Can you show us the Partitions window in DMDE?


Attachment:
1.PNG
1.PNG [ 40.05 KiB | Viewed 10070 times ]


Attachment:
2.PNG
2.PNG [ 27.56 KiB | Viewed 10070 times ]

Author:  fzabkar [ January 24th, 2021, 13:29 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

As expected, the $MFT has been overwritten. I think that a raw recovery will be your only option (as already stated), most likely without original file names.

Author:  Arch Stanton [ January 24th, 2021, 16:01 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

fzabkar wrote:
As expected, the $MFT has been overwritten. I think that a raw recovery will be your only option (as already stated), most likely without original file names.


I have never checked this, but I do not know how much of MFT DMDE actually examines. What I do know is you may have a lucky break. If I for example look at the NTFS partition on my internal drive MFT is fragmented and a huge portion is out of this 4 GB danger zone. MFT holds about 1 million files which is roughly 1 GB. In my case overwriting 4 GB of start drive would still allow me to recover 60% of files using file system meta data.

Author:  atuovu [ January 24th, 2021, 19:23 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

I'll see what will come out of it. This is an external drive so I guess there's a slim chance of fragmentation as the files were probably written in one (or two) go.

Which software handles this overwritten MFT scenario best? Getdataback, R-studio or DMDE?

Author:  fzabkar [ January 24th, 2021, 22:10 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

atuovu wrote:
Which software handles this overwritten MFT scenario best? Getdataback, R-studio or DMDE?

I have no personal experience, but there is a DR pro at reddit who consistently claims that Getdataback is the better tool in such cases, even though his primary tool appears to be R-Studio. Just saying ...

Author:  atuovu [ January 25th, 2021, 3:59 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Cool, thanks. I plan to try demo of both of them when I have the time.

Author:  atuovu [ February 1st, 2021, 8:50 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Status update:

GetDataBack didn't find anything (only NTFS special$ files).

Also tried raw file recovery with R-Studio. Scanned for 3 days and only found ~2-3 GB worth of mpg, jpg and pdf files. Some of them were legit but most of them useless. Scan abrubtly ended due to an unrelated BSOD and I didn't restart the scan afterwards.

Author:  Arch Stanton [ February 1st, 2021, 9:15 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

RAW scans typically result in many false positives. 2 - 3 GB, how full was drive, how much data is expected?

GetDataBack, what version did you use? Assuming Pro, what file systems were detected, what level did you select?

Alternatively try ReclaiMe (long scan), UFS, ZAR (zero assumption recovery). Note that the latter will not show you RAW results unlike the first 2. However it's pretty good coming up with a file system assuming meta data is actually detected.

If you settle for RAW or if it's only option, PhotoRec is free and supports many file types, not just photos.

Author:  atuovu [ February 2nd, 2021, 19:08 ]
Post subject:  Re: 4GB of 2TB hdd is overwritten, how to recover the rest

Arch Stanton wrote:
RAW scans typically result in many false positives. 2 - 3 GB, how full was drive, how much data is expected?

GetDataBack, what version did you use? Assuming Pro, what file systems were detected, what level did you select?

Alternatively try ReclaiMe (long scan), UFS, ZAR (zero assumption recovery). Note that the latter will not show you RAW results unlike the first 2. However it's pretty good coming up with a file system assuming meta data is actually detected.

If you settle for RAW or if it's only option, PhotoRec is free and supports many file types, not just photos.


Unfortunately I've no idea how much data was in the drive.

Used the latest version of getdataback (simple?) on 4-star mode. found 2TB NTFS but it was useless as stated.

I'll try the programs you mentioned.

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/