Recovery of WD 750GB USB3 - Passport

[jelc]

Hi all, could use some help!

I got my P8P67A (B3 revision) motherboard in a couple of weeks ago after the Intel recall, and was able to finally build out my new box after waiting for a couple of months with my 2600K processor serving as a paperweight. During the downtime waiting for my new system ,I had backed up and removed a bunch of high res pictures (2 years worth!) from my old computer and backed them up to an external WD 750GB Passport - USB3 drive. The drive the pictures were stored on were at around 90% capacity, and since then they have been clobbered with other data, so a recovery is pretty much impossible on that drive, which is where I looked first.

I have a question on what my best approach would be for a recovery given the following process on:

I had purchased a few SATA2 750GB drives to run RAID 5 on, and one SATA3 750GB which was going to be a performance disk for my new rig. I was using the SATA3 my old computer briefly for extra storage during the wait, as it was the first one I had ordered.. After getting Windows installed on the new computer, I wanted to clean up the 750GB SATA3 drive, and create a few partitions. Unfortunately I selected the USB drive during the diskpart operations, and lost the last two years worth of pictures of my family.. Wife is not happy, our 4 year old won't have any pictures for his school projects, and she was mad about the thousand bucks I had just spent on the computer already!

The following scenario describes what I think I did when I performed the erase on the usb:

diskpart
select disk 4
delete part 1
clean
create partition primary size=20000
format
ctrl-c (after about 8 secs)
/curse

Any advise? Complete recovery on EASUS Data Recovery Wizard Pro failed to turn up the missing files.

I've got the following systems available:
Windows XP
Windows7 64
Ubuntu - Jaunty

If the answer is "send it to a DR pro" that is fine. I will just need to wait a month or so, but any idea what price I would be looking at?

Thanks,
-John

[Vulcan]

Depending on which Windows version you were using, and (if it was Win7, whether diskpart invokes a full or quick version "format"), it seems you've lost the partition table, some filesystem metadata, and possibly (depending on the answer above) whatever 8s of zero-fill might have overwritten.

I'd suggest that the first step is for you to clone that disk - I'd probably clone it twice, so that I've got a duplicate clone (in case the original disk were to die for any reason), but others may consider that duplication to be over-the-top. Since there is currently no suggestion of physical issues, then I see no reason why you couldn't leave that disk in its USB enclosure and clone it from that (onto either direct-attached or USB-attached targets).

For maximum choice of recovery software that you can use later, then cloning to another raw disk is probably best; next best would be cloning to an uncompressed image file on another disk; most restrictive would be cloning to a compressed image file on another disk (since not all recovery software will read such a file). There's a choice of free cloning software possibilities (Windows & Linux), since the source disk is likely to read OK - have a search here for cloning software for some ideas.

Then you can do things with your "working clone" disk, like investigating whether the first xMB have been zero-filled or not with a hex editor; trying different recovery software (free and paid); etc. etc., and you can still go back to either the original disk or a duplicate of the clone, if you accidently change something on that clone disk. Just because one piece of logical recovery software didn't show your desired files, doesn't mean that a different algorithm in different s/w won't do so - there are many different pieces of s/w you can try, but do that on a clone IMHO.

You need yet another disk (in most cases, unless you're using more complex & confusing recovery configurations), to hold the recovered files from any logical recovery s/w. Also don't assume that just because recovery s/w shows a thumbnail photo preview which is OK, that the recovered photo will be OK when viewed full size - check all recovered files visually, before deciding that you've definitely got a successful recovery.

So there are some ideas for you - obviously other approaches are possible, and different people will have different opinions. Some of the recovery software vendors might also make some suggestions to you.