Deleted Partition and Formatted Hard Drive -> Help Recover!

[Arlen10]

I meant to delete a partition from my hard drive, but ended up deleting the contents of the entire drive. I went to use a utility to see if I could undo what I did, and it wasn't coming up, so I reinitialized the drive in disk management which essentially formats and assigns it a drive letter. I find later that this was a stupid mistake and that I just made the recovery process very difficult. On top of that, Windows targeted the formatted drive and wrote about 10mb of data to it and created folders as I had set Desktop, Downloads, etc locations on my external drive. So now I have a drive that was deleted, formatted, and was partially overwritten, and I need to recover my important data from it.

I've ran every software that I could get and none of them are giving me the correct directories for how the drive was before it was deleted. All of them are showing directories from when the drive was formatted over a year ago. So I have these partitions that show windows installations from my Windows 8 OS and such. I now have Windows 10 installed on an SSD, and use this hard drive as a storage drive. I ran EaseUS Data Recovery and managed to get a lot of my photos and videos that were important. However, I'm still missing some files for work and documents and some of the images/video are corrupt (I can live with it). It seems that EaseUS is finding these files on the hard drive, but I cannot find the directories for them. When I search through the directories EaseUS built, none of the files it found come up.

Does anyone know how to fix this? Is there any possible way to rebuild the directories and recover the data as it what? I'm not that great at data recovery, but I know my way around Windows very well. If anyone can help me with this I'd sincerely appreciate it!

OS: Windows 10 x64
RAM: 16GB
Boot Drive: 240GB SSD (W10)
Slave Drive: 1TB WD Blue (Deleted/Formatted Drive)
Extra Transfer Drive: 1TB WD Black (To transfer data to)
Other Storage Drive: 320GB WD Blue (Extra Storage, Slow and Old)

Software Installed:
EaseUS
Recuva
GetDataBack
iCare Data Recovery
Unformat

Approximately 700GB of Data was on that 1TB drive.

If anyone wants to help with this directly I'd appreciate the assistance and would be willing to pay.

[warnerr]

1) stop any and ALL writing to hard drive until all data recoverable is complete. you are blasting holes all over your data- the overwritten data is gone forever.
To maximize finding whats left my favorite tool would be to use R-Studio- it is not expensive and do a raw recovery: set it to find only the types of files you want recovered.
Save that output to any drive other than source.
I presume drive is positively good as ordinarily I would have cloned first to be safe.

[MindMergepk]

I have a drive that was deleted, formatted, and was partially overwritten, and I need to recover my important data from it.

most likely MFT is overwritten as well.

[fzabkar]

PhotoRec (freeware) can search for various file types.

DMDE (freeware disc editor) can search for NTFS structures. The free version can recover a limited number of files, but that may be just enough for you.

[Arlen10]

I went to the permissions of the drive and removed write, full control, and modify permissions from all users. Hopefully that prevents further data from being overwritten. If I make the drive as offline in Disk Management, will my scan software be able to detect the drive? Setting it as offline should unmount it so I don't think it would work. I'd test it but I'm running a scan now.

I tried the scan suggested by GetBackData for formatted drives, but it says in the description "no data was overwritten." I'm now trying the sustained damage scan that is suggested for massive amounts of data overwritten. Hopefully I can find my directories. After scanning through all the software there should have been a file that is ubuntu.vhd if it found the right directories. I've searched every partition but that file does not come up. I have most of my raw files that I need except that one, they are not their original names though, so I'll have to sort through them all (going to take hours). If possible I'm trying to recover the data with the original file names, or even better, with directories intact.

I contacted WeRecoverData.com, they estimate it could be around $500-$900 to fix, would give me a real estimate after examining the drive. That's really expensive for me. Anyone know of any reputable places that do Data Recovery for less?

[Arlen10]

1) stop any and ALL writing to hard drive until all data recoverable is complete. you are blasting holes all over your data- the overwritten data is gone forever.
To maximize finding whats left my favorite tool would be to use R-Studio- it is not expensive and do a raw recovery: set it to find only the types of files you want recovered.
Save that output to any drive other than source.
I presume drive is positively good as ordinarily I would have cloned first to be safe.

Nothing is writing to the drive anymore. I have another 1TB drive to transfer stuff to.

[Arlen10]

Realistically what are my chances of successfully recovering all my data with all the directories intact if I took this drive to a Data Recovery center?

[fzabkar]

I meant to delete a partition from my hard drive, but ended up deleting the contents of the entire drive.

Do you mean to say that your drive originally had several partitions and that it now has a single 1TB partition? If so, then all except the first partition should still be intact. DMDE should be able to see and recover the untouched partitions.

http://dmde.com/

[Arlen10]

I meant to delete a partition from my hard drive, but ended up deleting the contents of the entire drive.

Do you mean to say that your drive originally had several partitions and that it now has a single 1TB partition? If so, then all except the first partition should still be intact. DMDE should be able to see and recover the untouched partitions.

http://dmde.com/

No.
Before it was deleted. There were two partitions. One partition was part of the system or something else like 400mb. The other partition was 931GB. I'm looking for the 931GB partition that had all my data on it. But when I use programs to search for this partition, I get partitions that were formatted and erased along time ago. like 2 years ago. The drive was filled up to about 700gb before it was deleted. I've checked all of these NTFS sectors below, and I cannot find it. While the drive displays multiple "partitions" I only had 2 real partitions on this drive including system partitions. See images.
(recommended partitions)


(all partitions)







Using the EaseUS Recovery software, I was able to actually find some of my data that is from my system that was deleted. But I cannot find the directories for it.

The directories should look something like this
1TB HDD:
/Windows/
>/Program Files
>/Program Files (x86)
>/Desktop
>/Documents
>/Downloads
>/Pictures
/Oracle VM/
/Virtual Machine/
/Intel/

But after searching, the directories are not there, they're for older systems that were formatted. And if you look at the image below, the dates are not recent (2014). Should be 2016.


Also keep in mind Windows is not installed on this hard drive, its installed on my other drive. That's how it is right now and how it was before it was deleted.

[galaxy]

IF data is overwritten JUST FORGET IT .

JUST TRY WITH http://www.diskgetor.com/ WITH FULL SCAN RECVOERY AND TRY IT

[fzabkar]

A 400MiB partition would consist of approximately 800,000 sectors. Therefore the original boot sector should be located at this point.

1083392 sectors corresponds to 529MiB.

Sector 264192 is commonly assigned to a boot sector in Windows systems, but that would correspond to 129MiB.

How is your drive partitioned now? I was expecting to find a single NTFS partition at sector 2048 but I don't see it in your list.

[drHDD]

I could help. PM me.

[data-medics]

I went to the permissions of the drive and removed write, full control, and modify permissions from all users. Hopefully that prevents further data from being overwritten.

Data recovery software all needs to run with Admin privileges, so removing write from user accounts makes absolutely no difference. It has to work at a block level to function, so it's always with admin rights.

[data-medics]

But after searching, the directories are not there, they're for older systems that were formatted. And if you look at the image below, the dates are not recent (2014). Should be 2016.

You're too fixated on dates my friend. That "last modified" date is only the last time a file in the root folder is modified, and generally there are few if any files in the root. I has nothing to do with when the files in subfolders were modified. I would just take and actually look at any that are around the right size like #1 and #5 in that other picture.

[Dima_RnD]

If MFT recors and indexes are not rewritten then data can be recovered.

[drHDD]

You need only mft records to recover data. Indexes are useless without records. Some times records could be found not only in mft, but in other areas.