Logical Data recovery from Shrinked Volue not possible

[terminator2]

I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.

[Amarbir[CDR-Labs]]

I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.

Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

[terminator2]

I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.

Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

Hi Amarbit Thanks for replying. Yes you are right. This particular Toshiba hard disk is SMR
Toshiba Internal laptop Model - MQ01ABD100 Drive Rev. AAD AD00/AX0A1D Date -- 17 APRIL 2018

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss. If this is so then I must educate all my customers for the same.
Thanks again

[Tomset]

MQ01ABD100 - CMR

[northwind]

Yeah, MQ01 is NOT SMR.

[Amarbir[CDR-Labs]]

I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.

Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

Hi Amarbit Thanks for replying. Yes you are right. This particular Toshiba hard disk is SMR
Toshiba Internal laptop Model - MQ01ABD100 Drive Rev. AAD AD00/AX0A1D Date -- 17 APRIL 2018

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss. If this is so then I must educate all my customers for the same.
Thanks again

Well,
This is Not SMR My Friend .

[fzabkar]

This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.

[Amarbir[CDR-Labs]]

This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.

Well,
How about a Free copy of UFS And Check Hex Of The Entire Platter Surface

[terminator2]

This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.

Thanks a lot

[terminator2]

This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.

Well,
How about a Free copy of UFS And Check Hex Of The Entire Platter Surface

Thanks Amarbir and guys ,
Sorry I was mistaken. I think this was shrinked volume that is the reason I am unable to trace NTFS boot sector.
I am giving up finally after lots of efforts

[Arch Stanton]

Either I do not understand exact situation or I do not understand the failure to recover data. Please describe initial state and the one we have now.

With or without a boot sector you still should be able to recover data. Whether you can 'undelete' previous d: drive is a different matter. If for example d: was NTFS, find start of MFT or even portions of MFT and you can make educated guesses about the position of the file system, test our guesses and adjust as needed. Use it to construct virtual file system and recover data. Same if we have file allocation table or parts of it. And even if we could not, RAW recovery is still an option.

What file system was the d: drive?

[terminator2]

Either I do not understand exact situation or I do not understand the failure to recover data. Please describe initial state and the one we have now.

With or without a boot sector you still should be able to recover data. Whether you can 'undelete' previous d: drive is a different matter. If for example d: was NTFS, find start of MFT or even portions of MFT and you can make educated guesses about the position of the file system, test our guesses and adjust as needed. Use it to construct virtual file system and recover data. Same if we have file allocation table or parts of it. And even if we could not, RAW recovery is still an option.

What file system was the d: drive?

Hi Arch , Thanks for the help.
Customer (computer dealer) has given this disk , it came to him for installation of new OS. He has take backup of C: drive data and kept it in D drive.
Then he deleted C drive. However D drive also got missing . He has not done any overwritting later ,though he has tried to recover data using some tools.
He has copied all data in E drive which is intact and is accessible.
I am not getting either C drive or D drive as claimed by customer. He has created 2 partitions later but has not copied anything.
I am attaching few screenshots.

Attachments

[Arch Stanton]

I do not understand scenario entirely. When he says he created new partitions, did he also format them? If he used disk management he might very well have. If there was a c and d drive, why do we see more partitions thatn those 2, why did drive letter assignments change?

Did he create partitions in exact same locations? What file systems did we have before the chain of accidents?

With all these unknowns, first thing 'd be doing is run full scan on entire disk using DMDE, I'd rather work with that than with too vague stories. Then see from results if I can figure out location of the old partitions. Easiest is, if DMDE detects file systems is top open those (open volume) and check if directories are the ones that can be expected.

[terminator2]

I do not understand scenario entirely. When he says he created new partitions, did he also format them? If he used disk management he might very well have. If there was a c and d drive, why do we see more partitions thatn those 2, why did drive letter assignments change?

Did he create partitions in exact same locations? What file systems did we have before the chain of accidents?

With all these unknowns, first thing 'd be doing is run full scan on entire disk using DMDE, I'd rather work with that than with too vague stories. Then see from results if I can figure out location of the old partitions. Easiest is, if DMDE detects file systems is top open those (open volume) and check if directories are the ones that can be expected.

Yes he has created 2 partitions and have formatted them , I dont know whether they are of exact size like previous one. Other partitions are already present (service & recovery partitions)
I have done full scan using DMDE professional and have send log to dmitry for analysis but unfortunately as per him log is incomplete.So I am scanning disk again.
File system in all instances is NTFS only,I will update you with DMDE log file.