Data Recovery after Partition Editing and Quick Format

Guys, my hard drive malfunctioned recently and following some stupid actions from me I’m on the verge of losing all my important data. Here are the things I did to my Hitachi 2TB Hard Disk (HDS723020BLA642) after the disaster happened:

1. There was only one drive from the Hard Disk used for storing data and it was formatted in NTFS and used as “Dynamic Disk” named “Bulk Disk (D:)”.
2. My computer used to come up with BSOD during start-up for a few months and I was not serious about this and never tried to find out why that happened because after 2 or 3 failures the computer would finally start-up. One day, after booting my PC I found that there was no BSOD and the drive icon had disappeared. From disk management it showed the drive status to be in “Error” mode. Before that happened it used to show “Dynamic” & “Online”
3. I used a software ptedit32 and changed some values which are Type, Cylinder, Head and Sector. Initially after the fault, Type field showed value “EE” and other values were set to “00”.
4. I changed the value of the type filed to “07” which is for NTFS but the software won’t save the changes until I set values to other fields.
5. For “Start CHS” I used the minimum values and for “End CHS” I used maximum. Then I saved the changes and restarted my computer.
6. A drive appeared but it was a new drive named “Local Disk” and upon double clicking, it asked me “Do you want to format this drive?” Also, the “Disk Management” identified it as a RAW drive.
7. I “Quick Formatted” the drive to access it (and, I still don’t know why I did that). After “Quick Formatting” and renaming it back to “Bulk Disk (D:)” I could access the drive but all the data were lost.
8. After that I changed the “End Sector” and "Sectors Before" to “63”, saved changes and restarted my PC. The drive changed back to RAW mode and showed the name as “Local Disk”.
9. I tried many data recovery tools but to no avail. All the data they could recover were shown as “Lost Files” with automatically generated names.
10. I tried all the methods with “TestDisk” software. It found a lost partition “Bulk Disk” with a message “NTFS found using backup boot sector!” but couldn’t list the files in it. Both the boot records (Original and Backup) showed “Status: Bad” and I also tried to build one using MFT but after searching for MFT for a while, the searching process always hung up after a certain specific point. The "GetData Recover My Files" software also found a lost NTFS partition named " Bulk Disk " dated March 9 (A couple of days before the disaster) but had only one page file in it. I suspected initially that it was the new partition I created with the same name after the disaster but a moment later got confused after looking at the date.

Now, I am totally at sea what to do. I need my data back with complete file/folder structure and original names. Can anyone help me on this?

If your data is important, stop messing with it. Either make a full sector-by-sector clone and play with the clone or send it to a pro and have them recover it safely. Assuming that you haven't done much more damage than what you say, it should be a fairly easy recovery for a pro and a cheap recovery for you.

I agree you can not do this one on your own. Stop before you do more damage and then it is impossible for anyone to help you. A repair shop thought they could get off data on a persons HDD. It showed them as RAW-0 and they could not fix the partition table with their free software. So the guy decided he would format the HDD using a program which totally wipped the disk clean filled it with 0 and destroyed all the data. Now they say bring it to me and I can find the data on this one. Funny. On the guys second HDD what did they do. It was booting into a blue screen. So they pulled it out of his PC and put it on a running PC and when they plugged in the PS it fried this one good. Now the guy is out twice becasue of this repair shop and they have lots of clients who go there and come back with nothing except we are sorry and a bill to pay in the end. Learn from others mistakes and stop now before you are left with nothing and can not find your data you want on this one.

lcoughey wrote:If your data is important, stop messing with it. Either make a full sector-by-sector clone and play with the clone or send it to a pro and have them recover it safely. Assuming that you haven't done much more damage than what you say, it should be a fairly easy recovery for a pro and a cheap recovery for you.

Are you sure my data is still recoverable with complete file/folder structure EVEN after what I did from step 5 to 7? I was worrying that I might have erased the MBR and the MFT. Do you think the MFT is still intact? 'Cause when I quick formatted the drive, the start C,H,S values for the hard disk were 0,1,1 and end C,H,S values were 1023,239,63 with my hard disk having 258401 Cylinders, 240 Heads and 63 Sectors per track. To be honest, I don't know about the MFT and MBR locations in a hard disk. Can you enlighten me on that?

poehere wrote:I agree you can not do this one on your own. Stop before you do more damage and then it is impossible for anyone to help you. A repair shop thought they could get off data on a persons HDD. It showed them as RAW-0 and they could not fix the partition table with their free software. So the guy decided he would format the HDD using a program which totally wipped the disk clean filled it with 0 and destroyed all the data. Now they say bring it to me and I can find the data on this one. Funny. On the guys second HDD what did they do. It was booting into a blue screen. So they pulled it out of his PC and put it on a running PC and when they plugged in the PS it fried this one good. Now the guy is out twice becasue of this repair shop and they have lots of clients who go there and come back with nothing except we are sorry and a bill to pay in the end. Learn from others mistakes and stop now before you are left with nothing and can not find your data you want on this one.

I will certainly give it a thought. Although, I was thinking that if I could only find a software which can locate and apply the MFT and unformat the disk with it I could solve this problem on my own. So far I have failed to find one.

You should start with fixing your machine, not finding and running the software.

The rule is that you never ever do data recovery in unstable environment. First thing you do is to ensure the system you doing the recovery on is stable. Connect the drive to a different PC, create a disk image, and then apply software to the image.

Trying to do the recovery on the PC which cannot even start up reliably will eventually produce further damage.

lcoughey wrote:If your data is important, stop messing with it. Either make a full sector-by-sector clone and play with the clone or send it to a pro and have them recover it safely. Assuming that you haven't done much more damage than what you say, it should be a fairly easy recovery for a pro and a cheap recovery for you.

Luke, do you think my data is still recoverable EVEN after what I've done from step 5 to 7? I thought I erased the MBR and MFT completely after those steps. Because, when I quick formatted the drive the start chs were set to 0,1,1 and end chs were 1023,239,63 respectively. My drive has 258401 cylinders, 240 heads and 63 sectors per track. I didn't know about the original values for the disk. I thought perhaps the MBR and MFT are located on the first few sectors. Do you think the MFT is still intact? Where is it located actually?

ReclaiMe wrote:You should start with fixing your machine, not finding and running the software.

The rule is that you never ever do data recovery in unstable environment. First thing you do is to ensure the system you doing the recovery on is stable. Connect the drive to a different PC, create a disk image, and then apply software to the image.

Trying to do the recovery on the PC which cannot even start up reliably will eventually produce further damage.

The start-up problem was fixed as soon as the HDD malfunctioned. I think my system was, for some unknown reasons, not supporting Dynamic Disk. So when it malfunctioned into an "Error" mode the BSOD disappeared and from then onwards my PC has been booting without any problem. But, I like the advices you guys have given me. I WILL clone my hard disk before doing anymore experiments.

it's the technique & procedure than software you r asking for
make an image and go

Also, can anyone please tell me, on step7 when I quick formatted the drive and renamed it with the same name "Bulk Disk", was the MBR for the previous "Bulk Disk" (The one I've been using before the disaster) overwritten?

Let me tell you one story. A repair shop had this same idea. They found a disk in a client external enclosure. They told the client no problem. We can move this data to another disk. Well surprise surprise. Did not happen

Why they did as you want to do. But instead they used some sort of quick format program which over wrote the entire HDD with 0

Now guess what they made their new partition and what was behind it? NOTHING

You know what they said to me when they talked to me. Well it is supose to work like this. If we can not fix the partition and read it then what we have to do is delete it and make a new one and behind the new one all the data is there :oops:

Sorry does not work like this. Try it and you will :cry:

Wish you a lot of luck but if you think one of us will tell you this will ever work for you then you are really wrong

We told you what to do: Clone it and work with clone

Run a recovery prorgam you can get some to test as demo such as RStudio and if you see your data purchase it and recovery it. Nothing more no more said on this one. Go on and do this stupid move before you clone this HDD. It is not my data and I would never encourage you to do this one at all. You are the only judge who can do this one. I would not expect anyone here to say yes do this it will work. :mrgreen:

Alright! I'm not doing anymore experiments with this disk. But I have been losing my sleep over this disaster for the past few weeks. Can someone please tell me if the MBR/MFT of the initially created "Bulk Disk" should still be intact after what I have done (specially from step 5 to 7) or is it overwritten as I have given the newly created partition the same name. I have run some recovery programs eg. Active Partition Recovery & TestDisk which could only find the newly created "Bulk Disk" which did not have any of my user files in it. As far as I know, if I can not find the MBR/MFT for the initially created "Bulk Disk" I might as well say goodbye to the original file-folder name & structure. Please, if only one of you could CONFIRM me on this or else I'm losing hope.

Formatted disk destroy all. You will be lucky to get back RAW data on this one. After all this mess

I “Quick Formatted” the drive to access it (and, I still don’t know why I did that). After “Quick Formatting” and renaming it back to “Bulk Disk (D:)” I could access the drive but all the data were lost.
8. After that I changed the “End Sector” and "Sectors Before" to “63”, saved changes and restarted my PC. The drive changed back to RAW mode and showed the name as “Local Disk”.

You will be lucky to have back RAW data for you and you should be happy with this one.

Like we have said more than once. CLONE THIS DISK you can use DDResuce it is free

Run RStudio, Win hex by file type, or GDB (Get Data Back) but make sure they are paid for. You have a better chance to buy your programs legally and use them for you. You will get back RAW data on this one. You spent so much time screwing all this up will not be too hard to spend a little more time to rename your file folders and work and put them back where they belong. Know this is not what you want to hear but for DIY this is what there is for you now. Sorry

poehere wrote:Formatted disk destroy all. You will be lucky to get back RAW data on this one. After all this mess

I “Quick Formatted” the drive to access it (and, I still don’t know why I did that). After “Quick Formatting” and renaming it back to “Bulk Disk (D:)” I could access the drive but all the data were lost.
8. After that I changed the “End Sector” and "Sectors Before" to “63”, saved changes and restarted my PC. The drive changed back to RAW mode and showed the name as “Local Disk”.

You will be lucky to have back RAW data for you and you should be happy with this one.

Like we have said more than once. CLONE THIS DISK you can use DDResuce it is free

Run RStudio, Win hex by file type, or GDB (Get Data Back) but make sure they are paid for. You have a better chance to buy your programs legally and use them for you. You will get back RAW data on this one. You spent so much time screwing all this up will not be too hard to spend a little more time to rename your file folders and work and put them back where they belong. Know this is not what you want to hear but for DIY this is what there is for you now. Sorry

As far as I know "Quick Format" only erases the indexing/pointers to the data. It doesn't erase the user data at all. The data remains where it is until it's overwritten. Also, I can get the RAW data after a scan with any data recovery software but (I'm saying this again) I need my data with complete file/folder structure. If one of the experts at HDDGURU can confirm me about this if it's possible then I can finally sleep well. So far, whichever partition recovery software I've used could only scan and find the "Newly Created" "Bulk Disk". I need the "Initially Created" one. Mr. Luke with the first reply gave me a lot of hope but I doubt if he has read everything I have written, carefully and thoroughly.

amit wrote:I doubt if he has read everything I have written, carefully and thoroughly.

Unfortunately you have the wrong expectations IMHO. You think you have written "thoroughly" but there are still not enough details to know the state of your disk - it is impossible to know this detail, without having the disk (or a clone) on the bench of someone doing the DR.

amit wrote:I need my data with complete file/folder structure.

I do not expect anyone will guarantee to recover the complete file/folder structure, after what you have done to the disk.

Depending on how many files you had on the disk originally, some of the original file structure might not have been overwritten by your "quick format" and recovery attempts. Other methods of filename recovery are also possible sometimes. However you keep asking for someone to "confirm" that the "complete" file/folder structure can be recovered, and I doubt that you will get that confirmation remotely (personally I do not expect it is possible, after what you have done).

According to the following page, sector 0 was a "legacy MBR".

List of partition identifiers for PCs:
http://www.win.tue.nl/~aeb/partitions/p ... pes-1.html

EE -- Indication that this legacy MBR is followed by an EFI header
EF -- Partition that contains an EFI file system

I would think that by changing the partition type to 07, you would have converted this dummy MBR into a "real" one. A quick format would then have created a new $MFT in a different location than the original MFT.

I would use a utility such as DMDE (freeware) to search for NTFS file structures (Tools -> Search for Special Sector), but do this on your clone.

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

@amit,

After further consideration, I should not have said that "it is impossible" to know the necessary level of detail [about the filesystem state] remotely - but that IMHO it is so inefficient, error-prone and time-consuming to attempt this, it is highly unlikely you would find someone to go through the process with you for free.

You are lucky that fzabkar is helping you to do that.

@fzabkar,

fzabkar wrote:I would think that by changing the partition type to 07, you would have converted this dummy MBR into a "real" one.

Yes, I agree that's exactly what the OP has done.

fzabkar wrote:A quick format would then have created a new $MFT in a different location than the original MFT.

I agree that the new $MFT & $MFTMirr may have been written in a different location, but from my experience in a similar situation, that is not necessarily going to result in OP's desired objective, of recovering all his data intact.

Either the new $MFT & $MFTMirr were written to be completely contained within the previous versions (in which case no user data files were overwritten, but at least some filesystem metadata was lost); or they were written into a different location (as you are suggesting) in which case (even allowing for different partition alignment of GPT vs. MBR partitions) IMHO one file or the other (especially $MFTMirr) was likely written into the area previously occupied by user data files and hence risks having overwritten some user data. That is what I have seen before.

I agree with Vulcan be happy with RAW data and move on. You will be fine but time consuming to organize it again

Actually I think that something better than a completely Raw recovery might be possible in this case (and there are some obvious things to start looking at, if I had the disk in my workshop).

However the OP appears to be asking for certainty e.g. "Are you sure [...]". IMHO the repeated requests to "confirm" that all the data will be recovered with complete filesystem structure (especially after so many mistakes have been made), suggests to me that he does not understand the inefficiencies and other difficulties of trying to fully & accurately investigate filesystem damage/corruption, when remote from the disk.

But if the OP, and someone who is willing to help them, have enough time to go through all the necessary steps, and if the OP doesn't make any more mistakes, then perhaps their question can be answered, eventually - although that doesn't mean it will definitely be the answer that the OP wants

even after all that effort (which would be much more efficiently answered with the disk, or a clone, physically in front of someone with the necessary skills & utilities). All IMHO, of course

Vulcan wrote:@amit,

After further consideration, I should not have said that "it is impossible" to know the necessary level of detail [about the filesystem state] remotely - but that IMHO it is so inefficient, error-prone and time-consuming to attempt this, it is highly unlikely you would find someone to go through the process with you for free.

You are lucky that fzabkar is helping you to do that.

I don't have any other choice at the moment. The country/place where I live doesn't have professionals when it comes to data recovery. There are people who do some free lancing but neither they are reliable nor they can be trusted. I am completely dependent on this forum to get me out of jail!

Data Recovery after Partition Editing and Quick Format

Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format

Re: Data Recovery after Partition Editing and Quick Format