Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
March 17th, 2011, 13:07
Simplicity wrote:1. Create partition in empty space and leave it unformatted.
2. Start Recuva and get as much data as possible. I can't confirm it now, but it should be able to recover data from unformatted media.
1. will not work. it is bad idea to do this one. Allow the tool you are using for cloning to clone the entire drive or if it is SW do the same.
2. You need clone of your entire drive even if you are showing that you can not repair your partition table on this one. Then you can use Get Data Back, RStudio or USF explorer to find you data that is on the partiton of the HDD. That is easiest way to do this one. It might be RAW data but you can get it back. Winhex can also do data search on this one. But I have had more than one partiton that can not be fixed and this is easiest way to do this one.
March 17th, 2011, 14:47
DR-Kiev wrote:Alt(R-TT) wrote:1. A full-format (unlike a quick one) will overwrite all data remaining on the disk with 0s. That will make data recovery impossible.
I agree with Vulcan.
In most file systems, full-format not much different from quick-format.
From the set of programs the topic starter mentioned, I recon the host os is Windows. It overwrites the data with 0s during a full format.
March 17th, 2011, 15:03
My 50 cent :
If the drive has "bads" and the displacement of such "bads" is unknown (who belongs to : files, non important files, empty space, directory, metadata....) it is NOT advisable to format the drive having in mind future recovery (either RAW or complete) as it can lead to shifting / garbling / unrecoverability of data.
However, in absence of other tooling or options, format can be used until a certain extent to lock out from use these portions of data area, but it is uncertain if it will lead to other problems in the future or not (everything depends on the origin of the "bads").
Probably, FORMAT will force "reallocation" or elimination of bads (with many ' distinguo ' ) only in case of "mild" corruption by means of drive internals, but again everything depends on what was the problem in origin.
If format is successful, there can be many scenarios, from successful further recovery to successful recovery with some/extended corruption of data, to missing data (files, directories) , loss of file names ... Maybe only a raw recovery can work after that, assuming you can do without folder names.
The correct procedure is always clone the drive eventually circumventing the bads, analyze what files are affected by the bads (or what directory data) , then recover the good part of data. How to do it is a totally different story.
So, in any case, I wouldn't format a drive in order to recover data next.
March 18th, 2011, 3:51
poehere wrote:Simplicity wrote:1. Create partition in empty space and leave it unformatted.
2. Start Recuva and get as much data as possible. I can't confirm it now, but it should be able to recover data from unformatted media.
1. will not work. it is bad idea to do this one. Allow the tool you are using for cloning to clone the entire drive or if it is SW do the same.
2. You need clone of your entire drive even if you are showing that you can not repair your partition table on this one. Then you can use Get Data Back, RStudio or USF explorer to find you data that is on the partiton of the HDD. That is easiest way to do this one. It might be RAW data but you can get it back. Winhex can also do data search on this one. But I have had more than one partiton that can not be fixed and this is easiest way to do this one.
I would be glad to hear why one or another wouldn't work. Answers "will not work", "bad idea" gives zero information. Every statement should be backed with facts.
As all you know, R-Studio and Get Data Back is proprietary software and you need to pay for it. Imagine that you want to go free way. Recuva is free but unable to deal with unallocated space. So the only way is to create new empty partition and try to get data from it. Where's the flaw in my logic?
March 18th, 2011, 6:19
I have to comply with poehere on this one.. Adapting any sectors in your unallocated space will mean that you might be overwriting sectors with information of the partition that you want to retrieve.
You can always try to run the demo versions of r-studio, ufs explorer and gdb to see whether it will actually find the data you need...
If you really want to try to create a partition and use recuva, then I suggest making an extra clone and try it on that so that the original data is not adapted...
March 18th, 2011, 10:07
Alt(R-TT) wrote:From the set of programs the topic starter mentioned, I recon the host os is Windows. It overwrites the data with 0s during a full format.
With respect, your statement is misleading, because what you are saying
does not apply to all versions of Windows. Your statement is
only true for Windows Vista and Windows 7.
Windows XP and earlier versions do not overwrite all the data with zeros during a full format.
Please read the link which I included in my last reply to
Dave48838, for more details - here it is again:
http://support.microsoft.com/kb/941961I have seen the results (with a hex editor) of a full format with WinXP and with Win7 - they are totally different results. Therefore please do not confuse the situation by including a blanket statement about the behaviour of a full format in "Windows" without being clear about which version, since the result varies depending on the specific
version of Windows that was used, as well as whether a full or quick format was done. Thank you.

(Just to be clear to other readers, of course filesystem metadata is still (over)written with any type of format - that's what running format is designed to do

).
March 18th, 2011, 14:11
Even if the format command does not wipe the data area on the drive. The problem is that it does overwrite the indexing system. So even if scandisk does what is required, when the drive is scanned for data, much of it will be corrupt as the MFT will be gone. It may be possible to recover some data but larger files will be more difficult than smaller files. So, rather than scan a drive for bad sectors, why not just clone the drive or create an image file, it will take the same amount of time as a format and (assuming the drive survives the process - the data should be ok).
Of course, you could choose to send to a professional DR company who will know exactly how to deal with the drive.
March 18th, 2011, 15:12
Any recovery software worth its salt will ask for manual entry of partition information if its missing / corrupt. I'm a little confused as to why this "theory" is being entertained at all since its almost a rhetorical question. Put simply, you should never, ever, "need" to format a drive even if your attempt is in creating a faux partition for restoring data. I can't for the life of me come up with a single reason that this would be a good idea. The fact that this thread is now 2 pages long concerning this one idea is baffling.
Powered by phpBB © phpBB Group.