Data Recovery after Partition Editing and Quick Format

[amit]

According to the following page, sector 0 was a "legacy MBR".

List of partition identifiers for PCs:
http://www.win.tue.nl/~aeb/partitions/p ... pes-1.html

EE -- Indication that this legacy MBR is followed by an EFI header
EF -- Partition that contains an EFI file system

I would think that by changing the partition type to 07, you would have converted this dummy MBR into a "real" one. A quick format would then have created a new $MFT in a different location than the original MFT.

I would use a utility such as DMDE (freeware) to search for NTFS file structures (Tools -> Search for Special Sector), but do this on your clone.

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

Just the kind of post I was looking for. Thanks mate! I am going to clone my disk before applying anything else. Now the question is, if I clone the disk, how much space is the clone/image going to occupy? My disk had about 350 GB of data out of 1.82 TB. Is it going to occupy 350 GB or the whole 1.82 TB? If latter is the case I'll be needing to procure another HDD of 2TB+!

[fzabkar]

You need to clone (or "image") your drive, sector by sector, to a destination drive of equal or greater capacity. The source and destination drives must be exact "physical" copies of each other. A "logical" clone is only possible when the source file system is accessible and uncorrupted.

[amit]

You need to clone (or "image") your drive, sector by sector, to a destination drive of equal or greater capacity. The source and destination drives must be exact "physical" copies of each other.

So, I'm gonna have to buy another Hitachi HDS723020BLA642 HDD? Will that suffice?

A "logical" clone is only possible when the source file system is accessible and uncorrupted.

Are you telling me that I will need to "Quick Format" my current drive (which will be the source drive) again? 'Cause after the last modification done in step 8, my current disk is named "Local Disk (D:)" and file system is "RAW" and when I double click the drive icon it asks me "Do you want to format this drive?". Also, the new drive I buy will need to be formatted before it can be used, right? What exactly will I need to do to make a logical clone anyway? What software would you suggest?

Also, please be informed that after executing DMDE.exe and selecting the drive from "select device/disk", I get the following error message:

"There are partitions in MBR table which require the disk size to be not less than 4 294 967 358 LBA (2.20 TB).
Current disk size is 3 907 029 168 LBA (2.00 TB).
There may be errors in MBR table or driver can't access entire disk (LBA48 not supp., HPA applied, jumpers misplaced, RAID disconnect...)."

I got a similar message with "testdisk" when I tried to recover the partition that was found using backup boot sector. It said something like the drive size being bigger/smaller and that I need to fix jumpers and blah blah blah... I don't remember exactly. I don't understand what's wrong with my drive size. What's your thought on that?

[poehere]

Take it to somone who does. You have already done everything possible to destroy your drive and chances of getting back your data. Keep going and you can loose it forever. Or you will have to accept RAW data and go on with this one.

[fzabkar]

@amit, you can use any drive as your clone, as long as it is equal to or greater in capacity than the original. The brand and model do not matter. All you are trying to do is to reproduce the data, sector by sector, exactly as it is on the original drive. The reason for this is that, if your data recovery software makes a mess of the data on the clone, then you will be able to make another clone and try again, this time with with different software.

The reason that TestDisk and DMDE are giving you those messages is because you have corrupted the file system. DMDE is examining the logical structure of the drive. Instead you should tell it to examine the physical drive, in which case it will treat it like raw data. You can then search for the Special Sectors. If you find two MFTs, then one will have been created by your recent formatting, and the second will be the original one. In this case you will have a much better chance of getting your data. Otherwise you will be reduced to a RAW recovery, in which case you will end up with a bunch of files with sequential numeric filenames and no folder structure.

[shahij]

it is told several times by others to make a clone...

@fzakbar, you r doing good to help out the guy, but he is confused about fs and how data r stored... i m definitely sure he is gonna mess-up the data... (as he is asking silly questions) @amit, it's not ur fault that u r not familiar with the fs and other things that r strictly required to know and implement, but it's ur fault that you are still going ahead without any knowledge which are enough for messing up the things. (i m writing on this one based on ur explanation and ques.)
long story short - it's ur decision how to play with your data.

[shahij]

I don't have any other choice at the moment. The country/place where I live doesn't have professionals when it comes to data recovery. There are people who do some free lancing but neither they are reliable nor they can be trusted. I am completely dependent on this forum to get me out of jail!

You have wrong IDEA.

http://blog.vsrcbd.com - check out the blog - you will get the information what you will never get by googling. ah - for sure - completely on Data Recovery and Hard Disk Drive.

Specially - http://blog.vsrcbd.com/?p=90

http://blog.vsrcbd.com/?p=87

[JWCC]

I agree you can not do this one on your own. Stop before you do more damage and then it is impossible for anyone to help you. A repair shop thought they could get off data on a persons HDD. It showed them as RAW-0 and they could not fix the partition table with their free software. So the guy decided he would format the HDD using a program which totally wipped the disk clean filled it with 0 and destroyed all the data. Now they say bring it to me and I can find the data on this one. Funny. On the guys second HDD what did they do. It was booting into a blue screen. So they pulled it out of his PC and put it on a running PC and when they plugged in the PS it fried this one good. Now the guy is out twice becasue of this repair shop and they have lots of clients who go there and come back with nothing except we are sorry and a bill to pay in the end. Learn from others mistakes and stop now before you are left with nothing and can not find your data you want on this one.

I will certainly give it a thought. Although, I was thinking that if I could only find a software which can locate and apply the MFT and unformat the disk with it I could solve this problem on my own. So far I have failed to find one.

Meh, those are incompetent a******s. Yeah, if you can't read the sectors off to an image file on a bigger drive, you very likely need to send it to an DR expert. No amount of 'replacing missing partition table entries' type of software is going to work if you get tons of corrupted sectors and you may very well ruin the heads if it's not just a soft error but physical damage... Way to spread the dust (and abrasive) all over, LOL.

Caveat: I was able to 'fix' a FAT32 partition by copying the readable copy of sectors from the matching spot in the FAT (they have a mirror pair of File Allocation Tables) over on the other copy I had on my drive containing the image. And yes, this is biggest weakness to the FAT12/16/32 file systems. Even losing the root directory is not this evil. I just repartitioned it with a big gap (few hundred MB/1GB or ~1%=big enough to skip the original partition's FAT's) and kept it strictly for stuff I could get again. Once a drive fails even once, you're just begging for pain to rely on it.