Recovery images on partitioned AND formated drive

[willpower101]

Yes, I thought I had it backed up but I missed a specific folder on the root of the c drive.
I deleted the partition, did a full format in windows installer, ran chkdsk, and did a windows reinstall.
I haven't touched much else once I realized this.
The files were also put on last, right before formating, and the drive was at 80% capacity. So I'm hoping they are near the end.

This is an iphone folder which may or may not have the directory structure:
C:\DCIM\800AAAAA\IMG_0001.jpg

*I could have just copied the files to like, c:\iphonebak\IMG_XXXX.jpg

So... normally I use easeus data recovery wizard to get stuff like this back, however it's been no help this time.
After scanning it shows 30+ logical drives under the second phase of the recovery wizard, many with 96gb (origial partition size) and many with >50gb.
I've tried 4 at a time, multiple times, but i'm just getting back files that have recently been deleted in my current drive.

What program can I use to search through the blocks on the drive for something like "IMG_" ?

[labtech]

What windows OS was used to do the full format?

[willpower101]

The WinRE installer that's stock on a 7 install disc.

I'm testing out some software called getdataback for ntsf that someone reccomended in another thread. We will see if that turns up anything. I'll also show the recovery partition list in easeus later when I get to screenshot it again.

I've used easeus to recover accidents this bad before, but it's just acting wierd this time.

[willpower101]

Seems that the mft is gone. It can't find any mft for dates previous to 6.7.11 (the date i formated) except for in 2005 (which are all like 3mb or less)
But I'm sure the data should still be on the drive. I just have not dealt with recovery before in a situation where there was a missing or incomplete MFT.

http://i.min.us/jbmUdy.png

[pcimage]

GDB stands a reasonable chance if you use the right settings

[labtech]

As far as I know, a full format with Windows 7 writes 00s on the unused space. So, overwriting with 00s destroys files.

[pcimage]

As far as I know, a full format with Windows 7 writes 00s on the unused space. So, overwriting with 00s destroys files.

In which case, it's "game over"

[willpower101]

As far as I know, a full format with Windows 7 writes 00s on the unused space. So, overwriting with 00s destroys files.

I have never known this to be the case. I'm looking at Kb articles right now to try and confirm. Can you post supporting documentation of this? If true, then I'm obviously out of luck. But I've never heard of windows zeroing a drive. I've done a write test to a drive before and sector by sector the test easily takes days. Windows full format takes about 30 minutes for 100gb.

[willpower101]

This has some usefull info in it, However I still know there is absolutely no way windows zero'd a drive in 30 minutes. http://www.tomshardware.com/forum/19622 ... ick-format

[Vulcan]

@willpower101:
Does the Win7 install disk (which you say you used) definitely use Win7 formatting functionality? I don't know (I rarely use Windows) - the Win7 install disk behaviour is not necessarily the same as the actual Win7 OS, although I suspect that it is the same

The actual Win7 full format is as described by labtech and pcimage (see below).

I've never heard of windows zeroing a drive.

Your proof of the change in the behaviour of a full format, which was introduced in Win Vista (and also applies to Win7) is documented here in the MS KB:

http://support.microsoft.com/kb/941961

To answer the question for yourself, you could use the same Win7 install disk with another hard disk where you don't mind losing the data, stop the process just after the format has been done by the install disk, and then examine the hard disk with a hex editor to see if the formatted partition has been zeroed.

[willpower101]

Excellent idea Vulcan. I will do that just to be sure. In fact, this drive should have data all the way to the end, so I could just look at it.

What hex program would you all reccomend for this purpose? Just winhex or something more advanced?

I did read that Kb but also read other people's accounts that it is incorrect and still uses 98% of the time taken to chkdsk and the rest to delete the mft and first few megs of the drive.


I still don't see how a zero'ing can be performed in 30 minutes. I'm going to take a wild guess that it does something like throw a zero in the first sector of each allocation unit in the drive, therefore making the data non-contiguous and useless, however not fully removing it. Maybe it is really is zeroing it, but I'm still skeptical at this point.


[Edit: Confirmed - There are a TON of zero's on the drive. Like 99% of the unused space other than the new windows install is zero'd. Oh well . Thanks for the help!)

[Vulcan]

Excellent idea Vulcan. I will do that just to be sure. In fact, this drive should have data all the way to the end, so I could just look at it.

OK - just remember that the Win7 full format zeroes the selected partition not the drive. Even when using one partition that you think includes the whole drive, there can be unpartitioned space at the end of the drive (read about the fdisk requirement for "whole cylinders" for more info).

What hex program would you all reccomend for this purpose? Just winhex or something more advanced?

It's entirely your choice - just make sure it can access raw disks. As I mentioned before, I rarely use Windows, so don't rely on me for Windows software recommendations. Due to its commerical development, I expect WinHex would be fine on Win7, but you'll need to do the homework. I'll just mention that Tiny Hexer and AXE are freeware hex editors that worked on previous Windows versions that I've used - I haven't tried them with Win7.

I did read that Kb but also read other people's accounts that it is incorrect and still uses 98% of the time taken to chkdsk and the rest to delete the mft and first few megs of the drive.

In which case I won't spend further time trying to convince you of the accuracy of that KB article and of my comments - I'll let you do that yourself, using the test previously described .

FYI a full format in Windows versions prior to Win Vista (i.e. the "original" behaviour), does not do the filesystem checks which chkdsk normally does, although those earlier Windows versions certainly do not erase all the data - but this is getting off-topic for your current situation.

I still don't see how a zero'ing can be performed in 30 minutes.

Think about current disk & interface data transfer rates, do the math, and you'll get your answer .

I'm going to take a wild guess that it does something like throw a zero in the first sector of each allocation unit in the drive, therefore making the data non-contiguous and useless, however not fully removing it. Maybe it is really is zeroing it, but I'm still skeptical at this point.

Do the test I described and you'll see how your guess compares with reality

Edit: Just read your "edit" update - so you can see that the KB article & comments from members here were indeed correct, the drive was zeroed by the Win7 full format, and your guess was ... just a guess Previous data from before the Win7 full format is, as previously mentioned by other members, unrecoverable.

[willpower101]

thanks for the time you took to write the reply though. Hopefully this information will be usefull to someone else as stubborn as me in the future. I guess I will remember to only quick format from now on. It's not the end of the world for me, I just stupidly copied some files from my phone to the drive before I formatted it but *after* I'd backed it up, then proceeded to exchange my phone for a replacement

[Vulcan]

:) thanks for the time you took to write the reply though. Hopefully this information will be usefull to someone else as stubborn as me in the future.

No worries ( <hat tip> to labtech and pcimage for their comments too, of course)

I guess I will remember to only quick format from now on.

Understood. One of the (rare?) times when a "new" (Win Vista / Win7) full format is useful, is when a user is looking to dispose of their equipment before selling it etc., in order to (usually) remove their personal info (which was not, of course, being removed with earlier versions of format, and this may have been what prompted MS to change the behaviour).

It's not the end of the world for me

Glad to hear it Just one thought (though you might have already decided not to do this, or might have tried already) - is your original iPhone possibly still in a warehouse or shop where it could be found & returned to you, if you explain the situation? Good luck with whatever happens.