part formatted hard disk with diskpart. Please help recover

[trickyp]

I have made a massive mistake with diskpart in windows 7.
I cleaned the drive and started a ntfs formats on a Samsung 1tb drive instead of USB drive. The hdd had 2 partitions on witch I used to store photos and home video. I think around 600 700 gb.

I have tried to recover the partitions but nothing is working.

Can anyone please help and advise me on the best way to recover any data.

If I need the clone the drive first, what do I use for this.

I would be very greatful for any help.

[Michael.Reilly]

If you started a format on the drive but did not finish then your best bet would be to use testdisk (deeper search) for the second partition (hopefully it hasn't been overwritten at all, use p to list files)

For your first partition you're going to have to try something a little more complicated, there is software that will do format recoveries such as R-Studio (I think), Easy Recovery Pro, and others. If you don't have luck with using an MFT based data recovery then you can try photorec (it's in the same utility pack as testdisk) to perform a signature recovery on the drive. You should get good results with photos, less good with home videos because of the possibility of fragmentation.

Save the data to a different hard drive than the one you're recovering (obviously) An image should not be needed.

[trickyp]

Thankyou for your help, i will work through your suggestions, i did try running disktest yesterday but it didnt find anything. But I don't think I used deep scan, So I will try this later.


Most file were HD video or raw photo files at 30mbs each and all the important ones were on the first partition.


What's the best way to clone the hidden as i don't want to cause any more damage?

[Vulcan]

@trickyp:
More detail needed...

I have made a massive mistake with diskpart in windows 7.
I cleaned the drive and started a ntfs formats on a Samsung 1tb drive instead of USB drive. The hdd had 2 partitions on witch I used to store photos and home video. I think around 600 700 gb.

So your Samsung disk had 2 partitions on it, before you started diskpart - is that correct?

Then what exact diskpart commands did you run? List them all.

Did those diskpart commands finish, or did you interrupt it/them? Based on your story, I think they finished - please confirm.

You say that you "cleaned" the drive - I'm guessing you mean this was one or more of the diskpart commands that you ran. Please confirm that this is what you mean.

Then you say you started an NTFS format, so you must have used either diskpart or another utility to create one or more partitions, before you could format it/them. Make sure this creation of partitions is explained in your answer.

Did you select a full or a quick NTFS format?

Which partition did you select (if you created more than one)?

Did that NTFS format finish, or did you interrupt it? You say that you started it, so what happened after that is unclear in your story.

You ask:

What's the best way to clone the hidden

What exactly do you mean by the "hidden"?

With full, exact answers to these questions, the situation will be clearer IMHO.

[trickyp]

Hi, ok to make things clearer here is what happen.

So your Samsung disk had 2 partitions on it, before you started diskpart - is that correct?

Yes the hard drive had 2 partitions, the first approximately 800 gb and the second partition was what remained

Then what exact diskpart commands did you run? List them all.

ok i ran the following

SELECT DISK 1

CLEAN

CREATE PARTITION PRIMARY

SELECT PARTITION 1

ACTIVE

FORMAT FS=NTFS

Did those diskpart commands finish, or did you interrupt it/them? Based on your story, I think they finished - please confirm.

when i got to the format stage i didn't let it complete

You say that you "cleaned" the drive - I'm guessing you mean this was one or more of the diskpart commands that you ran. Please confirm that this is what you mean.

Yes as above

Then you say you started an NTFS format, so you must have used either diskpart or another utility to create one or more partitions, before you could format it/them. Make sure this creation of partitions is explained in your answer.
Did you select a full or a quick NTFS format?

As above i started a full NTFS format (not quick) but i didn't let it finish

You ask:

What's the best way to clone the hidden

What exactly do you mean by the "hidden"?

Sorry, that was a error my phone inserted the wrong word. My question was, Whats the best way to clone a hhd? as i didn't want risk anymore damage to the hard drive data.


I hope this makes my situation a little clearer.

[trickyp]

ok Thanks Vulcan. I hope this clears things up.

The Samsung hard drive i'm trying to recovery had 2 NTFS partitions. The first 835gb and secound patition was the remainding around 100gb.

When i selected this drive with diskpart here are the commands i used;

SELECT DISK 1

CLEAN

CREATE PARTITION PRIMARY

SELECT PARTITION 1

ACTIVE

FORMAT FS=NTFS

I believe i stopped the full NTFS format before it completed. (Format not run in quick mode)

So i attempted to format the hhd with one partition. Which brings me to the stage i'm at now trying to recover alot of important data to me.


I have tried running a scan with the r-studio demo and its picking up the secound partition on the drive. but not showing anything for the first 835gb which is where all my important files are.

[Vulcan]

@trickyp:

Thanks for the info - things are now much clearer. Based on your list of diskpart commands, the main damage was done by the full (not "quick") format. On Windows 7 (and Vista) a full format now overwrites the selected partition.

If you did manage to stop the format, but cannot find your files which were originally in the first 835GB of the disk, that suggests that the format had already overwritten the files. In other words, the format had gone "too far".

You could use a hex editor in read-only mode, to view the disk. You'll see sectors full of hex 00 where the format command has overwritten the sectors. Then you can see how much of the disk was overwritten (of course you ignore the new filesystem metadata which was written to the disk e.g. MFT).

If R-Studio is not finding any files, even when doing a "disk scan" (if I remember their terminology correctly), you could confirm this by running photorec to search for jpg photos, for example.

There are many different ways to make a clone of the disk, e.g. to a file on a different disk or to a blank disk of the same or greater size. Assuming that the disk has no physical problems, then some software (like R-Studio) has got cloning functionality, though personally I just use dd on Linux / Unix (or ddrescue - in case any unexpected read errors occur during the cloning process). Other options include HDClone and DMDE, which are mentioned by some members - I have not used those. Some software can also compress the clone image (although that typically makes it more difficult to then use the clone image for anything except just restoring onto a disk).

If you try several different software tools to look for your photos on the disk, and cannot find any trace, then as I said, the most likely explanation is that they were overwritten by the format. If you want confirmation of that, you can always ask for help from a DR company, and send your disk to them.

[trickyp]

You could use a hex editor in read-only mode, to view the disk. You'll see sectors full of hex 00 where the format command has overwritten the sectors. Then you can see how much of the disk was overwritten (of course you ignore the new file system metadata which was written to the disk e.g. MFT).

Ok I've looked at the HHD with HXD and it is full of 00 00's until i get to sector 1751086062 of 1953525168. So is this telling me that the first 1751086062 sectors are empty which is around 90% of the Disk. Also meaning that there is no information recoverable from the first partition of the drive?

If this is the case, is it over for me? or is there any other possible way to recover data? Does a DC company have any other tools that can be used? I was under the understanding it was quite hard to destroy information and it had to be over written several times?

[Vulcan]

Ok I've looked at the HHD with HXD and it is full of 00 00's until i get to sector 1751086062 of 1953525168. So is this telling me that the first 1751086062 sectors are empty which is around 90% of the Disk.

Yes.

Also meaning that there is no information recoverable from the first partition of the drive?

Correct.

If this is the case, is it over for me?

Yes.

or is there any other possible way to recover data? Does a DC company have any other tools that can be used?

None that I know which would be effective for current disks and their recording technologies. A system was developed for some older disks (SignalTrace), by a company later taken over by Seagate, but I doubt even that would help in this case. If any of the DR pros reading this thread has newer information than I'm aware of, then I'm happy to be corrected. However this would be such groundbreaking news, I think we would have heard about that capability by now, if it existed.

I was under the understanding it was quite hard to destroy information and it had to be over written several times?

That was true with some older disks disk encoding technologies, and which had wider track spacing etc. This is described in the old Gutmann paper, which has been the subject of other recent threads here, but that applied only to older disks (and all 35 overwrites that are mentioned, were never needed on any one given disk drive).

Unfortunately I see no realistic chance for you to recover anything from those overwritten sectors.

[drc]

A system was developed for some older disks (SignalTrace), by a company later taken over by Seagate, but I doubt even that would help in this case.

As far as I know, SignalTrace wasn't even intended to "recover" overwritten data, but was a proof of concept for reading data from platters that had been removed from a hard drive, without using any of the original drive's (or a donor's) electronics.

So as always, the answer is "No, you can't recover your overwritten data".

I recommend reading the Gutmann paper if you are interested in understanding more about it, which was why I posted it in the other thread... IMO if someone has some data that it is critical to recover (or destroy beyond possibility of recovery) it is kind of silly to just take the advice of some random guys on the internet without understanding what is behind it.

[Vulcan]

@drc:

As far as I know, SignalTrace wasn't even intended to "recover" overwritten data, but was a proof of concept for reading data from platters that had been removed from a hard drive, without using any of the original drive's (or a donor's) electronics.

Good, that was my understanding of the original use of SignalTrace too. However, given that it replaces the read channel and head positioning control from the original drive (which would be helpful (necessary?) for any attempts to recover overwritten data), then no matter what it was originally intended to do, we cannot rule-out potential uses beyond that. That's why I said what I said, although like you said, I also doubt it would be helpful here.

@trickyp:

This is described in the old Gutmann paper, which has been the subject of other recent threads here

I recommend reading the Gutmann paper if you are interested in understanding more about it

Here is a link to that paper which both drc and I have mentioned (make sure you read right to the end of the first link, as that is where the more recent updates are):

http://www.cs.auckland.ac.nz/~pgut001/p ... e_del.html

and some further discussion / explanation about this on Wikipedia:

http://en.wikipedia.org/wiki/Gutmann_method

[trickyp]

IMO if someone has some data that it is critical to recover (or destroy beyond possibility of recovery) it is kind of silly to just take the advice of some random guys on the internet without understanding what is behind it.

You random guys have taught me alot and pointed me in the right direction, And i'm very grateful for your time and the information you have shared, This has given me a better understanding from which I'v made decisions and done further research.


I recovered the data in the second partition that was still visible with a hex editor.

But ultimately I'm gutted. I've lost Tones of family video and pictures. And the reason all this happened was because i building a home server to back up all my critical data. And a silly school boy error along the way ended up in me destroying the data i was trying to protect.