Hi I've had a bit of a trauma... I'm a part time domestic PC tinkerer and I'm very used to reinstalling operating systems and backing up folk's data.... However! Shock horror when I was just about to reinstall Vista on my mate's desktop I realized all his data I had backed up a few days previously had vanished from my HDD!!! And further horror, I had just that second clicked on 'format' on the OS partition. All his data was now wiped with a blank partition over the top.

So I dug around a bit and found some free programs and am in the process of trying to get as much of his data back as I can.

I first used Easus Data Recovery Pro and did a deep scan, which took forever lol! This reported back about 20 different entries called '1 NTFS', '2NTFS' '3 NTFS' etc, all referring to the blank partition in question. I was able to highlight four of these at a time and then Easus took AGES to construct its results into a browsable format. On completion of this i first went after his emails - which were the most important things. There were two main categories within each '# NTFS' entry, one called 'Raw Files' and one called 'LostFiles'. Inside lost files I retreived his emails, or what remained.

However, when it comes to all the files in the 'Lost files' section their are loads of duplicates. Most annoyingly, and quite at random it seems, not all the duplicates work so when it comes to deleting the duplicates I can't just ask it to keep the first of every duplicate as it might be dudd!! Seemingly there's no quick way to sort these out!!

Why are there so many duplicates and so many '1,2,3 NTFS' entries??

I'm aware i might be doing something fundamentally wrong here! I have downloaded some more recovery scanners and are currently running them all. These are pandora, virtual dub and recova!

Please, has anyone got any tips for me bout how to go about this sensibly and get my poor friend's data back as good as I can??
Many thanks in advance,
Tony

Which drive are you scanning YOUR drive or your MATE's drive ? How did it disappear from your drive ? maybe that would be worthwhile looking at as well. In DR world we never work on the drive that has the problem we make a sector image of the drive to "image" file and work with that. In case a mistake is made so we don't make the issue worse than we got it. It make a file the size of the drive so you need a drive with equal or more space to work with the image. We then scan the drive similar to what your doing we just have better tools that cost lots of $$$. That said you probable have a really messed up MFT which is why you see so many copies and a LOT of the drive is in RAW due to the corrupted/missing MFT. Your getting results I would expect based on your description of events. Not an easy recovery job. With the image I may use test disk to see if I can find the partition and put it back if I make a mistake I can try again with a copy of the image. Some of this depends on the format that was done as Win7 and Vista format writes zeros to all sectors since your getting some results I doubt that happened. getbackdata is a good tool as well and Recuva has provided good results. Best of luck on your recovery lots of hours will be spent on this one for certain.

Hi I had copied the data from my mate's drive to mine. I then wrote quite a lot more stuff to my drive before I realised the data I had confirmed as copied was in fact not copied!! Hence I assumed my drive was not worth recovering from as I had already written so much data to the drive.

I could try though

I have no idea why the files I confirmed as copied suddenly vanished!! Its happened to a relative of mine before. I wish I'd realised sooner that the files had gone!!

I am recovering from my mates blank partition which was created by the Vista iinstall disk and has been untouched except for a 'recycler' system file windows placed on it.

Would it be worth deleting this blank parition so the disk in question is completely blank? I had wondered if the existing partition which is lying 'over the top' of the one I'm trying to recover from might be interfering with recovery?

Thanks for your suggestions!

Just one suggestion : ask people to BACK UP their data by themselves when they ask to format/reinstall, AND work differently. VERY differently.

Now you can just try to find what you have copied on your drive (hope not overwritten) but what happened is just guessing as a mimimum of diagnose is required - maybe you are not using the right SW or don't know how to use it properly.

One suggestion I would make is to check if you are able to see hidden folders and system files. Check in the folders tab.

For example often the folder named 'Pictures' is a hidden folder but the photographs are not hidden. It depends from which location and how you copied it.

I had this last week and when I copied photos. When I mounted the external drive on the pictures folder was missing. I could have sworn I had backed them up. So then I mounted the drive in a different os and there they were. The folder was hidden by the system. A silly mistake like this can happen when you are working between different operating systems and computers.

...or use a Linux Live CD and try to access the files from there.

I would use R-Studio or UFS if i were you, and see what the results is. If these s/w are successful, then you can purchase the license.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Hi Thanks everyone for your helpful replies.
I seem to have got some good results using the Easus program.. although there are many duplicates it did better than the others I tried at preserving the file structure.

I will try and look at the hDD I made the backup to. If the files are there, intact, only hidden somehow I'll kick myself! But I'l have a girt bloody big smile on my face at the same time! No more duplicate weeding!

Your responses have been just what I needed, thanks once again for your help!
Tony

Was the Vista format a full format?

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

Full format would yield no result.. So looks like quick format was done.

It was a quick format - in that it was completed in under 30sec... Vista setup didn't specify but experience told me it must have been a quick one... (oooh err madam).

I haven't yet tried the programs suggested but I WILL BE TRYING A few to see if the vanished copies I made are indeed still there. I can't believe they can hae just disappeared
tony