iOmega W2AA163650 500GB shows 31.9GB lost partition

[answain]

Hi All,

Recently I accidentally installed windows 8 recovery software in iOmega 500GB external hard drive and due to this
a. I could only see 31.9 GB available memory.
b. Lost partition and it shows rest memory as unallocated.
c. Lost all my existing data.

I would like to recover all important critical data. Please help me.

I tried all top free recovery data software such as recuva, R studio, puran, EaseUS, file scavenger and 50 more etc..

None of these are able to recover my data. Few software able to identify and while recovering it recovered tampered files with less than 20% relevant information.

Please help and do the needful !

Regards,
answain

Attachments

[fzabkar]

You might want to consider cloning your drive, sector by sector, before you thrash it again.

That said, ISTM that you've tried all the point-and-click tools, so maybe it's time to examine the damage with a disc editor, eg DMDE (freeware).

http://dmde.com/

If you would like to pursue this approach, then launch DMDE, uncheck the Show Partitions box, select your Physical Drive, and OK.

Type Ctrl-End to go to the end of the drive.

Select Tools -> Search For Special Sector -> NTFS Boot Sector. Choose the Backward radio button.

If the partition hasn't been completely zeroed, then you should find a backup NTFS boot sector within a few seconds. If you don't see anything within a minute, then abort the search.

If you find the boot sector, please upload it.

[answain]

Hi Friend,

I used the latest version of dmde software and could follow your step. Please review the below image and advise the next action.

Regards, answain

Attachments

[fzabkar]

It appears that the drive originally had a single 500GB NTFS partition beginning at sector 63. AFAICS only the first 12GB portion of the drive has been overwritten, so the majority of your data should still be there.

The MFT Start Cluster indicates that the MFT was at the 3GB point.

((786 432 x + 63) x 512 = 3 221 257 728

This means that you will probably need to recover your files in "raw" mode. That is, you need to search for file signatures rather than file names.

I have no idea why your software found nothing, but have you tried PhotoRec?

BTW, you could examine the MFTmirror sector, 488 384 063. This would be added confirmation that your data are still there.

Editor -> Goto Offset -> sector 488384063

Still one more thing you could do would be to start at the beginning of the drive (or at the 12GB point) and search for MFT Records.

Tools -> Search for Special Sector -> MFT Record

These MFT Records will contain files and folder names.

[answain]

Hi Friend,

Thanks for your continuous support and help.

As recommended, I have used PhotoRec which has recovered more than 4000 files however most of these files are .txt. PhotoRec has converted some other file extension to .txt which is not useful to me. Could you please confirm the below points
a. Do you think by partitioning rest of the memory (500-31.9) GB will restore the data as well ?
b. Do you have any other software which will recover the actual data with folder structure ? ( I don't mind to spend some money to purchase the best software)
c. Is there anyway to recover the overwritten data (12.2 GB) by that recovery files ?

Regards, answain

Attachments

Current Partition

MFT Mirror sector 488384063

MFT Record

[laptokowiec]

In DMDE use "NTFS search" for the whole hdd.

[fzabkar]

@answain, there is no way to recover any data that were overwritten. Those data are lost for good.

You will only be able to recover file names and folder names if you can find the corresponding MFT records. That's where the names are stored. The beginning of the MFT has been overwritten, so your only hope is that it was fragmented, and that fragments exist outside the initial 12GB section of the drive.

If a full surface scan finds no MFT records, then no software will be able to reconstruct your file names and folder structure. In this case your only hope will be raw recovery. Your data recovery software will then examine the content of each sector, looking for things such as signatures. For example, a JPEG file will have a text string in its header identifying its file type. The problem with a raw recovery is that the software doesn't know the file's size, nor does it know whether it is fragmented, or where to find the remaining fragments. Such information would have been stored in the MFT record. That's why such recovered files are often corrupt. For example, a recovered JPEG might only contain the first part of a photo.