How does the computer choose which sectors to write to?

Hi everyone, I've just committed the mortal sin of carelessness and have wiped (and overwritten) my client's external hard drive.

In over 15 years of fixing computers I've never done this and can hardly believe it to be honest.

I was trying to download and prepare a Windows 10 bootable USB drive for the USB stick that I had plugged into my laptop, but must somehow have selected the external drive which was also plugged in (I had earlier wiped and re-installed Windows 7 on the client's laptop but they decided they wanted Windows 10 after all).

Anyway, long story short, I lost the data from both the client's laptop and their external backup drive at the same time (good grief).

I'm currently running R-Studio against the external hard drive to see if it can pick up anything. I'd *really* love it to recover the 70GB Macrium disk image I made of the client's laptop which was on there but I'm not holding out much hope.

The Windows 10 installer is about 4GB I believe. I was just wondering, what are the chances that this 4GB would have overwritten the 70GB file given that the drive is 1TB?

I know I'm just clutching at straws here and just need to wait for the 8 hours for the scan to finish, but I guess I'm kind of curious.

Also - anyone have any other ideas about how to distract myself before I go crazy with the guilt??

Ok, so R-studio didn't pick up the .mrimg macrium reflect image file as far as I can see.

Anyone have any ideas about how to try and recover this file?

Generally if you wrote an image to the wrong drive, the data will be written at the beginning. So if it was a 4GB Windows image, should be just the first 4Gb overwritten. It's enough to possibly wipe out the prior MFT, but I doubt it touched the image file you're looking for as that would have likely been written further out in the LBA range. Windows uses a $BMP bitmap which maps out the used and unused sectors. When a file needs to be written it quickly scans the bitmap for the first available space large enough to store the file, which in the case of a really large file is usually at the end of all other data. Unless the drive had been full at some point, in which case it might have to fragment the file to different places to make it fit (fragmentation).

My guess is that R-Studio just doesn't know how to recognize that type of image file. Could you perhaps create a few small sample files of that type and post them somewhere? It may be possible to create a custom file type so R-Studio can find it. Even if you just post the first and last few KB of each sample file. That way I can look to see if it has any clear opening & closing signatures.

Hey, thanks for the reply Data Medics!

Glad to know there's someone out there willing to help - it's 3:43am and I'm still up wondering how to get out of this mess...

Ok, so the file extension is .mrimg

I am now trying a program called Lazesoft Free edition as I read a couple of people saying that they had managed to pick up their .mrimg using it. (Although I couldn't see that file type in the GUI when I started the scan).

I'm not actually sure how to post a sample of the file for you - how would I do that? I have a couple of sample files lying about but they're very large >100GB

Thank you so much for trying to help!

Ah ok, so I've managed to make a sample file < 30MB

I'll PM you with the details!

Just waiting for file to upload (internet connection is slooooow here in sunny NZ!)

P.s. You talked about writing the Windows image to the drive. Well, I don't think it's an image as such, it was a Windows Media Installer which formatted the 1TB drive to be 32GB large and then put a 4GB file onto it I believe.

Would this still have the same likelihood of avoiding the large file at the back of the drive?

The drive was essentially brand new. The only 4 operations have been (in order):

- delete the pre-installed bloatware
- manually copy some photos/documents folders over (about 10-15GB)
- manually copy over the disk image (70GB)
- erroneously format and write Windows files to disk (4GB)

http://webcache.googleusercontent.com/s ... IC_ID=2996

I'm afraid there is no file signature at the start of the file, it's at the end. As you don't know the length or fragmentation of the file then this won't help you.

You can search for the following characters at the very end of the file:

"__79241006_2651_11D4_"

However, without the cluster run(s) and file length this is unlikely to be successful.

Nick - Macrium Support

@chewdrive
How long did the wiping last?

labtech wrote:@chewdrive
How long did the wiping last?

Hi there, sorry my posts are having to be reviewed by a moderator so some delay.

The wiping was done by the Windows 10 media install program and it's kind of hard to tell exactly how long it took as it also downloaded the file first from the internet (slow connection here in NZ).

I did see it switch status from downloading to 'processing files' which may have taken up to 5 minutes I guess?

I have successfully recovered a few separate photos from the drive but I'm pretty sure quite a lot are missing. So was really hoping I could get this disk image as it would contain all the photos inside it.

Does that help at all?

Currently waiting for Lazesoft's scan to finish and if that doesn't pick up the .mrimg then I think I might have to thrown in the towel and send it to a data forensic team in Auckland and see if they can salvage anything.

One guy on the phone talked about possibly extracting photo images from within the disk image container. I guess in case the image is partially corrupted? I didn't realise that was a possibility, but perhaps that's an option?

Oh also, I'm curious - one (a little pushy) guy was telling me to stop scanning my disk as I could cause more data loss.

Is this true if the disk is in good physical condition and I have it plugged in as an external hard drive and am running scans against it with software on my laptop?

Of course I would save any results to my laptop hard drive, not the external hard drive.

It would be advisable to clone the drive, sector by sector, if only to guard against a second mistake.

BTW, is there any possibility that the image file may be compressed?

Ah I see, yes that's a fair point.

The image would have been made using Intelligent Sector Scan (if that means anything to you?) and yes it is compressed, at about 50%. What would this mean for data recovery purposes?

chewdrive wrote:The image would have been made using Intelligent Sector Scan (if that means anything to you?) and yes it is compressed, at about 50%. What would this mean for data recovery purposes?

I would think that it would be extremely difficult to make anything out of a partial image file if it is compressed in the way that a ZIP is compressed, especially if you can't find the header and/or footer info. Of course that would also depend on the structure of the image file (which I know nothing about).

You wouldn't be able to carve files out of such a compressed image as you would normally do with tools such as PhotoRec.

That said, perhaps the image is simply compressed by omitting unused clusters rather than compressing the sector content, in which case file carving may work.

http://www.macrium.com/help/v5/Advanced ... r_Copy.htm

Understanding Intelligent Sector Copy

When backing up a disk or partition you can select to do so using Intelligent Sector Copy. This is the recommended method for creating images. Using this method will result in smaller images and create them with greater speed.

How does it work ? In the case of a full image, Macrium Reflect will take a snapshot and then save only the clusters that are in use on the disk. In the case of a differential or an incremental, after the snapshot has been taken, Macrium Reflect will compare the clusters in use with the previous image and then save only those clusters that have been modified.

Oh dear..

I think the Intelligent Sector Scan may be different to the compression as it gives options to alter both.

So I guess now I just need to pray that the image file is intact.... I'm not sure I fancy my chances

But either way, should know in a few hours time.

Oh, one other point of interest. The disk would have originally been NTFS but the Windows 10 tool formatted it to FAT32.

Does this have any bearing on how likely it is to be able to recover data from it?

Welp, doesn't look like lazesoft could find the .mrimg file

Ah screw it

Oh wow, but it did manage to recover 10GB or so of photos, which R-Studio didn't manage.

Sheesh, at least that's something!!

chewdrive wrote:I think the Intelligent Sector Scan may be different to the compression as it gives options to alter both.

You could try ZIP-ing the 30MB test file. As long as you use compressible data for your test, you could determine the effect of each option. Furthermore, if you use text data, then it should be easy to see it in a hex editor.

One more thing you could try would be to create 3 text files and then delete the second file. The Intelligent Sector Copy option should shrink the space vacated by the deleted file. You should then be able to see this effect in the non-compressed image.

Thanks for the suggestion. I'm kind of running a little short on time as I am meeting the client tomorrow.

I think, to be honest, the only thing I can say to her is that I will send the disk off to an expert data recovery team to see if they can get the data back.

Expensive, but it was my fault so I need to pay out. I just hope they can get her photos back. Turns out that only 1GB of the 10GB I recovered were readable

How does the computer choose which sectors to write to?

How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?