All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 0:16 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 0:45 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
terminator2 wrote:
I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.


Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 3:23 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Amarbir[CDR-Labs] wrote:
terminator2 wrote:
I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.


Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

Hi Amarbit Thanks for replying. Yes you are right. This particular Toshiba hard disk is SMR
Toshiba Internal laptop Model - MQ01ABD100 Drive Rev. AAD AD00/AX0A1D Date -- 17 APRIL 2018

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss. If this is so then I must educate all my customers for the same.
Thanks again :good:


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 4:10 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
MQ01ABD100 - CMR


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 6:35 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
Yeah, MQ01 is NOT SMR.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 6:38 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
terminator2 wrote:
Amarbir[CDR-Labs] wrote:
terminator2 wrote:
I have got a case where a computer dealer accidently deleted C: Drive to reinstall OS. But for no reason D drive also got deleted.
He stopped further process and tried his own to recover data but nothing was recovered,
I suspect C: Drive was shrinked to create small volume . I think since it is a virtual volume valid till windows session no partition table entry is made .
I have also tried all available softwares but I am not getting required boot sector of D drive.
I just want to know whether recovery is possible or not in such cases.


Well,
Do check if drive is SMR type ,Whats the Drive Model And Brand

Hi Amarbit Thanks for replying. Yes you are right. This particular Toshiba hard disk is SMR
Toshiba Internal laptop Model - MQ01ABD100 Drive Rev. AAD AD00/AX0A1D Date -- 17 APRIL 2018

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss. If this is so then I must educate all my customers for the same.
Thanks again :good:


Well,
This is Not SMR My Friend .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 13:53 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
terminator2 wrote:
This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 10th, 2022, 15:08 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
fzabkar wrote:
terminator2 wrote:
This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.


Well,
How about a Free copy of UFS And Check Hex Of The Entire Platter Surface

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 13th, 2022, 1:17 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
fzabkar wrote:
terminator2 wrote:
This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.


Thanks a lot :good:


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 13th, 2022, 1:19 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Amarbir[CDR-Labs] wrote:
fzabkar wrote:
terminator2 wrote:
This particular Toshiba hard disk is SMR

But I was not aware merely formatting or deleting partition will cause unrecoverable data loss.

I understand that the drive is not an SMR model, but even if it were, merely deleting or creating a partition doesn't always invoke TRIM. It's formatting the partition that invokes TRIM.

I would use a tool such as DMDE to scroll through the LBAs to see whether the drive has been zero filled.


Well,
How about a Free copy of UFS And Check Hex Of The Entire Platter Surface


Thanks Amarbir and guys ,
Sorry I was mistaken. I think this was shrinked volume that is the reason I am unable to trace NTFS boot sector.
I am giving up finally after lots of efforts


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 13th, 2022, 7:29 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Either I do not understand exact situation or I do not understand the failure to recover data. Please describe initial state and the one we have now.

With or without a boot sector you still should be able to recover data. Whether you can 'undelete' previous d: drive is a different matter. If for example d: was NTFS, find start of MFT or even portions of MFT and you can make educated guesses about the position of the file system, test our guesses and adjust as needed. Use it to construct virtual file system and recover data. Same if we have file allocation table or parts of it. And even if we could not, RAW recovery is still an option.

What file system was the d: drive?

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 14th, 2022, 23:00 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Arch Stanton wrote:
Either I do not understand exact situation or I do not understand the failure to recover data. Please describe initial state and the one we have now.

With or without a boot sector you still should be able to recover data. Whether you can 'undelete' previous d: drive is a different matter. If for example d: was NTFS, find start of MFT or even portions of MFT and you can make educated guesses about the position of the file system, test our guesses and adjust as needed. Use it to construct virtual file system and recover data. Same if we have file allocation table or parts of it. And even if we could not, RAW recovery is still an option.

What file system was the d: drive?

Hi Arch , Thanks for the help.
Customer (computer dealer) has given this disk , it came to him for installation of new OS. He has take backup of C: drive data and kept it in D drive.
Then he deleted C drive. However D drive also got missing . He has not done any overwritting later ,though he has tried to recover data using some tools.
He has copied all data in E drive which is intact and is accessible.
I am not getting either C drive or D drive as claimed by customer. He has created 2 partitions later but has not copied anything.
I am attaching few screenshots.


Attachments:
tt.PNG
tt.PNG [ 72.41 KiB | Viewed 7914 times ]
33.PNG
33.PNG [ 101.57 KiB | Viewed 7914 times ]
Capture.PNG
Capture.PNG [ 27.49 KiB | Viewed 7914 times ]
Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 15th, 2022, 10:22 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
I do not understand scenario entirely. When he says he created new partitions, did he also format them? If he used disk management he might very well have. If there was a c and d drive, why do we see more partitions thatn those 2, why did drive letter assignments change?

Did he create partitions in exact same locations? What file systems did we have before the chain of accidents?

With all these unknowns, first thing 'd be doing is run full scan on entire disk using DMDE, I'd rather work with that than with too vague stories. Then see from results if I can figure out location of the old partitions. Easiest is, if DMDE detects file systems is top open those (open volume) and check if directories are the ones that can be expected.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Logical Data recovery from Shrinked Volue not possible
PostPosted: May 15th, 2022, 23:19 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Arch Stanton wrote:
I do not understand scenario entirely. When he says he created new partitions, did he also format them? If he used disk management he might very well have. If there was a c and d drive, why do we see more partitions thatn those 2, why did drive letter assignments change?

Did he create partitions in exact same locations? What file systems did we have before the chain of accidents?

With all these unknowns, first thing 'd be doing is run full scan on entire disk using DMDE, I'd rather work with that than with too vague stories. Then see from results if I can figure out location of the old partitions. Easiest is, if DMDE detects file systems is top open those (open volume) and check if directories are the ones that can be expected.


Yes he has created 2 partitions and have formatted them , I dont know whether they are of exact size like previous one. Other partitions are already present (service & recovery partitions)
I have done full scan using DMDE professional and have send log to dmitry for analysis but unfortunately as per him log is incomplete.So I am scanning disk again.
File system in all instances is NTFS only,I will update you with DMDE log file.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: F Alom, Google Adsense [Bot] and 93 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group