Restore lost partition "Not Recovery"

[LostDataSa]

Hi everyone,

I been in Data Recovery business for short time, and usually i get hard drives from customer who accidentally formatted his drive.
I usually use Data Recovery Software like "R-Studio" to recover lost partition and it's files.

My Question " is there anyway to just restore this partition again "bring it to life" without having to copy all of files and folders to my server then copy it back to the customer hard drive, just to safe time and effort ? "

[HaQue]

Have you tried dedicated partition management software like partition magic etc?

[labtech]

Assuming you are working off of clones, you are executing a two step extraction process, one to your server and then to something else. Why not extract files directly to something else that goes to the customer?

[HaQue]

I think OP is saying the recovery of just the partitioning info, meaning no copying at all, source and target the same drive.

It is pretty time consuming to copy off TB's of data. But I usually have plenty of other work to do

I just wonder if copying TB's of data in a short time to a new/fixed drive is doing anything bad to it, heating up or whatever. I tend to do it in 20Gb chunks and let it breathe.. but I may just be paranoid!

[labtech]

I think OP is saying the recovery of just the partitioning info, meaning no copying at all, source and target the same drive

I can kind of see where you come from and it would be nice to simply just accomplish that, however whatever way we throw the dice it is not feasible for the OP as a general practice for a number of reasons. For me though, the OP's description can have a different meaning.

@OP
At least 75% of the time, rebuilding a partition/file system as in "bringing back to life" is just not feasible as the majority of drives in need of recovery would have sustained severe enough damage to the file system, e.g. mechanically failed drives, bad sectors suffering drives, firmware related failures which about 65% of the time ties in with bad sectors, etc. (I feel like a little kid in front of the Christmas tree when I see a straight forward electronics or firmware failure. These are anomalies more and more often.)

Speaking to your description of most work being formatting related, then that in itself implies file system damage typically due to some degree of overwriting.

Lastly, we have to consider the deliverable, namely what media the customer will receive their data on, understand and use "the recovered data". If it is complicated in any way, which frequently is the case as the average folk do not understand folder/file structure, then an extraction is the most suitable. Plus, delivering data on the same media or even similar media as the failed one is a giant headache if not impossible at times.

To conclude from my perspective, the best is to cut down on time by using faster/fastest interface equipment and devices and making minimum number of extractions, basically just one.

I have to confess that lots of customers expect that the data recovery service means "restoring" their data to same or like media and beginning to operate in the very same manner before the data loss situation occurred. Head-scratcher... where do we start explaining?!?

And we have yet to even open the topic on anything flash based...

[HaQue]

Yes I really don't like to use disks I have had to recover data from again. I know the OP is saying just accidental format, but many times customers get it wrong, lie to make themselves not look foolish or have no idea of what they have done. Plus when you copy files off and back on again, you can often tell if they are good.

I don't trust windows ever working correctly when you start messing with partition/boot sectors etc.

[labtech]

Oh, no, putting data on back on the same disk is a no no situation.

[galaxy]

i use kernel windows recovery

Attachments

Kernel.for.Windows.Data.Recovery.v11.01.01_p30download.com.zip

install it

(3.14 MiB) Downloaded 593 times

[LostDataSa]

i use kernel windows recovery

Will it restore formatted HDD and do the magic I am looking for ?

[galaxy]

yes this is

[labtech]

i use kernel windows recovery

Will it restore formatted HDD and do the magic I am looking for ?

Looks like a file extraction software to me. Not magic partition restoring.

[lcoughey]

1. there is no way that the OP can be 100% sure that there are no sector issues on the original without getting a clone, nor should they experiment with "restoring" partitions without having a solid backup on which they can test their method.

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor? Or, if you want to be lazy, use testdisk.

3. it has been my experience that a 99 times out of 100, a client who says that they just formatted really means, they formatted, re-installed the OS and programs, and then ran programs that they downloaded on the drive to try and recover the files themselves. (okay, maybe less than 99% download and run data recovery programs, but you get the point)

[fzabkar]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor?

"Formatting" doesn't touch the MBR. Therefore one would expect that the structure of the boot sector would remain essentially the same afterwards, except in some special cases. Of course this assumes that the user did exactly what he said he did.

BTW, I edit BS with a word processor. ;-)

[lcoughey]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor?

"Formatting" doesn't touch the MBR. Therefore one would expect that the structure of the boot sector would remain essentially the same afterwards, except in some special cases. Of course this assumes that the user did exactly what he said he did.

Format an NTFS formatted drive with FAT32 or the other way around and then look at the BS. And, yes, I do see FAT32 drives reformatted NTFS or HFS+.

BTW, I edit BS with a word processor.

...because everything you write is BS? (just kidding, just in case someone gets there knickers in a knot.)

[fzabkar]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor?

"Formatting" doesn't touch the MBR. Therefore one would expect that the structure of the boot sector would remain essentially the same afterwards, except in some special cases. Of course this assumes that the user did exactly what he said he did.

Format an NTFS formatted drive with FAT32 or the other way around and then look at the BS. And, yes, I do see FAT32 drives reformatted NTFS or HFS+.

As I said, formatting doesn't touch the MBR, so, assuming that the user did what he said he did, then the partition type (as defined in the MBR) would not have changed, in which case an NTFS partition would have been formatted as NTFS, and a FAT32 partition would have been formatted as FAT32.

[fzabkar]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor? Or, if you want to be lazy, use testdisk.

I've reread your statement quite a few times, and ISTM that you are suggesting that restoring a file system after an accidental format is just a matter of repairing the MBR and Boot Sector. If that isn't what you are implying, then exactly what do you mean by the above statement, and what do you hope to achieve with this procedure?

[lcoughey]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor?

"Formatting" doesn't touch the MBR. Therefore one would expect that the structure of the boot sector would remain essentially the same afterwards, except in some special cases. Of course this assumes that the user did exactly what he said he did.

Format an NTFS formatted drive with FAT32 or the other way around and then look at the BS. And, yes, I do see FAT32 drives reformatted NTFS or HFS+.

As I said, formatting doesn't touch the MBR, so, assuming that the user did what he said he did, then the partition type (as defined in the MBR) would not have changed, in which case an NTFS partition would have been formatted as NTFS, and a FAT32 partition would have been formatted as FAT32.

You make assumptions about the original post...it just says user accidentally reformatted the drive and does not state to the original or the new file system. As I said, it is not uncommon for a FAT32 external drive to be "accidentally" formatted NTFS in which case, the partition type in the MBR would most definitely be changed.

[lcoughey]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor? Or, if you want to be lazy, use testdisk.

I've reread your statement quite a few times, and ISTM that you are suggesting that restoring a file system after an accidental format is just a matter of repairing the MBR and Boot Sector. If that isn't what you are implying, then exactly what do you mean by the above statement, and what do you hope to achieve with this procedure?

Yes, that is what I'm suggesting. Find the MFT start, edit BS to point to MFT start and edit MBR to point to BS with correct file system type. I suppose one could take it a step further and look for all the MFT records and manually recreate the MFT, but that is beyond what is requested by the OP.

[fzabkar]

2. as you are a data recovery professional, why not just manually edit the MBR and/or BS with a hex editor? Or, if you want to be lazy, use testdisk.

I've reread your statement quite a few times, and ISTM that you are suggesting that restoring a file system after an accidental format is just a matter of repairing the MBR and Boot Sector. If that isn't what you are implying, then exactly what do you mean by the above statement, and what do you hope to achieve with this procedure?

Yes, that is what I'm suggesting. Find the MFT start, edit BS to point to MFT start and edit MBR to point to BS with correct file system type. I suppose one could take it a step further and look for all the MFT records and manually recreate the MFT, but that is beyond what is requested by the OP.

The OP is requesting that the user's file system be reconstructed with full access to the original files. This means that the MFT and all the original metadata must be reconstructed. What you are proposing does nothing of the sort.

[fzabkar]

Let's take the example of a FAT32 file system that has been reformatted using the original formatting utility running under the original OS. In this case the MBR will not have been touched.

After formatting, the new BS differs from the original BS in only one aspect, and that is the volume serial number. Restoring the original serial number will do nothing to regain access to the original file system. That's because the formatting process does a lot more than just rewrite the BS. Both FAT copies are zeroed, and the root directory is initialised. This means that any fragmented file will be difficult, if not impossible to reconstruct. Moreover, any file or folder names that existed in the root directory will be lost.