MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 15th, 2013, 4:20 
Offline

Joined: December 15th, 2013, 4:13
Posts: 3
Location: Sydney
Hi All,

Recently I accidentally installed windows 8 recovery software in iOmega 500GB external hard drive and due to this
a. I could only see 31.9 GB available memory.
b. Lost partition and it shows rest memory as unallocated.
c. Lost all my existing data.

I would like to recover all important critical data. Please help me.

I tried all top free recovery data software such as recuva, R studio, puran, EaseUS, file scavenger and 50 more etc..

None of these are able to recover my data. Few software able to identify and while recovering it recovered tampered files with less than 20% relevant information.

Please help and do the needful !

Regards,
answain


Attachments:
Screenshots.png
Screenshots.png [ 93.71 KiB | Viewed 6074 times ]
Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 15th, 2013, 5:50 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia
You might want to consider cloning your drive, sector by sector, before you thrash it again.

That said, ISTM that you've tried all the point-and-click tools, so maybe it's time to examine the damage with a disc editor, eg DMDE (freeware).

http://dmde.com/

If you would like to pursue this approach, then launch DMDE, uncheck the Show Partitions box, select your Physical Drive, and OK.

Type Ctrl-End to go to the end of the drive.

Select Tools -> Search For Special Sector -> NTFS Boot Sector. Choose the Backward radio button.

If the partition hasn't been completely zeroed, then you should find a backup NTFS boot sector within a few seconds. If you don't see anything within a minute, then abort the search.

If you find the boot sector, please upload it.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 15th, 2013, 6:39 
Offline

Joined: December 15th, 2013, 4:13
Posts: 3
Location: Sydney
Hi Friend,

I used the latest version of dmde software and could follow your step. Please review the below image and advise the next action.

Regards, answain


Attachments:
dmde.png
dmde.png [ 36.27 KiB | Viewed 6016 times ]
Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 15th, 2013, 16:19 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia
It appears that the drive originally had a single 500GB NTFS partition beginning at sector 63. AFAICS only the first 12GB portion of the drive has been overwritten, so the majority of your data should still be there.

The MFT Start Cluster indicates that the MFT was at the 3GB point.

((786 432 x 8) + 63) x 512 = 3 221 257 728

This means that you will probably need to recover your files in "raw" mode. That is, you need to search for file signatures rather than file names.

I have no idea why your software found nothing, but have you tried PhotoRec?

BTW, you could examine the MFTmirror sector, 488 384 063. This would be added confirmation that your data are still there.

Editor -> Goto Offset -> sector 488384063

Still one more thing you could do would be to start at the beginning of the drive (or at the 12GB point) and search for MFT Records.

Tools -> Search for Special Sector -> MFT Record

These MFT Records will contain files and folder names.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 17th, 2013, 7:01 
Offline

Joined: December 15th, 2013, 4:13
Posts: 3
Location: Sydney
Hi Friend,

Thanks for your continuous support and help.

As recommended, I have used PhotoRec which has recovered more than 4000 files however most of these files are .txt. PhotoRec has converted some other file extension to .txt which is not useful to me. Could you please confirm the below points
a. Do you think by partitioning rest of the memory (500-31.9) GB will restore the data as well ?
b. Do you have any other software which will recover the actual data with folder structure ? ( I don't mind to spend some money to purchase the best software)
c. Is there anyway to recover the overwritten data (12.2 GB) by that recovery files ?

Regards, answain


Attachments:
File comment: Current Partition
Partition_details.png
Partition_details.png [ 43.14 KiB | Viewed 5982 times ]
File comment: MFT Mirror sector 488384063
MFTmirror.png
MFTmirror.png [ 67.06 KiB | Viewed 5982 times ]
File comment: MFT Record
MFT_Record.png
MFT_Record.png [ 48.46 KiB | Viewed 5982 times ]
Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 17th, 2013, 12:46 
Offline

Joined: October 24th, 2009, 8:16
Posts: 281
Location: Gdansk - Poland
In DMDE use "NTFS search" for the whole hdd.

_________________
data recovery Poland


Top
 Profile  
 
 Post subject: Re: iOmega W2AA163650 500GB shows 31.9GB lost partition
PostPosted: December 17th, 2013, 15:04 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16955
Location: Australia
@answain, there is no way to recover any data that were overwritten. Those data are lost for good. :-(

You will only be able to recover file names and folder names if you can find the corresponding MFT records. That's where the names are stored. The beginning of the MFT has been overwritten, so your only hope is that it was fragmented, and that fragments exist outside the initial 12GB section of the drive.

If a full surface scan finds no MFT records, then no software will be able to reconstruct your file names and folder structure. In this case your only hope will be raw recovery. Your data recovery software will then examine the content of each sector, looking for things such as signatures. For example, a JPEG file will have a text string in its header identifying its file type. The problem with a raw recovery is that the software doesn't know the file's size, nor does it know whether it is fragmented, or where to find the remaining fragments. Such information would have been stored in the MFT record. That's why such recovered files are often corrupt. For example, a recovered JPEG might only contain the first part of a photo.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 61 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group