Recover after multiple deletes and a format - FAT32

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
cbeall
Posts: 4
Joined: 22 Nov 2013, 16:47

Recover after multiple deletes and a format - FAT32

#1 Post by cbeall »

Objective:
Recover files from external USB-attached FAT32 hard drive after multiple deletes and a format.

Background:
Western Digital WD1200 120 Gb drive was being used as a weekly backup drive using Retrospect Express software on a Windows XP system. The drive was formatted with a single FAT32 partition. The user (my wife) reports that some time ago the drive would no longer power off normally after a backup was taken; she instead forced power off by holding the power button in. This did not appear to be causing any problem.
The drive became full and no more backups could be taken. Looking at the directory structure (Windows Explorer) it appeared that some files had been stored outside of the expected backup directories. Rather than attempt to diagnose and repair this, it was decided to erase the drive and start new backups.
An attempt was made to simply delete the files from the topmost directories on the drive, but Windows would not allow some directories to be deleted, saying a file within the directory tree could not be deleted. Files and directories were then deleted from the lowest level that would allow this, i.e. many different delete operations were performed, each on a group of directories or, if the bottom directory would not delete, a group of files within it. In this matter 99% or so of the space was retrieved.
This left a multi-level directory structure related to Flash shared files, within which there were a few files that could not be deleted.
With no other option obvious, it was decided to reformat the drive to remove these files, retaining its original FAT32 structure. Windows XP, however, would not allow a FAT32 format through the GUI, so Run -> Cmd -> Format /fs:fat32 was used. I do not recall if the /q (Quick) option was used, but the format completed almost instantly. I seem to recall (though this may be a false memory) that I was prompted for whether I wanted a Quick format and responded Yes, since I was simply trying to delete files and not change the partitioning or format of the drive.
Before work could proceed, and after the system had been in use for about 2 days, it was discovered that a group of directories from the C: drive was missing, probably inadvertently deleted during the multiple deletions being made to the external drive. With the external backup drive now 'empty', there was no backup to the missing files.
[TestDisk has found some of the missing files on the C: drive, but since the system was used for a while, many are corrupted and directory relationships are gone, leaving the external drive as a more attractive target for future examination.]

Actions and results:
To determine if the format had destroyed the actual file data, PhotoRec was run. It found thousands of files and overflowed the flash drive from which it was being run (no options were used, so many system files were included). This confirmed that the data on the drive had not been overwritten. It also made it apparent that recovering the data this way, even if restricted to file extensions of interest, would be a very long and tedious process.
Next, TestDisk undelete was run on the external drive, with nothing found except one subdirectory and two files NOT deleted (Containing a WD logo and apparently protected from the format operation). NO undeleted files were reported after 18 hours. The log appears below. I consider the likely explanation is that I did something wrong or incompletely.

Question:
How can I recover the deleted files using TestDisk, thus avoiding the need to wade through hundreds of PhotoRec-named files, rename them, and recreate the prior directory structure?
--------------------

Fri Nov 22 14:29:33 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8103395328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8103395328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=79957946880
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8103378944
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=120031478784
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9726 255 63, sector size=512 - WDC WD800BB-75CAA0, S/N:4457572d414d4538383739373732 032 0 0 0 0, FW:16.06V16
Disk /dev/sdb - 8103 MB / 7728 MiB - CHS 985 255 63, sector size=512 - PNY USB 2.0 FD, FW:1100
Disk /dev/sdc - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - WD 1200BB External, FW:0602

Partition table type (auto): Intel
Disk /dev/sdc - 120 GB / 111 GiB - WD 1200BB External
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
Info: size boot_sector 234436482, partition 234436482
FAT1 : 32-28646
FAT2 : 28647-57261
start_rootdir : 57262 root cluster : 2
Data : 57262-234436461
sectors : 234436482
cluster_size : 64
no_of_cluster : 3662175 (2 - 3662176)
fat_length 28615 calculated 28611
FAT differs, FAT sectors=0-16/28615
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P FAT32 LBA 0 1 1 14592 254 63 234436482 [WD USB 2]
FAT32, blocksize=32768, 120 GB / 111 GiB

FAT: cluster=2(0x2), pos=57325
Directory /
3 -r-xr-xr-x 0 0 36 17-Oct-2002 10:56 autorun.inf
4 dr-xr-xr-x 0 0 0 28-Oct-2002 14:03 autorun
FAT: cluster=4(0x4), pos=57453
Directory /autorun
4 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 .
0 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 ..
5 -r-xr-xr-x 0 0 766 14-Oct-2002 16:57 wdlogo.ico
FAT: cluster=2(0x2), pos=57325
Directory /
3 -r-xr-xr-x 0 0 36 17-Oct-2002 10:56 autorun.inf
4 dr-xr-xr-x 0 0 0 28-Oct-2002 14:03 autorun
FAT: cluster=4(0x4), pos=57453
Directory /autorun
4 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 .
0 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 ..
5 -r-xr-xr-x 0 0 766 14-Oct-2002 16:57 wdlogo.ico
FAT: cluster=2(0x2), pos=57325
Directory /
3 -r-xr-xr-x 0 0 36 17-Oct-2002 10:56 autorun.inf
4 dr-xr-xr-x 0 0 0 28-Oct-2002 14:03 autorun
FAT: cluster=4(0x4), pos=57453
Directory /autorun
4 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 .
0 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 ..
5 -r-xr-xr-x 0 0 766 14-Oct-2002 16:57 wdlogo.ico
FAT: cluster=2(0x2), pos=57325
Directory /
3 -r-xr-xr-x 0 0 36 17-Oct-2002 10:56 autorun.inf
4 dr-xr-xr-x 0 0 0 28-Oct-2002 14:03 autorun
FAT: cluster=4(0x4), pos=57453
Directory /autorun
4 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 .
0 drwxr-xr-x 0 0 0 28-Oct-2002 14:03 ..
5 -r-xr-xr-x 0 0 766 14-Oct-2002 16:57 wdlogo.ico
FAT: cluster=2(0x2), pos=57325
Directory /
3 -r-xr-xr-x 0 0 36 17-Oct-2002 10:56 autorun.inf
4 dr-xr-xr-x 0 0 0 28-Oct-2002 14:03 autorun

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover after multiple deletes and a format - FAT32

#2 Post by cgrenier »

TestDisk can undelete files but not unformat a partition. You will have to use the files recovered by PhotoRec.

Locked