NTFS Filesystem was Quick Formatted - are these steps correct to recover data?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
electrosphere
Posts: 2
Joined: 15 Mar 2021, 16:10

NTFS Filesystem was Quick Formatted - are these steps correct to recover data?

#1 Post by electrosphere »

Hi all,

As topic, I have a 1.5Tb USB 3.0 external HDD. It contains about 1Tb of backup data in the form of documents, media files etc.

What happened was that I went through the Windows 10 media creation steps using the tool supplied by Microsoft. The steps seemed to whiz by fast and I expected a big scary message to confirm the USB device that was going to be used. Anyway, the long and short of it is that my USB backup disk was selected by mistake!

What I have done is to download TestDisk and I am running the "analyse" step

https://imgur.com/ITf5V5O

It is a slow process, I expect it to take a few days to reach 100% because it is a 1.5Tb disk.

Once I have identified the missing partition (NTFS) then I am hoping to just list the files and then copy them somewhere. There was just a single partition in which there was 15 folders.

Is this the right approach for this kind of mistake?

Thank you

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS Filesystem was Quick Formatted - are these steps correct to recover data?

#2 Post by recuperation »

Yes.

electrosphere
Posts: 2
Joined: 15 Mar 2021, 16:10

Re: NTFS Filesystem was Quick Formatted - are these steps correct to recover data?

#3 Post by electrosphere »

Thanks, I was unsure if I need TestDisk to analyse the entire disk or try to "undelete" the files using this guide https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

(The disk is actually 2Tb not 1.5Tb so getting the right advice would save me a lot of time)

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS Filesystem was Quick Formatted - are these steps correct to recover data?

#4 Post by recuperation »

electrosphere wrote: 15 Mar 2021, 20:34 Thanks, I was unsure if I need TestDisk to analyse the entire disk or try to "undelete" the files using this guide https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

(The disk is actually 2Tb not 1.5Tb so getting the right advice would save me a lot of time)
If you want to save time please consult a professional recovery service. Doing a recovery is always time consuming. At least there is no need to monitor the cylinder count growing.

Deleting files is an entirely different process than overwriting the beginning of file system. What has been overwritten, is not recoverable. What has been deleted may be recoverable depending on the use of the file system following the incident in case of NTFS file systems. p.e..

Locked