cgsecurity.org

While attempting to to "Quick Format" a USB stick in Windows 7 64-bit, I accidentally formatted a hard drive containing years of invaluable data. I immediately recognized my error and isolated the drive so nothing else was written to the drive since.

Out of sheer desperation I Googled around for a solution and found TestDisk..I downloaded and installed version 7.0 and painstakingly followed the instructions. I've gotten as far as the instruction to reboot my computer, but regretably after doing so nothing happens and I'm unable to recover the partition. In fact I see no activity suggesting that TestDisk ran after rebooting. I'm using TestDisk 7.0 32-bit on 64-bit computer; does this make a difference? Should I be using version 7.1 instead?

Would really appreciate any help.

- James

I seem to have made some progress but I'm unsure where to go from this point. Previously I ran "Analyze" and it showed me the disk but I was unsure how to proceed after that. Now I've gone a step further and ran a Deep Search which shows the following result... what is the next step from here? Which of the two listings do I select for restore? I tried to view the files - and obviously I'm not versed in the utility - all it shows me is Recycle Bin and another file. Do I need to change the Disk Characteristics from the current "D" to "P" for recovery to work?

Thanks for all help and advice.

P.S. I've also included the latest log:

Sun Aug 9 07:14:53 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, Cygwin 2000.4
Compilation date: 2015-08-04T07:51:12
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160047300608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160047300608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=160045203456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=640132383744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - Intel Raid 0 Volume, S/N:System, FW:1.0.
Disk /dev/sdb - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - WDC WD80 0JD-60LSA0, S/N:W -DMWMAX9600276, FW:07.0
Disk /dev/sdc - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - ST364032 3AS, S/N:V90KK7BQ, FW:CC1F
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 01FALS-00E8B, S/N:W -DMWTA5V181704, FW:05.0

Partition table type (auto): Intel
Disk /dev/sdd - 1000 GB / 931 GiB - WDC WD10 01FALS-00E8B
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 1953518988, partition 1953519616
Current partition structure:
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953518988
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 15 26 1953518988
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(7,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(7,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(7,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(7,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(7,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616

You can use PhotoRec to recover your files. You need enough space to store on another disk during the recovery.
Note that recovered files will not have their original names.
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

Thanks for the reply. Are you suggesting that I will not be able to recover the drive intact?

I suppose I could try PhotoRec but I'm trying to ensure that I exhaust any other possible recovery options first.

Thanks very much.

cgrenier wrote:You can use PhotoRec to recover your files. You need enough space to store on another disk during the recovery.
Note that recovered files will not have their original names.
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step