external hard drive accidentally formatted please help urgent

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

external hard drive accidentally formatted please help urgent

#1 Post by ahmed1 »

hello,
i was creating a windows 10 usb to install win 10 on my other pc when selected my hard drive instead of usb ( i know i am an idiot). i didn't realize this until it ended and i sw my usb was untouched while hard drive now was renamed ad now 32 gb. (it is actually 300 gb) the rest of the hard drive is now unallocated space. this hard drive contains very important phd files. i have been pulling out my hair trying to reverse this i have tried many data recover programs b but they simply return raw with some labeled data without folders which is essentially useless. so i stumbled across testdisk in an Ubuntu forum.i am runing this program on 32bit windows 7. it can see the partition in both quick search and extended search:
quick search:
Image
when i press eter:
Image

deep search:
Image

enter:
Image

it says i the last line that it was found using back up sector

i cannot do anything with it now i have found :http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair
this post however i do not know how to proceed i know that this is free software and that no one is iclined to help me but and that you think i am a compleate idiot but seriously dont kow what do do i have tried to search on the fourm ( nothing simlar found)
if anyone could help me i would highly aprecheate it.

i belive this is the log file but i could be wrong:

Tue May 16 15:10:19 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072932864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072932864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=231589543936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4402970624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=34359738368
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD25 00BPVT-22ZES, S/N:W -DXW146AR17032, FW:01.0
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - SAMSUNG HM321HI

Partition table type (auto): Intel
Disk /dev/sdb - 320 GB / 298 GiB - SAMSUNG HM321HI
Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 67108864, partition 67108864
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
Current partition structure:
1 * FAT32 LBA 0 32 33 4177 117 36 67108864 [ESD-USB]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/32/33
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=26624
FAT32 LBA 0 32 33 4177 117 36 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39071080
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39071080
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,631428806(39304/159/30)) lseek err Invalid argument
file_pread(5,1,buffer,631428806(39304/159/30)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
This partition ends after the disk limits. (start=625137344, size=625137282, end=1250274625, disk end=625142447)
file_pread(5,2,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(5,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,625142591(38913/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,625142719(38913/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,625142847(38913/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,625142975(38913/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,625143103(38913/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,625143231(38913/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,625143359(38913/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,625143487(38913/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,625143615(38913/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,625143743(38913/101/36)) lseek err Invalid argument
file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,14,buffer,625143810(38913/102/40)) lseek err Invalid argument
file_pread(5,3,buffer,625143824(38913/102/54)) lseek err Invalid argument
file_pread(5,3,buffer,625143871(38913/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,625143887(38913/103/54)) lseek err Invalid argument
file_pread(5,11,buffer,625143934(38913/104/38)) lseek err Invalid argument
file_pread(5,2,buffer,625145856(38913/135/7)) lseek err Invalid argument
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 640 GB / 596 GiB)
The following partition can't be recovered:
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
FAT32 LBA 0 32 33 4177 117 36 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
Not an exFAT boot sector.

HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 320 GB / 298 GiB - SAMSUNG HM321HI
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 67108864, partition 67108864
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
1 * FAT32 LBA 0 32 33 4177 117 36 67108864 [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 67108864, partition 67108864
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
Current partition structure:
1 * FAT32 LBA 0 32 33 4177 117 36 67108864 [ESD-USB]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/32/33
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=26624
FAT32 LBA 0 32 33 4177 117 36 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39071080
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39071080
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,631428806(39304/159/30)) lseek err Invalid argument
file_pread(5,1,buffer,631428806(39304/159/30)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
This partition ends after the disk limits. (start=625137344, size=625137282, end=1250274625, disk end=625142447)
file_pread(5,2,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(5,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,625142591(38913/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,625142719(38913/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,625142847(38913/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,625142975(38913/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,625143103(38913/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,625143231(38913/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,625143359(38913/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,625143487(38913/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,625143615(38913/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,625143743(38913/101/36)) lseek err Invalid argument
file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,14,buffer,625143810(38913/102/40)) lseek err Invalid argument
file_pread(5,3,buffer,625143824(38913/102/54)) lseek err Invalid argument
file_pread(5,3,buffer,625143871(38913/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,625143887(38913/103/54)) lseek err Invalid argument
file_pread(5,11,buffer,625143934(38913/104/38)) lseek err Invalid argument
file_pread(5,2,buffer,625145856(38913/135/7)) lseek err Invalid argument
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 640 GB / 596 GiB)
The following partition can't be recovered:
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
FAT32 LBA 0 32 33 4177 117 36 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
Not an exFAT boot sector.

HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery


please reply as soon as possible

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: external hard drive accidentally formatted please help urgent

#2 Post by cgrenier »

As the disk been reformated, run PhotoRec, enable Expert mode in Options, select [Whole Disk], Search, use a 512 byte blocksize when asked, use the default options otherwise.
You need enough space on another disk to store the recovered data. Original filenames will not be recovered.

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#3 Post by ahmed1 »

hello,
cgrenier, thank you for replying. can photorec restore the folders i which the files existed. the files alone are essentially useless. is there no way i can recover the back up sector previously mentioned. only 30 gb has been formatted as i currently understand the backup sector is near the end of the hard drive sectors is there an way i would be able to recover it. the folders are the most important thing without this there is no way to distinguish the files.
eve if the folders are not named the placement of files together in a folder is all i need. i ca already recover the files without their names however this doesn't seem to help at all.
thank you for reading please reply soon.

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#4 Post by ahmed1 »

i have looked into photorec as you have suggested however it restores raw file data with no folder structure or names it their any way to recover them with the folders. as previously mentioned, not having folders renders everything else useless.
i have also bee searching and i have no idea what it means by ntfs found using backup sector can i recover folder structure using that.
i want to thank you for replying any assistance will be greatly appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: external hard drive accidentally formatted please help urgent

#5 Post by cgrenier »

After using testdisk, Analyse, Quick Search, set the NTFS partition to P(rimary), on next screen, choose Write, confirm, BackupBS, confirm, Quit and restart your computer.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
If it doesn't work, try Testdisk, Advanced, RepairMFT

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#6 Post by ahmed1 »

hello, again i want to thank you very much for responding to me i really appreciate it.
when doing this am i at risk of losing the data on the file i.e should i i some way (which i don't know) back up the drive so that if this doesn't work we ca try something else
it is currently analyzing after it finishes analyzing i will wait for your response before proceeding.
again thank you a lot for your continued help.

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#7 Post by ahmed1 »

hi, i actually followed your steps ad after quick search the analyse then changing it to p then confirm this error shows up the i kicks me out back to the main menu ( analyse advanced...ext screen :
Image
i will tr to analyse again again then follow the steps again. then ii will try to do a deeper scan and follow the steps after that. thank you for your continued help i appreciate it.

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#8 Post by ahmed1 »

never mind, upon inspection i believe the hard drive was up plugged from my laptop after the scan i will redo ever thing and change it to p.

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#9 Post by ahmed1 »

ok so i did this after selectig it brings me to this...
Image
it says sectors are not identical, is this because the actual one was formatted / overwritten , should i proceed with backup bs
i will wait for our response.
please ignore the previous posts i made the hard drive was unplugged.
thank you for our help

ahmed1
Posts: 9
Joined: 16 May 2017, 20:14

Re: external hard drive accidentally formatted please help urgent

#10 Post by ahmed1 »

hello, ok so i followed the steps with the backub bs and there was an error ( i forgot to screan shot itbut it said something vaigue like there was an eror... not givig any etails so i restared the pc as instructed and now i have a local disk e insted of the usb partion that windows mae it has asked me to format but i responded with no i canot acces any of it when i reopened testdisk and hit enter to aalyse this was shown:
Image
it is the same partion twice did i mess up... what even happened is everything gone now what the hell do i do..

Locked