Recover photos from NTFS overwritten partition Topic is solved

[sthiago]

I'm trying to recover photos from a 320GB HDD that was originally a NTFS partition. It has since been reformatted a few times. Some of those times to NTFS and some to ext4. Most of the "tail" of the drive hasn't been used tho (like the last 80% of it), only in the original NTFS times.

I was trying to recover JPGs from those original NTFS times. I can't recover the partition with testdisk, so photorec on the whole disk seemed the way to go. The initial run recovered only files that were very recent, seemed to be all from the somewhat recent ext4 times.

I've been trying to understand if changing the geometry options will get me more results. Stuff like reducing the sector size or the heads? The information in the manual isn't too clear to me. It talks about block size, but there is no block size option. And the block size seems to be a multiple of the sector size or something? Anyway, I tried smaller sector sizes, but to no avail.

I searched a bit in the forum before posting this. I read that the reformat to ext4 writes a little bit in every sector so it would've overwritten all my photos? Am I correct in understanding that?

All that said, is there anything else that I could try?

Thanks in advance!

[recuperation]

I'm trying to recover photos from a 320GB HDD that was originally a NTFS partition. It has since been reformatted a few times. Some of those times to NTFS and some to ext4. Most of the "tail" of the drive hasn't been used tho (like the last 80% of it), only in the original NTFS times.

I was trying to recover JPGs from those original NTFS times. I can't recover the partition with testdisk, so photorec on the whole disk seemed the way to go. The initial run recovered only files that were very recent, seemed to be all from the somewhat recent ext4 times.

I've been trying to understand if changing the geometry options will get me more results.

Photorec -Geometry.png (18.93 KiB) Viewed 3607 times

Photorec tells us what the geometry is used for.
Your partition is well-known and defined because you only formated your drive.
Therefore you should not touch those CHS-parameters.

Stuff like reducing the sector size or the heads? The information in the manual isn't too clear to me. It talks about block size, but there is no block size option.

The manual states:

11.4 PhotoRec options
• ParanoidBy default, recovered files are verified and invalid files rejected. Enable bruteforceif you want
to recover more fragmented JPEG files, note it is a very CPU intensive operation, it’s started after the normal
scan process.
• The expert mode option allows the user to force the file system block size and the offset. Each filesystem
has his own block size (a multiple of the sector size) and offset (0 for NTFS, exFAT, ext2/3/4), these value are
fixed when the filesystem has been created/formatted. When working on the whole disk (i.e. original partitions
are lost) or a reformatted partition, if PhotoRec has found very few files, you may want to try the minimal value
that PhotoRec let you select (it’s the sector size) for the block size (0 will be used for the offset).

In your special case having had both NTFS and ext4 with differing block sizes you might want to minimize what is labeled "sector size" in the menu.

And the block size seems to be a multiple of the sector size or something?

Yes, I think it stands for cluster size.

Anyway, I tried smaller sector sizes, but to no avail.

I searched a bit in the forum before posting this. I read that the reformat to ext4 writes a little bit in every sector so it would've overwritten all my photos? Am I correct in understanding that?

ext4 does not write every sector when formating. It is writing block group information all over your file system.

All that said, is there anything else that I could try?

No. Multiple format operations with different file systems strongly diminished your recovery chances.

[sthiago]

Thanks for the detailed response.

In your special case having had both NTFS and ext4 with differing block sizes you might want to minimize what is labeled "sector size" in the menu.

Ah ok, I tried messing up with that. Even though it listed 512 as the lowest option, I tried stuff like 16, 128 and 256. But nothing really changed, as expected.

ext4 does not write every sector when formating. It is writing block group information all over your file system.

I see, so it does overwrite a little bit everywhere and that spoils the recovery attempts

No. Multiple format operations with different file systems strongly diminished your recovery chances.

Yeah, figured as much. Just thought it was worth asking in case I was letting something simple pass by.

Thanks again!

[BitterColdSoul]

I've worked on a drive which had had a similar “history”, formatted from Windows to Linux and back to Windows, or something similar, plus it had a bunch of bad sectors and was unstable, yet I managed to recover more than 95% of the data from both the Windows filesystem and the Linux filesystem, using ddrescue to first create a complete image, then R-Studio to analyse it. But if it has been reformatted “a few times”, and new data has been written over the same volume, then the odds of recovering valid files from an earlier filesystem get very low very quickly (even if a large amount is unused, as, from the filesystem's point of view, the area where files from the older filesystem used to be is considered as free space, and it will tend to write new files near the beginning of the volume, based on performance considerations, as HDDs are significantly faster on the outer “cylinders”, i.e. the outer edge of the platters, which is defined as the beginning, contrary to optical discs where data writing starts on the inner edge).