cgsecurity.org

Hello,

When rebuilding my workstation I accidentally formatted an NTFS partition with macrium two reflect images. I had a working backup for the smaller one but there is a larger one over 400gb for which my backup is corrupted. I am trying to recover the .mrimg file with photorec but it does not support the filetype. I have found some instructions (https://www.cgsecurity.org/wiki/Add_you ... o_PhotoRec) and here (https://techglimpse.com/photorec-recove ... file-type/) but this is a bit confusing for me and the guide is using much simpler files such as a .php file.

Would it also be possible to add support for the Macrium reflect image file?

I created a test one of a very tiny FAT32 partition and tried on the photorec online checker and it said: ERROR: PhotoRec doesn't know this format.

https://www.cgsecurity.org/photorec/sca ... ef83d73b0c

Would anyone be able to tell me if what I am doing is possible and be able to help me through the process. It would be very much appreciated.

I am working on Windows 10 and I have the Linux subsystem with Ubuntu installed. I also have a Ubuntu machine I can work from if needed.

The small image file you provide looks like a truncated raw image.
I have successfully opened it using TestDisk, Geometry, Cylinders=10 (arbitrary large enough value), Boot, List.
The probability that your 400gb lost file was unfragmented is near 0, so PhotoRec will not work.
As yo are using Ubuntu, you can try the scrounge-ntfs utility. You need to have enough free space on another disk to store the recovered files.

thanks cgrenier,

I put the drive in my Linux machine and have had some success with with scrounge-ntfs. It has found the .mrimg file OK but seems to be stuck only 3.6gb in. (3,624,064,138 bytes) and not changing. Took dog for walk and still the same. This is with the -c option set to the default of 8. I tried with 4 but it gets stuck a few kb in. (681,984 bytes)
I am recovering it to an external usb HD.

To be more precise it wasn't a reformatted partition. I deleted it by accident when reinstalling Windows 10 so it's a blank space that I am working from.