difficulty recovering from quick format

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

difficulty recovering from quick format

#1 Post by rasarx »

Like many here, I quick formatted a data drive by mistake. None of the tools I have tried detect any files even though it was a nearly full drive.
TestDisk fails in the course of Analyze because it says the size of the disk is too small. Strangely, it does detect the correct size before Analyze but when it finishes the analysis it thinks the disk should be twice as large as it should be. How do you deal with that?
Image

I also tried PhotoRec and it didn't detect any pictures.

Are you supposed to, before running TestDisk, delete the partition that Quick Format created?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: difficulty recovering from quick format

#2 Post by cgrenier »

The blocksize from the new partition may be larger (or unaligned) than the previous partition.
Run PhotoRec, enable Expert mode in Options, start a recovery, answer No when asked about FAT unformat, use a 512 bytes blocksize, use the default option otherwise (answer No when asked about remaining data image).

rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

Re: difficulty recovering from quick format

#3 Post by rasarx »

Thank you for your suggestion. I tried it. It found zero files (even though there should be thousands of pics). In the following screen it is asking "Create an image_remaining.dd (511974 MB) file with the unknown data (Answer N if not sure) (Y/N)"
I assume it means the image it'll create will be whatever is left of the disk image minus the pictures photorec found, but since photorec found nothing image_remaining.dd will simply be the entire disk image. Is that correct?

Here is the log file:



Thu Feb 13 22:27:21 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=498926092288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=511974572032
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500423AS, S/N:5WR0A5MG, FW:0001DEM1
Disk /dev/sdb - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - KXG50ZNV512G TOSHIBA, S/N:0000_0000_0000_0010_0008_0D03_002F_103E., FW:AAHA4102

Partition table type (auto): EFI GPT
Disk /dev/sdb - 512 GB / 476 GiB - KXG50ZNV512G TOSHIBA
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1000215215 (expected 1000215215)
hdr_lba_start=34
hdr_lba_end=1000215182
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 1000214527 999950336 [Basic data partition] [MAIN_D]
NTFS, blocksize=4096, 511 GB / 476 GiB
Image created successfully.


dir_partition inode=5
2 P MS Data 264192 1000214527 999950336 [Basic data partition] [MAIN_D]
NTFS, blocksize=4096, 511 GB / 476 GiB
Directory /
5 dr-xr-xr-x 0 0 0 13-Feb-2020 20:11 .
5 dr-xr-xr-x 0 0 0 13-Feb-2020 20:11 ..
40 dr-xr-xr-x 0 0 0 13-Feb-2020 20:11 $RECYCLE.BIN
36 dr-xr-xr-x 0 0 0 10-Feb-2020 17:42 System Volume Information

TestDisk exited normally.

rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

Re: difficulty recovering from quick format

#4 Post by rasarx »

I should mention, this is a Toshiba SSD drive

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: difficulty recovering from quick format

#5 Post by recuperation »

Maybe you overwrote parts of an encrypted file system.

rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

Re: difficulty recovering from quick format

#6 Post by rasarx »

Is there a way to find out if it was encrypted? I'm not an expert so I would appreciate any pointers that could lead me in the right direction. Thank you.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: difficulty recovering from quick format

#7 Post by recuperation »

rasarx wrote: 16 Feb 2020, 02:55 Is there a way to find out if it was encrypted? I'm not an expert so I would appreciate any pointers that could lead me in the right direction. Thank you.
You should know if you/the owner installed and applied Truecrypt/Veracrypt or some other encryption tool.
Furthermore you should know if one needed a key to see data on the drive.
For Truecrypt/Veracrypt there is no way to find out. For the others I don't know.

I assume that your drive is either encrypted or broken.

Please check the SMART parameters using smartmontools and redirect the resulting report into a file and post it here:
smartctl -a /dev/sdx > myreport.txt
Replace x by the drive letter in question and extend "myreport.txt" with the path of your choice.

rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

Re: difficulty recovering from quick format

#8 Post by rasarx »

When I asked the system admin last week who configured the system he said they don't encrypt drives. However, I don't know this drive came from and I'll have to see if they know. It's an SSD drive. I wonder if that drive was used and if the previous user had it configured as encrypted. I don't think the drive is broken as it had given no errors prior to the quick format, nor do I see any errors while examining it. Unless the quick format somehow broke it. Looking at the content of the sector from the tool iRecover the contents all but a couple of the blocks are zero.

Here is the content of myreport.txt.


smartctl 7.1 2019-12-30 r5022 [x86_64-w64-mingw32-w10-1709] (sf-7.1-1)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Number: KXG50ZNV512G TOSHIBA
Serial Number: 38PB876VK5YS
Firmware Version: AAHA4102
PCI Vendor/Subsystem ID: 0x1179
IEEE OUI Identifier: 0x00080d
Total NVM Capacity: 512,110,190,592 [512 GB]
Unallocated NVM Capacity: 0
Controller ID: 0
Number of Namespaces: 1
Namespace 1 Size/Capacity: 512,110,190,592 [512 GB]
Namespace 1 Formatted LBA Size: 512
Namespace 1 IEEE EUI-64: 00080d 03002f103e
Local Time is: Sun Feb 16 14:55:27 2020 PST
Firmware Updates (0x14): 2 Slots, no Reset required
Optional Admin Commands (0x0017): Security Format Frmw_DL Self_Test
Optional NVM Commands (0x005f): Comp Wr_Unc DS_Mngmt Wr_Zero Sav/Sel_Feat Timestmp
Maximum Data Transfer Size: 512 Pages
Warning Comp. Temp. Threshold: 78 Celsius
Critical Comp. Temp. Threshold: 82 Celsius
Namespace 1 Features (0x02): NA_Fields

Supported Power States
St Op Max Active Idle RL RT WL WT Ent_Lat Ex_Lat
0 + 6.00W - - 0 0 0 0 0 0
1 + 2.70W - - 1 1 1 1 0 0
2 + 1.30W - - 2 2 2 2 0 0
3 - 0.0500W - - 3 3 3 3 1500 1500
4 - 0.0050W - - 4 4 4 4 6000 14000
5 - 0.0030W - - 5 5 5 5 50000 80000

Supported LBA Sizes (NSID 0x1)
Id Fmt Data Metadt Rel_Perf
0 + 512 0 2
1 - 4096 0 1

=== START OF SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

SMART/Health Information (NVMe Log 0x02)
Critical Warning: 0x00
Temperature: 37 Celsius
Available Spare: 100%
Available Spare Threshold: 5%
Percentage Used: 1%
Data Units Read: 18,029,396 [9.23 TB]
Data Units Written: 2,028,112 [1.03 TB]
Host Read Commands: 377,911,256
Host Write Commands: 19,855,335
Controller Busy Time: 292
Power Cycles: 851
Power On Hours: 4,153
Unsafe Shutdowns: 89
Media and Data Integrity Errors: 0
Error Information Log Entries: 0
Warning Comp. Temperature Time: 0
Critical Comp. Temperature Time: 0
Temperature Sensor 1: 37 Celsius

Error Information (NVMe Log 0x01, max 128 entries)
No Errors Logged

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: difficulty recovering from quick format

#9 Post by recuperation »

rasarx wrote: 17 Feb 2020, 00:38 When I asked the system admin last week who configured the system he said they don't encrypt drives. However, I don't know this drive came from and I'll have to see if they know. It's an SSD drive. I wonder if that drive was used and if the previous user had it configured as encrypted. I don't think the drive is broken as it had given no errors prior to the quick format, nor do I see any errors while examining it. Unless the quick format somehow broke it. Looking at the content of the sector from the tool iRecover the contents all but a couple of the blocks are zero.
Do you really used the -a parameter?
I am missing the list of smart parameters and their values.

If all sectors are zero, there is nothing left to recover.

rasarx
Posts: 11
Joined: 13 Feb 2020, 20:16

Re: difficulty recovering from quick format

#10 Post by rasarx »

That's what I'm afraid of. It seems odd though, that a quick format would do that. Isn't that what a full format would do? Is it possible that quick format acts differently on an SSD?

Yes, I did use -a. I still have the command in the history:

C:\Program Files\smartmontools\bin> smartctl -a /dev/sdb >c:\temp\myreport.txt

C:\Program Files\smartmontools\bin> c:\temp\myreport.txt

Locked