Accidental format of 2TB external drive Topic is solved

[Scooby]

My wife's laptop recently developed issues most likely due to a virus. So we backed up the entire hard drive to an external (eSata) 2TB drive. This drive was most likely formatted NTFS previously.

At which point we used the Dell recovery partition to reload the O/S (Windows 7). Unfortunately it decided to reformat all drives attached to the system and we had neglected to disconnect the external. That's what we get for doing it so late at night.

I have been learning about the awesome TestDisk utility but it says that the MFT & Mirror MFT are identical. Also the undelete only seems to list the files from the root of the external drive and none of the directories and files contained within.

I decided at this point to seek the help of more knowledgeable people in case I have missed something from my online research. Unless anyone has a better idea, then here are my next steps:

• 1. Buy antoher 2 TB drive
  2. Do a complete image of the existing drive (in case I mess something up and need to restart the recovery )
  3. Utilize PhotoRec to see what it is able to locate
  4. If the file listing looks fairly complete, then delete image from new 2TB drive & use it to copy the files over to

Any feedback would be greatly appreciated!

Thanks,


Scooby

[remy]

• 1. Buy antoher 2 TB drive
  2. Do a complete image of the existing drive (in case I mess something up and need to restart the recovery )
  3. Utilize PhotoRec to see what it is able to locate
  4. If the file listing looks fairly complete, then delete image from new 2TB drive & use it to copy the files over to

Hi,

As far as I understand well what you've done, it seems you tried to repair filesystem by going into "Advanced" menu. You should better begin with "Analyse" menu, trying to found and reconstruct your previous partition table. Then, if recognized, try to list files in the filesystem with "P" key. Give feedback and do not use "Write", we will begin with a fist diagnosis.

For your questions :
1/ Good idea generally speaking, but not essential there : Your disk didn't give symptoms of failure and a quick format didn't erase data. Trying to repair MBR or GPT will change only the first sectors and as far as you don't write, no risks at all.
2/ You should begin a new life : you already think like an expert in data recovery. Duplicate first. Well done But as said in 1/, not essential there. Very good idea in 90% of cases. If with diagnosis I think this option would be better, I'll let you know. But if you want to take the time to duplicate, go on. You'll have then a second drive to have always to backups
3/ Photorec will locate only files by extension, without names and filesystem structures. Poor result there, you'll probably be able to recover 100% of initial situation with testdisk. I hope.
4/ Cf. 3.

[Scooby]

You should begin a new life : you already think like an expert in data recovery.

Thanks remy, I learned some data recovery stuff last year when my laptop drive started failing. Unfortunately I learned about the merits of taking an image before modifying anything the hard way.

As far as I understand well what you've done, it seems you tried to repair filesystem by going into "Advanced" menu. You should better begin with "Analyse" menu, trying to found and reconstruct your previous partition table. Then, if recognized, try to list files in the filesystem with "P" key. Give feedback and do not use "Write", we will begin with a fist diagnosis.

Sorry I should have included more details on exactly what I did. Basically after a bunch of research I performed the following but did NOT write anything out to disk:

• 1. http://www.cgsecurity.org/wiki/Data_Rec ... _partition
  - saw no changes at all throughout the entire process
  2. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step (skipped the portion regarding the corrupted NTFS boot sector)
  - again saw no changes at all (not even a 2nd partition table)
  3. Undelete --> after about 4 hours it only listed a handful of files but nothing else. Appears to only list the files in the root of the drive.
  4. Found & tried a function regarding the MFT but it said that the MFT mirror was identical

I am not at home right now so cannot access TestDisk to give more details other than the above. Hopefully it is enough.

[remy]

I am not at home right now so cannot access TestDisk to give more details other than the above. Hopefully it is enough.

I really need more precision about what have been done, what was there before and the result of testdisk work.
Please launch testdisk with log, select "none" for partition table type, then option > align :no, then analyse, quicksearch, deepersearch.

Then post your log.

[Scooby]

Well before the Dell restore utility decided to wipe my 2TB eSata external drive, it contained one 2TB partition. I am almost positive it was formatted NTFS.

I followed your instructions remy and have attached the resultant testdisk log file as requested. Wow, turning off the align option certainly makes a huge difference in the results.

testdisk_log.zip

Testdisk log of external 2TB eSata drive

(6.61 KiB) Downloaded 1085 times

[Fiona]

The align option is in TestDisk 6.14 not available anymore and not needed.
Would it be possible to use TestDisk 6.14-32bit?
Your partition table doesn't match.
Partition is listed as unknown.
But Quick Search already found your partition.
Would it be possible to press p to list your data?
Results
P NTFS 0 1 1 243200 254 63 3907024002 [NexStar3: ]
NTFS, 2000 GB / 1863 GiB
The values actually match in comparison to your disk.
It means partition table type Intel also should find your partition, so that you should be able to write your partition to your partition table.
But I would need your testdisk.log using partition table type Intel.
In case if you want to and your files are listed, you can copy them to another disk or partition.
When you list your data, at the bottom of the screen you'll find all the commands.

Fiona

[remy]

Cross answer.
@Fiona : I've asked to try with "none" to have the largest diagnosis possible.

I bet it's intel table, and it would be a good idea to try to list partition detected after quicksearch :
NTFS 0 1 1 243200 254 63 3907024002 [NexStar3: ]

(press "P" to list)

[Scooby]

I ran another series of tests as follows:

• 1. Upgraded from testdisk 6.11 to 6.13 (latest non-beta version)
  2. create log file
  3. partition type = Intel
  4. Analyse \ quick search \ list --> only shows the current files ($RECYCLE.BIN & "System Volume Information")
  5. Deepsearch \ list --> same results
  6. Advanced \ RebuildBS --> says it detected a difference but the displayed values are identical
  7. Undelete --> only shows 27 files & no directories (files I need to recover where in directories)

NOTE
I said yes to the Vista prompt for searching (fairly certain we formatted the drive with a Windows 7 machine)

I will maybe try the latest beta version (6.14) later today.

Also I have been searching for info on the Dell Recovery Partition, in case knowing how the drive was wiped would help. So far all I have been able to determine is that it restored a windows image over the internal drive. Don't know about the external drive yet.

Here is the log file of the above:

testdisk02.zip

2nd testdisk log (Intel partition type this time)

(2.78 KiB) Downloaded 938 times

I am at a loss as to how to proceed other than an undelete utility and hope for the best. So thank you for your help!

[remy]

I'm not able to open this second zip. Perhaps corruption ? (Or error in my download ?) The listing you tried was on the partition called "Nextstar3:" ?

[Scooby]

Yes the listing that I tried was for Nextstar3: which is the external drive.

Here is the log file again. Hopefully it works this time

testdisk02.zip

2nd testdisk log (Intel partition type this time)

(2.94 KiB) Downloaded 1047 times