Windows "recovered" my NTFS volume by overwriting it

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
roelvdh
Posts: 5
Joined: 14 Aug 2018, 17:03
Location: Leiderdorp, NL

Windows "recovered" my NTFS volume by overwriting it

#1 Post by roelvdh »

I have a windows volume that actually resides as a loop device on an external Linux computer. Everything worked well untill I got a communication problem that was soon resolved. At that point Windows decided it should check the disk of my volume. Doing that there must have been an advice to reformat the volume and I must have agreed, but I cannot quite remember as I (stupidly) didn't bother much about the Windows side, being focused on the Linux side. Anyway, the NTFS volume was reformatted. After that I have saved the loop device image just to be sure not to lose anything more. I tried TestDisk and found the freshly created new partition with a correct but empty NTFS file system. My old data must still be there but how do I get access to it? Thanks for any help.

recuperation
Posts: 1986
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows "recovered" my NTFS volume by overwriting it

#2 Post by recuperation »

roelvdh wrote: 13 May 2022, 09:31 I have a windows volume that actually resides as a loop device on an external Linux computer. Everything worked well untill I got a communication problem that was soon resolved. At that point Windows decided it should check the disk of my volume. Doing that there must have been an advice to reformat the volume and I must have agreed, but I cannot quite remember as I (stupidly) didn't bother much about the Windows side, being focused on the Linux side. Anyway, the NTFS volume was reformatted. After that I have saved the loop device image just to be sure not to lose anything more. I tried TestDisk and found the freshly created new partition with a correct but empty NTFS file system. My old data must still be there but how do I get access to it? Thanks for any help.
I don't understand your configuration. How did a windows installation delete a windows volume on a separate computer?

Another point you missed is the time needed for the "reformat" operation which will determine the recovery chances.

You basically successfully wrote an empty partition exactly over a used one. Testdisk won't help you to get the content back because Testdisk finds your new empty volume and is able to navigate across it.
As for your old data, try Photorec or any other recovery software that does more than fingerprinting like Photorec.

roelvdh
Posts: 5
Joined: 14 Aug 2018, 17:03
Location: Leiderdorp, NL

Re: Windows "recovered" my NTFS volume by overwriting it

#3 Post by roelvdh »

The volume is an iSCSI disk on a remote Linux computer. Windows controls such disk as a local NTFS-volume. When the Ethernet cable between both computers got disconnected for a moment, Windows decided it should recheck the disk but rechecking became reformatting. There was zero writing activity after reformatting as I immediately saved the entire iSCSI-image on a different disk. My understanding of TestDisk was clearly wrong and I will now try Photorec. Thanks for the advice.

Post Reply