cgsecurity.org

Thanks so much, to clarify:
-"clean" was only used on the factory-fresh disk prior to originally loading it with my data. The wipe happened soley due to WSS. I included the clean as potentially relevant only as it might mean the first partition map I'd made after "clean" was stored in the very first sectors, and so was now split by the current glitch partitions ("Windows Reserved 128mb" & "Unallocated" 931gb) made by WSS.

-But this appears not to be the issue, as the first filesys was a GPT exFAT single partition for the whole disk, and so its partition info should have been backed up/written in multiple places around the disk, available for Testdisk to find and restore the part.table. Correct?

-However "Can't open filesystem. Filesystem seems damaged" is all we get. My guess is that's bc all Testdisk is finding, is the new WSS/ReFS filesys info partially written, not the previous exFAT info needed. However that exFAT info *must still be on the disk, (unless it's been trimmed).

-I tried PhotoRec as you suggested; nothing found, no files, no info, no data shown, period.

-However the odds are pretty good that the disk is indeed in good health, as WSS did this to two drives simultaneously (1TB sata and 4TB USB) in an instant, and both are now listed in Disk Mgr simply as "Unallocated" waiting to be formatted, appears to have no problem. It's very likely that if I went and reformatted, they'd show up again as ready storage space. (Of course I won't do that as I don't want to take more risk of permanent data loss).

-The 1TB disk was an exFAT SSD. I read that NTFS SSDs use TRIM, for which data is plainly unrecoverable. But I also read this does not necessarily apply to exFAT, and furthermore, this is a lost partition table, with the result converting to "Unallocated," so trim should not be addressing the Unallocated/unmounted sectors, sound right to you?

-Would CHKDSK hurt here or potentially help?

-It was storage only not a boot disk, nor was it MBR, but would trying to restore the boot record have any chance?

-I have made a backup image, does that have a worse chance of data recovery in any way? My thinking is that if I "clean" again, to get rid of whatever damaged filesystem there is, we will have a full raw drive to scan w/ no partitions.

-I will try to find and/or make a new log file.

-FYI, this happened as I was working on my new backup setup; one of my RAID disks failed, which prompted me to look into WSS, which killed the discs I had *deliberately *unchecked from its "Apply to" list, to avoid touching. -- I went for one damn night w/out a backup sys, and bam. Stung by the very thing I was trying to use to make my new one. My critical operating files are on the cloud so I'm still functional, but these files took over a decade of memories, hard work & money, so it'd really hurt to lose.

Thanks a million again.

UPDATE: I opened in R-Studio's Hexeditor to scan visually. I think it is very likely the data was zeroed out somehow . Can't imagine how, unless somehow trim does apply to unallocated space with no file sys, or there was some flash of current that just wiped it all when WSS tried what it did. I can see the little 128mb Windows Reserved partition in Sector 1:
Along with some bits in Sector 0 that might be a piece of the old partition table, or just the start of the 128 Windows Reserved one.


And in the very last sector I see what looks like another partition table, maybe for all love of god the old lost partition, but very possibly incomplete:
But regardless, every other sector between them seems to be flat 00 across the board, although maybe some were skipped too fast for an eye, it all scans solid this to me as I pull the scrollbar:
...Am I probably DOA? Could even deeper forensics get past these 00s? :'(

jaharwell wrote: 13 Oct 2020, 05:35 Thanks so much, to clarify:
-"clean" was only used on the factory-fresh disk prior to originally loading it with my data. The wipe happened soley due to WSS. I included the clean as potentially relevant only as it might mean the first partition map I'd made after "clean" was stored in the very first sectors, and so was now split by the current glitch partitions ("Windows Reserved 128mb" & "Unallocated" 931gb) made by WSS.

-But this appears not to be the issue, as the first filesys was a GPT exFAT single partition

You are mixing the partition table type (GPT/MBR) with the partition type here (exFAT).

for the whole disk, and so its partition info should have been backed up/written in multiple places around the disk, available for Testdisk to find and restore the part.table. Correct?

No. There is only one backup of the GPT on the disk and according to your description that does not exist anymore.

-However "Can't open filesystem. Filesystem seems damaged" is all we get. My guess is that's bc all Testdisk is finding, is the new WSS/ReFS filesys info partially written, not the previous exFAT info needed. However that exFAT info *must still be on the disk, (unless it's been trimmed).

Use commercial software to search for exFAT remains.

-I tried PhotoRec as you suggested; nothing found, no files, no info, no data shown, period.

You are done here - unfortunately.

-However the odds

Would you like to have your doctor tell you about your odds without having examined you?

are pretty good that the disk is indeed in good health, as WSS did this to two drives simultaneously (1TB sata and 4TB USB) in an instant, and both are now listed in Disk Mgr simply as "Unallocated" waiting to be formatted, appears to have no problem. It's very likely that if I went and reformatted, they'd show up again as ready storage space.

Formatting is not part of any recovery operation. Formatting means deleting.

(Of course I won't do that as I don't want to take more risk of permanent data loss).

-The 1TB disk was an exFAT SSD. I read that NTFS SSDs use TRIM, for which data is plainly unrecoverable. But I also read this does not necessarily apply to exFAT, and furthermore, this is a lost partition table, with the result converting to "Unallocated," so trim should not be addressing the Unallocated/unmounted sectors, sound right to you?

No.

-Would CHKDSK hurt here or potentially help?

It can not run without an existing partition.

-It was storage only not a boot disk, nor was it MBR, but would trying to restore the boot record have any chance?

???

-I have made a backup image, does that have a worse chance of data recovery in any way?

Worse than what? Restore the backup to another drive.

My thinking is that if I "clean" again, to get rid of whatever damaged filesystem there is, we will have a full raw drive to scan w/ no partitions.

???
After reading your posting and taking into account the outcome of Photorec I would really recommend you to use a professional recovery service instead of trying to recover anything yourself.

Okay, well given that it was an SSD using trim, and that scrolling thru the hex showed a pretty solid all zeroes which didn't flicker to any other characters at all, it's pretty safe to say that SSD is a goner.

There still seems to be some confusion:
-

Formatting is not part of any recovery operation. Formatting means deleting.

Aware, that's why I said I would not format. Only mentioned it to illustrate that the disk would probably work properly as a new disk, and is therefore likely undamaged physically, just zeroed out by trim.

-

Worse than what? Restore the backup to another drive.

Does a backup image/restoration have for any reason any worse chances of recovery, rather than just trying to recover from the original disk. A reasonable question.

In the end- I was able to recover about 70% of my data from the 4TB HDD, and am thankful enough for that. The problem w/ the SSD was that it was fully trimmed and unrecoverable. I might have been able to save it if I'd powered down and pulled it as soon as this happened, then turned off trim before plugging it back in to try any recovery searches. But after the SSD was sitting Unallocated for long enough on an active machine, it was fully zeroed out and that's that.

I may try pro data recovery service as you suggest, if you think there still might be a way through that. Let me know if you can think of anyone good enough to see deeper than zeros across the apparent hex, and I'll send you a truckload of M & Ms if they succeed. Unless you don't like M&Ms. Thanks again recup.

jaharwell wrote: 19 Oct 2020, 06:41 -

Worse than what? Restore the backup to another drive.

Does a backup image/restoration have for any reason any worse chances of recovery, rather than just trying to recover from the original disk. A reasonable question.

I don't understand the question. A backup does not need recovery - it is simply restored.

I may try pro data recovery service as you suggest, if you think there still might be a way through that.

I don't know, I never used a recovery service. I just tried to outline your options.

Let me know if you can think of anyone good enough to see deeper than zeros across the apparent hex, and I'll send you a truckload of M & Ms if they succeed. Unless you don't like M&Ms. Thanks again recup.

You have a hardware or firmware issue. This is beyond logical data recovery done by software.