cgsecurity.org

Hi ALL,

I am trying to help a friend. It seems that they have proceeded to upgrade their computer from win 7 to win 10. I am not familiar with the process, but it sounds like at some point either windows ran out of space or needed to create windows install disk and the user offered the external HDD for windows to use. They obviously didn't expect that windows would create an installation drive all over about 6 years of Data. The drive has been re partitioned into a windows installation partition and un allocated. I think before it was just 1 partition with all the data on. I am not sure if windows would do a disk format in this process.

Is any of the data going to be recoverable and what product (testdisk or photrec) and process should I use to try and recover as much as possible.

Thanks in advance
Jon Bonny Tide Times

bonnytidetimes wrote: 05 Oct 2020, 18:30 Is any of the data going to be recoverable

Standard answer: I don't know. Maybe. My crystal ball is still on holiday.

and what product (testdisk or photrec) and process should I use to try and recover as much as possible.

You would start with Testdisk, running analyze followed by deep search. You would need to go through the result list to see if Testdisk can read the content of a partition.

If that fails, use Photorec which comes at the price of loosing metadata like folder hierarchies, file names and more.

Indeed it's a situation full of known unknowns and unknown unknowns, with very little in terms of known knowns...
It would depend on :
– how much data there was on that drive in the first place
– how much data was stupidly written onto that drive by a moronic install interface (those things are supposed to be “idiot proof”, but this is the proof that they are designed by idiots)
– where on the drive were the most important files (personal stuff -- pictures, writings and whatnot, things that couldn't be replaced) and the not-so-important files (downloaded movies, music... p0rn can fall into either of those categories depending on who you ask -- don't ask me I won't answer) were located (could be anywhere, even in the most surprising places)
all of which is only known by God and Chuck Norris.
Therefore, all you can do is try everything, pray Joe Pesci and hope for the best.

I am not sure if windows would do a disk format in this process.

Depends what you call a “disk format” ; if a new partition had been created, then it has been formatted, strictly speaking. But what is usually called a “low level format” is something else entirely, it means completely wiping the existing data, with 00s or FFs usually. If that happens, it takes quite some time to be completed -- the friend should know if it happened in a matter of minutes or if the damn thing was grinding for hours. Or open the whole drive in a hexadecimal editor (WinHex should allow this even in trial mode : Tools => Open disk => select da one ya want) : if it's all zeroes all the way down, oviously, there's not much to recover (except for God and Chuck Norris).