Recover UNALLOCATED Drives partially formatted by Windows Storage Spaces?

[jaharwell]

Hi All,
Thanks so much for this resource. In a lot of pain here, decades of work just wiped last night by a glitch in Windows Storage Spaces. Two drives (main + backup), just wiped to "Unallocated" last night by Windows Storage Spaces trying to add them (against my wishes) to my other pre-existing pool, and failing.

The WSS wizard prompts were stupidly written and misleading, I was trying to swap in other disks to my pool, and wasn't trying to involve the wiped disks at all- they were never part of the pool nor intended to be (I had them clearly un-checked in the list, so my click should not have involved them, but argh, for some reason, it did).

Instead of ignoring those disks, when I clicked "Add" for the other new disks I wanted to address, despite the rest being UNCHECKED, WSS also tried and failed to add ALL OTHER DISKS ON MY SYSTEM -- I got an error message "Failed to add disks," but it got far enough to immediately revert them to "Unallocated" partitions and disappear them from Windows File Explorer.

It appears to be a very quick partial reformat that wiped the filesystem, so it's likely the data is still intact. I have not touched them since.

However, neither MiniTool RAW, nor EaseUS has been able to find any files on them after two scans. The first TestDisk attempt only found the little recovery partition, but otherwise found nothing else, no option to Write.

I'm about 75% through the Deeper Analyse on TestDisk for the 1TB drive. But I'm really concerned here. What to do when Analyse is done?

What to do overall?? Any help very greatly appreciated.

Thanks very much in advance.
J.

[recuperation]

Testdisk does not support storages spaces. Search for commercial software that helps you recover your data or consider paying a professional recovery lab - if they are able to help you at all.
Storages Spaces is undocumented proprietary technology. That makes recovery even more difficult. It is not suitable for people who don't run periodic backups.

[jaharwell]

I do not need to recover Storage Spaces. I need to recover regular exFAT disks that are now "Unallocated" by mistake.

(The reason for that being to a Storage Spaces glitch, should not be relevant to this, just that it was made them "Unallocated" by mistake.)

This was a very quick moment and the disks were 1TB & 4TB,

So somewhere still the previous files & traces of proper file system must reside. There also is a small recovery partition.

After "Analyse", this is what I get:

TDshot01.jpg (121 KiB) Viewed 6564 times

Do I have to re-add the correct partition myself from the recovery partition? What does "Load backup" mean, a whole disc backup from elsewhere, or backup info from the recovery partition?

Please let me know how to proceed here?

Thank you kindly.

[jaharwell]

This is what I get when I hit "Load backup":

TDshot02.jpg (178.05 KiB) Viewed 6561 times

However I hesitate to do this bc I can't tell if that's the backup partition table of the old proper format, or if it's a backup of the new Unallocated space, for which "restoring" it would just mean restoring the current unallocated state, thereby overwriting the correct data I need and it really would be lost then.

Is it safe to go ahead and "Load" to see if it's the right one to confirm? I'm even more suspicious bc of the date/time shown for that "backup" partition.

[recuperation]

The backup you are talking about is a log file with partition table information generated on user demand.
Do not use this function.
Instead wait for Analyze to finish to see if you can see your exFAT-partition. If not, run deep search.

[jaharwell]

Okay thanks, running Deeper Search now. Will post results...

[jaharwell]

Well, okay this is what I got again after Deeper Search:

Untitled-1.jpg (97.32 KiB) Viewed 6500 times

What can I do now?

[recuperation]

Try Photorec.

[jaharwell]

UPDATE 3-- The disk was exFAT GPT, before being corrupted. But I'm still getting the error: "Can't open filesystem. Filesystem seems damaged." However I read that my previous partition info. should be stored in multiple places around the disk, to prevent what I described below, and allow me to repair the filesystem. Any further thoughts/insight or how to do this? Would be so much appreciated, thank you kindly all.

UPDATE 2--
-Is it also possible that WSS writing that new little partition "Windows Reserved" overwrote my orig. partition map we need? If the former one was in the first few sectors as a fully un-partitioned disk, now the new one being written there to create "Windows Reserved" and "Unallocated" ? Does that mean the orig. map could be fully gone??

UPDATE--
I have an idea as to what might have happened, would you mind letting me know if this sounds reasonable and if so, what steps to take :

-I had set up my original disk using diskpart > clean to wipe any/all factory partitions off of it before formatting, hoping to get maximum capacity. It was working well.

-When the WSS error happened, it was partially reformatted into two smaller partitions: "Windows Reserved" (128mb) and "Unallocated" (931gb)

-So now the former file sys info (partition map? file tree? etc... I don't know what it should be called) may have had its sectors split by the new partitions, now residing partially in sectors on each of the new partitions

-Hence when I scan it now, the scanners do not see it as a raw disk, rather scanning one partition at a time, and so cannot find any file system info.

-Does this sound plausible? If so what all might be doable, and is there any way to scan right across all sectors 0-nn?

****ORIG REPLY:
Okay thanks will do. -- What doesn't make sense, is how a partial reformat of nearly 1TB could be so complete and utter, in only a split second? It had about 915gb of files on it, so it doesn't seem possible for those to have been zeroed out in that short a time. So the data *MUST be on the disc, but not even R-Studio has been able to find any file information. Meanwhile the drive is in perfect health and looks ready to format at any time. It reads as close to a factory bare drive as imaginable, without any of its previous content having been overwritten.

Can any of you imagine any ways this might be possible??

Thanks so much recup. & anyone else for your consideration and time.

[recuperation]

UPDATE 3-- The disk was exFAT GPT, before being corrupted. But I'm still getting the error: "Can't open filesystem. Filesystem seems damaged." However I read that my previous partition info. should be stored in multiple places around the disk, to prevent what I described below, and allow me to repair the filesystem.

You are mixing partition structure which is a kind of hull that points to file systems and the file systems themselves. Obviously Testdisk did not find remains.
That all looks kind of strange. I don't believe anybody telling me that his drive is in "perfect health" until he delivers me a log file from smartmontools. A log file with good parameters is no guaranty for a healthy drive, though.
You did not deliver the Testdisk log file.

UPDATE 2--
-Is it also possible that WSS writing that new little partition "Windows Reserved" overwrote my orig. partition map we need? If the former one was in the first few sectors as a fully un-partitioned disk, now the new one being written there to create "Windows Reserved" and "Unallocated" ? Does that mean the orig. map could be fully gone??

Yes. But once Testdisk finds certain information belonging to a file system such as a backup boot sector a partion table (MBR/GPT) can be recreated making this partition available for your operating system.

UPDATE--
I have an idea as to what might have happened, would you mind letting me know if this sounds reasonable and if so, what steps to take :

-I had set up my original disk using diskpart > clean to wipe any/all factory partitions off of it before formatting, hoping to get maximum capacity. It was working well.

-When the WSS error happened, it was partially reformatted into two smaller partitions: "Windows Reserved" (128mb) and "Unallocated" (931gb)

-So now the former file sys info (partition map? file tree? etc... I don't know what it should be called) may have had its sectors split by the new partitions, now residing partially in sectors on each of the new partitions

-Hence when I scan it now, the scanners do not see it as a raw disk, rather scanning one partition at a time, and so cannot find any file system info.

-Does this sound plausible? If so what all might be doable, and is there any way to scan right across all sectors 0-nn?

No, that did not happen because no partition was found.
Now, all of sudden it is not Microsoft Storage Places but you deleting partition information using the CLEAN function of diskpart.

****ORIG REPLY:
Okay thanks will do. -- What doesn't make sense, is how a partial reformat of nearly 1TB could be so complete and utter, in only a split second? It had about 915gb of files on it, so it doesn't seem possible for those to have been zeroed out in that short a time. So the data *MUST be on the disc, but not even R-Studio has been able to find any file information. Meanwhile the drive is in perfect health and looks ready to format at any time. It reads as close to a factory bare drive as imaginable, without any of its previous content having been overwritten.

Can any of you imagine any ways this might be possible??

There is no use in speculating especially as you obviously missed out important information like your CLEAN transaction and did not deliver any logs.

You should give Photorec a try because it should find the remains you consider healthy.