cgsecurity.org

Hi all,

As topic, I have a 1.5Tb USB 3.0 external HDD. It contains about 1Tb of backup data in the form of documents, media files etc.

What happened was that I went through the Windows 10 media creation steps using the tool supplied by Microsoft. The steps seemed to whiz by fast and I expected a big scary message to confirm the USB device that was going to be used. Anyway, the long and short of it is that my USB backup disk was selected by mistake!

What I have done is to download TestDisk and I am running the "analyse" step

https://imgur.com/ITf5V5O

It is a slow process, I expect it to take a few days to reach 100% because it is a 1.5Tb disk.

Once I have identified the missing partition (NTFS) then I am hoping to just list the files and then copy them somewhere. There was just a single partition in which there was 15 folders.

Is this the right approach for this kind of mistake?

Thank you

Yes.

Thanks, I was unsure if I need TestDisk to analyse the entire disk or try to "undelete" the files using this guide https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

(The disk is actually 2Tb not 1.5Tb so getting the right advice would save me a lot of time)

electrosphere wrote: 15 Mar 2021, 20:34 Thanks, I was unsure if I need TestDisk to analyse the entire disk or try to "undelete" the files using this guide https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk

(The disk is actually 2Tb not 1.5Tb so getting the right advice would save me a lot of time)

If you want to save time please consult a professional recovery service. Doing a recovery is always time consuming. At least there is no need to monitor the cylinder count growing.

Deleting files is an entirely different process than overwriting the beginning of file system. What has been overwritten, is not recoverable. What has been deleted may be recoverable depending on the use of the file system following the incident in case of NTFS file systems. p.e..