flashed windows media creation tool to external hard drive and wiped it

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

flashed windows media creation tool to external hard drive and wiped it

#1 Post by O5CARMAN »

Hi

I know, dumb mistake. Have been trying to figure this out on my own but am stuck. When i run testdisk, all hard drived detected are showing identical information. The affected drive is a 1 TB and the file system was changed to FAT32 when i made the tool. Will Testdisk still work? I tried to run it but it is incredibly slow and i am wondering if the file system change is causing that. Really at my wits end as some important data was on the drive. Thought i had backed the drive up but cannot find it. Any help/suggestions would be appreciated.

Thank you!

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: flashed windows media creation tool to external hard drive and wiped it

#2 Post by recuperation »

O5CARMAN wrote: 28 Jun 2022, 14:56 Hi

I know, dumb mistake. Have been trying to figure this out on my own but am stuck. When i run testdisk, all hard drived detected are showing identical information. The affected drive is a 1 TB and the file system was changed to FAT32 when i made the tool. Will Testdisk still work? I tried to run it but it is incredibly slow and i am wondering if the file system change is causing that. Really at my wits end as some important data was on the drive. Thought i had backed the drive up but cannot find it. Any help/suggestions would be appreciated.

Thank you!
No documentation, no answer.
Plain and simple!

Laziness in documentation is spreading like Covid - I better not touch my keyboard.

viewtopic.php?p=34916#p34916

O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

Re: flashed windows media creation tool to external hard drive and wiped it

#3 Post by O5CARMAN »

Gotcha. Thank you for the reply and the info. First time using one of these forums so not sure what all is necessary. Will get the required info together and try again.

O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

Re: flashed windows media creation tool to external hard drive and wiped it

#4 Post by O5CARMAN »

Hello

I have been running Testdisk for about 12 hours now. I understand it is a long process but I do not know what the messages mean. I have attached a screen shot of the current readout. Please let me know what other information i can provide to help try to recover my data.


EDIT: Apologies if i am not posting correctly or providing enough information. This is my first time using online forums and am trying to figure the rules and standards out. Thank you for your patience as I appreciate the knowledge and experience of other people. Is this running correctly or are more actions required to give the best chance at data recovery?

Thanks you.
22percent.PNG
22percent.PNG (45.31 KiB) Viewed 2620 times

O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

Re: flashed windows media creation tool to external hard drive and wiped it

#5 Post by O5CARMAN »

Hello

I am not familiar with Testdisk, am stressing a little and would really appreciate any guidance. I resized the progress window and now my view of the current progress is limited. Could someone please advise if this is still OK or if I need to start over. I can scroll up to the original status information but it snaps back to the view shown here. And if I am still doing something wrong with respect to posting, could someone please advise me on how to improve that.

Thank you.
afterresize.PNG
afterresize.PNG (12.71 KiB) Viewed 2593 times

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: flashed windows media creation tool to external hard drive and wiped it

#6 Post by recuperation »

1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

Re: flashed windows media creation tool to external hard drive and wiped it

#7 Post by O5CARMAN »

recuperation, thank you so much for taking the time to list the important information when going to forums for help. I really appreciate it. I will provide all I can....

1. OS
Microsoft Windows 10 Home
Ver. 10.0.19044 Build 19044

2.
Testdisk 7.2

3.
The drive is used as a backup, Connected to USB. (made wrong selection when making Windows Media Creation tool)
Since the incident, nothing new has been written to it. Automatic backups, etc, were stopped.

4.
Have not learned Linux

5.
Drive is data only

6.
HDD

7.
1T

8.
Toshiba

9.
593400-D USB 2.0 external HDD

10.
came in a housing

11.
currently running testdisk so not sure if i can do this right now.

12.
Not sure. It would be whatever the standard is as I did not make any changes. There is no OS on this drive, just data, saved through windows, with the folders made through file explorer
EDIT: Testdisk detected GPT

13.
I did not partition this drive.

14.
It is visible and shows the files for the Windows Media Creation Tool. As well, capacity reads as 31.9 GB, 4.3 GB used and 27.6 GB free. File system is now FAT32

15.
All that is showing is the Media Creation Tool files.

14.
I needed to make a media creation tool to try to repair my laptop. I usually use cds but my current computer does not have an optical drive. I found a USB stick but when i went to write the files i was careless and selected my USB external HDD by mistake. I did not realize my mistake until i removed the stick and tried to use it. Then i started sweating. Checked the HDD and the Media Creation Tool files where there. Looked online. EasyUS was suggested but it didn't seem to show any recoverable files. I was in a real panic so that could be a mistake I made (wrong drive selected...as it turns out, all 3 HDDs on this system are 1T and two are Toshiba so it is possible.) I did some more searching and found out about Testdisk and decided to give it a go. It has been running for about 24 hrs but i am not used to seeing results in DOS so not sure if it is working properly or if i need to do some preparation on the drive and start again. I can provide logs from Testdisk if that can be done while the program is running,

15.
No signs of failure

Thank you for your time and helping me understand what information is needed for someone to help out in these situations. I really appreciate it!
I have included a screenshot of the current status.
If you have time could you point me in the direction of some resources on how to get a proper backup system/routine going? What way do you feel is best?

EDIT: As well, is there a resource that you (recuperation) would recommend to start to get into Linux?

Thanks again!
status06_30_22.PNG
status06_30_22.PNG (16.07 KiB) Viewed 2475 times
disk info
diskinfo.PNG
diskinfo.PNG (72.11 KiB) Viewed 2467 times

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: flashed windows media creation tool to external hard drive and wiped it

#8 Post by recuperation »

To examine your 1 TB drive completely you need roughly 8 hours minimum over a USB 2.0 connection assuming 35 MB/sec.
Keep in mind there are 2 runs, the quick search and the deep search.

When in doubt over the health status of your disk consider publishing a smartmontools report:

viewtopic.php?f=5&t=10910

The best way to learn Linux is to use it and I use it only for recovery purposes.
You find hundreds of videos and written tutorials. Use what you like.

You can start with a live linux on a USB stick.
Install Linux on an old computer with no important data.
Shells like LXDE and XFCE are less ressource-hungry than KDE p.e.
Start playing with the command line.
Use the autocomplete feature of the command line when entering commands.
Learn how to install software on linux and installing from the command line.

Important special disk commands and software:

smartmontools (command smartctl)
lsblk
hdparm
testdisk (including Photorec)
dd
ddrescue
f3 (fight flash fraud)

O5CARMAN
Posts: 11
Joined: 28 Jun 2022, 14:41

Re: flashed windows media creation tool to external hard drive and wiped it

#9 Post by O5CARMAN »

Hello recuperation

EDIT: Stand by. I continued and it has listed a bunch of deleted files. I am trying to figure what to do next. Will read the step by step guide....just being over cautious about hitting enter... :roll:

EDIT 2: No recovered data yet. So so i do a deeper search or do i have to correct something (disk size mismatch) before moving forward?

EDIT 3: went ahead and tried to change the P to D and it wouldn't allow...now back to square 1. Do I run it again and continue to deeper or do i have to do something with the FAT32 file structure? Thanks!!

EDIT 4: I have been looking for solutions. Do i have to "unmount" the partitions before using Testdisk? And where would i find the info on that?

Thank you for your time and the information on linux. I am going to look into that for sure. A friend of mine has been using it since the 90's and swears by it. ( i am aware that not all mainstream software is supported but really hating Microsoft)

I did a run through (about 36 hours) with Testdisk. I have included the image of the result. Could this be because the Windows Media Creation tool formatted to FAT32 and the initial file structure was NTFS? I know there are instructions
to check HD jumper settings, BIOS detection... but not sure what to do next. I have also included tho only log file i could find. Not sure what to do nest and do not want to risk doing something wrong. Some of the data is irreplaceable so I am being extra cautious.

Thank you for any guidance you can give. I have read that some people (who probably know more than I do on this topic) were successful at recovering a large portion of the data lost when they did the same thing as I did with the media creation tool. I am still hopeful.
testdisk.log
(1.9 KiB) Downloaded 139 times
firstrunfinished.PNG
firstrunfinished.PNG (41.04 KiB) Viewed 2443 times

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: flashed windows media creation tool to external hard drive and wiped it

#10 Post by recuperation »

36h instead of 8h translates roughly into a transfer speed of 8 MByte/sec which appears to be to slow.
Your disk might be dammaged. For a quick check publish your smartmontools logfile:
viewtopic.php?f=5&t=10910

The location of the partition found starts roughly at the end of your disk and points to a sector location behind the last physically existing sector.
The data found is wrong.

Testdisk won't succeed when trying to run the p-key ("list files") on the next or one of the next screens.
The next step after running smartmontools and maybe ddrescue would be to run Photorec or any other recovery software.

Locked