ran mkfs.exfat on NTFS hard drive - lost all files

[iaminpanic]

Hello, everyone.

I am currently in mild panic.

I needed to add another partition to a single-partition NTFS hard-drive. After terrible judgement, I ran

Code: Select all

mkfs.exfat

on it and, of course, 600gb worth of content disappeared.

There were, from what I can tell, no further writes in the hard-drive. I ran testdisk on it. After a very long scan (2h30m),

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors

With options to add partition and load backup.

Do I have any hope in this scenario? What exactly are the options?

Any assistance is very much appreciated. Thank you!

EDIT: I am looking through some other posts. In my case, this is an external HDD with no boot partition. From what I can recall, there was only a single partition with files, in NTFS format. Also, after reading the documentation for mkfs.exfat, I did not choose the full-format option, which brings me some hope.

Also, the log file from testdisk:

Code: Select all

Partition table type (auto): None
Disk /dev/sdd - 1000 GB / 931 GiB - Seagate Expansion
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

Results

I am also aware of best practice being to clone everything from the other drive with ddrescue. I don't currently have a 1TB harddrive at hand but am considering this possibility.

[recuperation]

Hello, everyone.

I am currently in mild panic.

I needed to add another partition to a single-partition NTFS hard-drive. After terrible judgement, I ran

Code: Select all

mkfs.exfat

on it and, of course, 600gb worth of content disappeared.

There were, from what I can tell, no further writes in the hard-drive. I ran testdisk on it. After a very long scan (2h30m),

I don't know what "a very long scan" means as there are different ways of getting to the lines below.

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors

With options to add partition and load backup.

Do I have any hope in this scenario? What exactly are the options?

Any assistance is very much appreciated. Thank you!

EDIT: I am looking through some other posts. In my case, this is an external HDD with no boot partition. From what I can recall, there was only a single partition with files, in NTFS format. Also, after reading the documentation for mkfs.exfat, I did not choose the full-format option, which brings me some hope.

Also, the log file from testdisk:

Code: Select all

Partition table type (auto): None
Disk /dev/sdd - 1000 GB / 931 GiB - Seagate Expansion
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

Results

Please post your complete log file.

I am also aware of best practice being to clone everything from the other drive with ddrescue. I don't currently have a 1TB harddrive at hand but am considering this possibility.

Please forget the idea of "repairing" your disk.

[iaminpanic]

Hello! Thank you very much for the swift response.

Code: Select all

Thu Jan 25 10:25:06 2024
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.146-1-MANJARO (#1 SMP PREEMPT Fri Jan 5 16:20:43 UTC 2024) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'LC_CTYPE=en_GB.UTF-8;LC_NUMERIC=pt_PT.UTF-8;LC_TIME=pt_PT.UTF-8;LC_COLLATE=en_GB.UTF-8;LC_MONETARY=pt_PT.UTF-8;LC_MESSAGES=en_GB.UTF-8;LC_PAPER=pt_PT.UTF-8;LC_NAME=pt_PT.UTF-8;LC_ADDRESS=pt_PT.UTF-8;LC_TELEPHONE=pt_PT.UTF-8;LC_MEASUREMENT=pt_PT.UTF-8;LC_IDENTIFICATION=pt_PT.UTF-8'.


Thu Jan 25 10:25:06 2024
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.146-1-MANJARO (#1 SMP PREEMPT Fri Jan 5 16:20:43 UTC 2024) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       500118192 sectors
/dev/sda: user_max   500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sda: dco        500118192 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop10 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SAMSUNG MZ7TY256HDHP-000L7, S/N:S307NB0H808054, FW:MAT05L6Q
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Expansion, FW:0710
Disk /dev/loop0 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop1 - 58 MB / 55 MiB - 113992 sectors (RO), sector size=512
Disk /dev/loop2 - 42 MB / 40 MiB - 83672 sectors (RO), sector size=512
Disk /dev/loop3 - 228 MB / 218 MiB - 447264 sectors (RO), sector size=512
Disk /dev/loop4 - 42 MB / 40 MiB - 82800 sectors (RO), sector size=512
Disk /dev/loop5 - 58 MB / 55 MiB - 113992 sectors (RO), sector size=512
Disk /dev/loop6 - 122 MB / 117 MiB - 239928 sectors (RO), sector size=512
Disk /dev/loop7 - 228 MB / 218 MiB - 447264 sectors (RO), sector size=512
Disk /dev/loop8 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop9 - 121 MB / 115 MiB - 236984 sectors (RO), sector size=512

Partition table type (auto): None
Disk /dev/sdd - 1000 GB / 931 GiB - Seagate Expansion
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

Results
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
SIGINT detected! TestDisk has been killed.

Here's the complete log. Drive in question is /dev/sdd.

EDIT: I can get a 1.5TB HDD in half an hour to run `ddrescue`, in case that is advisable, although you recommend that I forget the idea. Is your assessment that all data is permanently lost, or that it is impossible to revert back to NTFS without loss of data?

[recuperation]

Please answer all my questions!

[iaminpanic]

Hello again. Sorry for the delay.

I don't quite remember what I did, so I'm trying to retrace the steps:

ran `testdisk`; selected the harddrive; at the partition type table menu I selected Intel, and the `hint` says `Hint: None partition table type has been detected.` And then I selected `Analyse`. After that I went with Quick search.

EDIT:

Please forget the idea of "repairing" your disk.

With this, you mean it is not possible to revert to the previous NTFS state, preserving file integrity and structure, yes?

EDIT2: and considering it is highly recommended to attempt any file recovery to a separate drive, I'll necessarily need another hard drive, correct?

Thank you for your help so far. And sorry for any unclear communication on my end, but I am very, very distressed about this.

[recuperation]

The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

EDIT2: and considering it is highly recommended to attempt any file recovery to a separate drive, I'll necessarily need another hard drive, correct?

Yes. This is a very basic fact.
If you are dealing with a broken disk, you need lots of storage, probably three times as big as a source: One time for a clone of your source, another time for a seond clone where you work safely on and a third time to have recovery space.

[iaminpanic]

The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

I can confirm I did not use any other parameter.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

So I now do a deep search to try and recover the NTFS file system? And if so, how do I select this option?

I'm not sure this is any helpful information. As I run the testdisk utility now, If I select 'None' I am shown the exFat partition. There are some files there because the hard drive got plugged into MacOS which already left some trace files.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

EDIT: I realise you mention ext3.mkfs; I used mkfs.exfat, which, from my limited understanding, doesn't necessarily overwrite the whole disk.

EDIT2: I am leaving the house to buy some spare HDDs. I have already downloaded photorec too. If you have any more ideas, I'd appreciate all help possible. Otherwise, I think I'll clone the source to a backup HDD, scan the backup HDD and then eventual found data in a third HDD. Sigh.

[recuperation]

The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

I can confirm I did not use any other parameter.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

So I now do a deep search to try and recover the NTFS file system? And if so, how do I select this option?

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I'm not sure this is any helpful information.

There is no more helpful information. For a detailed explanation please consult with a professional recovery lab.

As I run the testdisk utility now, If I select 'None' I am shown the exFat partition. There are some files there because the hard drive got plugged into MacOS which already left some trace files.

This suggests that previous existing data was destroyed in addition to your formating operation.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

EDIT: I realise you mention ext3.mkfs; I used mkfs.exfat, which, from my limited understanding, doesn't necessarily overwrite the whole disk.

Sorry, I wrote ext3.mkfs instead of mkfs.exfat. A quick format operation creating an exfat file system will not overwrite the whole disk.

[iaminpanic]

Alright. Thank you very much for the guidance so far. I'm currently copying the whole content of the formatted hard drive to an external hdd, and I'll start working from there to reduce possible further disruption. Will keep you posted. Thank you very much, again, for all the help (and the tools!).

EDIT: this will take a while before I can do any further steps. Just to be clear: if I don't get any option for deeper search, it would mean nothing can be done and then I should advance to PhotoRec, correct?

[recuperation]

I have already downloaded photorec too.

PhotoRec is part of the Testdisk package. If you downloaded PhotoRec somewhere else separated from the TestDisk package, you should worry and post the download location.

Edited: 25.1.2024 23:01