Accidental reformat 1TB WD hard drive

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kanikatie
Posts: 3
Joined: 14 Aug 2015, 19:34

Accidental reformat 1TB WD hard drive

#1 Post by kanikatie »

Whilst restoring a friends laptop to factory settings, my 1TB WD hard drive now appears as 'recovery drive 31.9 GB, FAT 32.
It would appear to have reformatted and partitioned my external hard drive, and no longer shows the music and photo files which were previously stored. I have tried recuva without success.
Any suggestions would be most appreciated. Thanks
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidental reformat 1TB WD hard drive

#2 Post by Fiona »

Overridden data are not recoverable.
It might be possible, if you have only a FAT32 unformatted partition that only a partition was created and you didn't override any existing data within your previous partition?
To figure it out, you can run TestDisk / Analyse / Quick and Deeper Search.
Especially Deeper Search looks for a backup of the boot sector.
If your previous file system was NTFS, the backup of the boot secor ist the last sector of your previous partition.
It means, that you should run a complete Deeper Search.
If your partition would be found by the backup of the boot sector, you can select your partition and press p on your keyboard, to have a try to list your files.
Other wise you'll need datarecovery software.
Info will follow.
TestDisk creates a testdisk.log.
You'll find it within your testdisk folder and you can open it using wordpad etc.. and copy and paste the content of your log file into your next post.

Fiona
kanikatie
Posts: 3
Joined: 14 Aug 2015, 19:34

Re: Accidental reformat 1TB WD hard drive

#3 Post by kanikatie »

Many thanks, I will try this and report back.
I have not written anything else to the drive since.
kanikatie
Posts: 3
Joined: 14 Aug 2015, 19:34

Re: Accidental reformat 1TB WD hard drive

#4 Post by kanikatie »

Thanks Fiona
I have carried out the above, I hope correctly.
This is a copy of the log file. I would really appreciate further advice
Many thanks


Sun Aug 16 20:38:55 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3998810112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3998810112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=308553941504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=11515461632
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3994681344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=34359738368
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdb - 3998 MB / 3813 MiB - CHS 486 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Drive C: - 308 GB / 287 GiB - CHS 37512 255 63, sector size=512
Drive D: - 11 GB / 10 GiB - CHS 1400 255 63, sector size=512
Drive F: - 3994 MB / 3809 MiB - CHS 485 255 63, sector size=512
Drive G: - 34 GB / 32 GiB - CHS 4177 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 67108864, partition 67108864
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
Current partition structure:
1 * FAT32 LBA 0 32 33 4177 117 36 67108864 [RECOVERY]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
FAT32 at 0/32/33
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190

FAT32 at 0/32/33
FAT32 LBA 0 32 33 4177 117 36 67108864 [RECOVERY]
FAT32, blocksize=32768, 34 GB / 32 GiB
file_pread(6,2,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(6,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(6,14,buffer,1953458177(121597/37/42)) lseek err Invalid argument
file_pread(6,1,buffer,1953458177(121597/37/42)) lseek err Invalid argument
file_pread(6,8,buffer,1953458183(121597/37/48)) lseek err Invalid argument
file_pread(6,3,buffer,1953458191(121597/37/56)) lseek err Invalid argument
file_pread(6,3,buffer,1953458238(121597/38/40)) lseek err Invalid argument
file_pread(6,8,buffer,1953458254(121597/38/56)) lseek err Invalid argument
file_pread(6,11,buffer,1953458301(121597/39/40)) lseek err Invalid argument
file_pread(6,2,buffer,1953460223(121597/70/9)) lseek err Invalid argument
file_pread(6,14,buffer,1953458178(121597/37/43)) lseek err Invalid argument
file_pread(6,1,buffer,1953458194(121597/37/59)) lseek err Invalid argument
file_pread(6,1,buffer,1953458241(121597/38/43)) lseek err Invalid argument
file_pread(6,1,buffer,1953458262(121597/39/1)) lseek err Invalid argument
file_pread(6,1,buffer,1953458312(121597/39/51)) lseek err Invalid argument
file_pread(6,1,buffer,1953460225(121597/70/11)) lseek err Invalid argument

Results
* FAT32 LBA 0 32 33 4177 117 36 67108864 [RECOVERY]
FAT32, blocksize=32768, 34 GB / 32 GiB

interface_write()
1 * FAT32 LBA 0 32 33 4177 117 36 67108864 [RECOVERY]
Locked