cgsecurity.org

Hi,

I accidently (quick) formatted my WD Elements 3.0 TB external drive having one single partition. Although most of the files are just back ups of the internal harddisk, there are also quite a few orignal file such as video's, pictures, etc. on the WD disk. Using file recovery programs to retrieve the files one by one is a terrable job as I will have to distinguish between backups and originals checking about 170.000 files.
I tried to use Testdisk 7.0 and earlier posts to see if any files are readable and some 33 files in 10 folders all together 172 Mb are found in the root and the system volume information directory. So the master file table might still be there. After the accidental format the disk has been switched off immedeatly so no furher writing took place. Can annyone tell me how I should use the files still present to retrieve the directory/file structure. Thanking you in advance for any help.

Kind regards,
Dave

Have you try testdisk, advanced, list and testdisk, advanced, undelete ?
It's possible to recover more file using PhotoRec but they will have their original names and the directory structure will not be found.

If you have been able to recover all the files from this disk without the file structure, there are some programs to remove file duplicate like fslint (linux). See alternative http://alternativeto.net/software/fslin ... rm=windows

Thank you for your quick response. I tried both ways with the new Testdisk 7.1 version. It does (only) find the file:

System Volume Information/ EfaSidat_"long number".

and a similar named file in the recycle bin, which seems to be damaged and cannot be coppied.

I copied the first file to a directory on the C disk, but don't see how I can use this to recover the data or file structure on the disk.
When I use Recuva I can find some 170.000 files of good quality, but then te problem arises to select the richt files.
Is it possible to try to restore the MFT be using the <boot> menu of testdisk? Or is the MFT also destroyed during the quick format operation.

Greetings,
Dave