cgsecurity.org

Hello,

I recently made the dumb mistake of formatting the wrong drive, accidentally running a quick format through windows explorer on my 2TB HDD which was used just for storing files (not booting Windows).

I can recover most of the files through data recovery software, but I do not have another 2TB right now to backup the files to so am currently unable to proceed with that solution.

I am currently running a "deep scan" to try and somehow detect this formatted partition, but I am not faithful that it will be found as I only see the new partition so far.

What am I wondering is, assuming I do not find the old partition with the "deep scan", is there any point in trying to rebuild BS or trying to restore the MFT/Mirrored MFT, or is a quick format of NTFS basically impossible to "cleanly" recover and getting the secondary 2TB to backup my files to will be my only/best option? Or am I going about this totally wrong and there is some better action to take following my accidental quick format?

Any answer is greatly appreciated, thank you very much for your time!

PhotoRec can be use to recover files after a Quick Format but it will not recover the original file structure.

Thank you for the reply and approval. I have been able to find most of my files with folder structure intact in various data recovery programs, but all of the programs seem to return most of the files as blank (all hex values are 00). From what I understand Photorec will use a signature analysis type of search, which these other programs have done as well but unfortunately the files I want do not show up under that search as they're already found with any quick search of the drive which, again, shows their folder structure, size, names, date modified, and the files themselves found through the signature scan are almost all composed of 00 too. Perhaps PhotoRec would produce different results though, although it seems unlikely to me.

Strangely when using testdisk I have not been able to see the old partition and only the new, virtually empty partition created from the quick format (just has the MFT files/etc. that were created by default), even after "deep scan" of the partitions. I have not been able to get testdisk to find my other partition, though it shows up easily from a deep scan on other programs. Both the old partition and new are NTFS. The only function within testdisk I haven't tried fully is the rebuild MFT, which I'm not entirely sure of the usage of.

At this point I'm not sure that PhotoRec will be able to recover much if anything that I haven't been able to retrieve with other raw signature analysis scans, and outside of the MFT rebuild function it doesn't seem there's anything left I could try with testdisk outside of advanced things like changing the geometry which I'll probably cause more trouble than good trying.