Is there any way to recover data off a formatted hard drive?
Long story short, I b0rked my computer. I had the brilliant idea of mirroring my OS using Windows software mirroring. Intellectually, I know this is a really bad idea. Somehow I justified it to myself though. Problem is one of the hard drives has bad blocks and got jacked. It replicated jacked information back to the other hard drive and when I rebooted, the computer was dead. Tried to repair the OS. No dice.
No problem. I've got a mirror here. I'll format one of the two drives and re-install Windows on it. I'll copy all my data back from the other drive. Bit of a pain, but doable. Not so much.
I boot off my CD, walk through the wizard. Pick one of my mirrored drives. Click format. It formats BOTH of them. Not one. Both. Somehow they were still mirrored even though I'm not doing any sort of hardware array. I totally did not expect that. I had to boot off a USB drive, fdisk one of the drives and re-install Windows. So now I'm back up. I've got Windows on one drive. I've been trying to recover files off the other drive. Every tool I run comes up empty. I've tried:
Recover-files
UnDelete Plus
PC Inspector File Recovery
Restoration
None of them see any recoverable files. I've got my documents, music, pictures, desktop stuff, etc.... all backed up locally on another drive and on Carbonite. My concern is that I had several games on here and I'd hate to lose all of my progress and have to start from scratch. I had hoped to be able to re-install the games, copy any saves from the other HDD and be back in business. None of that was backed up. Any ideas on what I can toss at this drive to see if I can find anything?
If it didn't overwrite the data (and just zeroed out the master file table [$MFT - hidden system file, which shouldn't matter right now...]) you should be able to do it kinda like this.actually, I don't think this stuff really matters if you use scalpel... well, if the drive was overwritten....
dd if=/borked/drive of=~/image.dd
then use a program called scalpel. It's command line and has a configuration tool that lets you pick what files you want to restore (by tool, I mean text file )
That should do it.
These tools are all free by the way.
__________________
Quote:
Originally Posted by Bob Maxey
And here you thought you would escape being wrong today.
^^ .
what he said . It's a forensic recovery tool /
It's available with DEFT Linux .
You can also try foremost or the GUI 4most hunchbacked(In DEFT ) .
I use WinHex on windows, though the demo wont be useful enough .
I guess TuneUp Utilities is one of the best software of that, i am using this software form i guess more then 3 years now & its really great. It recovers upto 90% of you lost data !
Tried Testdisk and it jacked me up. I've got two 1 TB drives. I picked the wrong one at the command prompt as it doesn't clearly differentiate them. Jacked the partition of the drive I was booting off of and had to re-install again. (Doh!) I'm trying out Recuva now which runs under Windows. It is taking forever and a day to scan the drive though. I let it run all night and it was at 25% this morning.
I'm going to look for that Handy Recovery 1.0. If it'll run under Windows it's a bonus for me as I don't have to have my computer offline to do recovery. This HDD with the data on it has bad blocks so I don't intend on using it again. I just want the data off it. The drive in question is just mounted as a slave and I haven't assigned a drive letter to it to avoid any more writes. I'll try scalpel if Handy Recovery won't work for some reason.
I'm using this as an excuse to buy an SSD which comes in today. I may wait to do more file recovery stuff until I get that up and running since I don't need the drive at the moment.
I'm not entirely aware of the situation, if the $MFT is still there or what, but you could try out SIFT workstation.... that's another forensics tool, a VM put out by SANS. Filled to the top with some cool things. Though, I do think scalpel would do this (not pretty, but it works).
Also, you might be able to try something like FTK Imager, but out by Access Data... I got it free in my class, but I'm not sure if everyone can get a free version or if it was something that the school put out for us... but again, if that works, it'll depend on some things. I mean, the files still need to be there, if they are completely gone and overwritten, that's that really. you might be able to recover some in file slack, but that's risky business (corrupt files and parts overwritten...)
--
About scalpel, it's not really too tough. I haven't used it in a while, but I used version 2. It uses a configuration file (scalpel.conf) which just contains a list of file headers and possibly footers and what filetype the correspond to. Then it just dumps them out to an output directory of your choosing, and I wanna say it dumps them according to filetype (ie: /outputdir/jpg and /outputdir/doc). Again, it's been a while.
And I want to say it's a pretty easy command, something like
Handy Recovery has pissed me off. V 5.0 sees all my files, but can only recover one at a time. V 1.0 is free, but doesn't see any files at all. Ugh.
It is looking like I can get the files I need off Carbonite and won't need the other drive. We'll see though. I won't know for certain until I get everything downloaded from Carbonite, copied to the right places and fire up the games to see if my progress is still there.
Device(s): HTC EVO 4g
I am a Changer.
May God Bless You.
Thanks: 1,567
Thanked 2,183 Times in 1,187 Posts
Quote:
Originally Posted by A.Nonymous
Handy Recovery has pissed me off. V 5.0 sees all my files, but can only recover one at a time. V 1.0 is free, but doesn't see any files at all. Ugh.
It is looking like I can get the files I need off Carbonite and won't need the other drive. We'll see though. I won't know for certain until I get everything downloaded from Carbonite, copied to the right places and fire up the games to see if my progress is still there.
I always use Testdisk and PhotoRec. They have done me very well over the years. Just keep in mind that the more you write to the disk the less chance of a full recovery. For best results I always used it from a bootable disk and only have the disk in the drive that I need that keeps me from screwing up and choosing the wrong drive (Before this practice I did it Twice) There are times its not possible for me to do. (External Harddrive) so then I just pay carefull attention to what I'm doing. IF you have an external you may want to have it plugged up so that you can have it place the restored files on that.
Is there any way to recover data off a formatted hard drive?
)
