# Is there any way to recover data off a formatted hard drive?

Discussion in 'Computers' started by A.Nonymous, Jan 12, 2012.

1. ### A.Nonymous Android Expert Thread Starter Rank: None Points: 213 Posts: 7,059 Joined: Jun 7, 2010

Jun 7, 2010
7,059
967
213
Long story short, I b0rked my computer. I had the brilliant idea of mirroring my OS using Windows software mirroring. Intellectually, I know this is a really bad idea. Somehow I justified it to myself though. Problem is one of the hard drives has bad blocks and got jacked. It replicated jacked information back to the other hard drive and when I rebooted, the computer was dead. Tried to repair the OS. No dice.

No problem. I've got a mirror here. I'll format one of the two drives and re-install Windows on it. I'll copy all my data back from the other drive. Bit of a pain, but doable. Not so much.

I boot off my CD, walk through the wizard. Pick one of my mirrored drives. Click format. It formats BOTH of them. Not one. Both. Somehow they were still mirrored even though I'm not doing any sort of hardware array. I totally did not expect that. I had to boot off a USB drive, fdisk one of the drives and re-install Windows. So now I'm back up. I've got Windows on one drive. I've been trying to recover files off the other drive. Every tool I run comes up empty. I've tried:

Recover-files
UnDelete Plus
PC Inspector File Recovery
Restoration

None of them see any recoverable files. I've got my documents, music, pictures, desktop stuff, etc.... all backed up locally on another drive and on Carbonite. My concern is that I had several games on here and I'd hate to lose all of my progress and have to start from scratch. I had hoped to be able to re-install the games, copy any saves from the other HDD and be back in business. None of that was backed up. Any ideas on what I can toss at this drive to see if I can find anything?

#1
2. ### mrspeedmaster Android Expert Rank: None Points: 113 Posts: 902 Joined: May 16, 2010

May 16, 2010
902
256
113
Yes.

I've recovered many this way.
There are a few rescue Linux Distros that have them built in like parted magic.

#2
linuxrich and argedion like this.
3. ### SUroot Android Expert Rank: None Points: 1,123 Posts: 23,925 Joined: May 25, 2010

May 25, 2010
23,925
5,307
1,123
Riddlesden, West Yorkshire, UK
I tend to use the free version of handy recovery to get stuff back. Ntfs getback used to be good for Ntfs (but that costs).

I'm sure there are good tools in bartpe, ubcd4win, hiren's etc but never used them myself.

#3
4. ### A.Nonymous Android Expert Thread Starter Rank: None Points: 213 Posts: 7,059 Joined: Jun 7, 2010

Jun 7, 2010
7,059
967
213
Handy Recovery looks like it'll work, but sadly only lets me restore one file a day in the free version.

#4

Feb 20, 2011
4,873
1,766
633
/home/
If it didn't overwrite the data (and just zeroed out the master file table [$MFT - hidden system file, which shouldn't matter right now...]) you should be able to do it kinda like this. actually, I don't think this stuff really matters if you use scalpel... well, if the drive was overwritten.... dd if=/borked/drive of=~/image.dd then use a program called scalpel. It's command line and has a configuration tool that lets you pick what files you want to restore (by tool, I mean text file ) That should do it. These tools are all free by the way. #5 karandpr likes this. 6. ### karandpr Android Expert Rank: #49 Points: 443 Posts: 2,952 Joined: Feb 16, 2011 Feb 16, 2011 2,952 1,816 443 Male ^^ . what he said . It's a forensic recovery tool / It's available with DEFT Linux . You can also try foremost or the GUI 4most hunchbacked(In DEFT ) . I use WinHex on windows, though the demo wont be useful enough . #6 7. ### SUroot Android Expert Rank: None Points: 1,123 Posts: 23,925 Joined: May 25, 2010 May 25, 2010 23,925 5,307 1,123 UK Technical Lead; Desktop Support Riddlesden, West Yorkshire, UK Follow the ultimate root tools thread in my signature. It's got version 1.0 which I stripped out of ubcd4win which has no licence restrictions. The ftp is password protected so start from the end of the thread and look for a post with password from rastaman #7 8. ### sofiablak Member Rank: None Points: 36 Posts: 73 Joined: Sep 19, 2011 Sep 19, 2011 73 4 36 Market Research I guess TuneUp Utilities is one of the best software of that, i am using this software form i guess more then 3 years now & its really great. It recovers upto 90% of you lost data ! #8 9. ### SUroot Android Expert Rank: None Points: 1,123 Posts: 23,925 Joined: May 25, 2010 May 25, 2010 23,925 5,307 1,123 UK Technical Lead; Desktop Support Riddlesden, West Yorkshire, UK Not free though #9 10. ### A.Nonymous Android Expert Thread Starter Rank: None Points: 213 Posts: 7,059 Joined: Jun 7, 2010 Jun 7, 2010 7,059 967 213 Tried Testdisk and it jacked me up. I've got two 1 TB drives. I picked the wrong one at the command prompt as it doesn't clearly differentiate them. Jacked the partition of the drive I was booting off of and had to re-install again. (Doh!) I'm trying out Recuva now which runs under Windows. It is taking forever and a day to scan the drive though. I let it run all night and it was at 25% this morning. I'm going to look for that Handy Recovery 1.0. If it'll run under Windows it's a bonus for me as I don't have to have my computer offline to do recovery. This HDD with the data on it has bad blocks so I don't intend on using it again. I just want the data off it. The drive in question is just mounted as a slave and I haven't assigned a drive letter to it to avoid any more writes. I'll try scalpel if Handy Recovery won't work for some reason. I'm using this as an excuse to buy an SSD which comes in today. I may wait to do more file recovery stuff until I get that up and running since I don't need the drive at the moment. #10 11. ### 9to5cynic Android Expert Rank: None Points: 633 Posts: 4,873 Joined: Feb 20, 2011 Feb 20, 2011 4,873 1,766 633 /home/ I'm not entirely aware of the situation, if the$MFT is still there or what, but you could try out SIFT workstation.... that's another forensics tool, a VM put out by SANS. Filled to the top with some cool things. Though, I do think scalpel would do this (not pretty, but it works).

Also, you might be able to try something like FTK Imager, but out by Access Data... I got it free in my class, but I'm not sure if everyone can get a free version or if it was something that the school put out for us... but again, if that works, it'll depend on some things. I mean, the files still need to be there, if they are completely gone and overwritten, that's that really. you might be able to recover some in file slack, but that's risky business (corrupt files and parts overwritten...)

--
About scalpel, it's not really too tough. I haven't used it in a while, but I used version 2. It uses a configuration file (scalpel.conf) which just contains a list of file headers and possibly footers and what filetype the correspond to. Then it just dumps them out to an output directory of your choosing, and I wanna say it dumps them according to filetype (ie: /outputdir/jpg and /outputdir/doc). Again, it's been a while.

And I want to say it's a pretty easy command, something like
Code (Text):
1. scalpel.exe -o "C:\OutputDir" C:\Path\to\Imagefile
but again, it's been a while for me. I think that's how it goes. There are - of course - a lot of other options that can be set as well.

#11
12. ### A.Nonymous Android Expert Thread Starter Rank: None Points: 213 Posts: 7,059 Joined: Jun 7, 2010

Jun 7, 2010
7,059
967
213
Handy Recovery has pissed me off. V 5.0 sees all my files, but can only recover one at a time. V 1.0 is free, but doesn't see any files at all. Ugh.

It is looking like I can get the files I need off Carbonite and won't need the other drive. We'll see though. I won't know for certain until I get everything downloaded from Carbonite, copied to the right places and fire up the games to see if my progress is still there.

#12
13. ### SUroot Android Expert Rank: None Points: 1,123 Posts: 23,925 Joined: May 25, 2010

May 25, 2010
23,925
5,307
1,123
Riddlesden, West Yorkshire, UK
Bah!

#13
14. ### argedion The TechnoFrog Rank: None Points: 953 Posts: 6,360 Joined: Jun 20, 2011

Jun 20, 2011
6,360
6,293
953
The Infernal Swamp
I always use Testdisk and PhotoRec. They have done me very well over the years. Just keep in mind that the more you write to the disk the less chance of a full recovery. For best results I always used it from a bootable disk and only have the disk in the drive that I need that keeps me from screwing up and choosing the wrong drive (Before this practice I did it Twice) There are times its not possible for me to do. (External Harddrive) so then I just pay carefull attention to what I'm doing. IF you have an external you may want to have it plugged up so that you can have it place the restored files on that.

#14

#15
16. ### linuxrich Well-Known Member Rank: None Points: 63 Posts: 130 Joined: Jan 22, 2012

Photorec has had a couple of mentions. +1 for that.

#16
17. ### mikedt 你好 Rank:  #4 Points: 3,238 Posts: 25,324 Joined: Sep 22, 2010

Sep 22, 2010
25,324
14,309
3,238
Teachaaa
Jinan, China
Another vote for Photorec here. I've used it to recover pics from a friend's SD-card that she inadvertently formatted.

#17