Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've searched through several questions but didn't quite find anyone treating mine.

So, I have a 1TB external hard drive I use for backup purposes with only 1 NTFS partition. Today using DiskPart I formated that partition by mistake (who would have thought the disc count started in 0 and not in 1). The complete command I used was:

format recommended override quick label=Windows

So I performed a quick format, and from which I've read after a quick format it's possible to recover the data stored there. Anyway, as soon as I realized it wasn't the partition I wanted to format the one I specified I removed the access to my external drive to minimize possible damages.

Now, the MFT is the metadata part where the file name, creation date, access permissions and contents are registered; and it's mirrored too (so there's a copy of it somewhere in the disk). What I don't know is if a quick format erases that MFT mirror too, I hope not.

I'm running a program to recover files on it but I'll have to save the files to another location (once it's finished scanning, ~12 hours from now) and I don't quite have over 900GB of free storage where to put the data.

I would like to know if there's a program or procedure by which I could restore the old MFT in-place and have all the data that used to be in there accessible once again.

Any help or light you could shed on how to proceed or what programs to use is really appreciated.

share|improve this question
    
A forum like this one may have more answers...forensicfocus.com/… –  Moab Dec 12 '10 at 17:43
    
@Ariadne - "who would have thought the disc count started in 0 and not in 1?". List of devices, strings of characters, etc. often begin the index at zero and not one. Most of the time the end user, like yourself, doesn't need to know or even care. Tough lesson to learn. I wish you the best of luck recovering your data. –  Mike Chess Dec 12 '10 at 21:04
    
@Moab: Thank you very much for posting that link, in that thread a post by jaclaz clarified that it's not possible to accomplish what I wanted to know; mainly because the mirror MFT gets overridden too and it's only a mirror to the first 4 records. –  Ariadne Sousa Dec 13 '10 at 15:57
    
@Mike Chess: Yes, tough lesson but there's nothing else to do now but to try to recover that data. I've already ordered a new hard drive where to restore the recovered files. The scan I ran yesterday was able to locate most of the data that was inside of it. –  Ariadne Sousa Dec 13 '10 at 16:02
    
@Moab Since you were the one that found the direct answer to the question if you write another answer or modify your current one telling it's not possible and pointing to that thread I'll mark it as accepted. –  Ariadne Sousa Dec 13 '10 at 16:04
show 1 more comment

3 Answers 3

up vote 1 down vote accepted

chkdsk can possibly restore the MFT from the mirror, back up your data before doing anything, buy a usb drive if needed, or risk losing it all.

No way for anyone to know how far the quick format went before detachment.

Never used this software but looks interesting

http://dmitrybrant.com/ntfswalker

According to Jaclaz in this forum it is not possible

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6425

For the record, unlike what a lot of people apparently thinks, the $MFTMirr is pretty much useless, as it consists of ONLY the first 4 (four) records of the $MFT. Obviously once you re-format, it represents the mirror of the first 4 records of the NEW $MFT, unless you changed CONSIDERABLY the partition size (thus causing the new $MFT and $MFTmirror to be "somewhere else") or you used a NT system that uses a different "default" for the placement of these structures - like Windows 2000, in which case the OLD filesystem structure may be not overwritten.

.

share|improve this answer
    
Thank you, I'll definitely buy another hard drive if I can recover some things or before going through risky operations, chkdsk for example doesn't only read. I've just tried ntfswalker but the MFT seems to be empty, most probably due to the format operation. Right now I have a data recovery software scanning through the disk, but it'll take 9 hours to finish so there aren't many things to do but wait. –  Ariadne Sousa Dec 12 '10 at 18:01
1  
chkdsk without any switches will run in read only mode. –  Moab Dec 12 '10 at 18:38
add comment

As a start ...

"Painless Partition Recovery

Partition Find & Mount implements a new concept of deleted or lost partition recovery. It works in the most convenient way possible — by locating and mounting partitions into the system, thus making those lost partitions available to you like any generic disk volume. Partition Find & Mount will also work in case any Boot Record (including the Master Boot Record) is missing, damaged or overwritten."

http://findandmount.com/

Otherwise I'd think you could find some utilities to restore the MBR - intact.

share|improve this answer
    
Thank you for the answer, the the partition was not deleted, nor the partition table modified or the MBR. I just "quick formated" that partition. –  Ariadne Sousa Dec 12 '10 at 17:06
add comment

I've done more or less what you've described before. Twice actually. The 2nd time on a 4TB RAID-5 (just for fun ;) The first time around, I ended up buying Restorer Ultimate. It worked both times, not to mention on numerous other occasions of varying difficulty levels, though not always 100%. The software runs in demo mode, which will tell you which files it can restore. In your case I would assume that's everything.

share|improve this answer
    
Thank you for the answer, the scan I ran yesterday could found most of the files (it's difficult to say if they're corrupted or not quite yet); I've ordered a new cost effective HD where to place the recovered data. –  Ariadne Sousa Dec 13 '10 at 16:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.