Can I recover files on a disk with 5% of start of disk completely wiped (overwritten with 1s)

Question

Recently a virus attacked my PC and cleared 5% of my hard disk which has one partition. I viewed the disk in a hex viewer program like Active Undelete, cleared the virus data and overwrote it with 1s.

I want to recover a large file that is about 10GB, but no recovery tools seem to be able to recover any files.

In theory, is this file recoverable?

I think that files are fragmented; I've researched about the NTFS File System and I understand that cluster information is just saved in the MFT File?

Is there any way to recover files without an MFT structure?

Answer 1

A little knowledge is a dangerous thing. Lets see, the right thing to do would have been to get the data out before you did a seriously low level operation. The 'smart' workflow would be to get the data you needed out with a livecd, run a virus scan on it (or a few) then wiped the disk.

You want to use a livecd for recovery work, and a second drive to save files into. I'd suggest the xubuntu livecd, and you can install the tools i mention quite easily as needed.

I'd give testdisk (as mentioned by karlson) a try first, and if that fails, go for other alternatives.

Now, if its a common filetype (check it against this list) photorec ignores the filesystem and recovers files, so that it can work on extremely damaged filesystems. They have a step by step guide here. It does mangle filenames, so some digging may be needed to find the file (but in this case, the filesize should be a giveaway)

Answer 2

There are a few tools that can help with that:

1. TestDisk -- I have used this previously; it worked great recovering from a broken NTFS partition. They have a step by step guide on using it which is very helpful.
2. ForeMost -- also open source. Don't know much about this tool.
3. Scalpel -- also a digital forensics tool.

If you are using Ubuntu at all they are all available in the repositories. You can check this link for more details.

Some of these tools state they are available in Windows versions, so if someone used those they can add some comments with regards to that.