1

I was trying to get a 65MB bootable image (Nook Manager, for rooting my Nook ebook reader) to write to an SD card in Win32 Disk Imager. Somehow it must have selected my external HD and written the image to that instead. Because I was having problems with writing to the SD card, I opened up the disk management control panel to delete the partition from what I thought was the SD card. Only after I'd done that did I see that the 1TB external HD was showing as ~930GB of unallocated space.

I've run EaseUS Partition Master and it didn't appear to find anything (assuming I ran it properly). I'm now running MiniTool Partition Recovery. Even on a 'fast' scan it's running very slowly (it's taken about half an hour to reach 3% progress). I can see that it's found a FAT16 partition for Nook Manager with Starting LBA 32 and Ending LBA 131071.

Am I right in assuming that if a new partition, however small, is written to the external HD (which was a single partition), then the old partition is completely destroyed? However, I'm also assuming that there's a large chunk of my data (roughly 400GB worth) that is still there - it's just inaccessible. Is that correct?

Since I realised my mistake, I haven't done anything to write to the disk or configure it. I'm wondering what my options are in these circumstances. Is there particular software that will be able to extract the remaining inaccessible data or can restore the remainder of the old partition?

3 Answers 3

1

Any portion of the disk that has been overwritten, by any method will not be recoverable. The portion that has not been overwritten still exists.

Changing partition tables still does not delete the data on the sectors.
Quick Formatting does not delete the data.
Full formatting in win7 does zero out all the data.
Different simple hard disk recovery softwares will be confused by the presence of a different file system type (fat vrses NTFS).
Cluster size being the same would be very important.

It is likely in this case that the MFT is completly overwritten, so direct simple easy pointers to the data no longer exist. Forensic recovery type programs then attempt to assemble the data from known headers , sequential data (see defragging helps), and can also use human observation to determine what goes together. Any recovery of Terrabytes of data take a very long time, when there is no tables, even longer. As long as the scanning software is still running, you will want to give it the time it needs, as you know the first overwritten part will just take time to get past it.

Note: there are mirror MFTs and Backup MFTs depending on the partitioning style that might not be overwritten.

I only have ever done recovery using simple tools, so what i would do might Not be the Best Method.
I would want to re-parititon the disk in the exact same way it was when the data was stored on it. That would include:
The type of partitions , including dynamic, basic logical, if it is striped (raid) etc.
The exact cluster size used.
the extact partition size used.
The exact file system used, and on the same operating system and program that partitioned and formatted it.

Formatting the partition with Quick format, then proceeding to do the recovery using software that will scan the sectors and assemble what it observes.

This is not an answer, and I do not have any software to suggest, just some ideas along the lines of what your dealing with. You already have lost, there are things you already know, so those are some things that might be important.

1

I mainly do data recovery from physically failing drives, but the tools are the same and about twice a year I get a client who has accidentally fornatted a drive with important data and I need to recover all that wasn't overwritten. From experience, I can state:

-- Yes, there is software that can help you and others in similar predicaments. -- Your data in the unallocated space is still there, as is some of your old data in the new FAT partition. (Though the latter is likeky too corrupt to use outside of a court of law ;-) ) -- You don't have to repartition the disk to recover your files, and in fact SHOULDN'T repartition it until after you've used the following procedure successfully or you may lose data!

This link goes into greater detail about the process than this format allows. https://help.ubuntu.com/community/DataRecovery What follows are highlights about how to choose which commands in that article to use, and depending on your experience you might need to google to understand some terms. This is not meant to be rude, just an efficient starting place.

If unclear, I will edit as needed.

You will need access to a Linux install or live CD that allows you to install programs in the live environment for the following info to work. I use an Ubuntu 14.04 live USB because recovery takes a while and this way the computer can still be used as a computer . There is probably a different distribution that has the key packages "ntfs-3g" "gddrrescue" and "foremost" installed by default, but I usually just install the latest versions from the repos after booting into the live environment.

I begin all data-recovery by using ddrescue to copy the entire drive to an image FILE on another larger drive. The larger drive should have at least 1.5 TB of free space in your case, preferably 2TB+. In your case and contrary to some tutorials, you can't use '/dev/sdb2' as the input since the number 2 denotes a partition and your files are in unalocated space. Use '/dev/sdb' instead, since that points to the whole drive. Replace sdb with the identifier of the accidentally formatted drive in question.

For the drive which will hold the output image, mount an NTFS partition ON A SEPARATE PHYSICAL DISK using ntfs-3g since it has better write support than the default mount method. You will then use a file on that mountpoint as the output argument to ddrescue. For example, if mounted at '/mnt/largeDrive' you would use something like '/mnt/largeDrive/myRecoveredImage.img' as the outfile. Note the '.img' which helps tell what kind of file it is. Ddrescue will create the file if it doesn't already exist.

Don't use a FAT partition for the outfile since it'll be larger than FAT's maximum file size.

Imaging a drive takes a LONG time (sometimes days if the drive is large enough or has a lot of bad sectors), but I have found that the extra data security is handy. Ddrescue is available as a liveCD, but I don't reccommend it because you won't be able to use your conputer while the process runs, and would still need to boot to full linux to use the forensic recovery tools.

All subsequent recovery operations are then applied to the image, not the actual drive. Therefore, any mistakes (other than running ddrescue itself incorrectly) do not damage the underlying data and you can try again with a different recovery method.

Once you have the image, there are many tools to recover individual files or even whole filesystems, but the tools I use most often are "foremost" and occaisionally "sleuthkit" if I'm looking for files that were marked for deletion. The link above has a section on recovering individual files with these tools, plus some others. For the record and to save google-time, you DON'T need to "mount the backup image as a loop" to use foremost on it.

-1

Go to disk management. Right click your desired partition, click extend - use default settings and it will fill up the space.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .