2

Here's an interesting problem and predicament that I'm currently in.

I have a 239 GB large VHDX, originally formatted as NTFS. It contains a lot of important files, including proprietary code, game development assets and a ton of artwork.

I was trying to create an Ubuntu Desktop 18.04 installer on my flash drive, and I used Rufus to try and put it in. I was in class, so I wasn't that concentrated on my laptop.

Funnily enough, Rufus sorted that mounted VHD as the first, and without double-checking, I started the operation. In less than 7 seconds, the entire disk was formatted into FAT32, and Windows instantly recognized the drive, along with the available space and all. Luckily enough, I was able to cancel the operation before it started writing to the drive. Immediately after this, I set the drive as read-only, and until now I have not unmounted the drive, in fear that it might implode (even though this isn't that possible.)

Now, here's the fun part: I am certain that the files are still there. The VHD size is still 239 GB, and Recuva is still able to determine a few files in the drive. I have tried deep-scanning the drive, and there are still a few files that it can muster up.

The problem is, with the changed filesystem, and the circumstances that the drive was formatted in, will I still be able to recover the files (possibly with free recovery tools) or not?

I've tried to use Recuva, but given that a Deep Scan is worth 9 hours and I might come up empty-handed, I just wanted to ask here first. I'm also seeing TestDisk as an option, although I don't know how it works.

The VHD itself, as seen in Windows Explorer.

A screenshot of the drive details, as provided by Windows. (note the incorrect partition name)

As hopeless as this seems, at least I kept a month-old backup of the drive. This was the main reason why I frequently use virtual hard drives. Although this drive contains a lot of the nostalgic stuff, I'm more interested in the newer files, since these contain projects and it's going to be a major setback to start from a previous time.

  • I wonder if the NTFS MFT is still intact? If I recall correctly, it's in a different place than any of the FAT32 metadata, and there's a chance data recovery specialists should be able to resurrect it. – user1686 Sep 2 '19 at 12:30
  • Well, I'm a bit willing to let this VHD file go to a specialist, but again, it's really big and the only way that would happen is by shipping a drive with the VHD file in it. Not the best of options, in my opinion, but if that's really what it takes, then yeah, sure. If there's any way to check myself if the MFT is intact, then I'll try it. – Chlod Alejandro Sep 2 '19 at 12:34
  • I've found a way to try checking for the MFT using TestDisk, but that means I first have to reformat the drive into NTFS. Will this be safe, considering it might overwrite the past MFT? – Chlod Alejandro Sep 2 '19 at 13:04
  • 2
    No, it won't be safe. As a general rule, no change to the broken disk is safe unless you have another read-only copy of it elsewhere. (It's why recovery specialists, afaik, first image the disk and only work with the image.) – user1686 Sep 2 '19 at 13:16
1

First advice : Make a backup copy of the VHDX (if not already done).

The product TestDisk can use the MFT mirror to restore a disk, although its being formatted as FAT32 may throw it off: In the Advanced menu, select the NTFS partition, choose Boot, then Repair MFT.

You will find a list of recovery products in the article Best Free Data Recovery and File Un-delete Utility. Personally, some time ago I had an important disk to salvage, so I tried every recovery tool in that list. The only utility that recovered almost all the files was MiniTool Power Data Recovery (free version limited to 1 GB), where a guide is found here.

The product DiskInternals NTFS Recovery seems to be specialized in NTFS. It is commercial and the limitations of the trial version are not specified.

Another commercial product I have seen mentioned is Restorer Ultimate Data Recovery (demo trial available).

If all fails, and since you (should) have a backup of the VHDX, you could re-format it as NTFS and run data recovery products.

Note that file recovery from a formatted hard drive is not always practical when a file was stored over non-consecutive sectors and the file-table is lost. You may also lose all file-names, and in that case will have to identify files or file-fragments by their content.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.