0

I accidentally FAT formatted a NTFS partition, and now it shows up as an empty FAT-partition. I'm thinking much should be recoverable, since AFAIK NTFS puts much of the important stuff towards the middle of the partition, while FAT's file table is at the beginning.

Anyway, there are plenty of information here about how to recover files from a partially overwritten NTFS-system (eg. careless use of dd), so that'll be the second thing I do... However, first I have to turn the partition back into a NTFS-partition. So how do I do that?

Trying to format the drive, would destroy the NTFS file table... Can I perhaps raw-edit the partition and put the correct magic-numbers for NTFS at the beginning?

4
  • did you perform a quick format or a full format? did it take seconds, or minutes to complete? Aug 3, 2022 at 18:28
  • Quick, It took a few seconds. I've also checked the partition in Linux, and although the beginning (and quite frankly a lot more than I expected - guess because it was FAT32 and I was using od with Hex and ASCII output to look at it) was zeroed out, after that, there were definitively remains of files. A full format ought to have zeroed out everything, right? Aug 3, 2022 at 19:11
  • 1
    somthing like that. now first things first, don't try to fix the disk on that disk unless you have good backups. always recover data to another disk. I do recommend you check TestDisk. it can probably recover your whole partition to a new disk Aug 3, 2022 at 19:52
  • "since AFAIK NTFS puts much of the important stuff towards the middle of the partition" - This is incorrect. Oct 18, 2022 at 18:01

2 Answers 2

1

since AFAIK NTFS puts much of the important stuff towards the middle of the partition

No, this incorrect, MFT is nowhere near the middle:

enter image description here

It is however possible MFT is fragmented and that some of the fragments are further out on the volume. It is also likely the MFT largely survived the format. If the drive is an SSD/SMR some other factors might be at play.

However, first I have to turn the partition back into a NTFS-partition.

Absolutely not. Any half decent file recovery tool can detect the actual file system, the 'dominant' file system or at least allow you to select it manually. First rule in data recovery is you do not alter anything on the patient drive. DMDE scan dialog allows for selecting to scan for NTFS file system meta dat, it will ignore FAT. A tool like ReclaiMe will present no such dialog and detect the file system automagically.

DMDE full scan dialog

Some good tools to try are for example R-Studio File Recovery, File Scavenger, DMDE or ReclaiMe File Recovery.

Ideally you first clone/image the drive using the file recovery's software disk image feature, put patient drive aside and recover files from the image file.

0

You need to change the partition type back to NTFS without touching anything else. GParted and other Linux based partitioning tools can do that.

Please note: If you did a "full format" as FAT you won't be able to recover anything. If it was a "quick format" you have a much better chance to recover some of your files.

2
  • I used only a quick format. I've also raw-read the partition (in linux with od), and although the beginning was zeroed out, eventually there definitively were data there. Problem is that the drive is GPT partitioned, and the typed (according to cfdisk) is "Microsoft Basic Data" - which I think is the same for both NTFS and FAT formatted partitions. (Sure, cfdisk also write that the filesystem is FAT, but I think it gets that from the partition itself, rather than the partition-table...) Aug 3, 2022 at 19:18
  • don't poke at the disk too much. you may be inhibiting your ability to recover data later. be careful, at least until you have a full image of the disk Aug 3, 2022 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .