6

I've searched through several questions but didn't quite find anyone treating mine.

So, I have a 1TB external hard drive I use for backup purposes with only 1 NTFS partition. Today using DiskPart I formated that partition by mistake (who would have thought the disc count started in 0 and not in 1). The complete command I used was:

format recommended override quick label=Windows

So I performed a quick format, and from which I've read after a quick format it's possible to recover the data stored there. Anyway, as soon as I realized it wasn't the partition I wanted to format the one I specified I removed the access to my external drive to minimize possible damages.

Now, the MFT is the metadata part where the file name, creation date, access permissions and contents are registered; and it's mirrored too (so there's a copy of it somewhere in the disk). What I don't know is if a quick format erases that MFT mirror too, I hope not.

I'm running a program to recover files on it but I'll have to save the files to another location (once it's finished scanning, ~12 hours from now) and I don't quite have over 900GB of free storage where to put the data.

I would like to know if there's a program or procedure by which I could restore the old MFT in-place and have all the data that used to be in there accessible once again.

Any help or light you could shed on how to proceed or what programs to use is really appreciated.

Improve this question
5
  • A forum like this one may have more answers...forensicfocus.com/…
    – Moab
    Commented Dec 12, 2010 at 17:43
  • @Ariadne - "who would have thought the disc count started in 0 and not in 1?". List of devices, strings of characters, etc. often begin the index at zero and not one. Most of the time the end user, like yourself, doesn't need to know or even care. Tough lesson to learn. I wish you the best of luck recovering your data.
    – Mike Chess
    Commented Dec 12, 2010 at 21:04
  • @Moab: Thank you very much for posting that link, in that thread a post by jaclaz clarified that it's not possible to accomplish what I wanted to know; mainly because the mirror MFT gets overridden too and it's only a mirror to the first 4 records.
    – Ariadne Sousa
    Commented Dec 13, 2010 at 15:57
  • @Mike Chess: Yes, tough lesson but there's nothing else to do now but to try to recover that data. I've already ordered a new hard drive where to restore the recovered files. The scan I ran yesterday was able to locate most of the data that was inside of it.
    – Ariadne Sousa
    Commented Dec 13, 2010 at 16:02
  • @Moab Since you were the one that found the direct answer to the question if you write another answer or modify your current one telling it's not possible and pointing to that thread I'll mark it as accepted.
    – Ariadne Sousa
    Commented Dec 13, 2010 at 16:04

3 Answers 3

Reset to default
2

chkdsk can possibly restore the MFT from the mirror, back up your data before doing anything, buy a usb drive if needed, or risk losing it all.

No way for anyone to know how far the quick format went before detachment.

Never used this software but looks interesting

http://dmitrybrant.com/ntfswalker

According to Jaclaz in this forum it is not possible

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6425

For the record, unlike what a lot of people apparently thinks, the $MFTMirr is pretty much useless, as it consists of ONLY the first 4 (four) records of the $MFT. Obviously once you re-format, it represents the mirror of the first 4 records of the NEW $MFT, unless you changed CONSIDERABLY the partition size (thus causing the new $MFT and $MFTmirror to be "somewhere else") or you used a NT system that uses a different "default" for the placement of these structures - like Windows 2000, in which case the OLD filesystem structure may be not overwritten.

.

Improve this answer
2
  • Thank you, I'll definitely buy another hard drive if I can recover some things or before going through risky operations, chkdsk for example doesn't only read. I've just tried ntfswalker but the MFT seems to be empty, most probably due to the format operation. Right now I have a data recovery software scanning through the disk, but it'll take 9 hours to finish so there aren't many things to do but wait.
    – Ariadne Sousa
    Commented Dec 12, 2010 at 18:01
  • 1
    chkdsk without any switches will run in read only mode.
    – Moab
    Commented Dec 12, 2010 at 18:38
2

As a start ...

"Painless Partition Recovery

Partition Find & Mount implements a new concept of deleted or lost partition recovery. It works in the most convenient way possible — by locating and mounting partitions into the system, thus making those lost partitions available to you like any generic disk volume. Partition Find & Mount will also work in case any Boot Record (including the Master Boot Record) is missing, damaged or overwritten."

http://findandmount.com/

Otherwise I'd think you could find some utilities to restore the MBR - intact.

Improve this answer
1
  • 1
    Thank you for the answer, the the partition was not deleted, nor the partition table modified or the MBR. I just "quick formated" that partition.
    – Ariadne Sousa
    Commented Dec 12, 2010 at 17:06
1

I've done more or less what you've described before. Twice actually. The 2nd time on a 4TB RAID-5 (just for fun ;) The first time around, I ended up buying Restorer Ultimate. It worked both times, not to mention on numerous other occasions of varying difficulty levels, though not always 100%. The software runs in demo mode, which will tell you which files it can restore. In your case I would assume that's everything.

Improve this answer
1
  • Thank you for the answer, the scan I ran yesterday could found most of the files (it's difficult to say if they're corrupted or not quite yet); I've ordered a new cost effective HD where to place the recovered data.
    – Ariadne Sousa
    Commented Dec 13, 2010 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .