0

I accidentally formatted my Windows 7 OS disk from my secondary OS in a moment of carelessness.

It was an encrypted drive with BitLocker. I have not touched it since the formatting took place. Is it at all possible to somehow undo the format?

More specifically, I am asking about any method which may undo the flags or similar set by the formatting process. As it was a "quick format" and did not actually delete anything, it just marked the whole drive as free.

0

1 Answer 1

2

When a drive is formatted (taking NTFS as an example), a new MFT and mirror MFT are written to the disk. This at least partially overwrites the existing MFTs. Unformatting is not as simple as resetting a couple flags.

Windows writes and reads back each sector on a volume on a standard format to test for bad blocks (reference, reference). This obliterates any data on the drive. Windows skips this step for a quick format.

What needs to be done is to scan the entire volume for things that look like files and rebuild the MFT manually. I don't know of a tool that specifically does this, tools I've used like testdisk will help you copy the files off but not restore it to bootable status (except if it's just a simple partition/MBR overwrite or error, which is easier to restore from).

1

Not the answer you're looking for? Browse other questions tagged .