Recovering a HDD?

[j.o.s.h.1408]

Hi, One of my hdd's got messed up when i think i accidently deleted the partition when i was reinstalling windows 8 and selected the wrong hdd. what app can i use to recover the data off of it?

On windows it now keeps telling me i need to reformat it

any advice?

[mycarsavw]

GetDataBack has been relatively successful for me over the years - http://www.runtime.org/data-recovery-software.htm

[BlackDwarf]

If it's just the partition table that's been destroyed, you might be able to recover it using TestDisk

Depending on what's been overwritten would depend on what you're able to recover.

Good luck, it's a terrible feeling when you do something like that.

[Agent]

@Active Undelete has always been excellent for me.

[j.o.s.h.1408]

If it's just the partition table that's been destroyed, you might be able to recover it using TestDisk

Depending on what's been overwritten would depend on what you're able to recover.

Good luck, it's a terrible feeling when you do something like that.

Tried TestDisk for the past couple of days trying every option available and it doesnt recover anything. just keeps saying that my partition is damaged and cant retrieve any files. i am going to try another software

[alsenior]

If you fancy sending it to me i could run it through the uni's digital forensics lab. if the data is still physically on the disk i can probably get it back.

[Dutchjonsey]

Ive had luck in the past with Recuva, though its a 50/50 proposition from my experience.

[Skinleech]

I lost 2 drives recently - one due to a hardware change in my HTPC and the drive suddenly showed up as RAW format, and the other thanks to me somehow messing up creating a USB bootable drive on my Desktop and overwriting the boot partition of my C: drive plus the other partition associated to it.

In both cases I tried Getdataback with mixed results. The RAW drive in the HTPC took about 40 hours to scan, found all my files my I was unable to recover any. Further issues have led me to believe the SATA cable was at fault with this one.

The Desktop drive was swfit to scan, an hour or 2 maybe, and all my data was recovered.

[j.o.s.h.1408]

I lost 2 drives recently - one due to a hardware change in my HTPC and the drive suddenly showed up as RAW format, and the other thanks to me somehow messing up creating a USB bootable drive on my Desktop and overwriting the boot partition of my C: drive plus the other partition associated to it.

In both cases I tried Getdataback with mixed results. The RAW drive in the HTPC took about 40 hours to scan, found all my files my I was unable to recover any. Further issues have led me to believe the SATA cable was at fault with this one.

The Desktop drive was swfit to scan, an hour or 2 maybe, and all my data was recovered.

how did u restore it? dragged the files into a new hdd or does the app actually restores the hdd?

[j.o.s.h.1408]

Hi. i tried getdataback andit doesnts eem to scan r do anything?

i chose teh default settings from the first screen and then on step 1 i chose my hdd thats damaged.

in step 2 nothing happens. it doesnt scan or do anything and on step 3 it doesnt display any of my files.

see screenshots below:





I have also tried TestDisk and what happens in TestDisk is that when itry to fix and rebuild the mft, it says this:

MFT and MFT mirror are bad. Failed to repair them.

Here is the status of that hdd under Testdrive:



I also tried this app and got no results when i tried to recover the files. i keep getting this error:



Last but not least, i tried Recuva and that simply sais that that it is unable to read the MFT?

Any suggestions? i have tried various apps already and none of them seem to work

[Onkston]

I've used winternals erd 2005 before and I managed to get most of my data back. Could give that a try.

[peterb]

I am a bit late to this party, however a few thoughts.

I think you have inadvertently made a bad situation, where you might have been able to recover some data, into a worse one where the chances of recovering useable data easily have diminished considerably.. More damage can be done by the incorrect use of recvery tools because you are working right down at the drive level.. The tools are powerful because they do what you tell them, usually without question (although you may get a warning).

First of all, when faced with a situation like the one you describe is to stop doing anything and switch the machine off.

Go away and get a second drive (preferably brand new) of the same or larger capacity than the damaged one.

You then need to take a bit by bit image of the damaged disk. You cannot use the damaged disk, and the best way is to use a live cd (linux) and use the dd command to image the damaged disk.

When you have done that, put the damaged disk away and work on the image. If you ness up, you re-image the disk and try again - but you always preserve the original. (You can re-use the target disk for the re-imaging)

But you are past that now.

If the MFT is damaged, your chances of recovery with automatic tools has diminished markedly, unless you use some of the forensic tools like EnCase, even then it can be hit and miss (and the cost if the licence will make your eyes water)

You might be abke to examine the disk with something like WinHex and manually recover snippets, particularly text files. Image files will be far harder, and will depend on identifying file headers and working from those. If the disk is fragmented, recovery becomes far harder.

You might try the open source tools (running under Linux) like Sleuthkit or BLESS (a disk editor).

One ray of hope. There is a copy of the MFT on the disk. Again working on a cloned disk, you could try copying the copy of the MFT over the original so that they are identical (assuming the copy is undamaged). Try the recovery tool again. If it dioen't work, re-image the disk, then copy the original over the copy (on the image) and try again. If thst doesn't work, it is back to salvaging what you can by inspection.

If you aren't comfortable doing it yourself, give the image (copy) disk to a reputable recovery company - but expect to pay a lot of money. And choose your company with great care.

Next time it won't be a problem, because you will recover the data from your backup.

[Sohaib.27]

Active partition recovery is a good tool! boot from the disk (create a bootable disk by visiting their website and downloading the iso. I recovered some deleted music and pictures using this tool*

[Kumagoro]

You could try photo rec which comes with test disk for file recovery. However you don't get the file names. In a thread several months ago someone suggested using the easus software which worked as well as photo rec but kept the filenames.

Try the drive in a usb caddy, also try doing it on a machine with Windows xp.. disk management in xp seems to pick up drives which need initializing more easily.

[peterb]

You could try photo rec which comes with test disk for file recovery. However you don't get the file names. In a thread several months ago someone suggested using the easus software which worked as well as photo rec but kept the filenames.

Try the drive in a usb caddy, also try doing it on a machine with Windows xp.. disk management in xp seems to pick up drives which need initializing more easily.

Just to re-iterate - NEVER try to do advanced recovery on the corrupted disk. Always take an image and work on that - then if you do mess up, you have a second (and third, and fourth....) chance.

[Kumagoro]

You won't be able to image it if it's not initialized