Printable View
Hi, One of my hdd's got messed up when i think i accidently deleted the partition when i was reinstalling windows 8 and selected the wrong hdd. what app can i use to recover the data off of it?
On windows it now keeps telling me i need to reformat it :(
any advice?
GetDataBack has been relatively successful for me over the years - http://www.runtime.org/data-recovery-software.htm
If it's just the partition table that's been destroyed, you might be able to recover it using TestDisk
Depending on what's been overwritten would depend on what you're able to recover.
Good luck, it's a terrible feeling when you do something like that.
@Active Undelete has always been excellent for me.
Tried TestDisk for the past couple of days trying every option available and it doesnt recover anything. just keeps saying that my partition is damaged and cant retrieve any files. i am going to try another softwareQuote:
Originally Posted by BlackDwarf
If you fancy sending it to me i could run it through the uni's digital forensics lab. if the data is still physically on the disk i can probably get it back.
Ive had luck in the past with Recuva, though its a 50/50 proposition from my experience.
I lost 2 drives recently - one due to a hardware change in my HTPC and the drive suddenly showed up as RAW format, and the other thanks to me somehow messing up creating a USB bootable drive on my Desktop and overwriting the boot partition of my C: drive plus the other partition associated to it.
In both cases I tried Getdataback with mixed results. The RAW drive in the HTPC took about 40 hours to scan, found all my files my I was unable to recover any. Further issues have led me to believe the SATA cable was at fault with this one.
The Desktop drive was swfit to scan, an hour or 2 maybe, and all my data was recovered.
how did u restore it? dragged the files into a new hdd or does the app actually restores the hdd?Quote:
Originally Posted by Skinleech
Hi. i tried getdataback andit doesnts eem to scan r do anything?
i chose teh default settings from the first screen and then on step 1 i chose my hdd thats damaged.
in step 2 nothing happens. it doesnt scan or do anything and on step 3 it doesnt display any of my files.
see screenshots below:
http://img132.imageshack.us/img132/927/step2yi.png
http://img833.imageshack.us/img833/2290/step3jd.png
I have also tried TestDisk and what happens in TestDisk is that when itry to fix and rebuild the mft, it says this:
MFT and MFT mirror are bad. Failed to repair them.
Here is the status of that hdd under Testdrive:
http://img547.imageshack.us/img547/2641/testdrive.png
I also tried this app and got no results when i tried to recover the files. i keep getting this error:
http://img845.imageshack.us/img845/3808/anotherapp.png
Last but not least, i tried Recuva and that simply sais that that it is unable to read the MFT?
Any suggestions? i have tried various apps already and none of them seem to work
I've used winternals erd 2005 before and I managed to get most of my data back. Could give that a try.
I am a bit late to this party, however a few thoughts.
I think you have inadvertently made a bad situation, where you might have been able to recover some data, into a worse one where the chances of recovering useable data easily have diminished considerably.. More damage can be done by the incorrect use of recvery tools because you are working right down at the drive level.. The tools are powerful because they do what you tell them, usually without question (although you may get a warning).
First of all, when faced with a situation like the one you describe is to stop doing anything and switch the machine off.
Go away and get a second drive (preferably brand new) of the same or larger capacity than the damaged one.
You then need to take a bit by bit image of the damaged disk. You cannot use the damaged disk, and the best way is to use a live cd (linux) and use the dd command to image the damaged disk.
When you have done that, put the damaged disk away and work on the image. If you ness up, you re-image the disk and try again - but you always preserve the original. (You can re-use the target disk for the re-imaging)
But you are past that now.
If the MFT is damaged, your chances of recovery with automatic tools has diminished markedly, unless you use some of the forensic tools like EnCase, even then it can be hit and miss (and the cost if the licence will make your eyes water)
You might be abke to examine the disk with something like WinHex and manually recover snippets, particularly text files. Image files will be far harder, and will depend on identifying file headers and working from those. If the disk is fragmented, recovery becomes far harder.
You might try the open source tools (running under Linux) like Sleuthkit or BLESS (a disk editor).
One ray of hope. There is a copy of the MFT on the disk. Again working on a cloned disk, you could try copying the copy of the MFT over the original so that they are identical (assuming the copy is undamaged). Try the recovery tool again. If it dioen't work, re-image the disk, then copy the original over the copy (on the image) and try again. If thst doesn't work, it is back to salvaging what you can by inspection.
If you aren't comfortable doing it yourself, give the image (copy) disk to a reputable recovery company - but expect to pay a lot of money. And choose your company with great care.
Next time it won't be a problem, because you will recover the data from your backup.
Active partition recovery is a good tool! boot from the disk (create a bootable disk by visiting their website and downloading the iso. I recovered some deleted music and pictures using this tool*
You could try photo rec which comes with test disk for file recovery. However you don\'t get the file names. In a thread several months ago someone suggested using the easus software which worked as well as photo rec but kept the filenames.
Try the drive in a usb caddy, also try doing it on a machine with Windows xp.. disk management in xp seems to pick up drives which need initializing more easily.
Just to re-iterate - NEVER try to do advanced recovery on the corrupted disk. Always take an image and work on that - then if you do mess up, you have a second (and third, and fourth....) chance.Quote:
Originally Posted by Kumagoro
You won't be able to image it if it's not initialized
The disk or volume fs isn't being mounted, so provided the kernel detects the physical disk, you can use dd to perform the imaging.
Oh so very true - nothing like a data loss to make sure you always have backups in the future.Quote:
Originally Posted by peterb
Expensive to do so lolQuote:
Originally Posted by mikerr
using Linux might be okay but I think still probably not if not initialized.
Although it was a couple of years ago now some friends of mine were doing ps3 repairs and they would often do hdd replacements. The hdds were not being recognised you couldn't format them on a ps3 Vista didn't want to know and my puppy boot disk couldn't format it either. Tried disk management in xp and it said it it needed initializing once done it was fine
Had the same problem a few weeks ago, tried to recover all my stuff just just kept on getting errors :( just decided to chalk it up to experience!
:(
damm
I'm also a bit late but I've found PhotoRec good for recovering files from damaged filesystems, it's a while since I've used it but IIRC it has an option to just recover anything possible from the disk, dumping it to another drive. It can be a nightmare to sort through the output but might be worth it for important files.
But as peterb said, it's always best to dd an image of the disk and work on that, don't try to initialise (create a partition table), it's not necessary and you don't want to write to a disk you're trying to recover. The reason PS3 disks aren't recognised is because data (including partition table, etc) is encrypted in hardware before being written to the disk, so it just looks like random data to Windows. Something like fdisk would have no problems creating a new table.
Recovery software can be useful if the error is realised soon enough, but it's not magic - if the data has been overwritten you have basically no chance of getting complete files back - that's essentially how HDD erase utilities work, but you might find a few smaller files/chunks of larger ones between newly written files but finding and recovering them would be far from simple on a modern (huge) HDD. Chance of recovery depends largely on how much has been written to the drive - if you only had a small mount of data at the beginning of the drive then installed Windows over it, it's not likely, but if for example you had important files near the end of the drive and/or only re-formatted the drive, chances are far better.
Initialisation is not necessary to do a raw read or raw write, as obviously the OS needs to write to the disk to initialise it If you can access an unitialised disk, you can use a raw read to get data off - this is way below file system level. Once the disk has been cloned, you can play with the cloned disk, safe in the knowledge that you can always re-clone from the original.Quote:
Originally Posted by Kumagoro
Whether or not the data on the disk can be re-assembled into a meaningful or useful entity is another matter - but my original post on the subject was to outline first steps in trying to salvage data - but this case has gone beyond that stage.
Applications like photo recover work at the file system level - but if the file system structure has been damaged, you need tools that access the disk directly, either mounted or unmounted.
PhotoRec actually operates below the filesystem level BTW.
Thank you - I think I was confusing it with another similar sounding app. It looks good, but again' if the disk's logical structure is badly damaged, I would still use it on a disk image (clone)Quote:
Originally Posted by watercooled
Oh definitely, I didn't mean to imply otherwise.
Hi all. Some good news. I tried a application called easeUS and it managed to find and list my files.
Trouble is the free version only allows us to recover 1gb so I tried it and it worked and managed to recover some files. I have ordered a new hdd and will buy pro version of this app and go from there
Good news indeed! Glad to hear it, and fingers crossed.
Now, about your backup regime....
The old drive i will use it for backing up what i am dumping into the new drive and then when i get paid i will buy another hdd to back up others.
One thing i noticed from that app is that only about 200gb worth of content was displayed and listed fine with there names and all intacked but i notice that the RAW files made up the rest and did not have there correct filenames :(
Its better then losing it all permanently though so at least i have the actual files accessible now.
my new HDD should arrive tomorrow from Scan and will recover all files from the old hdd and then reformat it once and for all.
Thanks and this was a life lesson indeed, from now on, i will make regular backups. spending even just £60 on a hdd once in a whole for a 1TB.
i have too much sensitive meaningful content now such as my pictures from my DSLR.
Well my portable hdd is screwed . A first the hdd would freeze and crash my whole laptop but worked fine on other laptop but now when u try access the drive on another pc there is no contents there and only a simple short cut icon linked to the actual hdd and nothing happens when I click on it.Quote:
Originally Posted by BlackDwarf
Same happens in safe mode on my pc. I did a virus scan on it and it did detect a virus that I removed and since removing it I can't access contents of it.
Also the laptop itself seems lie its ****ed as well as I can't view event logs as it crashes and tried to connect other ext hdd and would still crash the system
Try Recuva? It helped me last time one of my drives failed. (managed to recover the files I were after at least, didn't care about the rest).
A virus shouldn't be capable of damaging a HDD, but it could potentially nuke some system files making it inaccessible in Windows. Anyway, how did you manage to run a virus scan on a dead HDD?
most of recovery software will do but personally i am using hirenboot cd