Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

Data recovery - do I have any chance?

- - - - -

  • Please log in to reply
33 replies to this topic

#1
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

I've just had terrible thing happen to me.
I was reinstalling Windows and something went wrong, and data disk was wiped and used for installation instead of the correct one. I use fully unattended setup which does all the partitioning for me. I got absolutely no idea why it happened because disk 0 has always been the SSD.
Well I just lost 1TB of data, all documents and all programs, mails and favourites, because the dumb setup decided to magically pick different disk.

Since the data disk was wiped, partitioned, and Windows was installed onto it, do I have ANY chance of recovering any data from it? I doubt. I guess specialized company could dig something out of it, but that would cost me more than two brand new computers, I can't afford that.


Ideas?


How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Ideas?

Yes :yes: , but you won't like them :(.

While being wrong, you are right, but you are still wrong. :w00t:
If the disk has been wiped, it has been wiped ;).
On Vista :ph34r: and later a full format (i.e. without the /q switch) is enough to wipe.
Once a disk has been wiped with a "single pass" of 00's (or any other values for that matters) the data is GONE, FOREVER (and no amount of money nor recovery company will get it back).

The only hope you have (cannot say if it applies to your situation) is if the wipe/format affected only part of the disk (and not the full disk) in which case maybe some partial data can be retrieved (only if physically residing on the part of the disk that wasn't wiped).

I have seen a few reports about Vista :ph34r: and later OS re-ordering (for whatever reasons) the disks, it is likely that this is what happened to you, you should put a check (actually more than one) identifying correctly the disks and/or partitions on it BEFORE wiping/formatting.

BTW there is NOT one (valid) reason in the world (if not deleting your data safely before giving away a device) to format "full" on Vista :ph34r: or later, let alone use a wipe program.
You can well wipe the unallocated space AFTER the new install (if you really want to have unused sectors being all nice, rounded 00's and to have possible some advantages with a few imaging/cloning programs that can "skip" 00's).

jaclaz

#3
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,801 posts
  • Joined 12-May 07
  • OS:none specified
  • Country: Country Flag
I would have assumed that when the OP said the disc had been "wiped and used for installation" that he actually meant it had been formatted and used for installation. If the disc had "just" been formatted, then there is a chance that data could be recovered from it, at least the data that was not written over by the installation. ANY use of the new installation. however, would continue to make that task harder as temporary system files are written and erased from the disc. There are several programs available that do a fair job of recovering data from accidentally formatted discs, and their prices are fairly reasonable.

Cheers and Regards

Edited by bphlpt, 29 September 2012 - 07:31 AM.

Posted Image


#4
tomasz86

tomasz86

    www.windows2000.tk

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,525 posts
  • Joined 27-November 10
  • OS:none specified
  • Country: Country Flag

BTW there is NOT one (valid) reason in the world (if not deleting your data safely before giving away a device) to format "full" on Vista :ph34r: or later, let alone use a wipe program.

I always do full format on a newly bought disks as it's the most basic way to check if there are any problems (in fact, some time ago I had an error when formatting a new HDD and in the end it turned out to be defect).

For recovering data you can try DMDE although be careful as it's not really for beginners. This program saved my data a few years ago, and it's free for personal use.

Edited by tomasz86, 29 September 2012 - 07:28 AM.

post-47483-1123010975.png


#5
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

I always do full format on a newly bought disks as it's the most basic way to check if there are any problems (in fact, some time ago I had an error when formatting a new HDD and in the end it turned out to be defect).

And AGAIN, the behaviour of the "full" format is DIFFERENT from up to XP and from Vista :ph34r: onwards AND that disk WAS NOT a newly bought one, if it was, there would have been NO DATA to loose :whistle: .

@bhlpt
See:
http://www.msfn.org/...s-the-question/

Up to XP:
http://support.micro...kb/302686/en-us

From Vista :ph34r: onwards:
http://support.micro...kb/941961/en-us

The format command behavior has changed in Windows Vista. By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and in earlier versions of the Windows operating system, the format command does not write zeros to the whole disk when a full format is performed.

As often happens the good MS guys use wrongly "disk" instead of "drive" but if the disk was re-partiioned the final effect is the same.

jaclaz

#6
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,801 posts
  • Joined 12-May 07
  • OS:none specified
  • Country: Country Flag
I guess I stand corrected, though I could have sworn I had recovered data from a disc that had been formatted by Win 7. I guess it now depends if the OP's unattended did a full format or not.

Cheers and Regards

Posted Image


#7
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

I guess I stand corrected, though I could have sworn I had recovered data from a disc that had been formatted by Win 7. I guess it now depends if the OP's unattended did a full format or not.

Perfect, we missed this also :whistle:
http://grammarist.co...ling/disc-disk/

Just for the record a hard disk, is never "formatted", it is "partitioned".
Partitions or Volumes or drives in it may be "formatted".

jaclaz

#8
myselfidem

myselfidem

    Member

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,559 posts
  • Joined 06-January 10
  • OS:Windows 7 x64
  • Country: Country Flag
It seems the error was to use an Autounattend.xml file with automatic partitioning and all the disk was wiped!

Change the value about this question to avoid future loss of data !

Edited by myselfidem, 29 September 2012 - 01:13 PM.

For Windows 7 OS: SetProductKey.rar (fr-FR/en-US. Integrate keys).

#9
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Allright, I wasn't precise with terminology :P

These days there usually is nothing like wipe unless you forcefully do it, either by specialized software or non-quick format.

I couldn't recover anything, because I was double or even triple unlucky.

The data disk was repartitioned by the setup, which is obviously enough to kiss anything on it good bye (I could find traces of lots of mp3 files, but reported sizes were few kB. Not a single trace of any .mkv file, and the disk was pretty much full of movies.).

I was doing backups of some sort using the two disks, but how on earth could I expect this to happen.I only could imagine a disk malfunctioning, in which case I could just copy the important stuff over from the other.

I had two partitions on the SSD, the 2nd being used for programs I don't install. Unfortunately, I could only recover file structure from it, nothing was readable at all, but thank satan for at least that, at least I knew what stuff I needed to redownload. Conclusion: data recovery on TRIM-enabled SSD is impossible.

Now after a bit of time I guess the absolutely worst thing was losing all the favourites (and mails since 2004 too I guess, even if they were not important, just from the sentimental point of view), because over the years I saved loads of interesting and important links.




Guess I need to buy some premade NAS or build a file server myself.



#10
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

mysel, you are right. But I've been using this approach for over a year on lots of machines and it always worked without problems. I am extremely curious what the hell happened there. Disk 0 is always disk 0, isn't this kind of decided by BIOS?

#11
myselfidem

myselfidem

    Member

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,559 posts
  • Joined 06-January 10
  • OS:Windows 7 x64
  • Country: Country Flag
Yes, it seems possible if some changes has been made with Diskpart when there is 2 Disks (Disk 0 and Disk 1).

Edited by myselfidem, 29 September 2012 - 01:24 PM.

For Windows 7 OS: SetProductKey.rar (fr-FR/en-US. Integrate keys).

#12
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

The weird thing is I installed Windows on this machine at least four times in total and it always went fine. I've ran into the rather common (it seems) problem when setup pops up en error message saying there's no driver for CD/DVD drive though. Something MIGHT had gone wrong there since this is directly related to the SATA controller, though. Who knows.




The good thing about this whole thing is that

1) I will start doing some more fail-proof backups from this point on

2) I bought File Scavenger

#13
dencorso

dencorso

    Iuvat plus qui nihil obstat

  • Supervisor
  • 6,026 posts
  • Joined 07-April 07
  • OS:98SE
  • Country: Country Flag

Donator


I guess I stand corrected, though I could have sworn I had recovered data from a disc that had been formatted by Win 7. I guess it now depends if the OP's unattended did a full format or not.

Perfect, we missed this also :whistle:
http://grammarist.co...ling/disc-disk/

I, myself, use "disc" for optical media and "disk" for any other case.
While the grammarist is right in saying that the form "disk" is the preferable one for almost all cases, for optical media alone, there's a strong case for "disc" in the trademaks themselves, and their conventional logos, such as:

Posted Image ............ Posted Image ............ Posted Image



#14
myselfidem

myselfidem

    Member

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,559 posts
  • Joined 06-January 10
  • OS:Windows 7 x64
  • Country: Country Flag

I've ran into the rather common (it seems) problem when setup pops up en error message saying there's no driver for CD/DVD drive though.


Create a new time your Windows image, there is an error maybe about the iso creation !?
For Windows 7 OS: SetProductKey.rar (fr-FR/en-US. Integrate keys).

#15
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Nope, it works perfectly fine in VM. When I ran into it the first few times I freaked out, but after some googling it seems to be not so uncommon problem.

#16
dencorso

dencorso

    Iuvat plus qui nihil obstat

  • Supervisor
  • 6,026 posts
  • Joined 07-April 07
  • OS:98SE
  • Country: Country Flag

Donator

With all due respect, the problem is Murphy's Law!
All your tests will always work OK, ever: they should, since they're not mission-critical and you have nothing to loose.
Now, this does *not* mean it's safe to use unattended procedures with unbacked-up precious content present in the machine, because then things become mission-critical and you've got *a lot* to loose, and this means things will go wrong at this point: that is what Murphy's Law is all about. Sorry!
You should have at least opened the box and physically disconnected the HDD where you had unbacked-up precious data, before proceeding unattended. Or created a pair of full, known-good, off-line backups, which would be the best course to take. Sorry, my intention is not at all to lecture on you, just to get the matter in the right light (or focus, or whatever such metaphor you like most).

#17
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

I am not saying you are wrong :P

#18
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

The data disk was repartitioned by the setup, which is obviously enough to kiss anything on it good bye

NO, it isn't. :realmad:

Heck!! I am trying to reduce the chance of misunderstandings.

  • Re-partitioning a disk changes (at the most) 4*16=48 bytes in the MBR and, if Extended Partition volumes are used a bunch of other sectors. <- in practice EVERYTHING CAN be recovered if only primaries are created and ALMOST EVERYHING if also logical volumes were created
  • Re-formatting a pre-existing partition (with the same filesystem it was there before) under MS OS up to XP (or in later OS with the /Q switch or "quick" mode) overwrites the filesystems structure <- EVERYTHING that was not fragmeneted CAN be recovered - possibly losing the original filename
  • Re-formatting a pre-existing partition (with a different filesystem) under MS OS up to XP (or in later OS with the /Q switch or "quick" mode) overwrites OTHER parts of the filesystem structure <- in most cases almost EVERYTHING can be recovered, often including fragmented files and their names
  • Formatting a new partition made at different addresses than the pre-existing one under MS OS up to XP (or in later OS with the /Q switch or "quick" mode) overwrites other areas <- results will differ on a case per case basis, but in many cases a large number of files can be recovered
  • If a disk has been wiped, NOTHING can be recovered.
  • If a partition or volume (newly made or pre-existing) has been formatted on Vista :ph34r: or later OS without the /q switch, the area occupied by the partition of volume will be wiped and NOTHING can be recovered from it

Fully Unattended is (of course IMHO) overall a "foolish" approach (because of Murphy's Law) in each and every case, EXCEPTION made for "bare metal" deployment.

Please note how OP never explicitly stated WHICH windows OS was used, though in his profile there is "Windows 7 x64".


jaclaz

Edited by jaclaz, 30 September 2012 - 05:00 AM.


#19
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Well, then explain why I couldn't recover jack sh... even though only like first 10 GB were overwritten (the bloody system WAS installed on wrong disk like I said before), I couldn't even see a single trace of any of the huge movie files.




Fully unattended setup is great... as long as you have only one physical disk in the PC :P



#20
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Well, then explain why I couldn't recover jack sh... even though only like first 10 GB were overwritten (the bloody system WAS installed on wrong disk like I said before), I couldn't even see a single trace of any of the huge movie files.


If you ONLY repartitioned, you didn't write "only" 10 Gb.
If the subsequent format and/or install overwrote 10 Gb then you have lost the first 10 Gb, including, most likely the $MFT (I presume it was a NTFS partition).

ANY non fragmented file residing physically beyond the overwritten area can be recovered, often losing it's original filename.

The fact that you were not able to recover anything means NOT that anything wasn't recoverable, it simply means that you were not able to recover anything.

And without any meaningful detail (the ones you completely failed to provide) and EXACT sequence of the steps you performed, even if I wanted to find an explanation, I would not be able to.


jaclaz

Edited by jaclaz, 30 September 2012 - 01:19 PM.


#21
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Which meaningful details I completely failed to provide, pretty please?

If you don't want to find an explanation (I am not even asking anyone to do so anyway) why do you bother posting here?

You know, you are kind of ridiculing me here for not being exactly precise with describing stuff, but you didn't even pay attention to what I wrote in the first place. I might had not said 10 (20, 500, 2323)GB were owerwritten, but I specifically mentioned different (wrong) disk was used for the installation.




Anyway, when a mod comes around, this could be locked down because nothing meaningful could be added to the subject. Thanks.



#22
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,801 posts
  • Joined 12-May 07
  • OS:none specified
  • Country: Country Flag
Try not to be too offended. Most of those types of statements from jaclaz are usually meant to either get you thinking of what important details you might have forgotten, or as an example to other readers of the type of questions and info that are required to get the best answer the quickest. It might help if you were to provide the exact statements in your unattended that have anything to do with partitioning, formatting and installing the OS so that we can get a even better idea where to go from here, if anywhere. Also I think jaclaz mentioned being curious which OS exactly was installed - Win7 x64 we assume? What all have you tried to recover the data off the disc? I think you said you were not able to find anything, right? Are you using the newly installed OS on the disc, or did you go ahead and install onto the "right" disc and you're using that?

Cheers and Regards

Posted Image


#23
Octopuss

Octopuss

    I am the walrus

  • Member
  • PipPipPipPipPipPip
  • 1,127 posts
  • Joined 31-January 07
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Allright, I am fairly short-tempered and I just didn't like his tone, it reminded me too much of lots of people on the internets who like to outsmart others and make them look like idiots. That doesn't necessarily make it true though, does it...




90% of the disk was filled with 5-20GB movie files of which I could not find a single trace. There was also some music there, but I could find traces of those files, although reported sizes were only in kB.

Yes system is Win7 x64 as stated in my "profile".

What actually happened was wrong disk was chosen by the setup, OS installed on it, but after that the correct one was used for boot (at least in the very final stage). Basically after I booted into Windows and realized what happened, nothing was written onto it (by me at least, not sure how much does OS write in the background, but probably very little if anything)

I use (and been using for years) File Scavenger for recovery purposes, long scan, both ran on the partitions and disk as a whole.

<DiskConfiguration>
                <Disk wcm:action="add">
                    <DiskID>0</DiskID>
                    <WillWipeDisk>true</WillWipeDisk>
                    <CreatePartitions>
                        <CreatePartition wcm:action="add">
                            <Order>1</Order>
                            <Type>Primary</Type>
                            <Size>100</Size>
                        </CreatePartition>
                        <CreatePartition wcm:action="add">
                            <Order>2</Order>
                            <Type>Primary</Type>
                            <Size>51200</Size>
                        </CreatePartition>
                        <CreatePartition wcm:action="add">
                            <Order>3</Order>
                            <Type>Primary</Type>
                            <Extend>true</Extend>
                        </CreatePartition>
                    </CreatePartitions>
                    <ModifyPartitions>
                        <ModifyPartition wcm:action="add">
                            <Order>1</Order>
                            <PartitionID>1</PartitionID>
                            <Active>true</Active>
                            <Format>NTFS</Format>
                            <Label>Boot</Label>
                        </ModifyPartition>
                        <ModifyPartition wcm:action="add">
                            <Order>2</Order>
                            <PartitionID>2</PartitionID>
                            <Format>NTFS</Format>
                            <Letter>C</Letter>
                            <Label>SYSTEM</Label>
                        </ModifyPartition>
                        <ModifyPartition wcm:action="add">
                            <Order>3</Order>
                            <PartitionID>3</PartitionID>
                            <Format>NTFS</Format>
                            <Letter>F</Letter>
                            <Label>PROGRAMY</Label>
                        </ModifyPartition>
                    </ModifyPartitions>
                </Disk>
            </DiskConfiguration>
            <ImageInstall>
                <OSImage>
                    <InstallFrom>
                        <MetaData wcm:action="add">
                            <Key>/IMAGE/INDEX</Key>
                            <Value>1</Value>
                        </MetaData>
                    </InstallFrom>
                    <InstallTo>
                        <DiskID>0</DiskID>
                        <PartitionID>2</PartitionID>
                    </InstallTo>
                </OSImage>
            </ImageInstall>



#24
myselfidem

myselfidem

    Member

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,559 posts
  • Joined 06-January 10
  • OS:Windows 7 x64
  • Country: Country Flag
You mean wrong Disk or wrong PartitionID ?
For Windows 7 OS: SetProductKey.rar (fr-FR/en-US. Integrate keys).

#25
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,675 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
I'll try to expand. :)
I know that you know what you did and what happened, but you failed to describe it with enough accuracy/details, and/or provided conflicting reports.

Initially you talked of having wiped the disk. (the disk is "the whole thing" from sector LBA 0 up to the last sector accessible on the media).
Then you talked of re-partitioning (and implicitly formatting the new partition(s)) and "installing".

Then of having lost 1TB of data. (which possibly means that the drive was actually a 1 Tb in size one and was filled "up to the brim").
Still you did not provide EXACT details on how it was partitioned before and after the accident.

If you actually wiped the disk, NOTHING can be recovered. <- each and every sector of the disk is filled with zeroes
If you actually repartitioned the disk and formatted each partition/volume without the /q switch under the (presumed) Windows7 OS, NOTHING can be recovered. <- each and every sector of each partition/volume is filled with zeroes (the ones that are not are filled with the filesystem structure data)

Then you talked of having written 10 Gb (which obviously only overwrites 10 Gb or a little more than that).

IF the "format" command in your unattended setup behaves like the "full format" you have lost EVERYTHING.
IF as I suspect, it does instead a "quick" one, there may be chances.

To completely wipe (or "format full") a 1 Tb hard disk takes A LOT of time (hours), if it took you minutes to do the install it is not possible that you have wiped the whole 1 Tb.

NON FRAGMENTED files that have NOT been overwritten may still be recoverable.
It is UNcommon that very large files like the one you described are non-fragmented, though :(.

File Scavenger is an exceptionally good tool :thumbup , but it is not the only one and not necessarily the "right" one to attempt recovering those files.

As an example, if I had that accident happen to me :w00t: I would try defraser:
http://sourceforge.n...jects/defraser/
http://computer-fore...llocated-space/

jaclaz




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users