• Announcements

    • xper

      MSFN Sponsorship and AdBlockers!   07/10/2016

      Dear members, MSFN is made available via subscriptions, donations and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, become a site sponsor and ads will be disabled automatically and by subscribing you get other sponsor benefits.
Octopuss

Data recovery - do I have any chance?

34 posts in this topic

myself, it used wrong disk, but partitioning went as it should.

jac, I defragmented the disk just couple days before. So in theory you are absolutely right. But reality check had different opinion :P

At least I have lots of free space on the data disk now, lol.

0

Share this post


Link to post
Share on other sites

myself, it used wrong disk, but partitioning went as it should.

Which again tells nothing.

I won' t insist on asking exact details :no: since you are evidently not in the right mood to provide them, after all it's you that have lost the files and posted here for help, literally:

Data recovery - do I have any chance?

On the record it is now noted how I did try to provide some help :yes: .

Too bad I lost my time, admittedly not very precious, but still.... :(

demotivational-posters-disappointed-eagle.jpg

bye.gif

jaclaz

0

Share this post


Link to post
Share on other sites

myself, it used wrong disk, but partitioning went as it should.

Which again tells nothing.

It might help to occasionally describe the specific info you would like to get, rather than just point out the general failures of info you didn't get. :) Some people learn better from examples rather than trying to guess what you are looking for. Just sayin'...

Cheers and Regards

Edited by bphlpt
0

Share this post


Link to post
Share on other sites

I'll try to expand. :)

I know that you know what you did and what happened, but you failed to describe it with enough accuracy/details, and/or provided conflicting reports.

Initially you talked of having wiped the disk. (the disk is "the whole thing" from sector LBA 0 up to the last sector accessible on the media).

Then you talked of re-partitioning (and implicitly formatting the new partition(s)) and "installing".

Then of having lost 1TB of data. (which possibly means that the drive was actually a 1 Tb in size one and was filled "up to the brim").

Still you did not provide EXACT details on how it was partitioned before and after the accident.

If you actually wiped the disk, NOTHING can be recovered. <- each and every sector of the disk is filled with zeroes

If you actually repartitioned the disk and formatted each partition/volume without the /q switch under the (presumed) Windows7 OS, NOTHING can be recovered. <- each and every sector of each partition/volume is filled with zeroes (the ones that are not are filled with the filesystem structure data)

Then you talked of having written 10 Gb (which obviously only overwrites 10 Gb or a little more than that).

IF the "format" command in your unattended setup behaves like the "full format" you have lost EVERYTHING.

IF as I suspect, it does instead a "quick" one, there may be chances.

To completely wipe (or "format full") a 1 Tb hard disk takes A LOT of time (hours), if it took you minutes to do the install it is not possible that you have wiped the whole 1 Tb.

NON FRAGMENTED files that have NOT been overwritten may still be recoverable.

It is UNcommon that very large files like the one you described are non-fragmented, though :(.

File Scavenger is an exceptionally good tool :thumbup , but it is not the only one and not necessarily the "right" one to attempt recovering those files.

As an example, if I had that accident happen to me :w00t: I would try defraser:

http://sourceforge.net/projects/defraser/

http://computer-forensics.sans.org/blog/2009/05/13/automated-recovery-of-multimedia-from-unallocated-space/

jaclaz

The only point that I got out of that post that the OP had not addressed in his previous post to this (#23) was the implied question of the exact size of the disk and how it had been previously partitioned prior to the mishap. Did I miss something?

I agree with jaclaz that even though the unattended file specifies that "<WillWipeDisk>true</WillWipeDisk>", and I didn't see a /q option specified for any of the partition format statements, if the OP was able to find any info at all during his recovery efforts, then there must not have been a "wipe" executed and the format must have been a quick one:

[...] as I suspect, it does instead a "quick" one, [...]

So there might be a small chance to recover more of the OP's data.

Cheers and Regards

Edited by bphlpt
0

Share this post


Link to post
Share on other sites

It might help to occasionally describe the specific info you would like to get, rather than just point out the general failures of info you didn't get. :) Some people learn better from examples rather than trying to guess what you are looking for. Just sayin'...

It might help with people that ask for help and actually want to have it, it doesn't for those that don't.

On hindsight, my original mistake was to presume that there was an interest in attempting recovering (if possible) some data, now re-reading the OP it is more clear to me how it was just a rant.

For future use, the standard litany (not so casually called "standard" and not so casually called "litany") is here for everyone:

http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/problem-report-standard-litany.html

I guess everyone can adapt it to his/her specific situation well enough.

On the specific topic, this was IMHO a good hint:

To completely wipe (or "format full") a 1 Tb hard disk takes A LOT of time (hours), if it took you minutes to do the install it is not possible that you have wiped the whole 1 Tb.

that can be re-worded as:

How long did it take to wipe/format/install?

(simplified) If it took minutes, you have some chances if it took hours you have NONE. (of course proportioned to the size of the whatever - disk or partition/volume - that was wiped)

As a comparison, we have a report about wiping times:


http://reboot.pro/13601/page__st__75#entry1194932.5" 250GB HDD took 82 mins to erase using HDDErase <- this is native ATA command, nothing can be faster than this, because there is no data going through the interface
http://reboot.pro/13601/page__st__75#entry119521
with DBAN the same 2.5" 250GB drive took 3.5hrs <- this is a software wipe, more or less a software wipe will have this kind of speed, i.e. max speed of data transfer

jaclaz

Edited by jaclaz
0

Share this post


Link to post
Share on other sites

I am extremely curious what the hell happened there. Disk 0 is always disk 0, isn't this kind of decided by BIOS?

Disk numbering in WinPE is determined on the speed it takes to enumerated the detected disks. I have done a ton of testing in the past using Spindle disks, SSDs and card readers. On certain systems, the numbering can change between a HDD and a card reader on multiple boots. Plus, how the devices are connected physically (board-level) seems to have an effect on disk numbering. Disks connected via the PCI or SATA bus typically enumerate faster than those connected via the USB bus. But this isn't always the case.

When it comes to installing an OS onto a system with a data disk, I always unplug that drive for instalation just because I don't trust Windows to install on the correct disk, whether or not I am using an answer file.

0

Share this post


Link to post
Share on other sites

Have you configured your Disks as Disk0 = Master and Disk1 = Slave ,first ?

I think we can also improve the Autounattend.xml file, like this, adding more values:

(Using your example):


<DiskConfiguration>
<WillShowUI>OnError</WillShowUI>
<Disk wcm:action="add">
<DiskID>0</DiskID>
<WillWipeDisk>true</WillWipeDisk>
<CreatePartitions>
<CreatePartition wcm:action="add">
<Order>1</Order>
<Type>Primary</Type>
<Size>100</Size>
</CreatePartition>
<CreatePartition wcm:action="add">
<Order>2</Order>
<Size>51200</Size>
<Type>Primary</Type>
</CreatePartition>
<CreatePartition wcm:action="add">
<Order>3</Order>
<Type>Primary</Type>
<Extend>true</Extend>
</CreatePartition>
</CreatePartitions>
<ModifyPartitions>
<ModifyPartition wcm:action="add">
<Order>1</Order>
<PartitionID>1</PartitionID>
<Label>System</Label>
<Format>NTFS</Format>
<Active>true</Active>
</ModifyPartition>
<ModifyPartition wcm:action="add">
<Order>2</Order>
<PartitionID>2</PartitionID>
<Letter>C</Letter>
<Label>WINDOWS</Label>
<Format>NTFS</Format>
</ModifyPartition>
<ModifyPartition wcm:action="add">
<Order>3</Order>
<Format>NTFS</Format>
<PartitionID>3</PartitionID>
<Label>PROGRAMY</Label>
<Letter>D</Letter>
</ModifyPartition>
</ModifyPartitions>
</Disk>
</DiskConfiguration>
<ImageInstall>
<OSImage>
<InstallFrom>
<MetaData wcm:action="add">
<Key>/IMAGE/INDEX</Key>
<Value>1</Value>
</MetaData>
</InstallFrom>
<InstallTo>
<DiskID>0</DiskID>
<PartitionID>2</PartitionID>
</InstallTo>
<WillShowUI>OnError</WillShowUI>
<InstallToAvailablePartition>false</InstallToAvailablePartition>
</OSImage>
</ImageInstall>

Check also the letters for CD\DVD drivers (usually E:\ and F:\) !

Edited by myselfidem
0

Share this post


Link to post
Share on other sites

Tripredacus, that's interesting. Looks like we have no control over this then.

myselfidem, now you got me. I thought master/slave was only relevant to ATA cables with two connectors. I just kind of plug the cables into the mb, starting with port 0.

Redoing the partition/drive letters is actually not a bad idea. I'd have change lots of things though, which apparently is why I simply put F on the new SSD partition back then.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.