Jump to content

Recover data from harddrive


Recommended Posts

I have a Samsung M3 Portable HD. I was using it as a Network Storage Device.

I connected it to a laptop and it didnt recognise it, for some reason so i went into computer management and went through a few options (sorry dont fully remember) which now has made the drive unreadable. Everytime i connect it, it tells me i need to format it. Its set as a RAW file system in computer management.

I dont want to format it as i never made a backup of that data. So installed recuva to see if it could recover the documents. Unfortunately that too said to format as it cant read the drive.

Is there anything else i could try or would it be feasible to do a quick format and then use Recuva to get the files?

Thanks

Link to comment
Share on other sites


Well, you are not posting enough data to even attempt to provide you with possible answers/advice.

The only sure thing is that you shouldn't EVEN THINK of doing a quick format and then running Recuva.

Your disk - for whatever reason(s) - is now seen as either as unpartitioned or with an unformatted partition.

Which OS are you running?

Which OS was running on the laptop?

How big is the hard disk?

How was it partitioned before?

Which filesystem(s) was/were in the partition(s)/volume(s) on it?

Answers to the above questions are needed, as well as you getting TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

and run it with the LOG option and attaching the log to your next post.

jaclaz

Edited by jaclaz
Link to comment
Share on other sites

Well, you are not posting enough data to even attempt to provide you with possible answers/advice.

The only sure thing is that you shouldn't EVEN THINK of doing a quick format and then running Recuva.

Your disk - for whatever reason(s) - is now seen as either as unpartitioned or with an unformatted partition.

Which OS are you running?

Which OS was running on the laptop?

How big is the hard disk?

How was it partitioned before?

Which filesystem(s) was/were in the partition(s)/volume(s) on it?

Answers to the above questions are needed, as well as you getting TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

and run it with the LOG option and attaching the log to your next post.

jaclaz

Running Win8 Pro 64bit with all updates

1TB HD

I believe it was partitioned before as NTFS

One volume on that partition

I think i may have shot myself in the foot here. I misread your post and ran quick format :crazy: - Anything else i could try now or have i just crossed the line of no return? All im after is the iso files on that HD

Link to comment
Share on other sites

I think i may have shot myself in the foot here. I misread your post and ran quick format :crazy: - Anything else i could try now or have i just crossed the line of no return? All im after is the iso files on that HD

It depends.

IF you quick formatted (AND NOT "full" formatted) AND IF you quick formatted under the SAME Operating System AND filesystem as the partition/volume was originally formatted, THEN:

  1. any non-fragmented (i.e. contiguous) file can be normally recovered, including it's filename as long as it was in a directory (NOT in root)
  2. any non-fragmented (i.e. contiguous) file can be recovered, losing only it's filename and/or needing - maybe - some patching/correction
  3. any fragmented file is normally lost (unless a valid directory entry for it has been not overwritten, i.e. this depends on how "full" was the disk and on a number of other factors)

Your best choice right now is to get this tool:

http://dmde.com/

and see if it can rebuild a volume structure.

The free edition can recover one file at the time, up to you (IF it can find the files you are interested in) to recover them one by one or upgrade to a paid for edition.

Alternatively, you can try the PHOTOREC tool (complement to the mentioned TESTDISK):

http://www.cgsecurity.org/wiki/PhotoRec

Take your time

DON'T PANIC

(assume that the above is written in large, friendly letters)

don't do in a hurry anything you are NOT very sure about, ideally you should now make a "forensic sound" image of the disk "as is", BEFORE making further "damages" by mistake :ph34r:

jaclaz

Link to comment
Share on other sites

Thanks Jaclaz, at present ive downloaded the tool and clicked Drive > selected the drive > NTFS search and started it. Hopefully this is on the correct track as according to the documentation (http://dmde.com/manual/datarecovery.html) i didnt find the option "open virtual directory".... so have continued in what i think should find the files? Thought to ask as im hoping after searching a 1TB drive it doesnt come back to say ive made some kind of error?

Link to comment
Share on other sites

There is must be something that you either fail to report properly or that I misinterpreted.

If you just (quick) formatted the partition/volume it should find (as soon as you choose the PhysicalDrive) the actual volume and prompt you for a found volume (that will be marked with green EBCF) you should first try to open that volume and then on the left side you should click on "All Found + Reconstruction".

Basically the (quick) format (IF done under the same OS as the original) will overwrite parts of the $MFT (i.e. without changing the actual $MFT location), the NTFS search won't find "other" $MFT's (though it may found and detect remaining parts of the previous $MFT as "fragments" of other $MFT).

In any case, provided that there was only one partition on that disk, the $MFT will normally be on LCN 786432, i.e. around 786432*4096+63 or around 786432*4096+2048 roughly 3 Gb, there is not much sense in searching a $MFT after that area, you can safely stop the NTFS search if your progress (the amount of bytes "scanned") is above (say) 4 or 5 Gb.

jaclaz

Edited by jaclaz
Link to comment
Share on other sites

I see the All found + Reconstruction but i dont see any files on that volume? I have reconstructed the File system and still nothing there. There was 3 folders on the root of this drive which contained all the files within.

On the positive side i ran PhotoRec which has recovered files but problem with that its doesnt seem to keep the directory structure so i have quiet a few files with different names and in no order. So thanks for that.

Link to comment
Share on other sites

I see the All found + Reconstruction but i dont see any files on that volume? I have reconstructed the File system and still nothing there. There was 3 folders on the root of this drive which contained all the files within.

Most probably the $MFT was "small enough" and has been completely overwritten :unsure:

On the positive side i ran PhotoRec which has recovered files but problem with that its doesnt seem to keep the directory structure so i have quiet a few files with different names and in no order. So thanks for that.

Yep, that is the issue with "pure file based" recovery, but I guess that is better to have files (eiher mixed or without original names) than having no files at all ;).

Remember that there are no real "assurance" that a recovered file is valid (contiguous files will be, non-contiguous most probably not) so you will need anyway open/check them one by one.

jaclaz

Link to comment
Share on other sites

One other question i have is, is it possible to recover files by extension? At the moment its recovering files that i could do without but if i could recover files by an extension that would allow save me time? I couldnt find any reference for this.

Link to comment
Share on other sites

One other question i have is, is it possible to recover files by extension? At the moment its recovering files that i could do without but if i could recover files by an extension that would allow save me time? I couldnt find any reference for this.

Strangely enough ;) the reference is in the tool's "Step_By_Step" guide:

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

Hidden in a part titled "Selection_of_files_to_recover":

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step#Selection_of_files_to_recover

Such Options for Files are in the tool under a menu curiously called "[File Opt]"

As in:

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step#Source_partition_selection

Choose

  • Search after selecting the partition that holds the lost files to start the recovery,
  • Options to modify the options,
  • File Opt to modify the list of file types recovered by PhotoRec.

:whistle:

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...