Question 1.5TB of storage on my HDD got deleted and the HDD is now mostly unallocated space

Toggle sidebar Toggle sidebar
ErekS

ErekS

Reputable
May 25, 2020
13
0
4,510
I installed windows onto a new machine onto a m.2 nvme using a USB flashdrive. For some reason, it also was installed onto an HDD I had plugged in, and 1.5 TB of things I had saved on there, pictures, videos, games, etc... got deleted and replaced with windows. Also, the drive is now way smaller and 3/4ths of it is unallocated space at the moment, I can fix that, but I don't know how to get all my stuff back or if it's even possible. Currently, my pc is booting from my nvme, I have no idea why it would do that. Is there a way I can potentially get all of that back? It's a new machine everything in it is new except 2 HDDs and another m.2 nvme, so there are no restore points that have been made. If it helps, there is a $WINDOWS.~BT folder in the HDD that had gotten windows installed on it.

I probably fcked up in someway or another, would a software that scans my drive work?
 
Last edited:
Sort by date Sort by votes
helpstar said:
try pc inspector file recovery or recuva or similar , don´t do/write anything to the HDD, it will for sure destroy all data eventually recoverable.
Click to expand...
Thank you! I unplugged it from my PC for now and will test and try to recover everything on Sunday since I don't have to do a 10 hr shift then. I will get back to this thread at that time on whether I was able to successfully recover everything.
 
Upvote 0 Downvote
1. Before you start to do anything potentially destructive, please show us a screencap of your Disk Management window.
Discover the problem before applying a solution.

2. This is specifically what a good backup routine is for.

3. This is specifically why only ONE drive should be connected when installing the OS.
 
Upvote 0 Downvote
helpstar said:
try pc inspector file recovery or recuva or similar , don´t do/write anything to the HDD, it will for sure destroy all data eventually recoverable.
Click to expand...
USAFRet said:
1. Before you start to do anything potentially destructive, please show us a screencap of your Disk Management window.
Discover the problem before applying a solution.

2. This is specifically what a good backup routine is for.

3. This is specifically why only ONE drive should be connected when installing the OS.
Click to expand...
I used disk drill data recovery software and was able to retrieve all my old data back, now the problem is that I need to uncorrupt a lot of my files that were corrupted during the process.
 
Upvote 0 Downvote
Assuming that the original file system was NTFS, your misadventure probably overwrote the $MFT metafile. This file contains the info for every fiie and folder within the NTFS volume. This means that the data recovery software has to find any fragments of the $MFT that might lie outside the overwritten space, or perform "file carving". File carving involves detecting files by recognising their headers and then carving out the contiguous area of the drive that follows. The downside to this process is that files are not recovered with their original names, and only the first fragment of a fragmented file is recovered intact. In other words, any fragmented files will be corrupt.
 
Upvote 0 Downvote
fzabkar said:
Assuming that the original file system was NTFS, your misadventure probably overwrote the $MFT metafile. This file contains the info for every fiie and folder within the NTFS volume. This means that the data recovery software has to find any fragments of the $MFT that might lie outside the overwritten space, or perform "file carving". File carving involves detecting files by recognising their headers and then carving out the contiguous area of the drive that follows. The downside to this process is that files are not recovered with their original names, and only the first fragment of a fragmented file is recovered intact. In other words, any fragmented files will be corrupt.
Click to expand...
Sounds about right, the recovered data is sorted and renamed. They are organized by file type. So, every single file everywhere went into a different place instead of recovering in their original directory. Fortunately, the patient drive is still untouched and currently unplugged, nothing has written to it at all. I could run another scan/do another recovery process. I don't mind the renamed thing, but if possible, I would like to have everything recovered to their original directories.
 
Upvote 0 Downvote
https://imgur.com/a/x5jsJfq

fzabkar said:
I'm suggesting that the damage was already done during your new Windows installation ... somehow.

Can you show us the Partitions tab in DMDE?

https://dmde.com/
Click to expand...
Is this what you are looking for?
For more information, when I ran the recovery software, it did show everything with their names and correct directories, but when I actually recovered it, it made its own names and directories.
 
Upvote 0 Downvote
You can see the remnant of your original 2TB NTFS volume at sector 32768. The Indicators column is showing BCx instead of BCF. This means that DMDE was unable to find a file system (F).

If you d-click each of the "EBCF" volumes and expand the $Root, you should see the current contents of each volume. It does appear that the contents of the 524GB volume have overwritten your old data.
 
Upvote 0 Downvote
fzabkar said:
You can see the remnant of your original 2TB NTFS volume at sector 32768. The Indicators column is showing BCx instead of BCF. This means that DMDE was unable to find a file system (F).

If you d-click each of the "EBCF" volumes and expand the $Root, you should see the current contents of each volume. It does appear that the contents of the 524GB volume have overwritten your old data.
Click to expand...
Yes, my old data is gone. Which is why I am trying to recover it. I have recovered 1.49TB which is 100% of it onto an NVME, except they are renamed and sorted everywhere. Although, not all of them are renamed. Very few of them still have their original names and directories. Is there a specific program I can use to recover while keeping the directories of my original drive? Would running a full scan of my drive in DMDE do anything?
 
Upvote 0 Downvote
The only thing you can do in DMDE is to launch a full scan and deselect every file system other than NTFS. DMDE will then find all the MFT fragments and present you with a choice. If none of those choices contains your old files and folders, then you will not be able to reconstruct your original file system.
 
Upvote 0 Downvote
fzabkar said:
The only thing you can do in DMDE is to launch a full scan and deselect every file system other than NTFS. DMDE will then find all the MFT fragments and present you with a choice. If none of those choices contains your old files and folders, then you will not be able to reconstruct your original file system.
Click to expand...
Do I also deselect RAW? All the other file systems are deselected by default.
 
Upvote 0 Downvote
fzabkar said:
The only thing you can do in DMDE is to launch a full scan and deselect every file system other than NTFS. DMDE will then find all the MFT fragments and present you with a choice. If none of those choices contains your old files and folders, then you will not be able to reconstruct your original file system.
Click to expand...
https://imgur.com/a/2okjzfZ

Like so? When I deselect RAW it says, "Raw Scan may improve NTFS, exFAT, HFS results however it takes more time and memory."
It also says, "Raw Scan also allows recovering files if FS is unsupported or seriously damaged."

Should I keep it checked like shown in this image or should I uncheck it?
 
Upvote 0 Downvote
fzabkar said:
Your screenshot covers all the bases. DMDE will try to find NTFS metadata, plus it will augment the results using file carving (aka "raw scan").
Click to expand...
https://imgur.com/a/wZc8e7X

So, I was provided with all these NTFS results as I did a NTFS scan. When I double click on different ones, they do indeed provide me with my original folders in their correct directories. But files inside those folders such as images and or videos are not in there for some of them (when viewed from DMDE at least). I have a few questions looking at this screenshot.

Under the Start LBA tab, what is the different between the ones with positive and the ones with negative numbers?

Why does it seem like there are duplicates with the same exact storage? For example, NTFS 215 and NTFS 216 both have 293GB and the same number of files. Though their Start LBA number is different. What is Start LBA?

What is the difference between NTFS main results and NTFS additional results? Do main results contain all the additional results?

Lastly, how do I recover them while keeping the directories it is showing me in each of the NTFS results. I want all my data, no less and no more if possible.

If you need any more info or screenshots, I will gladly supply them.
 
Last edited:
Upvote 0 Downvote
AIUI, DMDE searches for all NTFS metadata (primarily the $MFT = Master File Table) and then tries to determine which NTFS volume they belong to, either an existing volume or remnants of old volumes. The first sector (aka LBA) of each volume is the boot sector for that volume.

Your Partitions tab shows an existing 524GB NTFS volume, $Noname 02, at LBA 239616 plus a "found" 2TB $Noname volume at LBA 32768. These two volumes appear in the Main Results. I confess that I don't understand the "Min. Size" that is reported for NTFS 0 and NTFS 9. (DMDE is poorly documented). However, if you d-click those two results you should see original file and folder names. That said, just because you can see the original file names doesn't mean that the file contents will not have been overwritten.

I confess that I don't understand the Additional Results. However, DMDE will sometimes report negative sector numbers if your drive was part of an array, eg spanned volume or JBOD. It just means that the sector exists on another member of the array.

In short, all you can do is to try each of the results and recover the files to another drive. Do the same with the raw results. Be aware that the free version of DMDE is limited to 4000 files of any size from any one folder per click. The standard version costs US$20.
 
Upvote 1 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom