I was wondering if I could recover data off a partially formatted hard drive. While installing windows on my laptop, I accidentally chose my external HD (western digital 120gb passport) over the laptop HD. The drive only had the install run for a few seconds, but now everytime i plug it in, it asks me to format it. Is there any way to get the old data off the drive?
- Status
SizroSpunkmire
Distinguished
- Sep 18, 2008
- 80
- 0
- 18,630
There are plenty of free recovery tools that can be run. Formatting a drive only wipes the first and last 300 sectors of the disk (essentially the mft and partition tables.). All the data in between is fine and can easily be recovered.
A very common misconception with formating is that it removes all the data. The only reason the data appears deleted is because the Master File Table is no longer present. Windows uses the MFT to address where on the disk the files are. If there is no MFT record for a specific location on the disk, its assumed to be free space. This is why its vital to never create new files on a drive that needs to be recovered; you can accidentally overwrite the data your trying to save.
Formatting a harddrive is like removing the catalog cabinet in your local library that contains all those little dewey-decimal cards without doing anything to the books themselves. Sure the data is still there but locating them is now impossible. Data recovery software doesn't care if there is an MFT or not and simply reads the data on the drive in the same way a librarian can ignore the card catalog and go track down the book directly.
A very common misconception with formating is that it removes all the data. The only reason the data appears deleted is because the Master File Table is no longer present. Windows uses the MFT to address where on the disk the files are. If there is no MFT record for a specific location on the disk, its assumed to be free space. This is why its vital to never create new files on a drive that needs to be recovered; you can accidentally overwrite the data your trying to save.
Formatting a harddrive is like removing the catalog cabinet in your local library that contains all those little dewey-decimal cards without doing anything to the books themselves. Sure the data is still there but locating them is now impossible. Data recovery software doesn't care if there is an MFT or not and simply reads the data on the drive in the same way a librarian can ignore the card catalog and go track down the book directly.
I have the same problem. Windows was doing some updating and somehow updated info on my external hard drive. Now my pc keeps saying I need to format my external in order to use it. Are you sure that if I choose to format it,that I will only loose some of it? Because I will be devastated if I loose it all. Plaase help!
thetrivialstuff
Distinguished
- Jun 4, 2011
- 22
- 0
- 18,520
Most of your data is probably recoverable. Here's an overview of what needs to be done:
First of all, as another poster said, copy all sectors of the drive into an image file as a backup. Windows cannot do this natively; you'll need some third-party tool to do it in Windows. If you know Linux at all, this is dead simple to do with the 'dd' command (but its joke name isn't "destroy disk" for nothing -- dd is dangerous; be careful!).
Then you need to:
- Find out whether you nuked the partition table, or just reformatted the same partition.
- If you nuked the partition table, you need to reconstruct it. The easiest way to do this is to actually use some partitioning tool and just make the partitions the way they were before. If you don't have a record of the exact layout, you'll need to find the partition offsets by looking for the first block of each filesystem. Google your filesystem to find out what its signature is. Then you need to do a bunch of math.
- If you didn't touch the partition table, your job just got easier and harder at the same time. The good news: no partition table math. The bad news: you nuked the master file table, so all your files are orphaned and not at all easy to recover.
- There should be a backup copy of the master file table somewhere. Since you're using Windows, I'll assume it's FAT or NTFS. Either of those only have one backup. If it's FAT, you're probably screwed, because the secondary FAT sits right next to the first FAT and would have been clobbered right away by the format. If it's NTFS you might have slightly more luck, but there's still a good chance that the format got both copies of the MFT. If you can find it and restore it (by copying it back onto the first MFT location), you're in luck -- your files should all be waiting for you next time you mount the disk. If the MFT was fragmented, this is probably not going to be easily doable, so you'll have to find a tool that can use the backup MFT to browse the filesystem -- I recommend one called DiskExplorer, which I've used to restore files from exactly this situation.
- If the backup file table is wiped, you can still get at your data, but now you're down to finding it one file at at time based on file signatures/content. Any file that was fragmented is probably unrecoverable (you'll get the first piece, but good luck finding any subsequent pieces). There are tools available to look for specific file types. Recovering smallish files with easily findable header signatures that are always the same is easy -- you will get all of your JPEG's and Word documents back. Good chance any music files are also recoverable. Recovering larger files (like movies) is, as I said, unlikely if they're in more than one piece, but since this is an external hard drive that presumably didn't have an OS running on it before, there's a fairly good chance most of the large files are in one piece unless you've really done a lot of copying and deleting on that drive. Recovering things like text files, which don't always look the same at the beginning, is harder, because you'll have to find each one based on its contents.
Good luck,
~Felix.
First of all, as another poster said, copy all sectors of the drive into an image file as a backup. Windows cannot do this natively; you'll need some third-party tool to do it in Windows. If you know Linux at all, this is dead simple to do with the 'dd' command (but its joke name isn't "destroy disk" for nothing -- dd is dangerous; be careful!).
Then you need to:
- Find out whether you nuked the partition table, or just reformatted the same partition.
- If you nuked the partition table, you need to reconstruct it. The easiest way to do this is to actually use some partitioning tool and just make the partitions the way they were before. If you don't have a record of the exact layout, you'll need to find the partition offsets by looking for the first block of each filesystem. Google your filesystem to find out what its signature is. Then you need to do a bunch of math.
- If you didn't touch the partition table, your job just got easier and harder at the same time. The good news: no partition table math. The bad news: you nuked the master file table, so all your files are orphaned and not at all easy to recover.
- There should be a backup copy of the master file table somewhere. Since you're using Windows, I'll assume it's FAT or NTFS. Either of those only have one backup. If it's FAT, you're probably screwed, because the secondary FAT sits right next to the first FAT and would have been clobbered right away by the format. If it's NTFS you might have slightly more luck, but there's still a good chance that the format got both copies of the MFT. If you can find it and restore it (by copying it back onto the first MFT location), you're in luck -- your files should all be waiting for you next time you mount the disk. If the MFT was fragmented, this is probably not going to be easily doable, so you'll have to find a tool that can use the backup MFT to browse the filesystem -- I recommend one called DiskExplorer, which I've used to restore files from exactly this situation.
- If the backup file table is wiped, you can still get at your data, but now you're down to finding it one file at at time based on file signatures/content. Any file that was fragmented is probably unrecoverable (you'll get the first piece, but good luck finding any subsequent pieces). There are tools available to look for specific file types. Recovering smallish files with easily findable header signatures that are always the same is easy -- you will get all of your JPEG's and Word documents back. Good chance any music files are also recoverable. Recovering larger files (like movies) is, as I said, unlikely if they're in more than one piece, but since this is an external hard drive that presumably didn't have an OS running on it before, there's a fairly good chance most of the large files are in one piece unless you've really done a lot of copying and deleting on that drive. Recovering things like text files, which don't always look the same at the beginning, is harder, because you'll have to find each one based on its contents.
Good luck,
~Felix.
thetrivialstuff
Distinguished
- Jun 4, 2011
- 22
- 0
- 18,520
Here's another way of doing it, if you still have one copy of the FAT or Master File Table intact:
http://www.linuxforums.org/forum/miscellaneous/138324-pebkac-formatted-first-16-megs-fat32-partition.html
Basically:
1. Image the drive to a file somewhere else
2. Format the drive with the same settings as you used the first time you formatted it (i.e. years ago, way before this. If you don't remember, or if you didn't format the drive yourself, it probably used the defaults)
3. Try to find the point that the accidental format reached
4. Splice everything after that point back onto the newly formatted drive
I think this has a better chance of working under FAT than NTFS.
~Felix.
http://www.linuxforums.org/forum/miscellaneous/138324-pebkac-formatted-first-16-megs-fat32-partition.html
Basically:
1. Image the drive to a file somewhere else
2. Format the drive with the same settings as you used the first time you formatted it (i.e. years ago, way before this. If you don't remember, or if you didn't format the drive yourself, it probably used the defaults)
3. Try to find the point that the accidental format reached
4. Splice everything after that point back onto the newly formatted drive
I think this has a better chance of working under FAT than NTFS.
~Felix.
ricno
Distinguished
- Apr 5, 2010
- 582
- 0
- 19,010
This is different between operating system versions. Here is an article about this, regarding the server versions Windows 2003 and 2008, but it is exactly the same between Win XP and Win 7. Basically a full format these days destroys all your data, and it is common misconception that it is a common misconception that no data is erased.
thetrivialstuff
Distinguished
- Jun 4, 2011
- 22
- 0
- 18,520
ricno :
This is different between operating system versions. Here is an article about this, regarding the server versions Windows 2003 and 2008, but it is exactly the same between Win XP and Win 7. Basically a full format these days destroys all your data, and it is common misconception that it is a common misconception that no data is erased.
Yea - but doesn't everybody always pick "quick format" because full takes too long?
~Felix.
- Status
TRENDING THREADS
-
Question How to correctly identify and oragnize PSU cables with their respective PSUs
- Started by BlackOrangutan
- Replies: 5
-
-
-
Question How to stop Microsoft Store Apps zombie auto updates?- Started by Cellie
- Replies: 0
-
-
Question Window 10 Keeps sending me back to download screen
- Started by fern213
- Replies: 4
Facebook
Twitter
Instagram