Question My hdd is in RAW format after make a booteable hdd of Windows 10. Can DMDE to fix it?

[Carles3456]

My 5 tb external hdd showed bad state in CrystalDiskInfo, so I bougth another 5tb external hdd and cut-paste all the data into it (the old hdd is now empty of data)

The next day, I had to install Windows and used the installer tool from Microsoft page to make a booteable usb image to using it in Rufus. But instead of make it, I made a booteable windows hdd in my new 5 tb and got a fat32 hdd with only 31,9 GB.

Then I read an article that could fix the mistake and did this:

Opened Disk Management and deleted the FAT32 31,9 GB Volume. Then, did Right click that unallocated space and choosen New - Simple Volume.

As the result of this, The whole drive was then in 2 big partitions. One 2040,00 GB RAW partition and one 2609,49 GB unalocated partition.

When I try to access to it can read a message about format it.

After that, I have read tons of articles, forums pages, but I can't understand how DMDE works in order to fix this.

Can DMDE recover the original folder structure?

Note: The hdd data is cloned and DMDE scan is done. And was a 5tb hard disk not partitioned.

Thanks for reading and sorry for my bad english.

 

[fzabkar]

Unfortunately, the NTFS metadata is normally located at the 4GB point of your drive, which means that your installer has overwritten this area. The best you can hope for is that your data recovery tool(s) will recover your files based on their signatures rather than their original filenames. If a particular file was fragmented, then only the first fragment will be recovered reliably.

 

[USAFRet]

I made a booteable windows hdd in my new 5 tb and got a fat32 hdd with only 31,9 GB.

This is specifically why it informs you, at least twice, that whatever drive you use WILL be wiped out.

 

[SkyNetRising]

If old drive is still available and had not been overwritten,
then it might be possible to recover deleted data from it.

You have overwritten portion of your new drive.
You have less chance of recovering data from partially overwritten drive.
Part of data, that has been overwritten, can not be recovered.

 

[Carles3456]

Firstly, thank you a lot for your replies!

You do a great job, specially helping people that have lost valuable data and have no idea how to recover it. I think you are a bit as superheroes with unusual skills. The data I lost ins't so valuable.

I had done several scans/full scans using free versions of DMDE, Testdisk, Photorec or Recuva on both hard disks.

Here any of the results I have obtained scanning the old hard disk:

- Recuva: recovered files using short or deep scan, but in both cases all files were corrupted. It show the whole structure folder.

- Testdisk: also show the whole structure folder, but recovered several files and were all corrupted.

- Photorec: didn't found any file.

- DMDE: doesn't find the structure folder. After a full scan get to find the structure folder, but all recovered files are corrupted.


Here any of the results I have obtained scanning the new hard disk:

Recuva doesn't seem to work with RAW file format.

Testdisk seems to complete a full scan in many days, so I stopped it.


Full scanning the new 5 tb drive using Photorec.

- Testdisk-7.1 / photorec_win.exe / Paranoid : Yes (Brute force disabled) . Full scan works fine until 30% drive is scanned, then Photorec scans again "sectors of the drive" that already had been scanned and seems to enter in a bucle. After 14 scanning hours doesn't seem to end ever.

Recover files, any files are corrupted.

- Testdisk-7.1 / photorec_win.exe / Paranoid : No . Only 20% drive scanned due test results.

Recover files, any files are corrupted.

- Testdisk-7.2 BETA / photorec_win.exe / Paranoid : Yes (Brute force disabled) . Only 20% drive scanned due test results.

Recover files, any files are corrupted.


- Testdisk-7.2 BETA / photorec_win.exe / Paranoid : No. Full scan. About 18 hours. Full scan works fine without rescan sectors of the drive.

Recover files, any files are corrupted. But this scan type recover more files than the others ones. Any files show an incorrect size, for example 20 MB instead of 120 KB.

A wmv file has been renamed .mp4 but works. Can I renamed it .wmv again?

- DMDE recover any files that using tesdisk-7.2 BETA/photorec were corrupted and get any corrupted files than using Testdisk-7.2 BETA/photorec were ok. But almost all recoverd files for both programs are ok.

DMDE recovered a corrupted file of 920 GB that doesn't exist in the hard disk and many other incorrect size files. Tesdisk-7.2 BETA/photorec also recovered any incorrect size files, but many less than DMDE. But DMDE only have scanned the whole hard disk, not the other volumes.

If I select the same 10 recovered files in DMDE and in photorec the bytes size is different in 928 bytes more or less, depending of the total size of these 10 files.

 

[fzabkar]

As I expected, your tools are recovering your files based on their signatures, ie a "raw scan" or "file carving". Some signatures will be false positives. That is, a sector may start with a byte sequence that is used by a particular file type, but this sequence may just be a coincidence. That would account for the bogus 920GB file.

Fragmented files will be corrupted after the first fragment because files are assumed to be contiguous, and that's because there is no metadata which enables the tool to locate the other fragments.

Many file types don't indicate the file size in their header, so the tool tries to determine the actual size based on the content. That would account for the 20MB versus 120KB result.

You can see the file signatures with a hex editor such as HxD (freeware). For example, a JPEG file begins with 0xFF 0xD8 and ends with 0xFF 0xD9.

https://mh-nexus.de/en/hxd/

Here are some ideas for sorting through your files:

https://www.cgsecurity.org/wiki/After_Using_PhotoRec

PhotoRec is an excellent file carver, so I would trust its results more than most other tools.