Question Recover data from formatted disk

[brutzza]

Hi everyone, I had to formatted a HDD with the W10 installation tool (the partition where it was already installed) because the OS crashed.
Is there any program that can actually find/recover files from desktop/documents/etc?
I've tried these three already

• EaseUS Data Recovery Wizard Pro
• Stellar Data Recovery
• Recuva

But haven't found anything...

If anyone knows for experience a program that worked, I'd appreciate it.

Thanks in advance.

 

[USAFRet]

If you tried those tools with no success...you are almost certainly Out Of Luck.

Possibly try Autopsy.

opsy | Digital Forensics

Autopsy® is the premier end-to-end open source digital forensics platform. Built by Basis Technology with the core features you expect in commercial forensic tools, Autopsy is a fast, thorough, and efficient hard drive investigation solution that evolves with your needs.

www.autopsy.com

 

[brutzza]

I'll try it, thanks!

 

[howtobeironic]

As you formatted it through Windows install, I don't remember there is any way you could overwrite the data unless you wrote something new onto it or hooked the command console and specifically told diskpart to overwrite, other than that the data should be still there. All three tools you mentioned are file-level recovery software, this means they need a partition to work on. But in your case partitions are also gone. So you need to rebuild them. (That is what I assume, as you told you deleted the partition)

Before we proceed, some words of caution. Right in that moment, every single bit you write on that drive will risk the deleted files. DO NOT write/delete ANYTHING on/from the drive. Don't run/install/format Windows on it. Don't install anything on it. Don't even joke about doing it. Best grab a second drive, install Windows on it then hook the deleted drive. For the paranoid, you can take a CLONE (not an image, it really mixes up in concept) of the drive using a bootable cloning software such as CloneZilla. It'll take a snapshot of every bit on the drive. If you screw the restorable data you can just rewrite the image and try again. That'll need another drive of the same size, fully empty. Oh, also, when restoring deleted data, don't restore to the same drive.

Let's try up TestDisk to see if the partitions are still there. Here is a step-by-step guide on restoring partitions: https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

 

[brutzza]

As you formatted it through Windows install, I don't remember there is any way you could overwrite the data unless you wrote something new onto it or hooked the command console and specifically told diskpart to overwrite, other than that the data should be still there. All three tools you mentioned are file-level recovery software, this means they need a partition to work on. But in your case partitions are also gone. So you need to rebuild them. (That is what I assume, as you told you deleted the partition)

Before we proceed, some words of caution. Right in that moment, every single bit you write on that drive will risk the deleted files. DO NOT write/delete ANYTHING on/from the drive. Don't run/install/format Windows on it. Don't install anything on it. Don't even joke about doing it. Best grab a second drive, install Windows on it then hook the deleted drive. For the paranoid, you can take a CLONE (not an image, it really mixes up in concept) of the drive using a bootable cloning software such as CloneZilla. It'll take a snapshot of every bit on the drive. If you screw the restorable data you can just rewrite the image and try again. That'll need another drive of the same size, fully empty. Oh, also, when restoring deleted data, don't restore to the same drive.

Let's try up TestDisk to see if the partitions are still there. Here is a step-by-step guide on restoring partitions: https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Thanks a lot, howtobeironic!
I will try this. Really helpful.
I do know the differences between clone and image, I have the same opinion as you, it is commonly mistaken as the same thing and they are clearly not.
Thanks again!!