Recover lost data..?

[Tommy Bandurka]

Let me start off with this.... I'm an idiot.
I was trying to reformat an extended partition on my 128gb usb drive, which i have kali linux installed on. so i open up gparted (from my kali installation, my main SSD runs windows 10 pro) and i select, unwittingly, /dev/sda4 instead of /dev/sdb4 (sda4 being my main storage partition of windows 10 installation). i happily click "Format to">ntfs, and Ctrl+Enter. Then i realised what i had done. so now here i am, trying to run various data recovery programs but the truth is I'm still fairly new to linux so I'm a bit out of my depth here. Is there any way to recover this lost data? Thanks guys

EDIT: I can only run LINUX right now, so thank you to Ceotase but sorry I should've been clearer.

UPDATE: I've run 3 data recovery programs from my PC (File Scavenger, Eassos Recovery, Recuva) and none of them can recover any more than 30-200 files which are all meaningless (.swf flash files and .mts media files), and the rest are all what appear to be recovery config files ($part etc.) I'm not sure what to do now. In the meantime I've copied windows 10 onto a spare hard drive and am using that on my laptop.

 

[Ceotase]

This is the recovery program that I've used successfully on occasion.

http://www.quetek.com/prod02.htm

 

[boosted1g]

As long as you did a quick format and not a full format then the data is easily recoverable from the software linked above or a dozen others.

Quick Format only marks the bits on the hard drive as inactiave so that they can be overwritten.
A full format will take every bit and change it to a 0, thus making it nearly impossible (without highly expensive equipment) to recover.
For DoD and government purposes they do 7 passes of setting to 1 and then to 0 and that gets rid of any traces of the magnetic storage for the data

 

[Tommy Bandurka]

As long as you did a quick format and not a full format then the data is easily recoverable from the software linked above or a dozen others.

Quick Format only marks the bits on the hard drive as inactiave so that they can be overwritten.
A full format will take every bit and change it to a 0, thus making it nearly impossible (without highly expensive equipment) to recover.
For DoD and government purposes they do 7 passes of setting to 1 and then to 0 and that gets rid of any traces of the magnetic storage for the data

Do you know whether gparted does a quick format by default? It seemed to be finished pretty rapidly, but then again, it is Linux, the OS of ridiculously loose restrictions on deleting files...

 

[boosted1g]

Quick means it did a quick format.

Even with a 120GB SSD drive you should see it take some actual time to complete a full format, vs click..wait 2 seconds..format complete

 

[Tommy Bandurka]

Quick means it did a quick format.

Even with a 120GB SSD drive you should see it take some actual time to complete a full format, vs click..wait 2 seconds..format complete

See, that's what I thought but all the data recovery I'm running is picking up completely meaningless files, which I don't understand because it was almost certainly a quick format

 

[boosted1g]

What kind of data recovery are you running?

From a windows machine you can just use a software like this: http://www.easeus.com/data-recovery/format-recovery-software/free-undo-disk-quick-format.htm

 

[Tommy Bandurka]

What kind of data recovery are you running?

From a windows machine you can just use a software like this: http://www.easeus.com/data-recovery/format-recovery-software/free-undo-disk-quick-format.htm

So far I've used Easeus Recovery, Easssos Recover, Recuva, File Scavenger, DMDE (which i am currently trying to find a key for - I'm broke lol) all from my PC connected to the SSD directly by eSATA, but I've found nothing. I'm considering professional solutions now...

 

[boosted1g]

Try the Easeus software tool I linked. Most of those software titles are file recovery, not designed to recover an entire OS partition of data; they are more or less meant to find files you accidently removed from recycle bin.

 

[boosted1g]

When you mount the drive, does it show the original partition?

 

[boosted1g]

Try this: http://www.ntfs.com/recovery-toolkit.htm

The problem is that the MFT table in the NTFS partition has been wiped away, so you need to restore that.

I thought the Easeus tool was more then what it was, it is just a glorified file undelete program, it wants to move individual files to a different disk.

 

[Tommy Bandurka]

Try the Easeus software tool I linked. Most of those software titles are file recovery, not designed to recover an entire OS partition of data; they are more or less meant to find files you accidently removed from recycle bin.

Just to be clear, in the menu it says I can choose from recovering from E:\ (the drive which is empty as it has been newly formatted (...)) or some "Lost Drives", of which there are nine, none bigger than 500MB. It doesnt say anything else about them.

Just saw your latest comment, will try that now.

 

[boosted1g]

Try the Easeus software tool I linked. Most of those software titles are file recovery, not designed to recover an entire OS partition of data; they are more or less meant to find files you accidently removed from recycle bin.

Just to be clear, in the menu it says I can choose from recovering from E:\ (the drive which is empty as it has been newly formatted (...)) or some "Lost Drives", of which there are nine, none bigger than 500MB. It doesnt say anything else about them.

Just saw your latest comment, will try that now.

Disregard with EaseUs, as stated it was not what I thought it was. I linked a different set of tools by NTFS a few posts up.

 

[Tommy Bandurka]

Bad news, I'm afraid. It appears when GParted formats a partition it invokes TRIM after it finishes, which means all the data is permanently gone. I will close the thread soon.

 

[boosted1g]

Bummer.

For future prevention of this issue, you should be having a backup image made every month or two (and file backups more frequently depending on individual need). Macrium Reflect Free is very feature rich and makes it very easy to schedule Full and incremental disc images of your entire drive and can handle doing images of ext3/4 as well. So the cost to do this is just the cost of a hdd and a little time setting it up.