[SOLVED] Some questions on file/partition recovery

Jul 20, 2021
24
1
15
0
Hello,
Recently I've been learning about data recovery due to a failed SSD (I've gotten the data back from it) and I wanted to try it out, so I backed up the data from an old 500GB drive that I used back in 2016-2017 as main drive in my laptop and then used as an external HDD to store files on it. I wanted to see if I could find something from 2016-2017, even just one file, even though I know it's probably impossible. I used Active@ Undelete to see if I could detect partitions from back then (since, in theory, no new partitions aside from the one I stored data on, that took up the entire disk, had been created) and I discovered a bunch of partitions. I only looked for NTFS and ext4 partitions and I found out that apparently:
  1. img and iso files were detected as partitions, and I could restore them with their files still there;
  2. the last partition on the disk (the data one), originally 466 GiB, was now detected multiple times as different sizes, 465 to 466 GiB;
  3. there was apparently a partition at some point on there, somewhere between 369 and 372 GiB in size, badly damaged, that I have no recollection of (I'm currently trying to recover it);
  4. there are many partitions marked as "boot".
I'm curious as to how the same partition can be detected multiple times with multiple sizes, with the smaller partitions missing their first sectors.
I'm also curious as to what all those boot partitions are; are they copies of the 466GiB partition's boot? Are they remains of the boot parts of IMG images? Could they be remains of partitions from 2016-2017? Maybe all three?
Could the 369-372 GiB partition be a part of the 466GiB partition?
I'm aware that the chances of recovering any data older than 2021 is probably impossible due to the fact that the disk was used since 2017, but it's still a cool thing to try, and I wanted to experiment since I'm not risking to lose any particular data that I care about.

Update: the recovered files from the 372GiB partition were mostly just Windows system files, including one file that's a software that I discovered in 2021. Some of the oldest files were dated 7th of August 2019. I'm still not sure where they came from, but I suspect they're a mix of a Windows 10 ISO image and a partition image from this summer.

Update 2: using Disk Drill I've found files from 2018! We're going more and more back in time.
Update 3: I've found a file that I think wasn't on the 466GiB partition! It might've been from the old times.
Update 4: Something doesn't add up; there are files that shouldn't be there, from 2018. Maybe my memory's bad and I actually changed the disk sometime in 2018.
Update 5: I remembered something! I didn't change the disk at least until June of 2018! This means that despite three years of accumulating data, it's still possible to recover files from back then! It's possible that anything before 2018 was formatted by me attempting to install a Linux OS, doing it all wrong, and formatting the entire disk, but at least I got some files back!
Update 6: I've found a file from 2017!
 
Last edited:
Since you are experimenting, I recommend DMDE. It is a disc editor as well as a data recovery tool. It's very powerful, but its UI is not the most user friendly. Other tools used by data recovery professionals are R-Studio, UFS Explorer and GetDataBack.

The cheapest commercial tools would be DMDE (US$20) and Recovery Explorer (US$25, produced by same people as UFS Explorer). The free version of DMDE can recover up to 4000 files from any one folder per session. DMDE will usually find your old partitions in less than a minute with its quick scan.
 
Reactions: System64MC

USAFRet

Titan
Moderator
Mar 16, 2013
153,562
10,972
175,990
24,029
Due to wear leveling and TRIM, recovery from an SSD is much more problematic than from an HDD.

In data recovery, nothing counts until an actual working file exists on some other drive, and is fully usable.
No matter what any 'recovery' tool reports.
 
Reactions: System64MC
Since you are experimenting, I recommend DMDE. It is a disc editor as well as a data recovery tool. It's very powerful, but its UI is not the most user friendly. Other tools used by data recovery professionals are R-Studio, UFS Explorer and GetDataBack.

The cheapest commercial tools would be DMDE (US$20) and Recovery Explorer (US$25, produced by same people as UFS Explorer). The free version of DMDE can recover up to 4000 files from any one folder per session. DMDE will usually find your old partitions in less than a minute with its quick scan.
 
Reactions: System64MC
Jul 20, 2021
24
1
15
0
Due to wear leveling and TRIM, recovery from an SSD is much more problematic than from an HDD.
That's great, since I'm recovering from an HDD :)
In data recovery, nothing counts until an actual working file exists on some other drive, and is fully usable.
No matter what any 'recovery' tool reports.
I'll keep that in mind, but the previews of some of the recovered files are giving me hope.
Since you are experimenting, I recommend DMDE. It is a disc editor as well as a data recovery tool. It's very powerful, but its UI is not the most user friendly. Other tools used by data recovery professionals are R-Studio, UFS Explorer and GetDataBack.

The cheapest commercial tools would be DMDE (US$20) and Recovery Explorer (US$25, produced by same people as UFS Explorer). The free version of DMDE can recover up to 4000 files from any one folder per session. DMDE will usually find your old partitions in less than a minute with its quick scan.
Thank you! I'll check them out. It seems there are no partitions in a decent state, so I'm just trying to recover files. I wonder if these softwares can recover any file? The one I'm using right now can only recover known file types, and I'd love to find a rather unknown type of file with the .mscz extension.
 

ASK THE COMMUNITY