[SOLVED] What to use to recover folder structure of formatted HDD

[Nobody-Important]

I was trying to repair my win7 install earlier this week and because the HP recovery disks didnt bring up the option to do a repair install i went searching for an executable through the console. Unfortunately the one i found didn't bring up that option either and instead started by formatting the c drive. Despite being stopped immediately it was already too late and the drive is now empty.

The question now is: is there any way to get the actual folder structure back somehow? The important things on this drive were mostly projects that rely heavily on the folder structure instead of singular files.
Since this was a full 500GB drive i doubt that everything could have been erased in the two seconds the formatter ran, but how do i actually recover them?

(I also don't know if this strictly belongs in the hardware section but it's where it fit the most)

 

[Nobody-Important]

What, specifically, was on this drive?

Which is better...individual files or none at all?

None at all. Projects for game modding and for work. Without the folder structure the files are completely useless.

That's why i explicitly asked about folder structure recovery in the title and not data recovery.

 

[USAFRet]

Proactive backups were what was needed.

 

[Nobody-Important]

Bottom line - Recovery tools are not magic. They can't always recover everything, or in the total original file/folder structure.

Sometimes, data IS actually overwritten and cannot be recovered.

The data is definitely NOT overwritten though. The installer in question ran for about 2 secs before i stopped it. That isnt even enough to list the contents of a 2gb folder much less all folders on a 500gb partition.

 

[USAFRet]

The data is definitely NOT overwritten though. The installer in question ran for about 2 secs before i stopped it. That isnt even enough to list the contents of a 2gb folder much less all folders on a 500gb partition.

The "data" isn't.
The file allocation table and partition structure might have been.

And as you say...without the entire folder structure, the bare files are "useless".

 

[Nobody-Important]

Proactive backups were what was needed.

And yes you already said this three times but that doesnt help me in my current situation, and it would not have been possible as i lacked the 100$ for a 1TB extHDD.

 

[Nobody-Important]

Here's my current thoughts:
If the folder structure is stored with the individual files recovering it should be trivial as Nothing was overwritten.
If the folder structure is stored separately it should still be possible to recover some of it as it is simply not possible to overwrite more than a tiny little bit of the records in the 2 secs the program ran, especially not with the slow HDD speeds that i have.
I know it is possible in some cases to recover the folder structure.
So i would like to know how to determine if it is possible to do in my case and if yes how.

I really appreciate the effort of all of you but i need concrete steps on how to check how much is left of the previous folder structure.

 

[USAFRet]

The "folder structure" is contained in the file allocation table.
Which can't be recuperated without its parent partition.

 

[Nobody-Important]

The "data" isn't.
The file allocation table and partition structure might have been.

This i where i need the help. How can i check what is left of the file allocation table and if all or some of the files on the disk still have their paths?

 

[Nobody-Important]

The "folder structure" is contained in the file allocation table.
Which can't be recuperated without its parent partition.

What do you mean? What prevents it from being read out normally?

 

[Nobody-Important]

I've also looked at DMDE and Recuva and i'll try both once i install win10 on a separate partition.

 

[DSzymborski]

I should note that cloud-based backups of unlimited data can be found easily for $5-$6 a month and preserve folder structure.

The fundamental problem here, is that unlike the data not overwritten, even in a few seconds, a lot of the file system structures are destroyed. It may take an hour to make a cake and an hour to eat a cake, but that doesn't mean you need an hour to destroy a cake.

Recovery software is generally focused on file restoration, not so much recovering the exact organization of folders. Software is generally file carving, reading the data to determine what kind of files are being recovered.

What you're asking to do is a more specialized problem. I've had luck using File Scavenger for this in the past, but if anything's recoverable of the folder structure, if software can't easily do it, it's not something you can do third-hand over the internet. In this case, you'd need to send the drive to a data recovery firm and these are not cheap.

 

[Nobody-Important]

Cheap or not i'm a full time student so i don't have any income to spend on data backups especially when the circumstances that needed to come together for this to happen were so unlikely.
I'm still using a 10 year old laptop.

I'll check out your utility too thanks.

Also to stick with your cake metaphor you might be able to destroy a cake in two seconds but it would nonetheless remain edible.
If it takes the OS 10 seconds to read in the contents of a single folder from the file allocation table, then it definitely can't erase everything from it in 2 seconds.

And as 90% of data on the partition was just programs its unlikely that the little bit destroyed was the 10% that was actually useful.

 

[USAFRet]

Depending on what you actually ran (we don't know), the partition table and the file allocation table might have been the ONLY thing it touched.

A destroyed wedding cake can't be glued back together into something that looks like a wedding cake, with all the layers (folders) in the proper place and intact.

While mostly edible, that would be the individual pieces (files).

 

[DSzymborski]

Cheap or not i'm a full time student so i don't have any income to spend on data backups especially when the circumstances that needed to come together for this to happen were so unlikely.
I'm still using a 10 year old laptop.

I'll check out your utility too thanks.

Unfortunately, things cost what they cost, so this is the risk you run in this case.

Also to stick with your cake metaphor you might be able to destroy a cake in two seconds but it would nonetheless remain edible.
If it takes the OS 10 seconds to read in the contents of a single folder from the file allocation table, then it definitely can't erase everything from it in 2 seconds.

That's not really how it works. An OS doesn't need to read things like this to destroy, which is the assumption you're working with. The cake you fed into the garbage disposal is no longer edible.

And as 90% of data on the partition was just programs its unlikely that the little bit destroyed was the 10% that was actually useful.

Again, you're working with an faulty premise, that everything's stored and destroyed in these neat, discrete little packages. An individual file doesn't need to lose many bytes to become worthless. USAFRet's been trying to explain this to you, with mixed results.

Since there's nothing more I can do for you, I wish you luck in retrieving your data!

 

[henterpriser]

Using GetDataBack for years...
Check it out:
https://www.runtime.org/data-recovery-software.htm

 

[ex_bubblehead]

The partition table and FAT only take milliseconds to wipe, and, once wiped are not trivial to reconstruct (assuming reconstruction is even possible). Without those it becomes equivalent to reconstructing "War and Peace" from individual words all thrown into a large bin (done without having a copy to compare to).

 

[Nobody-Important]

Depending on what you actually ran (we don't know), the partition table and the file allocation table might have been the ONLY thing it touched.

A destroyed wedding cake can't be glued back together into something that looks like a wedding cake, with all the layers (folders) in the proper place and intact.

While mostly edible, that would be the individual pieces (files).

You could probably salvage bigger pieces off of it though.

Also the utility was the windows installer executable you find on any installation media. Apparently when accessed directly through the command line it just starts to bruteforce install the system.

 

[Nobody-Important]

The partition table and FAT only take milliseconds to wipe, and, once wiped are not trivial to reconstruct (assuming reconstruction is even possible). Without those it becomes equivalent to reconstructing "War and Peace" from individual words all thrown into a large bin (done without having a copy to compare to).

How can the file allocation table take only milliseconds to wipe if it contains the physical and logical location of every single file out of millions.
Also the FAT is what windows reads when trying to display what's in a folder is it not? It takes time to read in info from the HDD and with writespeeds in the single digits of MB/s i highly doubt that it could have deleted the entire thing in less than 2 seconds.

 

[USAFRet]

Regardless of how much or little time it takes to overwrite part or all of the partition info or file allocation table...currently your drive is in an unreadable state.
And none of the consumer grade tools you've tried have worked.

At this point, it would seem there are two ways forward.

1. Stop messing with it and send it to a data recovery company. This will cost money.
2. Give up, and take this as a heads up to not let it happen in the future.

Good luck either way.

 

[DSzymborski]

How can the file allocation table take only milliseconds to wipe if it contains the physical and logical location of every single file out of millions.

For the same reason that a book that takes 20 hours to read can be burned to ashes in 2 minutes. Reading something and deleting something are not the same action.

Regardless, you've had your answer for your current situation. If you want to simply learn how Windows and more specifically, how file systems work, buying some reading material would be more helpful than random questions in a forum.

 

[fzabkar]

When you format a partition, you recreate the $MFT (master file table). That's the NTFS metafile which contains the file and folder names and structures. If the MFT has been completely overwritten, then it will not be possible to recreate the original file/folder tree. All you will be able to do is to recover individual files based on their signatures, ie a raw scan. That's what PhotoRec does.

 

[fzabkar]

Here is a screenshot of testdisk.

https://drive.google.com/file/d/17TbNy6ypvx2nQ2O7m5yklCflbg9osVPn/view?usp=drivesdk

Testdisk is basically useless for the current task. Moreover, it produces annoying CHS partition data when it should be using LBA mode. The CHS data are confusing and irrelevant. I can't understand why the author is still in the Stone Age.

 

[USAFRet]

Testdisk is basically useless for the current task.

It seems that everything is useless for the current task...
That being recovering everything, particularly the full original folder structure.

 

[Nobody-Important]

Regardless of how much or little time it takes to overwrite part or all of the partition info or file allocation table...currently your drive is in an unreadable state.
And none of the consumer grade tools you've tried have worked.

At this point, it would seem there are two ways forward.

1. Stop messing with it and send it to a data recovery company. This will cost money.
2. Give up, and take this as a heads up to not let it happen in the future.

Good luck either way.

I had not actually tried anything at that point yi was waiting for someone to tell me WHAT to try as i didnt wanna do the common mistake of messing around with a partition one is trying to recover.

 

[Nobody-Important]

It seems that everything is useless for the current task...
That being recovering everything, particularly the full original folder structure.

I have used Recuva as someone recommended and it worked somewhat.
The folder hierarchy was damaged but i could recover enough that i should be able to redownload things and piece things together if ill bother with that project again. Afte about six hours of manually selecting which other data was garbage and which not - savefiles diagrams and documents - i think i have managed to recover enough. I have a bitwise backup of the disk saved though because maybe a tool with more advanced algorhythms for file structure puzzle work can do a better job later.
I think one of the tools recommended in this thread had that.

Thanks for the explanations and the help!
Now on to reinstalling.