Page 1 of 4 123 ... LastLast
Results 1 to 15 of 48
  1. #1
    New Lounger
    Join Date
    Mar 2015
    Posts
    2
    Thanks
    1
    Thanked 0 Times in 0 Posts

    Data recovery for 2TB external HD after partition wiped all data?

    I am hoping someone here might be able to at least point me in some direction that might help me get my files back.

    At the end of December, my less than 6 month old laptop had an issue and I needed to send it in to be serviced. I backed up what little was on it, as I had all of my data from the last 5 years on my external harddrive. I then wanted to factory reset my laptop of all information so I wouldnt be sending anything sensitive out. So instead of sitting there waiting for 12 hours for everything to delete, I googled how to factory reset Windows 8 (I still can't figure out Windows 8) and while following the instructions through the menu, it asked me to create a recovery and forced me to select the external otherwise it would not proceed any further. It was done in 3 seconds and I thought something seemed off. When I opened My Computer to check my external, my heart sank when I realized it was showing the capacity as 32 GB and not the 2 TB. Everything was gone.

    More googling later, I realized it created a partition on the HD. I was able to delete it, and after some advice from Yahoo Answers, found a recovery program to download and run a deep scan. Catch is, you have to pay $70 for it to actually recover your files. So I was able to see the files sitting there, but had to pay to get them back. So it runs the real scan to recover the files, and instead of seeing pictures in the folders, all I could see was that generic thumbnail graphic for pictures. Attempting to open the pictures yielded a "this file does not exist" type of error. I got back maybe a handful of actual pictures. My boyfriend had run the scan on his laptop initially (I even had to buy a second external HD to re-backup my laptop so I could send it in to be serviced) and said he had some files, so I thought he had everything recovered to his laptop since his scan was run first. So I had already copied my laptop files to the original, screwed up harddrive. (I now realize I've probably screwed several GB of lost data and won't get that back..) I then spent weeks going back and forth with the company trying to arrange a time that they could remote access my laptop and try something else. After about 4 or 5 scans in total, they told me it wasn't going to work, and refunded my money.

    To make things worse, the laptop came back with more issues than I sent it off with, so I've been without a laptop for going on 3 months now.

    I then decided to call some local businesses who offer data recovery. The first place I called gave me the number for a company called Gillware, because she said they "take it a step further" and didn't see the point in me paying the local company $50 for a simple diagnostic only to find out they can't help me. So I called Gillware and the lady there told me it would cost between $900-$1800 to recover data from a 2TB sized device.

    Needless to day, I am distraught. All I really want back are my pictures from the last 5 years. Thankfully, I had all of my pictures from my pet that we had to put down 3 years ago. But, I really want my pictures of my current pet from the last 5 years because he is old- 11 years old now.

    If anyone has some advice, I would really appreciate it. I got a suggestion to try to find some local companies or IT students on Craigslist who might be able to help me for a more reasonable fee. I'm just afraid that everything I try is slowly chipping away at any recoverable date that might exist.

  2. #2
    WS Lounge VIP
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    8,168
    Thanks
    47
    Thanked 978 Times in 908 Posts
    If you have not written to the disk since the calamity there is a reasonable chance you can get your data back. Unfortunately, writing a new partition can make recovery less likely.
    You may find Easus Data Recovery works - see this thread. http://windowssecrets.com/forums/sho...ost-of-it-back

    cheers, Paul

  3. The Following User Says Thank You to Paul T For This Useful Post:

    ladybugamk (2015-03-05)

  4. #3
    New Lounger
    Join Date
    Mar 2015
    Posts
    2
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Paul,

    Thanks for taking the time to respond!

    EaseUs is actually the program I used before.

    I haven't written any new partitions (we only deleted the 32 GB one that got made that originally erased all my information), but I did stupidly re-copy my laptop files before sending it out, due to the fact that my 2nd external wasn't in my possession that day and I had to make sure I had a copy of my laptop docs before I sent it out the next day. I realize that will likely have written over some information, but obviously I still want to save as much as possible!

    I had a local IT guy call me back after I reached out for advice. He suggested I try MiniTool Power Data Recovery, but that unfortunately is $70 for the program as well. I had paid $70 for EaseUs as well, but I was just hoping to find something less expensive.

    Thanks again! I really do appreciate your time!

  5. #4
    Super Moderator bbearren's Avatar
    Join Date
    Dec 2009
    Location
    Polk County, Florida
    Posts
    3,760
    Thanks
    26
    Thanked 424 Times in 338 Posts
    Give Recuva from Piriform a try. There is a free version as well as a Pro, but the Pro is only $24.95. I've used the free version with very good results on pictures as well as other files.
    Create a fresh drive image before making system changes, in case you need to start over!

    "The problem is not the problem. The problem is your attitude about the problem. Savvy?"—Captain Jack Sparrow "When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns "Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware.
    Unleash Windows

  6. The Following User Says Thank You to bbearren For This Useful Post:

    Fascist Nation (2015-03-09)

  7. #5
    2 Star Lounger
    Join Date
    Dec 2009
    Location
    Tennessee,USA
    Posts
    161
    Thanks
    24
    Thanked 17 Times in 15 Posts
    you have to pay $70 for it to actually recover your files.
    This isn’t going to be any immediate help, but, for future consideration you might want to consider keeping 2 copies of all important data. For $70 you could easily purchase a 2nd portable HD. You could then use it for a cloned copy of the 1st portable HD. Don’t be discouraged if you find that cloning a large portable HD takes 10 hours or more. It could be an over night thing. The result ability to cope with tragedies is well worth the time and money.

    I use more than 6 portable hard drives for my computer. I have a duplicate copy of each. You may be surprised to learn how many members in the forum have duplicate copies of their portable HDs.

    Michael

  8. #6
    5 Star Lounger
    Join Date
    Oct 2013
    Location
    Phoenix, AZ
    Posts
    926
    Thanks
    554
    Thanked 137 Times in 128 Posts
    1. The data is almost certainly still there and near 100% intact. Just don't write to the drive.

    2. Recuva mentioned above ought to see it and restore it for you.

    3. If not, isn't it worth the $70? But you seem to indicate you paid for the Easeus so what's up?

  9. #7
    Super Moderator
    Join Date
    Aug 2012
    Location
    Durham UK
    Posts
    6,607
    Thanks
    147
    Thanked 869 Times in 831 Posts
    I've PM'd you with details of a program you can use to see if it will do any better than what you have tried.

    For anyone else reading this, it's for a free 1 year subscription for a Pro recovery program I got when I bought a particular product and haven't used the product key.

    Figured ladybugamk's needs are greater than mine.

  10. The Following 3 Users Say Thank You to Sudo15 For This Useful Post:

    access-mdb (2015-03-10),satrow (2015-03-10),Zig (2015-03-09)

  11. #8
    WS Lounge VIP access-mdb's Avatar
    Join Date
    Dec 2009
    Location
    Oxfordshire, UK
    Posts
    1,721
    Thanks
    146
    Thanked 156 Times in 149 Posts
    Shows how good the people on this Forum are.

  12. #9
    WS Lounge VIP Coochin's Avatar
    Join Date
    Jun 2014
    Location
    Queensland, Australia
    Posts
    2,150
    Thanks
    31
    Thanked 305 Times in 265 Posts
    FWIW my understanding (heavily influenced by years of trying to recover customers' files from sick/mismanaged HDDs) is that overwriting existing partitions on an MBR HDD is reversible by using an appropriate program.

    In several cases I have been able to recover over-written partitions on customers' HDDs after booting from a BootIt Bare Metal CD. In a few cases when BootItBM didn't work I was able to recover the user's data after booting from an Active File Recovery CD, but that gets a bit "geeky".

    As previous posters have indicated, if you want to recover your files from the affected HDD then don't write anything further to the drive; put it aside for later attention if/when you find out more about your recovery options.
    Computer Consultant/Technician since 1998 (first PC was Atari 1040STE in 1988).
    Most common computing error is EBKAC: Error Between Keyboard And Chairback
    AMD FX8120 (8-core @ 3.1GHz) CPU, Gigabyte GA-990FXA-D3 motherboard, 8GB (2x4GB) DDR3 1866MHz RAM, ATI-AMD Radeon HD6770 PCI-E VGA, 480GB Kingston SSD, 2TB Seagate SATA3.0 HDD, ASUS DVD/RW.

  13. #10
    2 Star Lounger
    Join Date
    Dec 2009
    Location
    Tennessee,USA
    Posts
    161
    Thanks
    24
    Thanked 17 Times in 15 Posts
    if you want to recover your files from the affected HDD then don't write anything further to the drive; put it aside for later attention
    +1 This cannot be over emphasized. This is a great time to purchase a new portable for current use. Put your important one aside. If/when you get your data back, you will be in a great position to have 2 copies of your important data.
    Ebay has great prices on those portables.
    Michael

  14. #11
    Silver Lounger RolandJS's Avatar
    Join Date
    Dec 2009
    Location
    Austin metro area TX USA
    Posts
    1,722
    Thanks
    95
    Thanked 126 Times in 123 Posts
    Somebody mentioned over-written partitions - meaning the creating of new partitions, which removed the old partitions, correct? Any cluster over-written means new info replaced old info -- old info gone for good.
    "Take care of thy backups and thy restores shall take care of thee." Ben Franklin revisited.
    http://collegecafe.fr.yuku.com/forum...-Technologies/

  15. #12
    Super Moderator bbearren's Avatar
    Join Date
    Dec 2009
    Location
    Polk County, Florida
    Posts
    3,760
    Thanks
    26
    Thanked 424 Times in 338 Posts
    Quote Originally Posted by RolandJS View Post
    Somebody mentioned over-written partitions - meaning the creating of new partitions, which removed the old partitions, correct? Any cluster over-written means new info replaced old info -- old info gone for good.
    Only partly true. The partitioning description occupies only a tiny fraction of a disk's surface, and only that tiny fraction is overwritten by the new partitioning description. Additionally, only to the extent that the new partition is written to is the preceding information overwritten. In other words, writing a few hundred MB's won't wipe out several GB's of previously written data.
    Create a fresh drive image before making system changes, in case you need to start over!

    "The problem is not the problem. The problem is your attitude about the problem. Savvy?"—Captain Jack Sparrow "When you're troubleshooting, start with the simple and proceed to the complex."—M.O. Johns "Experience is what you get when you're looking for something else."—Sir Thomas Robert Deware.
    Unleash Windows

  16. The Following User Says Thank You to bbearren For This Useful Post:

    Fascist Nation (2015-03-10)

  17. #13
    Silver Lounger RolandJS's Avatar
    Join Date
    Dec 2009
    Location
    Austin metro area TX USA
    Posts
    1,722
    Thanks
    95
    Thanked 126 Times in 123 Posts
    that's what I meant, any specific cluster containing user data which is over-written later by new info -- old info gone forever. The making and unmaking of partitions rarely interfere with user data clusters. Just how does NTFS work compared to FAT32? Does NTFS have things similar to FAT32's FAT/File Allocation Table and/or DIR tables?
    "Take care of thy backups and thy restores shall take care of thee." Ben Franklin revisited.
    http://collegecafe.fr.yuku.com/forum...-Technologies/

  18. #14
    Star Lounger
    Join Date
    May 2010
    Posts
    57
    Thanks
    1
    Thanked 12 Times in 9 Posts
    Quote Originally Posted by RolandJS View Post
    that's what I meant, any specific cluster containing user data which is over-written later by new info -- old info gone forever. The making and unmaking of partitions rarely interfere with user data clusters. Just how does NTFS work compared to FAT32? Does NTFS have things similar to FAT32's FAT/File Allocation Table and/or DIR tables?
    Yup, it's called the MFT (master file table) in NTFS. In Windows NT and higher, running the built-in defragmenter or another similar tool like Defraggler will show the blocks that are holding the MFT.

    There are some basic similarities between MFT and FAT, but MFT is also able to store file permissions beyond just basic read-only and read/write.

    Unlike FAT, NTFS is a journaling file system so a separate transaction log is used to hold changes to the MFT, data blocks, etc. until they are completely written to disk. If a write request is interrupted (e.g. power outage, OS crash, drive goes offline), a "dirty bit" isn't cleared. This triggers an automatic recovery where the journal is scanned for incomplete transactions and the bad data blocks are rolled back to their previous state. With FAT, corrupted blocks can build up over time until the file system becomes unstable unless regular checks are done.

  19. #15
    Star Lounger
    Join Date
    May 2010
    Posts
    57
    Thanks
    1
    Thanked 12 Times in 9 Posts
    A couple of things to watch out for when dealing with data recovery:

    Partition layout ...

    When trying to restore the original partitions on a drive that's been inadvertently repartitioned, the capacity and vintage of the drive, the operating system being used to run the repair tool(s), the repair tools themselves and the BIOS affect the partition layout.

    When drive capacities were smaller (2TB or less), using MBR was fine. For drives larger than 2TB, the newer GPT (GUID Partition Table) is used instead of MBR. For example, on a 4TB drive, only the first 2TB can be used if the partitioning scheme is MBR.

    (For the geeks among us, here's the math... most drives are natively 512-byte sectors or have 4096-byte sectors presented as chunks of 512-bytes for compatibility reasons. MBR uses a 32-bit value to address sectors. 32-bits = ~4 billion possible addresses. 512 bytes is ~0.000512 MB. 4 billion x 0.000512 = 2 TB.)

    GPT is great, except that 32-bit versions of Windows don't support GPT. So a 2TB drive could end up being partitioned using either MBR or GPT depending on the computer that's being used. From a user's point of view via a file manager, the drive partitions might look the same, but under the covers the partition scheme and sector alignment can be very different.

    GPT also uses a portion of the disk outside of the master boot record to store additional partition info. With MBR, removing the partitions from a disk and then restoring the same partition layout won't destroy any of the data blocks, but going from MBR to GPT will end up overwriting some existing data even if the new partitions aren't reformatted.

    Assuming that I followed ladybugamk's timeline correctly, her external 2TB USB drive has gone through the following changes since the problem started:

    1. A 2TB USB hard drive with files already on it was used as the target drive for Windows 8 to create a bootable recovery disk.

      (Ladybugamk said that the drive was 32GB after the process completed, so we know that up to the first 32GB of the disk was overwritten. From personal experience, a barebones Windows 8 installation can create around 8GB worth of files for a recovery disk. OEMs will often include drivers and other software so it's likely a minimum of 10GB of lost data assuming that only a quick format was done after the 32GB partition was created. Recovery programs often do full formats to check for bad blocks so it's more likely that the entire 32GB was wiped.)

    2. After realizing that the 2TB USB hard drive had been repartitioned from 2TB to 32GB, the 32GB partition was deleted.

    3. Personal files were then manually copied from the laptop to the 2TB USB hard drive.

      (This meant the drive had to be repartitioned and reformated again before the files could be copied.)


    So we're looking at repartition to 32GB -> format -> write recovery files -> delete 32GB partition -> repartition to 2TB -> format -> copy personal files from the laptop. That's two repartitions, two reformats and two file copy sessions. Newer versions of Windows default to a "quick format" so the data on the remaining 2TB might still be there.

    File fragmentation ...

    Most users don't defragment external drives and also tend to work directly off of them so the chances of heavy file fragmentation is high.

    NTFS defaults to 4K blocks which works out to 256 block per megabyte. So for every MB that's newly written, potentially up to 256 lost files could be partially erased.

    In her first post, ladybugamk said, "[...] So it runs the real scan to recover the files, and instead of seeing pictures in the folders, all I could see was that generic thumbnail graphic for pictures. Attempting to open the pictures yielded a 'this file does not exist' type of error. I got back maybe a handful of actual pictures." Windows assigns a generic icon for images that have a valid file extension, but contain errors preventing Windows from generating thumbnails. This is often a sign of file fragmentation, causing some data blocks to be lost by the earlier reformatting and file copies.


    Based on the timeline and symptoms so far, it doesn't sound promising, but I still hope that ladybugamk is able to get her photos back.

    Chung

Page 1 of 4 123 ... LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •