Recovering partially erased internal HDD?

CasualLiKE

Hello everyone,

I'm looking for advice on how I go about getting data back on a drive that had been accidentally put through a wipe for about 2/3 seconds.

I can live with re-installing windows but I'd very much like to get some of the files back. I unplugged the power as soon as I realized what had happened.

What are my options? I have an external Hard-drive at my disposal and Hirens Boot CD. The Bios still recognizes the hard-drive itself but it won't boot from it.

My worry is that the file allocation tables could have possibly been initially wiped.

Any help is appreciated.

Regards - CL

riclad

Windows 7 x64 pro/ Windows 7 x86 Pro/ XP SP3 x86


Download the 64 bit system repair disk from this site.

System Repair Disc - Create

Boot from the disk, choose command prompt then type the following commands one by one. Hit Enter after each.

Bootmgr is missing - Fix

Bootrec /fixmbr
Bootrec /fixboot
Bootrec /rebuildbcd

Now boot normally.

This can be done from Hiren also, locate the command prompt option in it.

just try the above commands , from dos prompt,in hirens cd,
before downloading anything.

the 3 commands above take 5 mins approx to complete,

riclad

see
http://www.sevenforums.com/general-discussion/184344-how-do-i-restore-master-boot-record.html

http://www.piriform.com/recuva


DO above commands then see does pc boot up again.

maybe try recuva later .

GarIT

The last suggestion might delete something. You can use hiren as tour boot manager. Boot into hiren and choose the option at the bottom boot windows 7 NTLDR and see if that works first.

CasualLiKE

Where's the commond prompt to type in DOS for those commands? I just checked the drive with Test Disk and it couldn't find any partitions. I'm now letting HDAT2 run to find where the bad sectors in the hard drive are.

BTW with regards to that recovery disk, does it matter what operating it's created on? I currently only have access to Windows XP.

Another thing that's been on mind is cloning. Could I potentially Clone the drive to an external 500 Gb hard drive (the same size as the internal one) and use a program like GetDataBack to recover some of the files via MiniXp?

riclad

i think its go to main menu,in Hirens cd.
GO to dos programs, ,
menu,8 ,
DOS press enter.
dos prompt menu appears.
type command after dos, cursor;
eg bootrec

riclad

see here acess dos from winxp cd,
http://www.computerhope.com/issues/ch000627.htm

you can use the xp cd to get acess to recover console,
and dos prompt mode.
Typing in help at the prompt will give a complete listing of all commands available through the prompt.

After getting to the Microsoft Windows recovery console you will need to select the Windows installation you wish to log onto. Therefore press 1 if you wish to edit the primary Windows installation.

Does,nt matter what cdrom you use,
as long as it gives you acess to dos prompt.

riclad

http://www.cgsecurity.org/wiki/PhotoRec

I THINK photorec ,or testdisk are the best programs to use on a disk,
where , the file system may be damaged.

Did you delete the partitions,
OR just tried to format the drive before you powered off.?http://gparted.sourceforge.net/
gparted can be used to look at and fix damaged partitions.
its a live cd like hirens cd.

See

http://www.addictivetips.com/windows-tips/how-to-recover-lost-partitions-and-hard-disk-data-guide/

CasualLiKE

The drive was accidentally included as an option for wipe with another drive. It was about 2/3 seconds before the power cable was pulled out. With Disk Check it told me it couldn't find a partition but there was an option to create one. I'm not too sure how I go about doing that.

As you can see No bad sectors shown.

riclad

When you say wipe do you mean, erase all data,
or delete partition.?

riclad

http://www.easeus.com/partition-recovery/
this recovers deleted partitions,

,Try going to dos prompt, and use bootrec ,fixmbr commands in my first post.

IF i have a problem with partitions i use gparted ,
or linux live cd to fix them.
when you get to dos prompt,
TYPE dir ,
or dir c;/

I,M trying to work out out was the primary partition deleted,
or maybe the formatting process was interrupted.

CasualLiKE

riclad wrote: »

When you say wipe do you mean, erase all data,
or delete partition.?

Erase all data but it was no more then 2/3 seconds.

If it was only being formatted for 2-3 seconds then you have a very good chance of recovering everything.

The important thing is patience, if you do the wrong things to the drive you will reduce the success of recovery. Some posters may mean well but just blurt out the first thing they can think of.

Put the drive aside, get all the advice first from several sources, research it to weed out the daft advice and only then should you attempt anything.

riclad

http://www.runtime.org/data-recovery-software.htm
this might be useful,


GetDataBack will recover your data if the hard drive's partition table, boot record, FAT/MFT or root directory are lost or damaged, data was lost due to a virus attack, the drive was formatted, fdisk has been run, a power failure has caused a system crash, files were lost due to a software failure, files were accidentally deleted. GetDataBack can even recover your data when the drive is no longer recognized by Windows. It can likewise be used even if all directory information - not just the root directory- is missing.

riclad

IF that was my pc, i,d use Gparted ,it scans the hd,
gives all the info, on partitions,
EG MOST pcs have 2 or 3 partitions, created by windows,install, primary partition ,that contains win7 s etc.

A small partition made by window, s contains no user data,
maybe 3gig,

ALSO maybe an os recovery partition 10gig ,
to reinstall the os.
seehttp://gparted.sourceforge.net/screenshots.php
http://gparted.sourceforge.net/screens/gparted_4_big.png

See FAQ #13 for Linux/GRUB.
See FAQs #14, #15, and #16 for Windows.
http://gparted.sourceforge.net/faq.php


you might want to read faq 14,
15, 16,
re fix windows boot configuration.

AT least gparted shows you if the windows partition is still there.

OBVIOUSLY the largest partition is the windows os partition .

riclad

http://superuser.com/questions/402065/repair-windows-7mbr-with-hirens-boot-cd


USE hirens cd ,
MBRFIX tool.

6541

Once you find a fix to this can you post the solution here, thanks.

riclad

http://www.ehow.com/how_7509758_recover-broken-partition.html



From hirens cd,
use testdisk,

What info does it say,
re no of partitions,
and the size of them,on the hardisk.


Use the arrow keys to highlight your logging preference from the launch menu and press "Enter" to begin; most users will not need to log their TestDisk session. From the next list, highlight the hard drive that contains the broken partition and press the "Enter" key. Select the partition-table type from the list and press the "Enter" key. If you do not know your partition-table type, TestDisk typically highlights the proper one for you.


<li class="step ">
<li class="step "> 5 Press "Enter" on the next screen to choose the "Analyse" option and then select "Quick Search" to begin the partition analysis. TestDisk will search the hard drive for any broken partitions and then provide you with a list. After the list appears, press "P" to view the files on the partition and confirm that it is the broken partition that you wish to repair. Press "Q" to exit the file list, highlight the partition using the arrow keys and then press the "Enter" button to continue.

Read more: How to Recover a Broken Partition | eHow.com http://www.ehow.com/how_7509758_recover-broken-partition.html#ixzz2P2IpFMlT

CasualLiKE

Okay I've tried copying the internal hard drive using CloneZilla which makes an image of the drive that's been partially erased. The problem I've encountered is that it seems to not let me go ahead with the clone because there's no recognized partition. I want to copy the hard drive so I can look at it at my own pace and pick the files that are still available.



Is there software I can use that will let me go ahead with the clone without the need for a partition?

riclad

I dont think you can clone a drive if partition has disappeared.

what partitions can you see,

i think you,ll need gparted to fix this drive.

riclad

You could remove drive,put it in a caddy,
then work on it , or install it as a slave drive,in the pc.

What program were you using exactly to wipe the drive.

Sounds like the partition was deleted, so its in limbo.
unless you can undelete it.
try the free version,

http://www.paragon-software.com/home/rk-express/


quote


Key Features Free Pro
Fix the majority of boot problems with Boot Corrector

Undelete Partition
When simply deleting a partition (without additional wiping) disk management software only removes the references to it in the Partition Table, thus leaving the possibility to recover it later. The Undelete Partitions Wizard enables you to find and recover these partitions. A restored partition will be fully functional, as long as other partitions were not created, moved or exceeded the disk space.

Undelete partitions - Undelete accidentally deleted partitions and recover them


undelete partition seems the simplest solution now.

CasualLiKE

riclad wrote: »

I dont think you can clone a drive if partition has disappeared.

what partitions can you see,

i think you,ll need gparted to fix this drive.

None show up that's why I can't clone it.

riclad

IF theres 0 partitions showing up, use the free program, to undelete em.
theres at least 2 partitions on any windows drive,
main partition, windows os, my docs,music,pic s,downloads
AND a small windows system partition,
and Maybe a windows os recovery partition 8- 10 gig.
even if you stopped c;/ format ,the other partition should still be there.

riclad

ITS a lot easier to put the drive in a caddy,
then plug it in to the pc,
IF you can get another drive,
then install windows or linux on it.
Maybe buy 1 from adverts.ie for sale ,computer hardware.
Do not touch the drive pcb, underneath .

hearny

Its important not to do anything that will write to the drive.

Do NOT use any partition editors or windows recovery options as suggested.

If you want to try to clone the drive which is a good idea you will need to use a program on linux called dd or dd-rescue depending on the version of linux.

The program that I have had most success with recovering damaged partitions etc. is EaseUs Data Recovery. you need to pay for it but 70 Dollars is not a lot to pay for recovering the data.
Program is http://www.easeus.com/datarecoverywizard/
Trial version is available here so you will know if it works first:
http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm
If you are around Waterford I will scan it for you.

You should install the above programs on a different drive and any files you can recover need to be copied to another drive. I know its stating the obvious but I'd rather say it a few times then assume.

No offence riclad but some of the info posted here will reduce his chances of recovery, I know you are trying to help but be careful with advice that can possibly cause data loss.

Agree with everything I Kill you Scum says and think the chances of recovery are pretty good provided you weigh up your options.

riclad

SO my advice is put in another drive as drive c;.boot drive,

install windows on it,
Install the software as suggested by hearney ,
in the previous post.

see
http://www.dummies.com/how-to/content/how-to-install-a-sata-drive-in-a-windows-7-desktop.html


you could use the cables , from the dvd rom drive .
data,power for the new drive .

i presume your drives are sata.

WHEN you are installing

windows , take it really slow,make sure you are installing it on the new drive,

IT WILL format the drive and ERASE all data on it.

when installing the drive,
KNOCK OFF PC,
Remove power cable from the esb socket,
maybe remove power cable from,

the drive with lost partitions ,as a PRECAUTION.

INSTALL windows ,on new drive,
switch off pc, switch off power to pc,
put power cable back in old drive.

ANY sata drive can , be installed in a pc.
Even a sata drive 2.5inch from a laptop.
if thats all you have.
MAKE sure its tight,secure , not loose in the pc frame,case.


SATA drives has no jumpers,

so pc just boots off the drive that has a bootable os,
eg windows , or ubuntu.

http://www.wikihow.com/Add-an-Extra-Hard-Drive
detailed guide with images.

remember what the drives are called,

eg seagate 459h =old drive,

new drive, =wd367fg

SO YOU can select the new drive when installing the windows os ,

YOU ,ll probably need to make a new partition ,on new drive,
primary active,
if theres no partitions on it.

PROBABLY its safer leave power cable to old drive ,disconnected,

until new windows install process is finished.


I don,t see any way of recovering the data ,

apart from connecting drive to a pc with windows installed on it.

if you wanna get a caddy ,you,ll likely need a 3.5inch sata disk enclosure,
cost around 24 euro.approx.


When installing any drive inside a pc,its important,
knock off pc,

remove PC power cable from esb socket.

ITS the first time ,ive seen a drive with all the partitions deleted.