Data Recovery: Windows XP External Hard Drive

[rcecale]

Anyone know how to un-format a Windows XP hard drive so I can get my data back???

Without going into a lot of detail, I'm hoping someone here may have a workable solution for my bonehead move last night.

Working on a friend's laptop, attempting to get Windows XP loaded onto it. The CD-ROM drive on the laptop wasn't working properly, so I decided to plug the laptop into my docking station to use the external CD-RW drive. Unfortunately, my 1Tb external HDD was connected to the docking station as well.

When I booted to the WinXP installation CD, it asked if I wanted to format the HDD as NTFS or leave it be. It didn't dawn on me that it was asking about the external drive and NOT the internal, laptop drive.

Long story short, I formatted my external drive...several hundred Gb of music, photos and documents that I'lll never be able to replace. It's all GONE!

Does anyone happen to know of a WinXP utility that I could use to basically, "un-format" the external drive so I can get my data back? Yeah, files HAVE been written to the drive, which could be a problem, but I'd still like to give it a try.

Any help will be seriously appreciated!

Randy

[Outback Porsche]

Try BadCopy Pro

[rcecale]

Appreciate the quick reply, Jeff. Sadly, BadCopy didn't work. Also tried Win-Undelete, as recommended by BadCopy...no joy to be had.

Still open to any suggestions anyone may have.

Cheers!

Randy

[porwolf]

You may want to try "Recuva". On their FAQ page they claim to be able to recover files from reformated drives. It is free.

Recuva - Features

[slodave]

If you want to send it to me, I'll take care of it for you.

[rcecale]

Porwolf, thanks a ton! It appears Recuva may be able to do it.

I started it running, but the progress meter indicated it was going to take up to 12 hours to completely "Deep Scan" the drive. When I cancelled the operation, another window appeared which listed a lot of the files that I had feared lost. Recuva indicated they were in good shape, and available for recovery, so we'll see.

I need to take the laptop to work for a different project, but I should be able to initiate the recovery process tomorrow evening and let it runn through the night. Hopefully the files will be recovered. It looks promising!

Dave, in the event I'm not able to recover them, I may be looking for a shipping addy!

Best,

Randy

[slodave]

Randy, formatting the drive really does not do too much damage. It just deletes a link to the "Table of contents". The standard Windows format doesn't really touch the data sectors on the drive. The program you are running will find the TOC and more than likely you can recover 100% of your files. If the drive was written to at all after the format, the success goes down and data sectors are overwritten. Good luck.

[rcecale]

Finding the TOC seems to be exactly what was happening when I stopped the process last night. Recuva returned a pretty informative display, showing filenames, locations/paths to the files and how "recoverable" the files were likely to be. I should have done a screen capture and posted it here.

I kinda knew that about formatting, just wasn't sure how much things may have evolved since the days of UNDELETE in DOS. The DELETE command would simply remove the first character of the file(s) name. If you found later that you needed that particular file, you could navigate to that directory and run UNDELETE. If the file location hadn't been overwritten, you stood a good chance of restoring it...so long as you knew the first character.

Anyway, I'm hopeful that I'll be able to recover the data on my external drive. There was around 600 Gb of data on it that I would really love to retrieve...pretty much my entire music library. Since it's going to take quite a while to scan and then restore, it will have to wait until I get home this evening to start it.

Thanks again to porwolf for the Recuva recommendation. I'll keep you guys posted.

Randy

[id10t]

DONT WRITE ANYTHING TO THE DRIVE!!!!

That done, try downloading and using BackTrack - http://www.backtrack-linux.org/downloads/

[RWebb]

Absolutely

can someone advise him as to what actions might cause the machine to write to the drive w/o the user doing it explicitly? e.g. will the hibernation or sleep function do this (or do they always set aside their own reserved sectors that do not change...)?

if it was me, I might just shut the computer down and not use it until fixed

[azasadny]

Randy,
If you have the time, send me the drive and I'll recover the files...

[John Rogers]

I have used Power Data Recovery on thumb drives, external USB drives and internal SATA/IDE drives that had their partitions deleted and also suffered an accidental reformat. Worked every time.

[id10t]

Originally Posted by RWebb

can someone advise him as to what actions might cause the machine to write to the drive w/o the user doing it explicitly?

If you power it off with the switch or by pulling the plug, then the OS won't have a chance to try and write to it. Of course, if files are being written (elsewhere as well) they could be corrupted.

Backtrack won't mount it until you tell it to (same with most other Linux systems) and has the nice forensics tools to bring the backup journal/FAT/etc back.

[rcecale]

Originally Posted by RWebb

Absolutely

can someone advise him as to what actions might cause the machine to write to the drive w/o the user doing it explicitly? e.g. will the hibernation or sleep function do this (or do they always set aside their own reserved sectors that do not change...)?

if it was me, I might just shut the computer down and not use it until fixed

Randy, it's a USB external drive. I simply unplugged the drive. Nothing to be written to it after that.

Porwolf, I owe you, dude!!! Recuva did the trick.

Ran a scan which took a little over 12 hours, but it found a total of 166389 files, 96961 of which were my music library, and the remaining files I was hoping to restore (documents, images, etc,) all seemed to be there as well. Once the scan was complete, I initiated the recovery (which took an additional 12 hours) and everything I was looking for was restored. In excess of 620 Gb of data!

I've still got a bit of work to do to complete the recovery. All the files restored were placed into a single folder, so now I have to cull through them and rebuild my directory structure manually. Fortunately for me, my naming convention should make this a pretty simple process. Should have everything completed by the end of the weekend. With triple-digit heat in the forecast, should be a good weekend to stay inside and get it done!

Thanks for all the advice, fellas. It never ceases to amaze me, the knowledge depth on this BBS.

Cheers!

Randy

[rcecale]

Originally Posted by azasadny

Randy,
If you have the time, send me the drive and I'll recover the files...

Appreciate the offer, my friend! You and Dave seem to be the go-to-guys for all things PC related.

Thanks!!!

Randy