0

So I was trying to create a bootable USB to reinstall Windows for a friend, but mistakenly started partitioning the wrong disk (probably the dumbest mistake I could have made).

This disk is a 1 TB WD Black in NTFS format, hooked up as my D: drive to Windows for a variety of photos, documents, movies and game installs – the basic home stuff.  There was about 400 GB of files on the drive (i.e., it was about 40% full).

The following sequence of events occurred:

diskpart
select disk 1 // wrong disk number
clean
create partition primary
select partition 1
active
format fs=ntfs // note the missing 'quick' argument

It then ran to about 3% when I realized my mistake.  So I hit Ctrl+C to cancel the formatting.

In Windows' disk management tool the drive now shows up as healthy, active, primary NTFS partition that is 100% free and 931 GB capacity.

So after some googling, I downloaded TestDisk. I tried analyzing and then the deeper analysis of the drive, which just came back with 1 available partition that is fully empty. The only files found were within the "System Volume Information" folder. It didn't seem to be able to restore any MFT copies or lost partitions, but I'm not an expert with these things so maybe I did something wrong – I wasn't sure exactly what guides and steps to follow since I did more than a simple diskpart clean.

After all that failed me, I attempted running PhotoRec to see if any files could be found. That also failed with 0 files found.

I'm out of ideas now, but from my (limited) knowledge, at most 3% of the drive was re-written in the format, so the rest of the drive should have intact data that can be recovered. What more can I try?

Update: Using Frhed, a hex editor, to load up the partition gave "A disk read error occurred...BOOTMGR is compressed" (image below). Trying to scroll through the sectors everything shows 0 – but without a boot sector, it can't be read so is this reliable?

Update 2: according to this question on Tom's Hardware forum, using Ctrl+C to interrupt the command doesn't actually stop the formatting, it runs in a separate process in the background. Since I didn't immediately reboot my PC it has indeed overwritten the entire disk. Thanks for all the help, I wouldn't have needed to ask this question if I had known this sooner.

Hex editor output

Ward D.S.
  • 103

1 Answers1

1

How may partitions were originally there? If only one, then it's size may not have changed, and testdisk wouldn't find any other partitions (but it might've possibly found some files to undelete - did you check for files?).

PhotoRec definitely should have found some files to undelete, unless they were very small and all managed to get overwritten in that first 3%... was it definitely reading the correct drive, and was looking for all filetypes? If not, you might've only been searching for 1 or 2 filetypes and it just didn't find any.

TestDisk and PhotoRec both have great webpages with documentation like TestDisk Step by Step to recover lost partitions and repair damaged FAT/NTFS boot sector.

(I do like to use a GUI like gparted to see what's going to be overwritten first, and try keeping other drives disconnected or at least asleep to avoid these types of problems, and backups are important too)

Xen2050
  • 14,391