6

I've searched through several questions but didn't quite find anyone treating mine.

So, I have a 1TB external hard drive I use for backup purposes with only 1 NTFS partition. Today using DiskPart I formated that partition by mistake (who would have thought the disc count started in 0 and not in 1). The complete command I used was:

format recommended override quick label=Windows

So I performed a quick format, and from which I've read after a quick format it's possible to recover the data stored there. Anyway, as soon as I realized it wasn't the partition I wanted to format the one I specified I removed the access to my external drive to minimize possible damages.

Now, the MFT is the metadata part where the file name, creation date, access permissions and contents are registered; and it's mirrored too (so there's a copy of it somewhere in the disk). What I don't know is if a quick format erases that MFT mirror too, I hope not.

I'm running a program to recover files on it but I'll have to save the files to another location (once it's finished scanning, ~12 hours from now) and I don't quite have over 900GB of free storage where to put the data.

I would like to know if there's a program or procedure by which I could restore the old MFT in-place and have all the data that used to be in there accessible once again.

Any help or light you could shed on how to proceed or what programs to use is really appreciated.

Ariadne Sousa
  • 63

3 Answers3

2

As a start ...

"Painless Partition Recovery

Partition Find & Mount implements a new concept of deleted or lost partition recovery. It works in the most convenient way possible — by locating and mounting partitions into the system, thus making those lost partitions available to you like any generic disk volume. Partition Find & Mount will also work in case any Boot Record (including the Master Boot Record) is missing, damaged or overwritten."

http://findandmount.com/

Otherwise I'd think you could find some utilities to restore the MBR - intact.

therube
  • 1,476
2

chkdsk can possibly restore the MFT from the mirror, back up your data before doing anything, buy a usb drive if needed, or risk losing it all.

No way for anyone to know how far the quick format went before detachment.

Never used this software but looks interesting

http://dmitrybrant.com/ntfswalker

According to Jaclaz in this forum it is not possible

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6425

For the record, unlike what a lot of people apparently thinks, the $MFTMirr is pretty much useless, as it consists of ONLY the first 4 (four) records of the $MFT. Obviously once you re-format, it represents the mirror of the first 4 records of the NEW $MFT, unless you changed CONSIDERABLY the partition size (thus causing the new $MFT and $MFTmirror to be "somewhere else") or you used a NT system that uses a different "default" for the placement of these structures - like Windows 2000, in which case the OLD filesystem structure may be not overwritten.

.

Moab
  • 58,769
1

I've done more or less what you've described before. Twice actually. The 2nd time on a 4TB RAID-5 (just for fun ;) The first time around, I ended up buying Restorer Ultimate. It worked both times, not to mention on numerous other occasions of varying difficulty levels, though not always 100%. The software runs in demo mode, which will tell you which files it can restore. In your case I would assume that's everything.

glenneroo
  • 2,377