Recover data form formatted drive

Hardware HDD's & SSD's
1

Hey all,

I have searched for answers to my problem and although have came up with a few results most are outdated or incomplete.

Basic problem statement: I formatted my 4 TB USB backup disk and then wrote OSMC a Linux based os to the drive. The OS is only about 300mb so I hope the rest of the 4 TBs are still intact. I need to recover the data from this.

I have started my process by taking a full backup.img of the drive using ddrescue in a live Kali environment.

Currently, I have the completed .img file and map file and it has finished successfully.

Next step that I could find was using Testdisk to search the drive for deleted files. While my live kali environment was giving me trouble installing Testdisk I decided to get the windows version and run it from another machine. I couldn’t get it to run with the .img file so I ran it against the main formatted drive.

Normal Testdisk operations in this case that I could find were select drive/partition, go to advanced, highlight partition, select undelete and it brings up a list of your files to copy to a new location. Testdisk just returned the files of the new OSMC- OS that is currently written to the dive and no other files.

I read using Testdisks analyze feature can recover partitions so I have started that process on the windows machine using the original drive. Everything takes forever on a 4TB drive. It is at 4%

I still have my image file, I am debating if Testdisks analyze will bring me to a point to recover files and wish to start another operation in parallel on the Kali/Linux box working from the .img file.

Next program I plan to use is foremost and start carving. Wondering if anyone has experience with this situation. A tool or process you recommend for me to retrieve the data.

I am aware of testdisks PhotoRec although majorly turned off that it can not recover file names. I have also tried Recuva Pro (from the creators of CCleaner) although it to only showed me the files of the current OSMC- OS partition and not the formatted partition.

A few important notes.
-The 4TB drive is only showing up as a 300mb drive with the OSMC- os on it.
-I am trying to recover all types of files, doc, raw images, mp3, mp4, wav.
-I have about 3.5 TBs of data that was on the drive.
-The ddrescue copied all 4TB to the .img file.

Appreciate any input or suggestions and open to answering any additional questions you may have.

Thank you for your time.

2

Excellent. This will maximize your chances of recovery.

What was the original filesystem on the disk?

Yeah, this will take a while, but it’s probably the best option. Testdisk is an excellent tool.

You’re unlikely to be able to recover filenames from a deleted partition. File and Folder structure/metadata are typically lost when you write over a partition.

I’d start with testdisk, then go ahead with Foremost if testdisk fails.

You shouldn’t be running parallel operations on these images, not because of corruption, but because HDD seek time will cause performance to tank.

1 Like
3

I believe NTFS as it was just a WD usb external hard drive. I suppose I could have used exFAT but I’m pretty positive it was NTFS.

I would like to start running another tool or operation on a second computer, using the Img file I have created of the main partitioned drive. (copy of the drive) so this will not affect performance.

Also current status of TestDisk Analyze
Capture

Should I run foremost then? Do you have any other program or operation suggestions?

4

Ah, if it’s on a second computer, go for it.

If I can’t get the data back from testdisk/foremost, I usually give up. Yes, I’d recommend Foremost.

This is good. Both of these filesystems are well supported on these tools.

1 Like
5

is that a compressed drive? (osmc might have compressed the files remaining on the drive)
mismatch of the heads and cylinders(possible controller failing)
I know youve tried kali, have you tried cyborg hawk? (forensic distro)

6

OP is trying to recover the data that was there before the OSMC partition was written, from my understanding.

7

use foremost but id recommend being ready to dd the copied drive as needed should different steps fail

8

I think there’s a software that can recover files.
goo.gl/NNs6Cg

9

This is already a very old topic.
We appreciate your input, but it’s very likely that said topic starter,
already has fixed the said issue.

So there for i’m going to lock this topic.

Next time please check date of the topic.

Grtz :slight_smile:

1 Like