Data recovery after SSD Format

[roborobs computer repair]

Had a drive that when I upgraded it to an SSD and removed the HDD Booted off the SSD Fine. Took the old drive and reformatted it on another system and put HDD back in the patient - only adding old hdd as spare storage - the system would not boot saying BOOTMGR missing. Tried doing windows recovery no luck. When I connected the SSD to my main machine it comes up that the boot partition is unallocated ie something happened that caused the boot partition to reformat. after the second drive was added.

Tried recovering the partition on the SSD but kept getting stuck at 24% so we switched back to the HDD to try and recover.

I'm trying to use Remo Recover on on the HDD. it finds the data but it is only showing the files as their file type without any file structure. any ideas?

 

[Porthos]

This is why I take the extra step and Image a drive to external storage before I do any upgrades.
Did you do a clone of the drive to the ssd?
Might want to try a Macrium boot disk and use the fix boot feature.

 

[britechguy]

Also, for attempting data recovery from the reformatted HDD, I have had great luck with TestDisk or PhotoRec (which comes as part of TestDisk).

 

[roborobs computer repair]

This is why I take the extra step and Image a drive to external storage before I do any upgrades.
Did you do a clone of the drive to the ssd?
Might want to try a Macrium boot disk and use the fix boot feature.

Yes cloned the drive directly to the SSD. had the drive not been 1TB and had 800GB of data on it I would have done an image.

Also, for attempting data recovery from the reformatted HDD, I have had great luck with TestDisk or PhotoRec (which comes as part of TestDisk).

I'll have to give TestDisk a try.

 

[Porthos]

had the drive not been 1TB and had 800GB of data on it I would have done an image.

But now you are stuck without the client's data and are trying to recover it.
Did you even consider booting a Macrium restore disk to fix the boot issue on the SSD?

 

[roborobs computer repair]

But now you are stuck without the client's data and are trying to recover it.
Did you even consider booting a Macrium restore disk to fix the boot issue on the SSD?

Well not a client persay working in a corporate environment at the moment. - He really should have had his stuff backed up to the server like everyone is instructed to when working for this organization.

No I have not. yet.

 

[lcoughey]

Your immediate first steps after discovering the data loss should be to make a full sector-by-sector clone of both the SSD and the hard drive, just to make sure you cover yourself from any more mistakes. Then, you should attempt file system recovery against the clones, setting the original drives aside, just in case you need to send them off to a data recovery professional.

TestDisk - not really a data recovery program. It just looks for a boot sector (partition starts) and recreates a partition table. If the drive was reformatted, it won't help with the overwritten mft and any other overwritten sectors. Definitely should never be run against the patient drive, unless you have secured a 100% complete clone first.
Photorec - if you don't give a rip about a file structure and just want RAW files with the cheapest recovery option possible, this is your guy.
Remo Recover - I wish garbage recovery programs like this would just go away. I have listed many software recovery programs in the resources section.

Just remember, if you, the professional, didn't know better and make a full backup of your client's drive and lost their data, you should be the last person to lay blame on the client for not having a backup of their data.

 

[Sky-Knight]

Especially when you can get an 8tb Seagate External USB drive for $130.

The time for the image to be made is annoying for sure, but it's set and forget.

But in this case I'm curious why the original drive was touched. New SSD means old drive stays intact... if the owner wants that drive used for something else later, they can come back in a week. If they need more space, sell a new drive.

But if the original drive was simply formatted, testdisk can rebuild the old partition table and usually put the data back. If it was formatted and written to... it's dead Jim.

 

[britechguy]

Just remember, if you, the professional, didn't know better and make a full backup of your client's drive and lost their data, you should be the last person to lay blame on the client for not having a backup of their data.

That would be true, sans any context, but I suggest you look up the OP's posting history.

He's working for a company that, in my opinion and that of many here, is run by idiots. It is unsurprising that even if they have a policy in place regarding data backup, it was not being followed.

If I work in a company where I have been told, "These machines are backed up automatically at {interval X}," and am part of the department that is supposed to be doing that, I'd be willing to believe that others are doing their jobs as I'm supposed to be doing mine. If they weren't, that's not my fault, and re-doing what is supposed to have already been done is not an effective use of my time or company resources.

Under the circumstances described, Test Disk could likely recover quite a bit from a quick formatted drive. I agree that PhotoRec is the tool of last resort, but I've had to use it on a couple of occasions.

If the original drives themselves are not and were not in the process of failing then cloning them is really not necessary, they should be safely readable as many times as needed. I would presume that anyone who posts here knows that you only attempt to recover from a source drive to a completely separate physical drive, otherwise you could and would be overwriting sections of the very device you want to recover from.

Most data recovery situations involve drives in the process of failing, which is why cloning is critical then, as you may only get one shot to get something you can then take repeated passes at. This is not the situation here.

 

[lcoughey]

Rule #1 of data recovery - never, ever, ever assume anything and always make a full sector-by-sector clone.
Rule #2 of data recovery - never, ever, ever write a single sector back to the drive from which you are trying to recover

Yes, companies can have policies for users to back up. If they lose their data because they didn't backup, the fault is theirs. But, when a user gives a technician their drive that has all their data on it and the data is lost because of the technicians actions, it is 100% the technician's fault. The technician's very first question before working on it should have been, "is it backed up?", followed by, "are you 100% sure?"

 

[britechguy]

And what if the answers to those questions were, "Yes," and, "Yes," neither of which were true?

There is a limit to what one can, and should, do in an organization one is a part of, at least if one wishes to keep one's job and business relationships.

Again, and I won't be changing my opinion, a sector by sector clone is only needed when one is dealing with a drive one believes to be in death throes, no matter how early. Otherwise, it's a complete waste of time if one is following Rule #2, which one absolutely should be.

One should only ever be reading from a drive being recovered, and if it's not malfunctioning then having a clone serves no purpose but to consume time.

 

[lcoughey]

Otherwise, it's a complete waste of time if one is following Rule #2, which one absolutely should be.

FYI, testdisk writes to the drive, violating Rule #2

 

[lcoughey]

If you say that you have fire insurance and I ask you to confirm it and you say yes, followed by me lighting your office on fire. Who is to blame for the loss when it is discovered that your insurance wasn't renewed?

 

[Your PCMD]

Well not a client persay working in a corporate environment at the moment. - He really should have had his stuff backed up to the server like everyone is instructed to when working for this organization.

Doesn't matter. He HAD his data prior to when you touched it, now he doesn't, so its your fault. And as @Porthos said, +1. This is why you ALWAYS have a spare SSD (1TB) handy for situations like this. I have 2 1TB SSD's and a 2TB SSD for occasions like this, well worth the investment over the hassle. Had you had that image, you could have avoided the problem facing you now. Maybe this will give you incentive to get that spare SSD now.

 

[Markverhyden]

followed by, "are you 100% sure have you tested it?"

FTFY

 

[Markverhyden]

At this point the only thing you can do on an image of the drive is something like R-Studio. It will try to identify files based on raw data. Just be aware the result is huge, many times the size of the original drive.

 

[fincoder]

I'm trying to use Remo Recover on on the HDD. it finds the data but it is only showing the files as their file type without any file structure.

It must not be a very good data recovery program then. For formatted drives and lost partitions, I use GetDataBack which always works if the drive hasn't been written to. The full folder structure with original filenames is reconstructed in memory allowing easy recovery of selected folders.

 

[roborobs computer repair]

Well, looks like GetDataBack for NTFS is working. Now I know why this guy had SOO much data, 7VMs running on his machine for testing.

 

[Joep]

It must not be a very good data recovery program then. For formatted drives and lost partitions, I use GetDataBack which always works if the drive hasn't been written to. The full folder structure with original filenames is reconstructed in memory allowing easy recovery of selected folders.

Exactly, Remo Recover, RecoverIt, Stellar, all a waste of time. In the majority of the cases so is PhotoRec.

GetDataBack is good. if you want user friendly and still support for RAID and ridiculous amount of file systems I'd say ReclaiMe. If you want control and power, R-Studio or UFS Explorer. If you want dirt-cheap, DMDE (Be aware it can WRITE repairs to patient disk which is why I do not recommend it normally). In many cases these tools will give you the data complete with filenames in their original directory tree.

50% of screw-ups in the data recovery subreddit is by clowns using Testdisk. 40% followed advice of the 'stook heads' YT guy. 10% miscellaneous. if someone can put that in a spreadsheet that would be swell.

 

[Markverhyden]

In my experience testdisk is good for only one thing. Trying to recover the partition table. And as always get mentioned it should be done on a image, never the patient.