# Recover mistakenly formated drive ?



## bcarwell (Mar 17, 2019)

Let no good deed go unpunished...
I recently got a new huge SSD and was excitedly and dutifully organizing and consolidating everything on my other drives before utilizing it.
Whilst doing so I inadvertently re-formatted the hard drive where I was consolidating all my music libs, programs, and samples before transferring them to the SSD.
I am now horrified that my HOURS of work were trashed in two seconds by mistakenly re-formatting this hard drive thinking it was the SSD that was requesting formatting.
Fortunately I now surmise there are various programs which will totally reverse the brain phart (PLEASE confirm this is true !!!) with a few clicks.
Problem is: there seem to be MANY solutions and programs promising a fix- some free, some costing.
Can some kind soul please tell me very simply exactly WHAT I need to do to get me back to where I was before I pharted ?

THANX !!!,
Bob


----------



## whiskers (Mar 17, 2019)

Definitely DON'T write to the drive after format.

There's no easy undo, but is it mac or pc?


----------



## dzilizzi (Mar 17, 2019)

I recovered a lot of data from a drive that was accidentally formatted with an operating system installed on it when the OS installed to the wrong drive. Obviously, some was lost forever, but I was amazed at how much was still recoverable. 

I want to say I used a few freeware programs, but I think I ended up paying for one. The freeware worked great but gave me thousands of files without usable names. After opening a number and renaming them, I decided it was better to use a program that actually reconstructed the files and folders. I'm on Windows, so the programs for Mac will likely be different


----------



## whiskers (Mar 17, 2019)

Yep there's no real 'undo'. Maybe try recuva if on PC. It's probably not going to be clean any way you go about it.


----------



## BL (Mar 17, 2019)

bcarwell said:


> Let no good deed go unpunished...
> I recently got a new huge SSD and was excitedly and dutifully organizing and consolidating everything on my other drives before utilizing it.
> Whilst doing so I inadvertently re-formatted the hard drive where I was consolidating all my music libs, programs, and samples before transferring them to the SSD.
> I am now horrified that my HOURS of work were trashed in two seconds by mistakenly re-formatting this hard drive thinking it was the SSD that was requesting formatting.
> ...



I can recover it. PM me.


----------



## Gerhard Westphalen (Mar 17, 2019)

I'm not familiar with any specific tools but it's definitely possible depending on how it was reformatted. Most of the time, deleting files or reformatting just removes the entries from the table which stores the location of the files (I forget what it's called). The data is untouched and there are programs which will "find" the files and rebuild the table. That's why in order to securely wipe a drive you need a tool which will write over the entire drive which can take hours.


----------



## whiskers (Mar 17, 2019)

Gerhard Westphalen said:


> I'm not familiar with any specific tools but it's definitely possible depending on how it was reformatted. Most of the time, deleting files or reformatting just removes the entries from the table which stores the location of the files (I forget what it's called). The data is untouched and there are programs which will "find" the files and rebuild the table. That's why in order to securely wipe a drive you need a tool which will write over the entire drive which can take hours.


Exactly. If you want any hope of recovery you don't want to write to the drive after format. Zeroing the drive or writing random data to it makes recovery very difficult.

The table with file information goes by several names depending on file system. File Allocation Table, Master File Table, or Master Directory Block


----------



## wst3 (Mar 18, 2019)

It is absolutely reversible until you start writing to the disk again.

I've used R-Tools, successfully, to do exactly this. There are several similar tools, I just happen to have a license for R-Tools.


----------



## MartinH. (Mar 18, 2019)

What are the differences between SSDs and HDDs when it comes to recovering deleted files or accidentally formatted drives? 




whiskers said:


> Zeroing the drive or writing random data to it makes recovery very difficult.


My understanding was that for zeroed/low-level-formatted/overwritten data there is NO consumer grade option to restore it. Is that incorrect? I know that in the realm of professional third party data recovery they can even get something back from a smashed hdd platter that was overwritten 2 times, but afaik that's so expensive that no one of us could ever afford it.


----------



## richardt4520 (Mar 18, 2019)

BL said:


> I can recover it. PM me.


You can recover a formatted _solid state drive?! _


----------



## richardt4520 (Mar 18, 2019)

poetd said:


> Of course.
> As long as nothing new is written, all a format does is reset the File Allocation Table - all the files are still there - speed is of the essence though, leave the disk for too long and it's rewrite protect software will make it near impossible to recover (depending on ssd type and setup).


My understanding is that's true on platter HDD but on SSD, it is composed of banks of RAM so it doesn't work the same way. Files on a physical magnetic HDD are still there since it's just magnetic spots on a metal disc and you've just removed the file pointers. You've done this before with an SSD? If so, that's pretty cool to know!


----------



## whiskers (Mar 18, 2019)

MartinH. said:


> What are the differences between SSDs and HDDs when it comes to recovering deleted files or accidentally formatted drives?
> 
> 
> 
> My understanding was that for zeroed/low-level-formatted/overwritten data there is NO consumer grade option to restore it. Is that incorrect? I know that in the realm of professional third party data recovery they can even get something back from a smashed hdd platter that was overwritten 2 times, but afaik that's so expensive that no one of us could ever afford it.


That's correct as far as I'm aware


----------



## chillbot (Mar 18, 2019)

I had good results with Disk Drill. Recovered about 95% on an SSD.

https://www.cleverfiles.com/disk-drill-windows.html

Recommended to me by @Farkle. I ended up having to purchase the full version, worth every cent. There's a lot of similar programs that do the same thing, I wasn't sure if some of them might actually be malware or not... this one is legit anyway.


----------



## dzilizzi (Mar 18, 2019)

Here is a list of free ones if you want to try them. https://www.techradar.com/best/best-free-data-recovery-software

I think I used the Recuva. I also used the TeskDisk and PhotoRec, which work very well even on stuff that might have been overwritten. BUT you don't get it in a very easily usable finished product and it takes forever. The files do have the correct extensions if you are looking for a particular file, but the names are useless and you have to open them all. 

Here is another list. https://www.lifewire.com/free-data-recovery-software-tools-2622893

Disk Drill, mentioned above, is in this list. I don't think it was available when I used these. EaseUs is another one that is good, but that you have to pay for. I've used a lot of their free stuff and it works well. You definitely want something that doesn't install to the drive you are recovering. And you want another drive to recover the data to. A lot of these will run from a USB stick/drive.

Okay, that is about the end of my knowledge on this. Good Luck!


----------



## whiskers (Mar 18, 2019)

Obligatory "this is why you should make backups before embarking on data/system changes..."


----------



## whiskers (Mar 18, 2019)

richardt4520 said:


> You can recover a formatted _solid state drive?! _


yeah, the mechanics are slightly different, but the logical layout of the filesystems are the same. As long as you haven't written data to the drive post format, you've essentially wiped/replaced the File Allocation Table and filesystem header, but the rest of the data is just marked as 'free for use,' just like on a hard disk magnetic platter. Once you write over that, however, things get exponentially more difficult. 

There's a bit of hope even after some overwrite, if you were to go crazy expensive, with forensic tools (e.g. FTK) or even magnetic force microscopy (MFM) on magnetic platters, but recovery costs and efforts are astronomical, and again, there's no 'complete' undo, you're gonna get partial bits of data.

SSD recovery is a bit different i think, in the mechanics, as you're attempting to read flash memory to find data blocks rather than changes in magnetic storage, but I haven't really looked into it. I know that TRIM can be pretty aggressive with data deletion/'use after free' so recovery can be pretty difficult with those (I think most modern SSDs use TRIM?).

I did quite enjoy the year of digital forensics I took in college though, maybe I should look into it more. Most recovery efforts for the pro shops are often after drive failure more often than overwrite, so there's usually more to go off of.

As a security guy though, I would have to say the best ways of actually securely erasing storage mediums is degaussing (for magnetic based mediums) and physical destruction. It's a lot more efficient and orders of magnitude more difficult to recover destroyed media vs media that has been zeroed (even though, again, that's very difficult as well.)


----------



## richardt4520 (Mar 18, 2019)

Really glad for the info in this post. Last i'd heard, any deletions or formatting ssds permanently lost the data. That's why i've stayed away from using them for system drives. I backup, but not nearly as much as I should. Modern wd hdds rarely ever failed in my corporate environment at work when we used them and I've never had one bite the dust so I was holding out. Probably better to just back up more than every couple of months, I know! Lol


----------



## whiskers (Mar 18, 2019)

richardt4520 said:


> Really glad for the info in this post. Last i'd heard, any deletions or formatting ssds permanently lost the data. That's why i've stayed away from using them for system drives. I backup, but not nearly as much as I should. Modern wd hdds rarely ever failed in my corporate environment at work when we used them and I've never had one bite the dust so I was holding out. Probably better to just back up more than every couple of months, I know! Lol


I just have a backup job that runs once a month. You can do differentials or incremental as well if you don't want to take the time of a full backup, but if you schedule it, it can be pretty fire and forget. I personally wouldn't let your fear of data loss hold you back from using an SSD (though I wouldn't go for a cheap one) - they are pretty amazing compared to HDDs.


----------



## kitekrazy (Mar 18, 2019)

whiskers said:


> Obligatory "this is why you should make backups before embarking on data/system changes..."



A true humbling moment for the OP. I could easily do this same mistake. I pay attention to drive letters and make sure drives are given names. This kind of mishap could also be a blessing for me as to reduce bloat.


----------



## richardt4520 (Mar 18, 2019)

poetd said:


> But ALWAYS Back Up Your Shit!
> No-one on this site needs telling that? Right? RIGHT?...


Oh yeah! Haha Definitely should know better!


----------



## dzilizzi (Mar 18, 2019)

I used to not really bother much. I duplicated the information from my desktop to my laptop and copied documents and pictures. But not the full drive. This was mostly because I had backups that couldn't be read once the related computer drive died. I've now found I can mount them as a virtual drive and recover the data. But it was very frustrating for years when drives would die. Which was why I would just copy files. This was both purchased and Windows back-ups. And purchased were worse because I would lose the program and ability to recover when the drive died.

Windows currently makes decent system images. So I make an image of the main drive, which is mostly programs, when I make major changes and copy the files off the others on a regular basis. I've still had issues trying to load the image. I had to disconnect all the drives but the new one and the one with the image. I almost did what you did with the caveat that I did have everything backed up. This was after a recent crash. Not fun at all.


----------

