Data Loss Due to Accidental Formatting – What Happened:

Recuva
1

Data Loss Due to Accidental Formatting – What Happened:

I accidentally formatted one of my hard drives – the full story is a bit longer:

My laptop had a dual-boot system with Windows and Linux installed. After Linux crashed, I was prompted during the recovery process whether all data (except the Windows partition) could be deleted. I confirmed, assuming that this only referred to the first hard drive with the two system partitions (Windows and Linux).

Unfortunately, the deletion also affected the second hard drive – which contained all of my important data.

I then started a data recovery process using Recuva. Fortunately, the program found about 99.9% of the deleted data. The recovery destination was set to the second hard drive (i.e., the same one the data was originally deleted from).

Before the recovery process began, Recuva showed a warning that problems could occur if the recovery is done to the same drive — since it could overwrite existing data. At that point, I aborted the process.

The Problem:

Despite the abort, Recuva had already saved a file named
rtr72F2.tmp (approx. 1 GB in size) on the affected drive. Presumably, part of the disk sectors was overwritten by this. Since then, neither Recuva nor any other recovery tools (e.g. TestDisk or PhotoRec) have been able to find any files on the drive.

Question:

Is there anything I can still do with this .tmp file?
Is it possible that this file contains important information related to the recovery, such as:

  • Directory structure

  • File names

  • Storage locations

  • Metadata of the found files?

Is there any chance of extracting some kind of restore point or a file reference list from it?

2

Sorry to hear about that happening, but I believe that you still may have a chance to get your files back. (Recovered to a different drive of course).

In usual use Recuva looks for files that have a ‘deleted’ flag, which from what you say I think may be what you had done.

However with a reformatted drive the files you are wanting to get back are the non-deleted files that were ‘live’ on the drive when it was reformatted.
Those files hadn’t been deleted, they were ‘lost’ in the reformat. So they don’t have a ‘deleted’ flag and there is a special way of recovering them.

Have a read of this (and watch the linked video), then once you have a target drive to recover to give it a go to see what it can find:

PS. With a bit of luck that .tmp file won’t have overwritten much, and maybe not any of the non-deleted file data which is what you actually want to recover.

Good luck with your recovery attempt, hope it goes well for you.

PPS. I see that you had already asked this question on reddit and got some not so helpful replies there.
Do you actually have a 2-month old backup as stated there?
And is the drive that you are attempting to recover from an SSD as some there seem to think, or is it a HDD?

3

Thank you for your prompt response.
Indeed, Reddit often proves to be unhelpful in situations like this. My backup is two months old and stored on an SSD. The drive installed in my laptop is also a 4TB SSD.

I attempted the method you previously suggested, but unfortunately, it was unsuccessful.

At the moment, I am trying GetDataBack in hopes that it will be effective.

4

SSDs are tricky, because of TRIM and garbage collection/wear leveling there is very limited time before the data is lost forever.

You have a bit more of a chance with an external SSD, simply because the TRIM etc. tends not to happen as often. But it still happens, especially with newer external SSDs when the drives controller may issue TRIMs.

I’ve never been able to recover more than 2 or 3 deleted files from a SSD.

I’ve also never tried a recovery from a reformatted SSD.
I suspect that it’s somewhat different to the reformatting of an HDD and no data at all would be recoverable. Possibly with forensic recovery? (Government or Law enforcement level stuff).