File recovery question

[JJJJ1]

I've just very foolishly formatted (quick format) my E drive with almost 2 TB of data on it. The hard drive contained mostly Raw files from varies cameras along with many jpeg's, tiffs and psd files in many different folders.

 

Will Recuva be able to preserve the file and folder structure, assuming it recovers everything?

 

Any help would be much appreciated, thanks.

[Andavari]

To get the file and folder structure restored (you need to restore onto another disk though so you're not overwriting what you want to restore):

1. Open Recuva, and click cancel if the Wizard startup GUI shows to get into the main Recuva window.

2. In the main Recuva window click: Options -> Actions -> Restore folder structure

 

Also see the help documentation before you start:

http://www.piriform.com/docs

[JJJJ1]

Thank you for your help. I'm off to read the documentation now.

[JJJJ1]

Having now read the documentation I've set Recuva running to do a deep scan. In a matter of seconds it indicated that it had found 182931 files and I left it running overnight, at this stage it was indicating that the progress was at 11%. This morning the scan has now been running for approximately 9 hours the found files remains the same but the progressed has only increased to 12% and has stayed there for the last couple of hours. The estimated time left has increased from 1 day to 3 days. Does this sound like it's working ok or is it possible it's 'stuck' on 12% progress?

 

I presume there's no way of ending the scan and recoverring the 182931 files it's found so far.

[Augeas]

If you cancel the scan then the files found already will be displayed - perhaps more or fewer than 182k, but you will see some results.

 

In the case of a formatted volume I assume you would be interested in recovering previous live files, not deleted?

 

If so, chop the deep scan, uncheck the deep scan option, check the Recover Non-Deleted Files option, and run the (normal) scan again. It will be far faster than the deep scan.

 

The deep scan is used for finding deleted files that can't be found using a normal scan, and has limitations, such as it won't fully recover fragmented files, or file names or folder structures, or txt and bat and other files that have no file signature.

 

Your volume is larger than 2tb? A Recuva deep scan has to read every cluster and check for a valid file signature from a fairly long list. At a 4096 cluster size it has to do this nearly half a billion times. Disks are just too large these days.

[JJJJ1]

Thanks for your help Augeas. The scan is still only on 14% so it would take several weeks by the looks of things. I'll cancel the scan and follow your instructions. I appreciate you taking the time to help

[JJJJ1]

Hi Augeas,

 

  I cancelled the scan and a huge list of files were displayed. It included many of the file types I was hoping to recover, such as CRW (Canon raw files), psd files, jpeg's, tiff's, etc It stated that every file was in excellent condition and not overwritten. See screenshot below of the results;

 

 

I re-launched Recuva and did another scan with the settings you advised, i.e. Scan for Non Deleted Files and Restore Folder Structure checked. The other boxes in the Action tab were left unselected.

 

The result finished virtually instantly with just 3 files shown, as seen below;

 

 

 

Any ideas on how I can recover the files shown after the deep scan, but preferably keeping the folder structure and names intact?

 

 

 

 

 

 

 

 

[Augeas]

That's a blow. As far as I know when the quick format runs it writes a new shortened MFT on top of the old one. The scan for non-deleted files option reads past the end of the new MFT and picks up the old file entries. In this case it looks as if the entire old MFT has gone - I don't know why, perhaps something in the formatting.

 

Unfortunately the deep scan results have gone as well. To recover those 182k files listed you'll have to run it again. I assumed that if you saw any files that were worth recovering you would have done so, but I should have mentioned it. Ah well.

 

The files will all be excellent because there's not a lot in the MFT that can be overwriting them. When a file is found with a deep scan the following clusters are read until another file signature or an eof is found. This means that if the file is fragmented only the first fragment will be found. Of course no folder structure info is held in the file so the folder will not be able to be reconstructed. I don't know where the file names come from, overwhelmingly they are not held in the file data area, but it might be different with these psd files.

[DennisD]

I've just very foolishly formatted (quick format) my E drive with almost 2 TB of data on it. 

Any help would be much appreciated, thanks.

 

Hi JJJJ1.

 

As I don't like, or intend, to step on the toes of my associates, can I just say that after you've exhausted the recovery process with Recuva and the sound advice you've received towards that goal, I could have another suggestion for you.

 

If you achieve the results you want, then that would be great and you can ignore this post. If not, then I'll outline my suggestion, which would be one coming at the problem from a completely different angle.

 

All I will say is that the possibility is available because you've done nothing more than "Quick Format" your drive, and is also dependent on you not carrying out any "write" operations to the drive in the meantime.

 

Because this is primarily a Piriform Support Forum, then Recuva has priority over my suggestions, but I'm mentioning this in case you do do any further "write" operations, which would jeopardize what I have in mind.

[JJJJ1]

Thank you again Augeas for your help and advice. I have done another deep scan and although I don't think it's found everything, I shall recover as much as I can. The hard drive represents approximately ten years of photography so as you can imagine I'm keen to get as much back as possible. My own fault for not keeping up to date with my back-ups, although thankfully some of it is. Reading through the file types that a deep scan is capable of recovering there was no mention of Photoshop's PSD files. I assumed they wouldn't be found, but to my surprise they were

 

 

Dennis,

 

  Thanks for your input and I would very much welcome your suggestion on alternative recovery techniques as I still appear to be missing severable files I would very much like to get back. I am following your advice and not writing anything to that drive. I've just bought another drive to recover the files to, leaving my E drive untouched.

[DennisD]

OK Jman, once you've done all your recovery to that other drive, and get to the point where you are sure you can't recover anything else, I'll outline my suggestions in full for you.

 

I'm not being mysterious here, but my approach will eventually mean a write operation to the drive, which won't do any harm if you've completed and exhausted what you're doing now.

[JJJJ1]

Thanks Dennis.  It's likely to be several days by the time I've finished as it looks like recovering over 182000 files is going to be a very slow process. I'll get back to you then if it's ok. I appreciate your help, thank you.

[JJJJ1]

The file recovery process has now finished and I've recovered the files to a new hard drive. Recuva has done a great job of recovering approximately 1.3TB of data but unfortunately I'm still missing about 200GB's worth of files.

The strange thing is, there were several folders of images from 2014 and other than just one folder from 7.10.2014. no others were recovered. Also, other folders that contained images that were edited in 2014 also appear to be missing anything from that year. There doesn't appear to be any problem with recovering files and folders from all the way back to 2004 up untill the end of 2013. It's just that all the 2014 data is missing apart from the one 2014 folder mentioned above.

Does anyone have any ideas why this is?

If anyone has any further advice on how I may be able to recover the more recent files and folders, that would be great and very much appreciated.

 

 

Dennis,

  Would you be good enough to now share your suggestion with me? Thanks