recovering from accidental quick format to different cluster size

[wyup]

Hello,

I reformatted by mistake a 1tb usb hdd thinking it was a pendrive. I formatted to NTFS 32kb cluster size and copied two 4Gb files. Probably the deleted disk was 16kb size cluster.

After deep scan and all safe options check, 112k files were not recoverered (out of 192k) for cause: "Skipped" and "wrong block".

My question is: does the new 32kb format prevent from recovering my files? My deleted partition was low fragmented.

Should I try deleting the volume and run Recuva to the disk directly, without partition? Or should I reformat the partition to the 16kb block size and attempt recovery once again?

[Augeas]

It's certainly going to make recovery difficult. Did you check Scan for Non-Deleted Files? If so these files - with file names and directory info - will be worthless, as the cluster addresses are multiples of block sizes, the wrong block size. You need to look at the deep scan files, those with just a number and extension.

Assuming the sector alignment is the same (i.e. both block sizes start at the same boundary) then you may possibly find and recover some files. But you will be retrieving two 16k blocks in one 32k read. Whether this is valid, and for all file types, I don't know. Also you will be missing all files that are aligned on the odd-numbered 16k block boundaries. The 32k block reads will read the 0, 2, 4, 6 etc 16k blocks, and miss the 1, 3, 5, 7 blocks. A recovery of a single 32k block will contain another 16K of data. And to add to all that a deep scan will not retrieve anything but the first extent of a file.

So it's all a bit of a mess really. I think your best plan is to quick format back to the old spec and keep your fingers crossed. This time you can check Scan for Non-Deleted Files, and hope that some of the old MFT still remains. But all of this is guesswork, I don't really know what's happened to your disk, it's at your own risk.