help recovering data from a partially formatted disk

I would start by scanning the disk to see if there are any MFTs left. On many disks, the MFT starts at sector 0x60003f, ie about 3GB into the disk. This is rather close to the start, and would need a fairly quick 'abort' not to erase it.

Your luck may be in the MFT has been fragmented, and there are still areas of it left on the disk.

If it was a FAT disk, then the FAT will have been erased, but you may still beable to scan for directory entries. Fragmented files would not be recovered straight off.

You need to determine how much has been formatted, and then work out if the above two methods will help. Final solution is just data carving

i thought that the MFT mirror would help… but…

i thought that the MFT mirror would help… but…

My understanding is that the $MFTMirr is just a copy of the first 4096 bytes of the $MFT (4 records). If you have lost more than 4 records then it's pretty useless.

Paul

ok thanks.. then i'm pretty errr… f.. D

With the $MFTMirr you will be able to tell where the $MFT has been stored. Determine which area of the disk has been formatted, and you will see if any $MFT is still available

@Rampage

Testdisk is a good tool to recover a drive that has been accidentally re-partitioned, can't do much about re-formatted.

But something can be done nonetheless.
http//www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

$MFT and $MFT mirror location is connected to the size (and cluster size) of the actual partition, so, by recreating an image with the same size you should get the right location of both the $MFT and $MFTmirror.

The $MFTmirror is actually 4 sectors long
http//www.ntfs.com/ntfs-system-files.htm
but it is enough to access the actual $MFT (if it is still existing and/or the single MFT entries, whch most probably are still largely there).

However, what you may want to try is FILE-based recovery, besides PHOTOREC, that probably won't be useful in your case, you can try
http//memberwebs.com/stef/software/scrounge/

or, among the Commercial software, I can recommend you FileScavenger
http//www.quetek.com/prod02.htm

Check this wink
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5353

jaclaz

thanks jaclaz, it looks like getdataback is working fine.