Accidentally wrote an image on a harddrive, anyway to recover data?

[r0g3r]

Hey guys,

so I was flashing an image to my SD card, except i accidentally chose the wrong drive letter and ...it wrote on the hardrive instead of the sd card.


I had tonnes of important stuff on this harddrive. is there any way to recover it?

Please help!

Thanks in advance

[sabad66]

1. Stop using the drive ASAP.
2. Plug drive into an enclosure of some sort
3. Connect enclosure to another computer and use some recovery software such as recuva

[eblend]

what sabad said. Data is never really lost, it's just freed up to be rewritten, and the longer the drive is in use after the fact, the much more chance there is it will be rewritten.

I usually use Ontrack Data Recovery, used to be on Hiren's boot disks prior to version 10, so if you find Hiren's Boot Disk version 9.9 on torrents it will have the software you would need. Boot of the CD and run the software, select your harddrive, and do a scan and see what it can find. You will need to have a place to dump the data it found so make sure you have another harddrive handy as you won't be able to recover in place.

[UndrgroundRider]

Recovery should be pretty easy with this one. Assuming your image file was relatively small <2GB, then likely only system files were overwritten. Most of the good recovery tools will be able to read the MFT mirror (stored at the end of the drive) and recover your important files.

[r0g3r]

I tried recuva and it didn't find anything.

What other tools would you recommend , and how to use them exactly? I will try on track data recovery when I get home.

Can any of you provide like some instructions with the good software? I'm very newbie with this data recovery business. I'm willing to buy the recovery software if it will help, and work.

The image I flashed was only about 200mb.

Thanks for your help.

[eblend]

Ontrack is used by big data recovery companies, so give that a try as mentioned earlier.

If you have the drive I can just meet you downtown and try the recovery for you.

Also, I made a mistake, it isn't Hiren's CD that has that (perhaps it does as well), its the BartPE disks that do.

[r0g3r]

Is this the ontrack recovery program you were talking about?

http://www.ontrackdatarecovery.ca/file-recovery-software/windows/

?

[frizzlefry]

Being that you applied an image your MFT (master file table) was overwritten. So when you run recuva you will need to enable deep scan. This will reconstruct the file table for the recovery. Without deep scan enabled it just looks to the current table to see where files were located. If that's not there (which it isn't) it won't see anything.

That said, if your hard drive is an SSD drive you may be shit outta luck. All newer SSD drives support a function called TRIM which renders data recovery useless. With old school magnetic disks, data can be written on top of previously deleted data. Until that happens the data can be recovered rather easily (which is why you should zero-fill or overwrite the entire magnetic drive before recycling it). But with an SSD drive data cannot be written over previously deleted data, old data must be deleted first before that space is free for new data. After time this would slow down the performance of SSD drives as every time a write would occur a delete would have to be executed first. So newer drives have TRIM which will automatically issue a low level delete command in the background when files are deleted (or partitions nuked). So a delete is actually a real delete as opposed to magnetic disk where a delete simply removes the file listing from the MFT. There are a number of white papers out there describing how new SSD drives are rendering computer forensics useless as even the mega expensive En-Case police software cannot recover deleted data from a TRIM enabled SSD.

If your drive is magnetic disk, then a deep scan or a more thorough recovery program should do the trick. If its SSD you may be SOL....

[eblend]

Originally posted by r0g3r
Is this the ontrack recovery program you were talking about?

http://www.ontrackdatarecovery.ca/file-recovery-software/windows/

?


I sent you a PM last night..