HD horror!

[loop4me]

To be as short as posibile, and to spare myself the misery of writing the whole sad story ,and to remind myself again of the weiredest things that is going on with hd this days, lets just say that i was trying to format my external-usb2,5 HD drive from xp and something get wrong.
Formating process halt at 71%, an i aborted the format.
The next thing i notes my internal 500GB Samsung drive was all f* up. Not the external that i was formating, but internal drive.
Mine almost 500GB full storage disk with half of my life.
BT ,just like xp see it like NewVolume, and it's empty.
I tried with ntfsfix and outher ntfs... programs in BT. But no success
It's a terrible situaton. Pliz don't ask me what's with the backup.
This disk contain about 2000 pdfs. God know how much video tuttorial and outher non-priceble data of mine.
All "file recovery" programs i tried can't see the files like deleted one, only as lost files. Is it inod structure broken or something else, don't know.

I managed to recover about 1000 pdf with photorec from BT, and i know i can do some more with outher data (video files, jpg etc).
But there are two BIG problems.

First, all recoverd files with photorec are random named (in win recovery program too, lost files). So it's allmost imposibile to give a name to every data latter (music files for example etc.). It's a 500GB of data.

Second, the pdf-s i recoverd with photorec are messy. If i open a pdf from adobe reader is not gona show me the same pdf as i open it from kpdf. Even if i save it by other name. Like they are merged or something, totaly strange.

I'm not so good in forensic i must say. So i need some tips, what program to try with?
I know that this kind of tools can do some more damage to file system, and that is not good idea to mess with the damaged file system, but to be honest , 'recovery data services' are so expensive for me.

What are the steps in situation like this. What can i do except from starting photorec? And staring in random named messy data.

All tips are welcome.

[prowl3r]

Sad to hear that. Try to learn from the experience.

First thing you should have done is cloning the disk. Do it now anyway (dd command).

'foremost' worked for me in the past, now it has evolved to Scalpel.

http://www.digitalforensicssolutions.com/Scalpel/

However I'm not an expert in forensics so another member might show you a better way.

[Dissident85]

I wouldn't be using BT for data recovery. I would be using helix, I haven't used it all that much. but I know it mounts the drives in read only so that you don't risk doing more damage. Also i would make an image of the drive using dd and work of that...
I don't know much about disaster recovery. But have a look at the packages on helix and start reading man pages... would be a good place to start.. If there is something out there that can help you, my best bet it would be on there.

[loop4me]

Thank you for your fast replys.
I'm definitely gonna make raw copy of hd with dd, as soon as i find free space.
These are some fine tips i found here

This is going to be a long trip with Helix i supposed.
Btw Helix is not free anymore. Anyway there are older versions available.
If somebody needs a Helix 2008R1 here is a iso.


If somebody has some usefull reference on this, please post the links.

[Dissident85]

Btw Helix is not free anymore. Anyway there are older versions available.
If somebody needs a Helix 2008R1 here is a iso.

Yes it is, you can download Helix2009R1 here

Fill out the form and they will email you a download link.

[IAMZOMBIE]

I use EnCase at work. If the disk can spin, it can get the data off it.
Problem is it's not free by a long shot.

I've also used 'getback for ntfs'. I'm not 100% sure if it will do the trick or not, but it's worth looking into.
Data Recovery Software Products - Runtime Software Products

[loop4me]

First of all i wanna give a thanks to this great community, even if i hate that word.
Contribution on this forum is outstanding.
Thank you very much, all of you.
Special thanks to ...Dissident85 ,prowl3r and IAMZOMBIE

Who could know that this horror will be defeted by a zombie, i mean IAMZOMBIE.

I've also used 'getback for ntfs'. I'm not 100% sure if it will do the trick or not, but it's worth looking into.

GetDataBack For NTFS!!!

What should i say, i tried with 10-15 different programs with no success.
GetDataBack succeded to recover all of mine data, with whole file system structure. Names, directories.
The drive is a mess, a lot of a garbage data is there also.
This great program found 15 different MFT – The Master File Table-s on drive.
I don't know what went wrong, but i'm sure that has something to do with microsoft
Seriusly formating extenal drive involed my internal drive and cause a disaster.

Try to learn from the experience.

The way is right if you are rigth.
I'm gonna keep that in mind.

Once more, thank you all for fast contribution.

[Andy90]

If not too late try:
Active@ Recovery suite thingy, lost a disk once, tried a dozen or so recovery apps, this is the only one that worked, slow as hell, but recovered flawlessly.

[IAMZOMBIE]

First of all i wanna give a thanks to this great community, even if i hate that word.
Contribution on this forum is outstanding.
Thank you very much, all of you.
Special thanks to ...Dissident85 ,prowl3r and IAMZOMBIE

Who could know that this horror will be defeted by a zombie, i mean IAMZOMBIE.

No problem. Glad to be able to give back.
That program actually saved my friend from being fired about 8 years ago. He gave a partner a new computer, re-imaged their old desktop the same day, and it just so happened the partner had a 1gig pst on their old C drive. Never backed up, hard drive formatted and re-imaged, the partner was PISSED. He ended up getting fired anyway about a year later, lol.