Beware of Windows 7 when recovering data!

Forum on data recovery, file unerase, disk unformat, and RAID reconstruction.
Forum rules
Discussion on the R-Studio, R-Studio for Mac, R-Studio for Linux, R-Linux, and R-Undelete software

Beware of Windows 7 when recovering data!

Postby Alt » Mon Mar 01, 2010 8:21 am

Windows 7 can severely undermine successful data recovery after a quick format by extending an empty MFT file to 256KB and effectively killing the information about 229 records of previously stored user's files. Moreover, it may quietly extend the MFT file to 256KB when a fresh disk formatted by XP or Vista is connected to a Windows 7 system.
More information.
Alt
Site Moderator
 
Posts: 2199
Joined: Tue Nov 11, 2008 2:13 pm

Re: Beware of Windows 7 when recovering data!

Postby MarcusXP » Thu Mar 04, 2010 7:27 am

What if I have a ext4 partition that I need to recover?
It was wiped-out by mistake by running mkfs.ext4 command (nothing else was written after that). I stopped the command before finishing but it was already too late, all the files seem to be gone (partition looks empty).
Can I recover my files safely if I connect this drive to a machine with Windows 7 installed?
MarcusXP
 
Posts: 11
Joined: Sun Feb 28, 2010 6:34 pm

Re: Beware of Windows 7 when recovering data!

Postby Alt » Fri Mar 05, 2010 8:09 am

MarcusXP wrote:What if I have a ext4 partition that I need to recover?
It was wiped-out by mistake by running mkfs.ext4 command (nothing else was written after that). I stopped the command before finishing but it was already too late, all the files seem to be gone (partition looks empty).
Can I recover my files safely if I connect this drive to a machine with Windows 7 installed?

Yes, you can. This problem with a $MFT file extended affects only NTFS disks.
Alt
Site Moderator
 
Posts: 2199
Joined: Tue Nov 11, 2008 2:13 pm

Re: Beware of Windows 7 when recovering data!

Postby adem0x » Wed Jun 02, 2010 3:42 pm

http://www.data-recovery-software.net/Articles/Quick_Format_Issue/index.shtml

Not Found
The requested URL /Articles/Quick_Format_Issue/index.shtml was not found on this server.
adem0x
 
Posts: 4
Joined: Thu May 27, 2010 6:15 am

Re: Beware of Windows 7 when recovering data!

Postby Alt » Thu Jun 03, 2010 5:44 am

adem0x wrote:http://www.data-recovery-software.net/Articles/Quick_Format_Issue/index.shtml

Not Found
The requested URL /Articles/Quick_Format_Issue/index.shtml was not found on this server.

Thanks for reporting it, now the correct URL is:
http://www.r-tt.com/Articles/NTFS_Recovery_after_Quick_Format/index.shtml
Alt
Site Moderator
 
Posts: 2199
Joined: Tue Nov 11, 2008 2:13 pm

Re: Beware of Windows 7 when recovering data!

Postby RedFox » Mon Jan 16, 2012 10:37 pm

So to clarify, the only problem is in connecting disks that were JUST quick formatted? Is there any risk to drives with an existing OS installation?
RedFox
 

Re: Beware of Windows 7 when recovering data!

Postby Alt » Wed Jan 18, 2012 2:50 am

RedFox wrote:So to clarify, the only problem is in connecting disks that were JUST quick formatted? Is there any risk to drives with an existing OS installation?

As I understand the situation, there should be no risk.
Alt
Site Moderator
 
Posts: 2199
Joined: Tue Nov 11, 2008 2:13 pm

Re: Beware of Windows 7 when recovering data!

Postby paulb47 » Wed Aug 29, 2012 5:50 am

Yeah this isn't good news since it basically describes my situation. I had a WD 3TB drive, originally formatted by vista into 3 1TB partitions so it would work on XP 32bit. Which it did. Windows7 however mistook it for a my new Seagate 3tb drive and tried to initialize it--I.e., quick formatted it. Bummer!

I have one hope. This is an external drive hooked up via USB 3. I'm hoping against hope that Win7 doesn't necessarily take the same liberties with an external drive as it does with a drive directly connected. DO I have any Hope there? Is it possible that win 7 wouldn't automatically extend the $MFT file to its default 256KB on an external drive!?
paulb47
 

Re: Beware of Windows 7 when recovering data!

Postby Vjay » Mon Oct 22, 2012 2:14 am

Hi paulb47, were you able to recover the data with R-studio? I am in very similar situation. my 1Tb seagate disk (NTFS) was quick formatted by windows7 to NTFS, while I was getting the other drive ready for backup on same system, I was mainly using this disk on WinXP.
There are no files visible, it had 830 GB of my project data which was not backed up since about 6 months, the disk is not used after the quick format, except to recover data. The files are very important as the project deadline is in a week. I have following questions for the community.
1) Can R-studio be used to successfully, all the files and directory structure? there is no overwritten clusters on most of the disk(except perhaps about 1 Gb Data).
2) Can file signatures can be added to the data base used for searching. I have the old backup which has almost all the file types on the disk. Many of the files types are not the common ones like(.fdf , .m, .mat, .fid, .emf, .par, .rec )
3) Is there 255 char limit on file name (total path) ? The other program I used is giving me trouble due to long paths recovered and searching long path from 714,800 files manually is difficult when the file name is shown not the full path.
4) I attempted to make a disk image(to avoid any further curruption due to recovery attempts) but the 1TB disk has 931.51GB space and the purchased disk only has 931GB so the software is not allowing to create a bit-by-bit image. Is this caution warranted?

Please advise, its urgent and important to me. I will highly appreciate your suggestions to help successful recovery.
Vjay
 

Re: Beware of Windows 7 when recovering data!

Postby Alt » Mon Oct 22, 2012 4:57 am

First, the answer to Question 4: you don't have to make an uncompressed image in order to have an exact byte-to-byte image of the disk. The compressed one is good for that, too. The only reason to use uncompressed images is ability to apply some other data recovery utility if R-Studio appears unsuccessful. And it's a very wise idea to create the image.
Q3: no, there's no file name length limits in R-Studio except those from the host OS.
Q2: Yes, R-Studio can add file signatures, the article Creating a Custom Known File Type for R-Studio explains how.
Q1: Generally, R-Studio recovers files with a complete folder structure, but that depends mostly on how severely data is damaged on the disk. Sometimes R-Studio recovers files completely, sometime partially, sometimes it doesn't recover them at all. Why? Because sometimes there's nothing to recover remaining, sometimes R-Studio isn't that perfect, sometimes its users have not enough skill to recover data. But you may try R-Studio and see. More is in our topic: What to do if I don't know if R-Studio can recover my files?.
Alt
Site Moderator
 
Posts: 2199
Joined: Tue Nov 11, 2008 2:13 pm

Next

Return to Data Recovery

Who is online

Users browsing this forum: No registered users and 1 guest