Page 1 of 3

Beware of Windows 7 when recovering data!

Posted: Mon Mar 01, 2010 8:21 am
by Alt
Windows 7 can severely undermine successful data recovery after a quick format by extending an empty MFT file to 256KB and effectively killing the information about 229 records of previously stored user's files. Moreover, it may quietly extend the MFT file to 256KB when a fresh disk formatted by XP or Vista is connected to a Windows 7 system.
More information.

Re: Beware of Windows 7 when recovering data!

Posted: Thu Mar 04, 2010 7:27 am
by MarcusXP
What if I have a ext4 partition that I need to recover?
It was wiped-out by mistake by running mkfs.ext4 command (nothing else was written after that). I stopped the command before finishing but it was already too late, all the files seem to be gone (partition looks empty).
Can I recover my files safely if I connect this drive to a machine with Windows 7 installed?

Re: Beware of Windows 7 when recovering data!

Posted: Fri Mar 05, 2010 8:09 am
by Alt
MarcusXP wrote:What if I have a ext4 partition that I need to recover?
It was wiped-out by mistake by running mkfs.ext4 command (nothing else was written after that). I stopped the command before finishing but it was already too late, all the files seem to be gone (partition looks empty).
Can I recover my files safely if I connect this drive to a machine with Windows 7 installed?
Yes, you can. This problem with a $MFT file extended affects only NTFS disks.

Re: Beware of Windows 7 when recovering data!

Posted: Wed Jun 02, 2010 3:42 pm
by adem0x
http://www.data-recovery-software.net/A ... ndex.shtml

Not Found
The requested URL /Articles/Quick_Format_Issue/index.shtml was not found on this server.

Re: Beware of Windows 7 when recovering data!

Posted: Thu Jun 03, 2010 5:44 am
by Alt
adem0x wrote:http://www.data-recovery-software.net/A ... ndex.shtml

Not Found
The requested URL /Articles/Quick_Format_Issue/index.shtml was not found on this server.
Thanks for reporting it, now the correct URL is:
http://www.r-tt.com/Articles/NTFS_Recov ... ndex.shtml

Re: Beware of Windows 7 when recovering data!

Posted: Mon Jan 16, 2012 10:37 pm
by RedFox
So to clarify, the only problem is in connecting disks that were JUST quick formatted? Is there any risk to drives with an existing OS installation?

Re: Beware of Windows 7 when recovering data!

Posted: Wed Jan 18, 2012 2:50 am
by Alt
RedFox wrote:So to clarify, the only problem is in connecting disks that were JUST quick formatted? Is there any risk to drives with an existing OS installation?
As I understand the situation, there should be no risk.

Re: Beware of Windows 7 when recovering data!

Posted: Wed Aug 29, 2012 5:50 am
by paulb47
Yeah this isn't good news since it basically describes my situation. I had a WD 3TB drive, originally formatted by vista into 3 1TB partitions so it would work on XP 32bit. Which it did. Windows7 however mistook it for a my new Seagate 3tb drive and tried to initialize it--I.e., quick formatted it. Bummer!

I have one hope. This is an external drive hooked up via USB 3. I'm hoping against hope that Win7 doesn't necessarily take the same liberties with an external drive as it does with a drive directly connected. DO I have any Hope there? Is it possible that win 7 wouldn't automatically extend the $MFT file to its default 256KB on an external drive!?

Re: Beware of Windows 7 when recovering data!

Posted: Mon Oct 22, 2012 2:14 am
by Vjay
Hi paulb47, were you able to recover the data with R-studio? I am in very similar situation. my 1Tb seagate disk (NTFS) was quick formatted by windows7 to NTFS, while I was getting the other drive ready for backup on same system, I was mainly using this disk on WinXP.
There are no files visible, it had 830 GB of my project data which was not backed up since about 6 months, the disk is not used after the quick format, except to recover data. The files are very important as the project deadline is in a week. I have following questions for the community.
1) Can R-studio be used to successfully, all the files and directory structure? there is no overwritten clusters on most of the disk(except perhaps about 1 Gb Data).
2) Can file signatures can be added to the data base used for searching. I have the old backup which has almost all the file types on the disk. Many of the files types are not the common ones like(.fdf , .m, .mat, .fid, .emf, .par, .rec )
3) Is there 255 char limit on file name (total path) ? The other program I used is giving me trouble due to long paths recovered and searching long path from 714,800 files manually is difficult when the file name is shown not the full path.
4) I attempted to make a disk image(to avoid any further curruption due to recovery attempts) but the 1TB disk has 931.51GB space and the purchased disk only has 931GB so the software is not allowing to create a bit-by-bit image. Is this caution warranted?

Please advise, its urgent and important to me. I will highly appreciate your suggestions to help successful recovery.

Re: Beware of Windows 7 when recovering data!

Posted: Mon Oct 22, 2012 4:57 am
by Alt
First, the answer to Question 4: you don't have to make an uncompressed image in order to have an exact byte-to-byte image of the disk. The compressed one is good for that, too. The only reason to use uncompressed images is ability to apply some other data recovery utility if R-Studio appears unsuccessful. And it's a very wise idea to create the image.
Q3: no, there's no file name length limits in R-Studio except those from the host OS.
Q2: Yes, R-Studio can add file signatures, the article Creating a Custom Known File Type for R-Studio explains how.
Q1: Generally, R-Studio recovers files with a complete folder structure, but that depends mostly on how severely data is damaged on the disk. Sometimes R-Studio recovers files completely, sometime partially, sometimes it doesn't recover them at all. Why? Because sometimes there's nothing to recover remaining, sometimes R-Studio isn't that perfect, sometimes its users have not enough skill to recover data. But you may try R-Studio and see. More is in our topic: What to do if I don't know if R-Studio can recover my files?.