$MFTReconstructed and reconstructing a Disc File System.

[ahandro]

Hi, so about a week ago I was using Win32DiskImager to format an SD card and write a Linux iso into it, when doing so the stupid and fatal mistake of not selecting the right drive... so there I was with my 1 TB drive that was about 800 GB full had now just been over written by a File server OS. when this first happen'd I didn't panic as much as I would have if this was the first time this sort of thing happend, about a year and a half before this instant i had done the same kind of thing and had used Ease-US data recovery to get my data back so this time I tried using it but since I had just imaged an iso for an OS there was more than one drive in the recovery selection screen so I ended up wiping the drive manually so only one drive would be there instead of 3 partitions. after doing so all the software could find was scraps of the Linux drive partitions! after being frustrated by that I took to the internet to see what other software was out there for me to use. That is when I stumbled appon R-Studio Data Recovery after doing a full scan of the drive I found the same Linux drive stuff but also another drive that was labeled "Recognized 3" this happend to be the only drive that was NFTS and was the size of about the entire disk. Inside there where 3 folders Root, Extra Found Files (which had an X over it) and the last one being Metafiles. Root was empty but in the folder labeled Extra Found Files there where tons of folders, most being labled $$$FOLDER0001 etc. and others that where sorted by file types. the final and most entrusting folder labeled Metafiles had a file called $MFTReconstructed. After looking for a solid and and a half I couldn't find anything AT ALL about $MFTReconstructed, the only thing that lead me to think that this could g anywhere was something found on the Basic File Recovery page for R-Studio what said in a quote "Metafiles are the file system's internal files invisible to any user, or file system data, which R-Studio represents as files. These files do not contain user data directly. Unless you want to scrutinize a disk file system, do not restore them." the thing is I do want to somehow reconstruct the disks file system to at least try and get my file names and not to mention my file systems back. Knowing that the MFT holds file names and file structures is there any way I could some how put my drive back together with the stuff I have?

I really do appreciate any help anyone can give me because stuff from the past 4 years was on that drive and I really hope I can get it back
-Thanks

[Alt]

What did you exactly do when you wiped the disk?
$MFTReconstructed = MFT reconstructed by R-Studio. But it's not clear how valid it is until it becomes clear how you wiped the disk.

[ahandro]

the way I wiped the disk was by using Win32diskimager. I accidentally chose the wrong drive and then poof, it was all gone.

[ahandro]

What did you exactly do when you wiped the disk?
$MFTReconstructed = MFT reconstructed by R-Studio. But it's not clear how valid it is until it becomes clear how you wiped the disk.

If you are referring to after and I wiped it personally however, I used mini tool partition wizard to delete the new linux partitions that where created after linux got imaged over my stuff.

[Alt]

I'm afraid that all files information and content that had been overwritten with the data of the Linux partition are gone. Worse, the information about all other files are gone, too. The only option you have is to recover files using search for known file types (raw file recovery). Unfortunately, without proper file names and folder structure. You may read more about file recovery in our article: File Recovery Basics: How Data Recovery Works.

[ahandro]

I'm afraid that all files information and content that had been overwritten with the data of the Linux partition are gone. Worse, the information about all other files are gone, too. The only option you have is to recover files using search for known file types (raw file recovery). Unfortunately, without proper file names and folder structure. You may read more about file recovery in our article: File Recovery Basics: How Data Recovery Works.

If so I guess Im stuck, however the MFT file that seemed to be recovered as well I thought that by somehow using that I could get all of the names and folder structure. Then again I'm no expert in this field so I could be wrong.
once again, any information helps

-thanks again

[Alt]

Actually, R-Studio uses the information from the recovered MFT, the problem is that quite often that information doesn't correspond quite well with the actual disk state.
Raw file recovery may help to some extent, though.