Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: SSD hard drive, deleted and quick formatted volumes

26 Sep 2016   #41
RolandJS

Windows 7 Professional 64-bit
 
 

jumanji, is it possible that henri's SSD was using encryption involving a Windows user account's password -- EFS?


My System SpecsSystem Spec
.
26 Sep 2016   #42
jumanji

Windows 7 Home Premium 32 bit
 
 

Honestly ,Roland, I had no idea whatsoever about something called EFS . On a casual read, I understand that it is not a full-disk encryption but a file level encryption to be implemented by enabling it in Advanced attributes for each file by the user..

In any case it is the OP who has to answer that question. Let us see his answer.

I would presume even if a file is encrypted by EFS, the Volume Boot Record (VBR), which is not a user-accessible file, could not be encrypted and it should be possible to recover the partitions from the VBRs and may be a data recovery program would still recover an encrypted file.
My System SpecsSystem Spec
26 Sep 2016   #43
RolandJS

Windows 7 Professional 64-bit
 
 

Quote   Quote: Originally Posted by jumanji View Post
Honestly ,Roland, I had no idea whatsoever about something called EFS . On a casual read, I understand that it is not a full-disk encryption but a file level encryption to be implemented by enabling it in Advanced attributes for each file by the user...
?I was wondering if EFS was being used, then would the files created by end-user or written to by end-user be encrypted?
My System SpecsSystem Spec
.

26 Sep 2016   #44
jumanji

Windows 7 Home Premium 32 bit
 
 

As I understand, the file is not encrypted when written. It is only later, a user has to select the file he wants to encrypt , go into the Properties > Advanced and implement it.

SSD hard drive, deleted and quick formatted volumes-27-09-2016-07-07-36.jpg

This user selected file encryption is not controlled by Windows but by the NTFS File System in the HDD/SDD. So it will continue to be encrypted and accessible only to that user and user linked Password. I am not going to break my head further on this aspect unless there is a need and a user reports he had employed EFS for some files.. In any case in such an instance and if the partition recovery is successful, the user can create an account with the original user name and password to access the encrypted files.


My System SpecsSystem Spec
26 Sep 2016   #45
RolandJS

Windows 7 Professional 64-bit
 
 

jumanji - you're aok!! Always good to see you in these forums! Have a great week, see ya in the papers!
My System SpecsSystem Spec
27 Sep 2016   #46
henrikkhach

win 7 64bit
 
 

Quote   Quote: Originally Posted by jumanji View Post
Finally,I could find sometime only today to write my concluding post.

If you haven't yet formatted your SSD and it still remains in the last quickformatted condition, you can examine the drive with bootice. It is not going to recover any data but it will only facilitate viewng the sectors of your SSD to check whether the boot records of the second and third partition still exist at their start sector and whether the other sectors are populated with data.

If you have 64 bit Windows download v1.3.3.2 x64 from 【BOOTICE v1.3.3.2: 功能强大的启动维护工具】-*逸轩
Extract the RAR file into a folder named bootice64. ( You can create the folder anywhere in your system, even on a pendrive) You will get a single BOOTICEx64.exe file which you will run.

To familiarise with bootice: Lost partitions!

Note: While you can read the whole post, you are not going to save any sector. You are only going to examine the sectors.

Check what is there in Sector 0. (The screenshot below shows Sector 0 of my 750GB HDD. When you created a simple volume encompassing the whole drive a new 16byte partition table is written into sector 0 after wiping out the three 16byte partition tables there. That partition table defines the start point and end point of the partition.) The partition table is highlighted in green. You will see the current partition table in your SSD.

Attachment 392122

(The following 48bytes field can accommodate three more 16byte partition tables. So one can have only a total of four partitions in an MBR drive.)

When you quickformatted the drive, it would have wiped the volume boot record of your previous first partition at 2048 and would have written a new Volume Boot Record (NTFS File system) consistent with the partition table in sector 0. ( The first partition always starts at sector 2048) The screenshot below shows the volume boot record at sector 2048 on my drive )

Attachment 392123

Creating a single simple volume and quickformatting it makes only these two changes on these two sectors.

So the volume boot record of the second and third partition at their start points as well as data in all the sectors will still remain unaffected.

Using bootice you can now do a search.

To be continued after a break .........

.

Hi dear Jumanji
I think something has happened to my ssd, as i said i'm not an expert in this field and these numbers and tables have no meanings to me, but i think i have lost my all data. have a look at these screenshots.

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_15.jpg

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_16.jpg

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_17.jpg

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_18.jpg

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_19.jpg

SSD hard drive, deleted and quick formatted volumes-comp_mng_screen_20.jpg


My System SpecsSystem Spec
27 Sep 2016   #47
jumanji

Windows 7 Home Premium 32 bit
 
 

Yes, it is all 00s everywhere except Sector 0 and 2048 (QuickFormat creation), as would happen with a complete wipe.
My System SpecsSystem Spec
27 Sep 2016   #48
henrikkhach

win 7 64bit
 
 

Quote   Quote: Originally Posted by jumanji View Post
Yes, it is all 00s everywhere except Sector 0 and 2048 (QuickFormat creation), as would happen with a complete wipe.
However i'm thankful for all your endeavour, i'm sorry that we couldn't solve this problem.
But i'm glad that i found a good friend and will be more glad of keeping in touch with you.
I don't know weather you have read details that i wrote about Armenia in this post

SSD hard drive, deleted and quick formatted volumes

but i'll give you my contacts.

email: henrik.khach@gmail.com
FB: https://www.facebook.com/henrik.khach
Instagram: https://www.instagram.com/henrikkhach/

Henrik Khachatoorian
Graphic Designer
My System SpecsSystem Spec
Reply

 SSD hard drive, deleted and quick formatted volumes




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
hard drive formatted on vista says not formatted on my vista pc
I discovered this issue recently, i bought an external drive case so i can move my internal drive installed on my Vista PC and have it accessible on my Win 7 laptop away from home. I don't understand why the hard drive reads as not initialized or formatted on my win 7 pc. I have two from my vista...
Hardware & Devices
Hard drive shows inconsistent volumes
Whenever I select my computer/c drive the amount of free space keeps changing Examples: One minute say 99gb, next minute 2gb. Then 99gb then 67gb. The values are all over the place. Even restarting doesn't help Any ideas why this is happening and is it signs of a serious condition. Any help...
General Discussion
Hard Drive formatted but not empty
Hello, I've found an old hard drive, so I plugged it to the pc and formatted it, now, Windows shows that it is empty but when you open properties it shows that 190 MB are in use. why is that, is there a way to remove those 190 MB?
General Discussion
hard drive needs to be formatted
Hello, I borrowed my friend's external hard drive and a I first connected to my PC it was working perfectly. Yet the second time I tried to my PC recognized it but couldn't open it & it kept giving me the message that I need to format the hard drive before using it. I tried many time on different...
Hardware & Devices
I accidentally formatted my hard disk drive .....
HI I accidentally deleted one my hard disk drive using "mini tool partition wizard"(still remained unallocated) , and immediately i selected partition recovery wizard in that software and scanned the entire hard disk and it showed the files exactly how they are in my formatted drive looks ..when...
General Discussion
VIRUS has formatted hard drive
i had a bad virus attack on 19/11/2011 and it formatted my hard drive but for some strange reason took all of my files but left notepad files ive used a program to find some system restore files and there from before the 19/11/2011 and there on my usb drive and don't know what to do with them in...
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 22:12.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App