HDD 2Tb Unallocated, how to retrieved all data

TonyH · 19 Mar 2016

Hi,
i have external drive WD (My Book essential) 2Tb only one partition.
OS win 7
laptop acer
suddenly OS win 7 did not detect the HDD, when i checked at computer Management, it said not initialize and offline.
this step i already done :
1. initialize and make it online at computer management.
2. choose new simple volume..
3. assign the drive letter.
4. choose do not format this volume.
5. click finish.
6. when i read some article that said if you still want the data, you can not initialize the drive, after that i delete the volume.
7. latest status was unallocated and online.

what i have done :
1. i just follow Jumanji step in other thread using mini partiion tool, run the quick scan until finish and no luck finding the partition.
2. try easyUS partition recovery, choose data recovery. the result is many file listed but all of them can't be used.
3. lastly running minitool power data recovery and choose lost partition recovery, 5% until now.

question :
1. the step i have done, is it wrong ?
2. the data still can recovered ?
3. how to recover the data ?

please help and Thanks in advance.

TonyH · 20 Mar 2016

Update progress, using software recovery that mention above.
all the data recovered can't be used. is there a way to revert back to original data before unallocated ?

jumanji · 21 Mar 2016

hmmm... you have come here after messing up your drive right and left.

Initialising the drive is OK. It only writes the MBR code to sector 0. You messed it up by creating a new volume which writes the partition table at sector 0 and also writes zeros to the NTFS boot sector at 2048 destroying the original NTFS that existed.Deleting that volume will only remove the partition table at sector 0. Leaves the NTFS boot sector unaffected. All zeros as of now in your case - a clean one sector wipe..

Immediately after initialising, had you run PW, it would have found the original valid NTFS at sector 2048 and would have written the partition table in sector 0 and perhaps you would have been singing merrily. No longer, since by creating a new volume, you have wiped the NT File System at sector 2048.

Now using TestDisk, we may need to find whether the backup of that can be found and is OK.

Download Windows version of TestDisk from here TestDisk Download - CGSecurity
Note: Download only Windows version and not the Windows 64-bit version even if you have Windows 64 bit on your machine.
Extract it and run testdisk_win.exe with only your external drive plugged in ( Please remove any other external drives/pen drives)

A. At the first window, select “No Log” and press the <Enter> key. ( You can move the HighLight with UP/Down arrow keys and horizontally with Left/Right arrow keys))
B. Select which disk to analyse, choose “Proceed” and <Enter>. ( Choose Disk not drive and choose your external identified with its capacity))
C. Select partition type – Intel if it’s a PC then <Enter>.
D. Choose Advanced > press <Enter>.
E. Choose Boot > press <Enter>.

Post the resultant screen. After taking the screenshot and posting it, quit TestDisk by repeatedly pressing Q or hitting the X on the top right corner. You can run TestDisk again after getting my instructions.

Follow the instructions. Do not deviate and try something on your own. It is dangerous if you do not know what it does exactly.

Using Snipping tool for screenshots: How to Use the Snipping Tool in Vista

Uploading to SevenForums: Screenshots and Files - Upload and Post in Seven Forums

TonyH · 21 Mar 2016

Hi Jumanji, yeahh i am wrong. because i just follow the instruction from unknown source.
i just realize when i search more of information about this.
i see, that how it work for created new volume.

i already follow the instruction from you, and i dont see boot option.
attachment for the screen capture.

Thanks a lot for the response.

jumanji · 21 Mar 2016

I didn't expect this. Hmmm... it really makes me feel that I should quit my indulgence in data recovery and live a peaceful life :).

If what you have done as described in steps 1 to 7 in the first part of your first post is all that had happened, you should get the boot screen I mentioned.

Does this mean what you did in the later part viz running the EaseUs Partition Recovery and Minitool Power Data recovery botched your drive further???? Too many cooks can of course spoil the broth.

Necessarily we have to investigate further and find the status of your drive.

To start with Post a screenshot of Windows Disk Management with only your external drive connected. Follow the guidelines here : Disk Management - Post a Screen Capture Image

Also post a screenshot of Partition Wizard. The very first screen that appears when you launch PW.

I shall see it tomorrow morning. You must also be running late with an hour or so ahead of me.

TonyH · 21 Mar 2016

Hi,
don't feel like that, i don't expect much also.
we already try best we can do :)

before i just run the recovery partition and data, i dont know both of that can botched my drive.
here is the request of the screen shot:

ok continue next morning.
Thanks again for your support today.
have a great dream :)

jumanji · 21 Mar 2016

OK, I wanted you to post only the first screen that appears when you launch PW. You had obscured it with the PRW Window and I can't see what is behind. Never mind. What I can see is enough.

Now go ahead and install bootice. If your system is 32bit , download v1.3.3.2 x86. If your system is 64 bit download v1.3.3.2 x64 ã€BOOTICE v1.3.3.2: åŠŸèƒ½å¼ºå¤§çš„å¯åŠ¨ç»´æŠ¤å·¥å…·ã€‘-å*é€¸è½© Extract the downloaded .rar file to get the single *.exe file which you will run.

1.Select your 2TB external drive > Sector Edit > click on Partitions button and post a screenshot of what it shows. 2.Then select sector 63 and post a screenshot. 3.Select sector 2048 and post a screen shot.

4. Keep your mouse pointer inside the bootice Window and use the mouse roller to scroll through all sectors starting from 2048. If you see the sectors populated - but not 00 s, then you have the data ( though we will not know in what shape they will be which we will come to know only when we recover the data if we can manage to.)

On how to use bootice: Lost partitions!

At the moment we are only examining the drive and not writing anything to it. No need to save or restore or edit the sector contents. So keep away from making any changes unless I ask you to.

TonyH · 22 Mar 2016

Hi Jumanji,
here is your request :
1,2,3. screen shot
4. the only 00 is sector 2048, other have sector populated.

jumanji · 22 Mar 2016

Good. You have been catching up and doing a good job.

I shall give you some detailed instructions in a few hours from now. Though I had seen your post much earlier, I was busy with the Airconditioner Technician who had come to attend a fault. Before I go to bed, you can expect my post which you can carry out tomorrow.

The sector 0 has the MBR but no partition table. Sector 63 should normally be all zeros but there is some junk in it. Sector 2048 is all zeros, No NTFS, as expected since creating the new volume had done it.

Now I just want a few clarifications before my next post.

1. Quickly scroll through sectors 1 to 2047 and tell me whether you see any junk in those. Normally it should all be zero.

2. Also confirm when you created a new volume and later deleted it, you did it all in Windows Disk Management.

I have my plan ready to roll out but need sometime to organise the matter and write.

TonyH · 22 Mar 2016

Hi Jumanji,
that ok, no need hurry.
i just see a light of hope from your last post :)
1. - I checked sector 34 until 2047, most of the value similar to sector 63.
- from sector 1 to 34, there is no zero.
2. yes confirm, i did created new volume and deleted it from windows disk management.