ran mkfs.vfat over top ntfs partition... any way to restore ntfs partition info?
 

Title basically says it all. I was attempting to format a flash drive, and well, used the wrong sdX device. I've run DiskInternals Partition Recovery tool, and all my files are still there (you have to pay $139 to have it restore the files). Is there any way using tools in linux to restore the ntfs partition/files? It was a single disk with the partition taking the entire drive. I've tried mounting it with the -t option, but it says invalid ntfs signature. Man, two lessons the hard way, make sure you backup (duh) and be careful what you type as root.

There is a GNU licensed tool called photorec which you might be able to use to recover the files. It won't recover the directory structure though.

Unfortunately it isn't the partition format that you have corrupted, but the actual filesystem itself. It would be difficult to recover the filesystem. Not impossible, since the FAT format will have only written a few sectors, but hard to do with any sort of automated tool (since I'm guessing that the root directory at least will have been partially destroyed).

Just forcing it to use NTFS format is not going to work, because it isn't just a bad partition identification.

Typing the wrong device name - an easy mistake to make. Not having backups? What can I say!

Have a read through this thread. Last post has one happy camper.

The drive had lots of stuff in many directories, so I'm not sure photorec would really get me what I want, but I'll give it a shot to see if i can save some money.


I was just wondering if I could reformat the partition with a new NTFS, then run a chkdsk on the drive if it would find and restore the files. I guess that would be far to simple of a fix.

Well, you see, my backup routine was already set in my head, and I had good intentions, just never put in the time to fully implement it. I had setup a CentOS server that I was going to have a cronjob do a daily or weekly copy, or somehow set it up as a mirror, and as you can see, I didn't really have it figured out as to how to do it. Luckily, most of the really important stuff I had backed up, but if I don't get the drive back, I'll lose about a year worth of pictures, as well as other backups stored on that drive from other computers.

I'll give the GetDataBack demo a try. It's a bit cheaper, but only does NTFS. It almost seems that if I have to buy a program to do this dirty work, I'd want one that would work for more than just NTFS.
Member KimVette in this thread recommends R-Studio http://www.linuxquestions.org/questi...1/#post1686091

I have done similar on ext3 (mkfs.ext3 -S) and it actually worked. However this was a tightly controlled test on a newly constructed filesystem (no updates/reallocations, just new files).
I wouldn't be betting my house that it'd work on NTFS.

Another lesson I've learned is that it is near impossible to find reputable reviews for this type of software. I think there are so many sites that play on people's fears, that finding actual professional reviews is quite a challenge. So far, I've found this article Data Recovery Software Roundup -- Don Your Detective Cap and Find Your Missing Data! [maximumpc.com]

The drive in question is a WD2500JB, and I happen to have two of them; so I was considering doing a dd copy from one to the other, and just start messing around on the destination drive.

Edit:
I really hate cross-linking to another forum, but there is a long discussion on slashdot about which tools to use.
Slashdot | What Data Recovery Tools Do the Pros Use?[slashdot.org]
It seems the general consensus is GetDataBack is the way to go. I first want to see what my dd-reformat-chkdisk can do, then I'll try the photorec, just for fun, and I also want to try the free Recuva. Even though I've lost the files, I'm pretty confident I can get them back, so I'm just going to use this as a learning experience for working with "dead" drives.

Well, I tried the reformat at NTFS on my copied drive, then ran the check for errors tool in Windows 7, and it said everything was fine. I wonder if there is a way to force a deep scan check disk from windows?

When you do the NTFS format, it creates a new empty file system, so it looks completely normal. It doesn't matter what is in the sectors marked as empty, because chkdsk is not a recovery tool.

What chkdsk does is search the file system for file entries that are corrupt, for example two files stored on the same area of the disk, or areas that have no file entries but are not marked empty. And in general it doesn't recover files, it just removes entries that have problems so as to maintain a consistent file system. Since you created a new empty file system, there were no file entries to check, so chkdsk will not find any problems.

The full disk option in chkdsk is just to search for bad sectors; it does not search for data on the whole disk.

Some of the proprietary recovery tools might be able to reconstruct the root directory (the rest of the directories might be intact anyway). They usually have gratis demo versions that you can try. Typically the demo versions show you what they think they can recover, but do not do the actual recovery. I don't have a recommendation on a proprietary tool.

Otherwise the fallback is to do file-by-file recovery. Might not be so bad if your photos have unique filenames, but yes, it is painful to do this for a lot of files.

I think if the root directory could be reconstructed, I'd get back almost all my data. I used Recuva, and it seems to have found everything, even the directory structure. A few of the directories that were in the rood of the drive, the name was lost, but their content was still fine.