Quick Format

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Quick Format

Post by 21grammes »

Hello
I have accidentally formatted unmounted encrypted partition and obviously, now my disk shows 100% free space.
I have the header backup'ed and i still know the password but i don't know how and IF, i can get back all my data.

what can/should i do?
any help would be welcome, please!

-- EDIT --
for anyone getting to this thread in the future, solution is:
1:*quick format by error*
2: don't touch anything, don't write anything to the disk.
3: clone the deleted disk <sector by sector> to another disk of the same size (preferably).
4: restore header to the original (deleted) disk
5: restart windows to be able to mount the disk
6: mount the disk
7: decrypt it
8: launch recovery process once disk fully decrypted.
9: enjoy getting back your "deleted" data.
Last edited by 21grammes on Sat Nov 20, 2021 8:29 pm, edited 3 times in total.

User avatar
DavidXanatos
Posts: 340
Joined: Fri Mar 19, 2021 11:26 am

Re: Quick Format (2)

Post by DavidXanatos »

hmm.... first of all make a full sector backup of the broken partition in order to not break it further when working on it.

Than try restoring the header and then mounting the colume, you will probably get somethign that appears unformated, but than you can try wunning some file recovery tools that are designed for the case of having formated the wrong partition, this should be able to find the files.

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Re: Quick Format (2)

Post by 21grammes »

Thanks for your fast reply.
i'm gonna try this.

i'll update the thread about how things went, maybe it'll help some other people like me in the future.

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Re: Quick Format (2)

Post by 21grammes »

DavidXanatos wrote:
Mon Nov 08, 2021 8:20 pm
hmm.... first of all make a full sector backup of the broken partition in order to not break it further when working on it.

Than try restoring the header and then mounting the colume, you will probably get somethign that appears unformated, but than you can try wunning some file recovery tools that are designed for the case of having formated the wrong partition, this should be able to find the files.
so:
>had a HDD crypted with disk cryptor
>quick formated it by mistake without having the disk mounted
>did no writing or whatever on the disk right after realizing my mistake.
>did a full sector by sector clone of the original HDD
>successfully restored the header on the original HDD

there was no option to "mount" the disk via disk cryptor right after restoring the header, windows was still showing a 100% free space partition.
i still tried to start a file recovery process via the paid recovery software R-STUD**

>almost no result, and the small amount of results that the software found was corrupted when restored.
>>restarted the computer
>>after restarting, i was able to "mount" the disk, so i did.
>>disk successfully mounted
>>the disk now shows as "inaccessible" by windows, even tho in the windows disk management interface, the disk appears as a normal one.
>>>did a second try with R-STUD**
>>>same result as before mounting the drive (corrupted & almost no result)
>>>>tried the free recovery software DMDE
>>>>still almost no result, and the few results were also corrupted.

Anything else that i can try?

User avatar
DavidXanatos
Posts: 340
Joined: Fri Mar 19, 2021 11:26 am

Re: Quick Format

Post by DavidXanatos »

mounting must work if it doe snot moutn the otehr tools will not be able to do anything

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Re: Quick Format

Post by 21grammes »

DavidXanatos wrote:
Sat Nov 13, 2021 11:39 am
mounting must work if it doe snot moutn the otehr tools will not be able to do anything
i was able to mount it after restarting windows, so yeah now it's indeed mounted.
but still, the recovery softwares aren't finding anything but a lot of corrupted .swf files or random corrupted files.

what could be wrong?
i'm 100% sure that was the right header.

User avatar
DavidXanatos
Posts: 340
Joined: Fri Mar 19, 2021 11:26 am

Re: Quick Format

Post by DavidXanatos »

hmm.... grab a disk editor and use it to view the mounted partition, if you can find anythign that does not look like random garbage than the header was right, if there is only high entropy garbage than probably its the wrong header.

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Re: Quick Format

Post by 21grammes »

honestly this is beyond my knowledge/understanding, i'm not able to tell the difference between "high entropy garbage" and normal things in hex aha.
i took some screenshots of the mounted disk:
>1:Image
>2:Image

what am i supposed to look at?

21grammes
Posts: 7
Joined: Sun Nov 07, 2021 3:36 am

Re: Quick Format (2)

Post by 21grammes »

DavidXanatos wrote:
Mon Nov 08, 2021 8:20 pm
hmm.... first of all make a full sector backup of the broken partition in order to not break it further when working on it.

Than try restoring the header and then mounting the colume, you will probably get somethign that appears unformated, but than you can try wunning some file recovery tools that are designed for the case of having formated the wrong partition, this should be able to find the files.
i've tried to reproduce the steps of my original mistake but with a clean, brand new USB stick, in which i've put some mp4 files and some images.
here's what i did:

1: encrypt the USB Stick
2: put the mp4 files etc
3: backup the header
4: unmount the disk
5: quick format the disk "by mistake"
6: restore the header
7: restart windows to be able to mount the disk via DiskCryptor
8: mount the disk
9: start the recover process with different recovery softwares

tried 5 different recovery softwares, and still, none of them were able to find any of the previous files.
so i guess we can surely say it's not related about the header.

Any other ideas of what to try sir?
Last edited by 21grammes on Tue Nov 16, 2021 2:50 pm, edited 1 time in total.

User avatar
DavidXanatos
Posts: 340
Joined: Fri Mar 19, 2021 11:26 am

Re: Quick Format

Post by DavidXanatos »

Try the same test just skip the encryption
create volume,
add files
quick format
try recovering

to test if any of these tools is any good

Post Reply