Any way to recover a partition after writing zeros with DLG?

[energydream2007]

Hello. iv an hdd recovery question(s) and i hope you have some resolution:


HDD: Western Digital - WD3200AAKS , its a 320GB 3.5\" drive (1 Partition on it that was NTFS with no OS on it - just important data like VMware projects)


OK so i guess you know the Data Lifeguard Diagnostic tool by wd:
http://support.wdc.com/product/download.asp?groupid=606&sid=30&lang=en
The version iv used is the latest (witch is 5.04f).

(dont mind the drive listed)


The problem is i did have a failed drive (other wd drive) witch i wanted to Zero Fill it by this tool but by mistake i did it for my good & healthy WD3200AAKS drive mention above. I did the quick "Write Zeros To Drive" command without having noticed its the wrong drive until booted to the OS.


My question is:
Is there any way to recover the partition after running a Zero Fill command?

I did tried alot of recovering soft but its not working so good (from 320GB iv recovered something like 26GB witch are off course not in the original structure they were). i havnt find any software that can recover the ALL original partition data & the folder structure (or at least most of the data & the structure).


Can you advise on the next step man? how to recover the data?


TNX :] :hello:

 

[taltamir]

My question is:
Is there any way to recover the partition after running a Zero Fill command?

no, all the data on it is lost forever.

 

[energydream2007]

no, all the data on it is lost forever.

Its not true at all. i asked for a ways to recover (and i did successfully recover some of it but i need more). im asking for software solutions before going to a professional service (witch cost alot of money)

 

[taltamir]

Its not true at all.

if you zero filled the entire drive, all data on it is lost forever.

i asked for a ways to recover

there are none.

(and i did successfully recover some of it but i need more).

You are lying. You did not recover data from a drive that was zero filled.
Either you did not actually zero fill the drive, or you "recovered" the data from a backup. But you did not actually get data off of a drive that has been secure erased by zero filling, it contains no data at all.

im asking for software solutions before going to a professional service (witch cost alot of money)

A professional service cannot do anything for you.

 

[energydream2007]

What are you talking about?? im not noob man if that whats your thinking.
I did recover 26GB of real files (not RAW) using R-Studio.
I did 100% Zero Filled the drive by WD DLGDIAG using Quick mode (witch i believe using 1-Pass) with no termination.

And i know for a fact that professional service DOES recovering all the data 95% percent of the time (even physically damaged drives - witch is not the thing).

I guess you dont know much about HDD computer security man

 

[iluvdeal]

Have you tried GetDataBack? http://www.runtime.org/data-recovery-software.htm

This software has saved me a few times in the past.

 

[VirtualLarry]

I'm with taltamir here. If you zero-filled the entire drive, then you shouldn't be able to get back ANY data, using software alone. The only solution that I know of, requires examining the platters with a high-power scanning-tunneling-electron-microscope, determining the waveforms, and somehow re-encoding them back into data.

Zero-wipe a drive, and as far as normal means go, the data is lost forever.

Oh, and next time, UNPLUG EVERY OTHER DRIVE, other than the one you want to wipe. Just as a precaution.

 

[tcsenter]

I did 100% Zero Filled the drive by WD DLGDIAG using Quick mode (witch i believe using 1-Pass) with no termination.

The Quick mode only wipes the first and last ~100MB of the disk (basically erases the partition table, FAT, MBR, and anything that might be redirected/remapped to the last sector). Most of the data will still be there but no you can't recover the partition data because that's been wiped for good. You could use a disk editor (RAW) to recreate/redefine the partition but you'd need to already know how the partition was defined or have a backup of it.

 

[Voo]

And i know for a fact that professional service DOES recovering all the data 95% percent of the time (even physically damaged drives - witch is not the thing).

I guess you dont know much about HDD computer security man

Ok, so you're claiming that the recovery tool can create data from nothing at all? Because after zero filling the drive, the only data you get when reading it back in, will be.. zeros (after all that's the whole point of zero filling it).

It's theoretically possible with HW (as VirtualLarry said with an electron microscope), though I haven't heard of any recovery service doing that.. wouldn't want to see the bill for that in any case - but we've got people working in this field in the forum, so let's see.

 

[tweakboy]

Its a low level type format, NO you cant recover its contents. Sorry for your mistake I feel for you.

 

[energydream2007]

Ok, so you're claiming that the recovery tool can create data from nothing at all? Because after zero filling the drive, the only data you get when reading it back in, will be.. zeros (after all that's the whole point of zero filling it).

It's theoretically possible with HW (as VirtualLarry said with an electron microscope), though I haven't heard of any recovery service doing that.. wouldn't want to see the bill for that in any case - but we've got people working in this field in the forum, so let's see.

WD DLGDIAG did wiped the drive with the quick option.
The data iv recoverd (witch is 100% usable & real) was recoverd by GetDataBack & R-Studio (and some more) so not sure why you are saying its impossible with software - right now im searching for the MFT using hex editor after created a RAW image of the drive guiding by some other forum but i wanna hear more ideas from the experts on that matter on this community. and tnx for the comments

You could use a disk editor (RAW) to recreate/redefine the partition but you'd need to already know how the partition was defined

Thats what im trying to do now - "you'd need to already know how the partition was defined" - can you explain man?

 

[frostedflakes]

DLGDIAG has the option to zero fill the first and last one million sectors of the drive instead of a full wipe. You must have done this if you were able to recover any data from the drive, because as others have stated, a complete zero fill would make the data unrecoverable.

Also, needless to say, that means that whatever data was on those first and last one million sectors is now gone forever and there's no way to recover it. So if you've already tried recovery software, whatever it has picked up from the middle of the drive that wasn't zero filled is probably about all you're going to get.

 

[tcsenter]

Thats what im trying to do now - "you'd need to already know how the partition was defined" - can you explain man?

I could but its not going to do you any good, since the FAT and MFT is what you need, and whatever state those are in right now is all you're ever going to get. Recreating the partition table isn't going to help that (since some advanced recovery utilities or disk editors allow you to scan/read the disk using an assumed/predefined partition type anyway).

The only options you have are to use a couple-few good recovery/undelete utilities like you have been. And when those have stopped yielding results based on their predefined data/file types, you're last and only option is to dump whatever else is there in full RAW mode, then use some utility (or write your own script or something) to manually define the data/file types you are looking for. I'm sure there is a way to log or record the sectors/locations that already yielded complete or recoverable files, so those locations can be excluded from your search of the RAW disk dump. This is forensic level data recovery shit and I've never done it, so I can't help you there.

 

[VirtualLarry]

The Quick mode only wipes the first and last ~100MB of the disk (basically erases the partition table, FAT, MBR, and anything that might be redirected/remapped to the last sector). Most of the data will still be there but no you can't recover the partition data because that's been wiped for good. You could use a disk editor (RAW) to recreate/redefine the partition but you'd need to already know how the partition was defined or have a backup of it.

True, if he didn't zero-wipe the entire drive, then much of it should still be recoverable.

 

[energydream2007]

I could but its not going to do you any good, since the FAT and MFT is what you need, and whatever state those are in right now is all you're ever going to get. Recreating the partition table isn't going to help that (since some advanced recovery utilities or disk editors allow you to scan/read the disk using an assumed/predefined partition type anyway).

The only options you have are to use a couple-few good recovery/undelete utilities like you have been. And when those have stopped yielding results based on their predefined data types, you're last and only option is to dump whatever else is there in full RAW mode, then use some utility (or write your own script or something) to manually define the data/file types you are looking for. I'm sure there is a way to log or record the sectors/locations that already yielded complete or recoverable files, so those locations can be excluded from your search of the RAW disk dump. This is forensic level data recovery shit and I've never done it, so I can't help you there.

*What is the predefined partition type?
*so basicly you suggesting to nerrow the data search based on sectors that already give me files - tnx.
can you recommend more good softs? (the best you can think of)

DLGDIAG has the option to zero fill the first and last one million sectors of the drive instead of a full wipe. You must have done this if you were able to recover any data from the drive, because as others have stated, a complete zero fill would make the data unrecoverable.

Yes thats what i did - its called Quick or -FWRITE and im trying to find solution b4 going to a proffesional recovery service witch cost alot (200-500 USD and more) but first i have to try (knowledge is power )

 

[tcsenter]

Try Acronis Disk Director, which includes Acronis Disk Editor (or at least it used to). It has some useful features but its not specific or purpose-built for data recovery. I don't know of any others because the products that are going to be of most use are the proprietary stuff that professional data recovery companies have spent years and years developing for their own use and thus they aren't going to be giving that away for any small amount.

 

[energydream2007]

Try Acronis Disk Director, which includes Acronis Disk Editor (or at least it used to). It has some useful features but its not specific or purpose-built for data recovery. I don't know of any others because the products that are going to be of most use are the proprietary stuff that professional data recovery companies have spent years and years developing for their own use and thus they aren't going to be giving that away for any small amount.

Il try it.

 

[Rifter]

Was going to post what taltamir said, then when you told him he was wrong(which he 100% is NOT) with all of a few posts under your belt decided not to bother, you cant recover anything anyways. zero fill = zero recovery

 

[energydream2007]

Was going to post what taltamir said, then when you told him he was wrong(which he 100% is NOT) with all of a few posts under your belt decided not to bother, you cant recover anything anyways. zero fill = zero recovery

Apparently you didnt read my post or the others after it - so read very carefully: I DID R-E-C-O-V-E-R APPROXIMATELY 26GB.

 

[Rifter]

Apparently you didnt read my post or the others after it - so read very carefully: I DID R-E-C-O-V-E-R APPROXIMATELY 26GB.

I have now read them, and you didnt zero fill the drive so the info in the title and OP is incorrect.

 

[energydream2007]

I have now read them, and you didnt zero fill the drive so the info in the title and OP is incorrect.

Again - il say this to all the thread listeners:

I DID ZERO FILLED MY DRIVE 100% SUCCESSFULLY WITH DLG "WRITE ZEROS TO DRIVE" IN QUICK MODE WITH NO TERMINATION AND I DID RECOVERED A 26GB OF WORKING USABLE REAL FILES!!

 

[razel]

If the partition you had is NTFS use testdisk to find that partition and do a partition recovery. NTFS keeps two copies of the File Allocation. One usually in the beginning of the drive, which probably got wiped and elsewhere... usually in the middle of the drive. Find that and you'll be in good shape.

Keep in mind there are two types of data recoveries... partition and file signature. You'll want to do your VERY best to stay in the partition (and file system) portion. It's more accurate.

 

[Rifter]

Again - il say this to all the thread listeners:

I DID ZERO FILLED MY DRIVE 100% SUCCESSFULLY WITH DLG "WRITE ZEROS TO DRIVE" IN QUICK MODE WITH NO TERMINATION AND I DID RECOVERED A 26GB OF WORKING USABLE REAL FILES!!

Maybe you should read post # 8, you didnt 100% zero fill the drive or you would have a 0% chance of getting anything off of it. You are lucky you ran it in quick mode, you should be able to use any data recovery software to recover most of your data unless it was stored at the very beggining or end of the drive.

 

[corkyg]

In Quick Mode all you did was write zeros to the boot sector. A full zero write takes a long time and once done, you recover no data unless you have a lab that can read data edges.

 

[Rifter]

In Quick Mode all you did was write zeros to the boot sector. A full zero write takes a long time and once done, you recover no data unless you have a lab that can read data edges.

thats what ive been trying to say, along with everyone else that responded before me.