Is there a way to recovery data as I format my HHD from ext4 to ntfs?

Today I used GParted to format my USB, but made a deadly mistake that I formated my HHD.

Is there a way to recovery those data?

Thanks in advanced!

A quote from elsewhere:

1 Like

Before attempting any recovery

  • consider bringing the drive to an expert and pay them.

The following advice is at your own risk! I'm not a data recovery expert at all! If professional help for money is not an option then

  • clone the drive with clonezilla and then try to reformat the clone to ext4 with Gparted - the data might be back again if nothing was written to the new partition.

Hi, thank you so much!

Yeah I change to another hard disk for daily use right now. Sometimes maybe I will pay the expert if no perfect ways.

And how to know the command exactly which gparted did when I format my HDD? Is there a command log?

Thanks a lot! But I don't dare to use them... afraid to lose some data.

Gparted is pretty much an industry standard, if you describe what you did then an expert will know what to do. I don't know where the logs would be. The command is probably mkfs.ntfs -Q with -Q being not overwrite with zeroes, unless you told to overwrite with zeroes.

It should be recoverable. But you should invest the money for a second similar sized disk to clone the original one to it. This way you can try to recover it without risk.

I have done some data recovery - the best way to do it is to create an image of the disk in question using dd

  • mount the image and run recovery tools on the image
1 Like

Just don't select the wrong drive with dd...
What do you think about Clonezilla instead of dd, considering the experience level of the OP?

That is equally good but you cannot do forensics on a clonezilla image.

I prefer to make an image of the drive using dcfldd - and not touch the drive again unless I need a new copy to work on. It is also possible to mount the device read only and recover files by copying to a third device.

There is a couple of forensic tools in the repo - dd_rescue and ddrescue (I actually don't know the difference) and there is sleuthkit. In AUR is graphical interface for Sleuth Kit called autopsy.


@roachsinai The most important thing - if you hope to rescue anything - do not do anything on the drive - remove it from fstab so you do not write to it by accident.


@roachsinai Depending on how you created the ntfs filesystem - you may be in trouble. If I recall correct - when you format using nfts - the defaults are to zero the device.

A command like this will zero the first partition on a device named sdy

mkfs.ntfs /dev/sdy1

If it took a long time - and I mean long, long time - to complete the formatting to ntfs - then you have most likely zeroed your device.


IMPORTANT: Data recovery is not for the novice user. Consider yourself warned. NEVER work on the damaged device in read-write mode. ALWAYS work on a copy created with a forensic tool.

I tested gparted with an usb - on my system it was

mkntfs -Q -v -F -L /dev/sdm

Because the command - on my system - included the -Q argument only a subset of data has been overwritten - just like @eugen-b - said.

So - there is a reasonable chance the data can be recovered. ext4 save the file allocation table - in several locations through the disk - these backups can often be used to restore almost everything - almost - depending on a lot things - actually ...


If you want to get an idea of what is possible - install the gpart package - then from gparted -> select the device -> devices menu -> attempt data recovery.

sudo pacman -Syu gpart

Gparted will not allow you to change the disk but copy select data to other device.

Double check yourself with every step - every action - you take - not to destroy your possible data recovery.

2 Likes

@eugen-b @linux-aarhus thanks for all you guys suggestions and instructions! What a fool I am.

Looks like we might have a new member to the church of backups. :slight_smile:

1 Like

In fact, I format my backup HDD...

But, it's true that I don't have another copy of my Data.

I back up my data. I don't back up my OS's.
哈!哈!

3 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Forum kindly sponsored by