How to Recover After Formatting


The filesystem is of utmost importance. It is what keeps track of where the files are located, how much free space there is, etc.

When a partition is formatted, a fresh book keeping is made. The data is all still there, however we don't know where the files are.
The data isn't overwritten until the new filesystem writes new files. Thus the first thing you should do is not use the disk or write new files.

This guide will help you recover the files.

First if you're not sure whether the filesystem is gone or you just deleted the partition then check out How to Recover a Partition, if you're sure the filesystem is gone then continue below.

Making an Ubuntu Live USB

Download Ubuntu, a linux based OS.

If you have a 64bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-amd64.iso

If you have a 32bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-i386.iso

If you don't know if your PC is 32bit or 64bit, downloading the 32bit will work on both.

After downloading the file, head on over to https://www.linuxliveusb.com/en/download

and install Linux Live USB Creator. Follow the instructions on how to make a Live USB.

Starting the Live USB

Plug the Live USB into the PC and then turn it on.
If you aren't greeted with an ubuntu screen showing "Try Ubuntu" or "Install Ubuntu"
click on Troubleshooting Starting a Live USB.

Choose "Try Ubuntu" you should get a desktop after a few mins.
If you're stuck at a black screen, click on Black Screen After Starting a Live USB.

After the desktop has loaded, start a terminal with Ctrl + Alt + T

You should see a command prompt such as ubuntu@ubuntu:~$

Assessing the situation

Type sudo parted -ls

You should get a list of the disks and partitions
ubuntu@ubuntu:~$ sudo parted -ls
Model: ATA HGST HTS541010A9 (scsi) <---- Disk name
Disk /dev/sda: 1000GB <---- Disk name as known to linux with size
Sector size (logical/physical): 512B/4096B
Partition Table: gpt <---- Partition table type (gpt or msdos)
Disk Flags: 
Number  Start   End     Size    File system     Name                  Flags
 1      1049kB  316MB   315MB   fat16           EFI Partition         boot, esp
 4      316MB   9979MB  9664MB  linux-swap(v1)
 5      9979MB  16.8GB  6784MB  ext4
 2      16.8GB  896GB   880GB   ntfs            Microsoft basic data  msftdata
 3      896GB   1000GB  104GB   ext4

Model: Seagate BUP Slim BK (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags: 
Number  Start   End     Size    Type     File system  Flags
1 1049kB 2000GB 2000GB primary ntfs boot

Installing Testdisk

hook the PC up to the internet and install testdisk

by typing sudo add-apt-repository universe
then type sudo apt update
then type sudo apt install testdisk

This program searches for partitions on the disk, and allows you to write a new partition table with the selected partitions. It also allows you to view the files of a partition and copy them without changing the partition table which is what we want to do.

Take note of the Partition Type in the previous output of "sudo parted -ls", you'll need it for testdisk.

Start testdisk with sudo testdisk

Choose "Create"
Select your HDD and press on "Proceed"
Select the Partition Table Type noted above. If you don't know which type it is, testdisk usually makes a good guess as to what it is and selects it for you.
Choose "Analyse"
Choose "Quick Search"
It will show you the list of partitions it found.

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors P MS Data 34 2041 2008 P MS Data 2048 616447 614400 [NO NAME] >P Linux Swap 616448 19490799 18874352 P MS Data 19490816 32741375 13250560 P MS Data 32741376 1750769663 1718028288 P MS Data 1750769664 1953525127 202755464 Structure: Ok. Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted Keys A: add partition, L: load backup, T: change type, Enter: to continue
The numbers below "Start" are the Starting sector of the partition, the "End" column is where the partition ends.
If you highlight a partition it should say at the bottom the size in gigabytes and other information.

Use the arrow keys to highlight the partition that was formatted and press "p" to view the files. Red files are deleted ones. Press "C" to copy the files to your harddisk.
If you had a FAT filesystem it should be easy to get the files back. If you can't get the files back then you can use a program called "photorec" which comes with the testdisk package.

Using Photorec

Photorec doesn't care about the existence of a filesystem, all it does is scan the disk for files and recover them.
It won't recover them with the directory structure. It also can be used to search for certain file types by using file headers and recover those only.

Start photorec using sudo photorec
Select your HDD
You can go to File Opt to see the list of file types it will recover, some file types aren't selected by default.
Then highlight the partition you want to search, or the whole disk and press Search
Choose where to save the files it recovers, then press "C"
It will ask about the filesystem type, for Windows filesystems and mac select FAT/NTFS/HFS+
It will recover the files in the recup_dir whereever you chose to save them.


RELATED TOPICS
Live USB, Ubuntu, Partition table, Partitions, Filesystems, Testdisk