How to recover data in formatted hard disk and already installed a new OS

Question

Help how to recover formatted hard disk and already installed a new OS but not yet installed applications.

Edit: I have two 500g hard drives lets say HD1 has my personal files and the other is HD2 where I need to install my OS, but I accidentally formatted my HD1 and installed the OS on it.

I just want to know if I can recover some data on it estimated 200g of data.

Solution

You are not guaranteed that you will recover all your files. If you have anything precious in deleted files then the next worth giving it a try.

You are not recommended to write on partition any more in order to keep data chains at the drive as they are. In other words avoid sectors overwriting. Stop using this drive immediately!

Boot from Live CD (or even better from the different drive with installed OS) and run any software which is supposed to recover deleted files. It's general recommendation. As you didn't include what OS do you have it will be below explained how to do this in Linux, for example from Ubuntu Live CD.

So you should run the software which find and recovers files/data from your physical storage. It is still possible although Operating Systems can not see deleted files due to their references were deleted from File Table, or File Table was corrupted.

• Scalpel

This is a filesystem-independent recovery tool for Linux. The latest version is 2.0. Install it in Ubuntu with

sudo apt-get install scalpel

Next is some text editing — the configuration file is /etc/scalpel/scalpel.conf. You will find that everything has been commented out — uncomment the specific file format that you want to recover. For example, if I want to recover a deleted zip file, I will uncomment the .zip file section in scalpel.conf

Next, in a terminal, run:

sudo scalpel  [device/directory/file name] -o [output directory]

The output directory, in which you want to store recovered files, should be empty before running Scalpel; otherwise, you will get an error.

• Photorec

This is the fastest utility of the three. It’s installed by the testdisk utility package. If you don’t want to mess with the command-line, this is the best utility for you. Just run photorec as the root user in a terminal, and you will see a nice ncurses-based UI.

Select the device to search, and it will ask you for the partition table type. Select yours; in my case, it’s Intel. Next, you have to select the filesystem or partition of the device disk. Next, it prompts you to choose the file system.

Last, it will ask for an output folder in which to store recovered files. After making a selection, press y to proceed.

Note: The above utilities will not recover replaced files, because in the case of replacement you are replacing the inode itself, so it’s not possible to recover it.

Comments

[Keltari]

agreed. at this point, you are most likely out of luck. You can try data recovery software or even take it to a data recovery specialist, but there is a good chance most, if not all, the data is gone.

[Psycogeek]

While that is for the most part correct, the user never even provided how much of the hard disk has been overwritten. 30gigs of an OS overwriting a portion of a 500gig drive that was 300gigs used, still has a lot of recover possible. They did not inform of the method of formatting the disk, or how badly framented it might have been prior to any loss of file tables pointing to the data. Plus there is high-end software that attempts to reassemble clusters that originally may have belonged together. Add that to a system finding "holes" to place whole data sequentially. Too many factors to know.

[arielnmz]

I completely agree with you, but one can infer from the imperative tone of the question that the user wants to recover data, not some of it, not the rest of it, but it. But anyway I find your comment helpful and will update my answer accordingly.

[Psycogeek]

I believe it is the question that does not provide enough data.

[LittleGeek]

Thank you for your answer. Can you suggest software that can I use to recover data?