0

I have an dd image of a partition that once had a Windows 10 NTFS filesystem and then got accidentally formatted (or so I assume) and now has a pretty empty NTFS with only an empty Windows directory on it.

Is it possible to recover at least some files by scanning the binary dump for Magic Bytes?

I tried testdisk, foremost and some other tools without finding any file so I'm wondering if NTFS somehow works that different than FAT or ext where the contents can be found even if the filesystem is not readable any more.

Improve this question
6
  • NTFS of course works slightly differently, but in the end, the data has to be on the disk somewhere, and especially small files are likely to be sequential. Try binwalk. good luck. Commented Jun 16, 2021 at 22:03
  • Of course, especially if this happened on an SSD, then "formatting" might just have told the SSD to discard all the data, so you dd'ed a lot of zeros. easy test: if this image gzips to basically nothing, you can give up. Commented Jun 16, 2021 at 22:04
  • Discarding all data without explicitly overwriting them (which would take a long time) is possible on SSDs? Anyway, as I can find only random data at various offsets and even at the end of the image, I guess there must have been some kind of encryption at work. Commented Jun 16, 2021 at 23:13
  • 1
    Identifying and recovering files by their contents, or "Magic Bytes" would be the job of testdisk's sister program: PhotoRec. Commented Jun 16, 2021 at 23:20
  • As @telcoM mentioned, you should use photorec. In photorec there are options for a) selecting ntfs as the underlying system and b) searching by magic bytes. you just need to run photorec as sudo. Unless you went through some serious effort actively erasing your partition, you will virtually always come up with something. I have formatted partitions, put new OSes on them, then re-filled them up 90% of the way ( per OS diskspace managers) and could still pull out files from when the previous OS was on them. Even if photorec comes up empty, your data may still be recoverable. Commented Jun 17, 2021 at 0:42

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.