0

I'm trying to recover deleted data for a friend.

They accidentally formatted their hard drive (I'm hoping it was just a quick format).

The drive is currently in an external case accessed by USB. When I targeted the drive using CCleaner's Recuva tool it failed saying it was Unable to Determine File System Type

So I'm trying out Hiren's BootCD PE

I got my computer to boot from the USB, and tried a few of the different backup programs. At long last I created a backup file using DriveImage XML The backup file is of the datatype .mrimg.

This backup was created using the setting that allows for data recovery.

I see when I right click on it I can attempt to mount it as a drive.

That seems to succeed, but the drive does not show up in the my PC view, so perhaps mounting is failing silently?

At the moment I am attempting to use Recuva targeting the folder containing the .mrimg. It has a progress bar, and I guess I will know if a few hours if that works, but I have doubts that this is how I'm intended to use the backup file.

I would rather not touch the hard drive again, in case I utterly fail at this, I hope to do no harm, and let professionals have a shot at it. I have 2 copies of the backup on my machines hard drive in case I mess one up.

So I'm looking for a way to recover the lost files just from this .mrimg backup that was made using DriveImage XML.

I'm suspecting that the way I'm currently trying to use Recuva is not going to work, but if it does, I'll let you know.

Edit: Replying to comments:

@music2myear: I was able to get the image to mount as a drive... However despite the image being 500GB, the mounted drive is only about 50MB.

So I suspect the image creation failed.

@DrMoishe Pippik: I did choose an image type that said it was for forensic, but it wasn't the clone option that completely overwrites another drive. (I don't have an empty drive to clone this too, but I do have drive I'm currently using that also have more than 500GB of free space to hold the image.)

Since the image is garbage, I think I'm done attempting to recover data.

Those links are great though! If I were brave enough to try again, I suspect I would find everything I need there. Thanks!

(since there was no answer posted, I cannot accept an answer... should I delete this question, or summarize something and mark that as an answer?)

Giacomo1968
  • 55,001
SketchBookGames
  • 101
  • After you mount the drive, does Disk Management show the storage? I don't think that running Recuva against that file will do anything. Recuva needs to run against a drive that is mounted some way, and an image, though it contains data from the drive, is not a mounted drive. If you can create an ISO or other mountable image file and mount it so it has a drive letter, then Recuva will be able to help you, but I think you're a couple steps short of that still. – music2myear Feb 13 '24 at 18:38
  • Also, relevant: https://superuser.com/questions/241817/how-do-i-recover-lost-inaccessible-data-from-my-storage-device – music2myear Feb 13 '24 at 18:40
  • Be sure you're making a complete clone with DrivImage XML, as shown here,https://www.ubackup.com/clone/driveimage-xml-clone-boot-drive.html, not an image file. What you want is a forensic copy of the drive, a bit-by-bit copy. Then work on recovery from the copy. Here are more recovery tools: https://www.cleverfiles.com/howto/top-5-data-recovery-software-windows.html – DrMoishe Pippik Feb 13 '24 at 18:56
  • If the drive image was created with Macrium Reflect you need the same software to use it, not Recuva. You may want to try Macrium's recovery media. The recovery environment should be enough to, at least, read what's inside the image file. Whether or not you can manage individual files (as opposed to recovering the full contents to a different drive) I don't know. I use Linux/FOSS tools only. And yes, backups made with MR seem to be in a proprietary format, reason why you need to use it and of equal or newer version of the one that created the backup. – ChanganAuto Feb 14 '24 at 04:28
  • With Macrium Reflect installed in Windows it should be as easy as described here: https://forum.macrium.com/52593/RE-Cant-explore-backup-image#52607 . Different method may be needed when booting from MR's recovery bootable media (only needed for re-imaging a new drive/new machine from the (full) drive backup). – ChanganAuto Feb 14 '24 at 04:47
  • Now, if you made the image after the fact of having data deleted, in the hopes of later working on the image with data recovery tools, as already commented above you need a bit-by-bit copy, something that CLI tools like dd provide reliably (and to a standard ISO format). I wouldn't trust what you used for that and apparently the "raw" option - if it works at all - is only available from drive to drive (and of course, it deletes the target drive). If you need a GUI then there's https://guymager.sourceforge.io/ – ChanganAuto Feb 14 '24 at 05:25

0 Answers0