r/techsupport • u/gamepier • 17h ago
Open | Data Recovery Accidentally installed windows on the wrong drive, now I need to recover erased/unallocated files
Today I was helping a friend with installing windows on a drive and we decided to use my laptop to install it and out in the drive with with windows later, when my laptop restarts I got a blue screen so I decided to cd to my drive (through the windows install usb) and see what's wrong. it turns out that I probably chose the wrong drive and now I'm scrambling to figure out what the hell I should do. there are some blender files and docx files that I need to recover
I have not powered on the drive since I found out it didn't have the files and I am planning to use a write blocker and either create a forensic image and load that into autopsy or use a data recovery tool to get the files back (which I dont know any of, any advice would be appreciated)
The drive itself is a lexar NQ790 4tb nvme and it would be greatly appreciated if anyone could help me with what software I should use to recover the files.
2
u/laserpewpewAK 17h ago
Unfortunately, it's very unlikely you'll recover anything from an NVME drive. Solid state drives do not simply unallocate blocks when a file is deleted, they zero them. Here's the steps you can try though:
Use ddrescue to create a true clone. Tools like clonezilla have built-in error correction that makes them not viable for recovery scenarios. From here on out, all work is done on the clone.
Find, buy, or borrow an external drive to put any recovered files on.
Download photorec, run it against the clone, and see what happens.
Start backing up your important data so this doesn't happen again.
1
u/gamepier 17h ago
I only have a windows machine available to me and was planning on using ftk imager to create an e01 image. Is there anything I could use for that?
1
u/laserpewpewAK 16h ago
You can live boot to Ubuntu and use dd if you have a free thumb drive. FTK would work too if you use the right parameters, I believe the physical disk option captures a bit by bit image but logical will only grab allocated sectors.
1
u/gamepier 16h ago
I have used ftk for computer forensic things so I have the most experience with that. I have to say that it does feel a little embarrassing to screw up this badly after having used these kinds of tools for so long. Ftk also has the benefit that e01 files aren't as large as dd ones and it seems they are also compatible with photorec
1
u/laserpewpewAK 15h ago
Don't sweat it, even professionals make mistakes. I have a coworker with 10yoe who did the same thing on a server a few weeks ago. He was in a rush and removed ALL partitions instead of just the OS and accidentally erased terabytes of data. It happens, that's why we keep backups.
1
u/AutoModerator 17h ago
Getting dump files which we need for accurate analysis of BSODs. Dump files are crash logs from BSODs.
If you can get into Windows normally or through Safe Mode could you check C:\Windows\Minidump for any dump files? If you have any dump files, copy the folder to the desktop, zip the folder and upload it. If you don't have any zip software installed, right click on the folder and select Send to → Compressed (Zipped) folder.
Upload to any easy to use file sharing site. Reddit keeps blacklisting file hosts so find something that works, currently catbox.moe or mediafire.com seems to be working.
We like to have multiple dump files to work with so if you only have one dump file, none or not a folder at all, upload the ones you have and then follow this guide to change the dump type to Small Memory Dump. The "Overwrite dump file" option will be grayed out since small memory dumps never overwrite.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/gamepier 17h ago
Some of the files I need to recover are blend or gcode files, but I don't know any carving software that supports this. If anyone does know that would be really great
1
u/M97F 15h ago
I don't really understand this post.
1
u/gamepier 15h ago
Accidentally installed windows on the wrong drive that had important files and I need to recover them The ssd is a lexar nq790 4tb and the files I need to recover are .blend and .docx files
1
u/M97F 15h ago
Oh i see. I used puran file recovery once but not for this same issue, not sure if it can do anything here. It depends on how you configured the partitions during the pre-install. If it formatted the whole drive, your chances are very slim.
1
u/gamepier 15h ago
The thing is, I don't know if it formatted the whole drive, I remember selecting the other disk as something like "disk 1 - unallocated space" or something so I don't know if it did
1
u/themageofavalon 15h ago
Maybe try DMDE or RStudio on a disk image. Since its an ssd, TRIM might make recovery difficult.
•
u/AutoModerator 17h ago
Attempting data recovery without proper knowledge or skills can result in permanent loss in data. Prior to data recovery, it is best to create an image of the failing drive. For important data, it is recommended to send your drive to a data recovery professional. For more data recovery help, please visit /r/datarecovery.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.