Bitcoin Forum

By mistake, one of my friends formatted the hard drive partition (His intention was to format a flash-drive) that contains all his private files, including wallet backup files (not seeds), all files containing passwords and security codes that he uses on all platforms. Unfortunately, he does not have a backup copy of all the data except the seed words for his wallets which are hidden in a place that is currently inaccessible (family home in another country).

While I was asked for help, I wasn't able to provide accurate help as i didn't face the same issue before. Searching online, I found many recovery programs but there are no guarantees that any of them are reliable to handle with such sensitive data. (As i'm not a technical expert, i doubt that any software can send a copy of a possible recovered files to a third part).
I suggest him to start changing all his codes in platforms as he still has access to his emails (fortunetly located in a safe partition) and phone numbers used in registration. Sure this is so much time consuming but at least he can recover at least his accounts until finding a solution to recover the rest of the files (perso images, projects...).

The computer he uses is a Toshiba laptop that runs with Windows 8 (a version that has not been updated since 2020 and not even licence activated), and he formatted the partition [D:] using the NFTS(default) system.
To be sure, he did not format the entire disk, but only a secondary partition, not the main partition [C:].

My question is for the expert members about the most effective way to recover those files or about any reliable program that is available for free, because my friend does not have the ability to purchase paid softwares online.

I chose to publish here because I do not trust other forum platforms and because any suggestions will be useful to everyone here, given that these incidents are a common occurrence and not everyone is qualified to deal with them professionally, especially since most of us will avoid dealing with specialized service companies due to the sensitivity of the data that will be worked on.

Please do not share any suggestion that you are not sure of its effectiveness. It is best to make it based on your own experience/technical knowledge, because some mistakes may be fatal, whether a copy of the data will be stolen or may will be lost forever.

Oh my goodness  :o. He literally has made a very costly mistake. I too have come across some recovery technicians however all were online and therefore just like you mentioned I really can't recommend them since they don't guarantee safety of his data. I am not an expert anyways I think technicians have some way they can recover data from a formatted hard drive that is if the specific hard drive meets some certain conditions. I believe we have some nice tech guys on this forum who hopefully would be able to render some help.

I think most hard drive recoveries have to be done physically by the technician. Probably if it turns out so a technician here could guide him through a possible option for the restore process. +1 for you op for trying to assist him. I hope he is able to recover the data he lost.

I have some experience with this because I have faced a similar situation before. Here's what I think based on my experience: The good news is there might still be hope for those files. Quick formatting a partition generally doesn't erase data from the disk, it just designates that space as "free space". The bad news is that if you are not an expert or technically proficient enough, you could do even more damage than the current situation.


This is why it might be best to leave this job to an expert. To a professional who has a good track record. But if you still want to continue on your own, it's best not to do anything rash. Don't even turn on that computer again to avoid any possibility of further data damage. The key is to avoid writing anything new to the drive. Every write operation can overwrite the lost data permanently.

The first thing I would do is clone the entire drive to a new one. You'll need a spare hard drive with the same or greater capacity. Then, you need to connect both disks to another PC (desktop) and boot it with a specialized live OS version from a CD/DVD or USB flash drive. The last time I did this, I used Hiren's BootCD, which has all the necessary tools for these situations. There are probably some Linux distros that might work as well, but I haven't explored those. Once you clone the disk, you can then proceed with the recovery partition, but on the copy, not the original disk.

Oh well, that sucks big time. Don't get discouraged though, there are still reasonable chances to successfully recover your friend's files. As the previous poster already mentioned, formatting your hard drive doesn't fully delete your files, your files are permanantely deleted when they're overwritten by other files. I personally was successful recovering photos and videos over 5 years old with Recuva, I'd suggest you to at least attempt it with a deep scan. If that fails, I'd recommend going to a professional, even though I'm not quite sure how differently they can act.

Which wallet did he use? Electrum, Bitcoin Core, Exodus, another one? If things happened in the way you say, it's concerning. Because if I understand correctly, he just made a format by mistake. It means missing files have been formatted, so if he's unable to retrieve them, they are very likely to have been formatted, and not just deleted or sent to the trashcan.  

Files themselves can't be formatted, only the partitions or drives that store them.  That's why recovering the wallet backup files might still be possible, even if the partition was formatted. 
as I have already replied earlier, formatting a partition in most cases doesn't delete data from the disk drive.

Does Formatting a Drive Erase Everything? No! (https://www.easeus.com/resource/does-formatting-drive-erase-everything.html)

I think from what the Op explained , his friend actually lost the data via a format not a regular deletion. If it was simply a case of data deletion, the op could simply get the files back from his recycle bin. Another option is if the op previously had a pre saved restore point on his windows system. With that he could easily make use of the restore point feature to get back data he lost from the format via a pre saved restore point.
I think there are other technically methods of retrieving lost data from an hard drive however I don't have any experience about the processs. As for the wallet, if the op made use of something like Electrum, the keys and seed phrases would be  encrypted making it unable to be retrieved via simple means like a that of a pre saved txt file with the phrase and keys.

You are right. When you delete a file it doesn't get erazed from the hard drive. There is still a chance to recover some files from the formatted drive. The most important thing you need to do right now is to stop using that hard drive because anything you do may damage your data. The data on your hard drive is not completely lost but it might get overwritten (lost forever) if you keep using it.

OP, If your buddy chose the quick format path, odds are decent that most of the data might still be recoverable. But fetching those formatted bits is no sure bet and  whether the recovery sticks depends on how thorough the formatting was and what got written over those sectors in the meantime.  

Okay, so included on these are his wallet backups, are those backups not currently in an active wallet now? Better to move it on a new wallet if its still active, or just get a new backup.

On his other stuff, i knew every data in such drives (hard disk, hard drive flash drive) are recoverable. You better use experts or service that do such thing in your area, your friend may start searching or asking now. Although there some service apps available online, which are paid ones but i not guarantee that they can recover all of those data and won't get any copy of the recovered files.

There is a huge chance that the file can be recovered completely as long as the sector used by those important file is not overwritten by another file.  So I will suggest to have an extra storage disk if you decide to use a recovery tool to recover your deleted files.  It will be used to save the recovered file so that the file you recovered won't accidentally use the sector that contains your important data and avoid file corruption due to incomplete data.

I have experienced something similar, but it can still be saved, although not all of it. I used Recuva Technician to recover all data that had been formatted accidentally. maybe you can try it. it's free and widely available on the internet.
I hope this helps a little and I hope you can find important files that were accidentally formatted.

It is very bad that your friend saved a second back up in a location he can not access easily and I believe this accident will give him a valuable lesson with backup methods in future.

For recovery, I agree with some recommendations above that in the meantime, your friend should not use that disk to avoid overwritten on it.

10 Data Recovery Software to Retrieve Lost Files (https://www.geeksforgeeks.org/10-data-recovery-software-to-retrieve-lost-files/). You can share it with your friend but in my opinion, I will not hurry to do it with the disk if I am not proficient with data recovery from a formatted disk. It can cause forever loss.

By don't do anything on that disk, your friend will still have chance because his bitcoins will not be stolen if nobody can access its private key. Risk will be from a second location (in another country), where he stored backups.

Firstly, you need to think that those specialists about whom many speak here are the same people. Following the proverb: “It’s not the gods who burn the pots.” This means that everything that people do can be done by your, OP, friend. I always overcome any problem with my experience. Check out the video on YouTube. I'm sure there are thousands of videos out there on how to recover files after formatting, recommend programs, and show how to do it. Some software has a trial period, and it is not at all necessary to pay for it. Your friend, having started working with the program, will have to see and identify the necessary files for recovery. I think that this is not fundamentally all, but only the important ones. The main thing is not to connect the computer to the network when using such software until it is completely restored.

I think quick formatting doesn't erase the data from your hard drive completely rather it would just store the data into the backup space and it'll show that the risk is empty and new files can be saved. As after a particular time it'll automatically erase all the backup data so you need to be quick.

I'll advise you to call an expert or take the hard drive to him , don't do a anything on your own as it'll complicate the situation. It is possible that your data can be retrieved.

Recuva's free version has gotten me out of a few jams too!  It's amazing what kind of magic those data recovery programs can work sometimes. I used it a couple of times to recover my files from formatted drive and memory cards.  Here's hoping your friend can recover most, if not all, of their important files.

Recovering files from a formatted drives is not that difficult task, a simple data recovery tool can bring everything alive but the only one condition is the deleted partition should not be over written. So your friend shouldn't do any activities like moving, copying new files, etc.

Recuva is one of the most popular yet free for personal use that can do the job what you're asking but since sensitive data is at stake better approach it with caution.

Files are not lost when you format your PC, they're still in the hard disk but they cannot be accessed by the operating system. There are many free recovery tools are online, but I do not know how effective they are and I cannot recommend one for you. Also, you should reconsider paying for one instead of downloading it for free because you do not know the authenticity of the application whether it's infected with malware.

I don't have solution to this as I'm also not a technical expert. I feel so much for your friend and hope it'd be resolved to set his mind down because I can from afar imagine how disheartening such could be.
I also appreciates you Op for sharing this here because either similar mistake has happened before without treated because it wasn't brought to this reputable community of troubleshooters to solutions also so that everyone of us can more careful with our software programs.

There is a saying “if you don’t pay for the commodity, then you are the commodity”. In the case of financial data recovery, probably shouldn't be greedy for a couple of ten dollars. Free apps may hide dubious monetization methods, and not just malicious programs (third-party).


Developers of free apps need to earn money from something, and theoretically why is this impossible?
Paranoid people should turn off the Internet while data is being restored, and then remove the OS on which the recovery program was installed. :)

P.S. Don't forget to restore data to another disk (physical).

That's right, this is one surefire strategy if you use free applications available on the internet.
especially if the developer provides free access, even if it is not limited in terms of usage, it usually includes advertisements.
It is highly recommended to download directly from the software developer to avoid being exposed to malware which could result in your data being copied to third parties.
and when your data can be restored with this free software, immediately back it up to another hard disk or your other storage media.

 Data lose or lost data occurs either intentionally or unintentional. To prevent it from happening, I think the following ways can help if been adopted. which are;
 1.Update your files.
2.Protect your hardware.                         
3.Make sure your employees have knowledge about data leakage.
4.Make your computer clean always.
5.Application of antivirus and anti-malware software.
6.Develop robust security policies for devices and endpoints.
7.Ensure sensitive data is encrypted.
Keep software patches up-to-date.


Hard ware security is essential to prevent data lose. It should not be over looked.
While most data are now stored in the cloud, hardware devices are still necessary to access it. Those data, especially the critical ones that reside on them can be lost when damaged or compromised. Attentions need to be paid to them.  the following precautions need to be taken to avoid such from happening;
1.Anti-theft equipment needs to be installed.
2.Also install circuit breakers.

I think the one that could have been more costlier is when he completely loose access to his wallet private keys and couldn't have any alternative means as backup, but as the case maybe, he could have made a back as well on other devices on those files, or rather seek for the access top redownload some of those files and make recovery of his account or data with the same login details used, if he could manage to remember any.


I don't know if some features can be accessible from the MSDos to recovery such deleted files, there is a way deleted files are found on the recycle bin while some can be recoverable with the use of some certain command, but in this case, it was formatted, and this simply means a complete and total erase from the ROM which i don't think he may have the opportunity of recovering such data files again.

As decodx said, it's important to not use the formatted partition to avoid any further write operation by OS or whatever else.

Create a full image backup (bit-by-bit forensic copy) of the storage device. An image copy that only copies used data is completely insufficient after formatting a partition of full drive by error. You need a full sector-by-sector copy regardless of the content of the sectors on the source drive. Your destination drive for the forensic copy must be equal in size or bigger than the source drive.

Your forensic image backup is what enables you to always recreate the status quo before you attempt to recover any data. Any data recovery alters your source maybe to a point where it becomes unusable or even more damaged than before. Do not alter the forensic image backup!

The first recovery software might not be the best. You may have to try another one. Without the forensic image backup you can't restart from the beginning. Remember that!

Giving the recovery task to a professional could be a risk when crypto wallets are to be recovered (unless they have a decent good password or rather a not crackable one). The recovery professional might be tempted to steal your wallet and tell you recovery failed. Then what? Wouldn't be the first reported case...

OK, this isn't helping in this particular situation but I will ask it for other readers anyway: why do people not have backups, seriously? People have valuable data on their devices, sometimes worth a lot of money or personal value. Why don't you perform backups on a regular basis on another storage device to avoid hassle and losses like reported here?

I don't get it... No backups, no mercy! I know, truth is hard. (I had my share with a failing harddrive and my Bitcoin Core wallet on it; saving data before the drive died and recovery was no fun and took me a long time. It was the last time I had no good backups...)

I would like to thank you for all the support I felt through your words and for the helpful suggestions that everyone will certainly get help from.

Initially, I will make an image copy of the formatted partition so that the files can be recovered independently and my friend can continue using his laptop at the same time. I may have convinced him to buy a new hard disk, but he still has a lot of data on the rest of the partitions that will require double the effort and time to transfer data to a new disk. With this in mind, I would like to ask you: Is it better to stop using the entire disk, or can he just stop using the formatted partition? Can using applications (Photoshop, Internet browsers...) on the same laptop contribute to more harm as well?

When you delete files from your harddisk they are not entirely gone, there is a chance that you can get them back but there is a catch.

I read comments saying you need a professional, I don't disagree but make sure you stay with them when they are doing their magic, those professionals also need money, if they find informations that can get them free money they will take it and you won't know.

Only to find out that your crypto wallet is empty, or even bank account, be very careful.

---

If you have idea about computers there is something you can do, actually many people don't know that they can get their files back themselves without the help of a professional, what they don't know is that free softwares don't get your files back or completely back.

Meaning you will lose some and get few back, all you need is a paid software, and you will see the magic difference between a paid software and a free software, I have struggled to get my files back and in the end I paid for a premium windows file recovery software which works perfectly.

Sorry it's been like 5 years in the past since I did it, I can't remember the name of the software anymore.

I'm still waiting for my friend to have time to start working on the issue because I refused to make any attempt without him being present with me. He trusts me but I cannot afford to be honest because of the sensitivity of the data. My friend completely stopped using the computer according to your instructions. But I would like to get an answer from expert members for this question:

Is it better to stop using the entire disk, or can he just stop using the formatted partition? Can using applications (Photoshop, Internet browsers...) on the same laptop contribute to more harm the formated partition as well?

Cheers,

If I have a data recovery job to make, I would make as very first step a full forensic copy of the original storage or partition media. This is the baseline to which you always want to be able to return if you mess something up or before you try another recovery tool.
(Full forensic copy means a copy of all sectors irrespective of their content, you don't try to make any filesystem logic assumptions for such a copy; copy all sectors 1:1 from source to a backup destination drive)

Storage devices like harddisks aren't too expensive, so usually one can afford to have a forensic backup copy. If recovery data is more valuable, I'd have two independant forensic copies for redundancy.

You could hide and unmount the partition from the OS. Your basic goal is: no new write to the partition where data must be recovered. Again, I wouldn't want to risk anymore alterations to the partition/drive where data has to be recovered.

First step in my opinion and work ethic: forensic backup copy, period!


If I had data to recover that's worth the effort, this would be my work setup:
1. forensic copy on two independant backup drives verified by cryptographic hashes to be a 1:1 representation of baseline source drive.
1.1. one forensic copy is never touched and serves as emergency backup in case other forensic copy gets messed up accidently
1.2. no write operations on forensic image copy
2. make work copy on another storage media from forensic image copy
3. try recovery on work copy
4. goto step 2 if other recovery tools need to be used on fresh baseline or work copy gets messed up
(source drive can be returned to owner if needed (for a laptop of owner e.g.) or serves as work drive as long as it is intact and can stay at me)

You forgot to include that if you use the computer or laptop then there's a chance that the file will be lost if it is overwritten with new file. If OP's friend decided to use a software to recover lost files then I won't recommend using the laptop to avoid what I just explained. What decodx posted is what I would do after cloning which there's a chance to recover important files from the hard disk that OP's friend accidentally formatted.

Yes, that's right, I've encountered cases like this with my friends. When the hard disk he owned was accidentally formatted and my friend tried to save data on the hard disk, all the data could not be restored easily.
Instead of trying to see if the hard disk still works by saving a new file on the hard disk, it turns out it can overwrite files that have been formatted. Until now I still can't recover the formatted files.

A few tips for everything possible, when your hard disk is accidentally formatted, don't immediately overwrite it with new files. It's better if you immediately take it to a technician to restore the formatted files.

I once recovered several files that had been deleted from a laptop using a free application, it is possible to recover 60% of the data that has been deleted if you immediately recover it using a file recovery application, but the recovery file will not overwrite files that are still on the laptop unless you restore those files. in the same folder and the file name is also the same, we can determine for ourselves which folder will recover the files. I tried using the window operating system and a file recovery tool application but I don't know on Linux, it's possible that they can recover files using certain coding commands without using the application.

That's only possible when you recover the files right away but if what explanation above about when the files are overwritten by new ones then it is possible that you will no longer be able to recover the files. When a file is deleted it doesn't mean it is deleted because there's a record left that there's a file like that stored in the hard disk until it is replaced (overwritten by new files) which makes it really deleted. As explained, not using the hard disk will keep the record of the files that is stored before in the hard disk before it was formatted then it is possible to recover that's why it's better not to overwrite it with new files.