Recover vhd files from quick-formatted disk

[eigenVector]

I've got a set of VHD and VHDX files on a couple of hard drives that have been re-formatted using the NTFS quick format option.  Enabling deep-scan seems to be able to identify many of the files that were inside of those VHD's but most files only offer partital restore. Is it possible for recuva to identify and restore the VHD files themselves as a whole image? 

[Augeas]

If a vhd file is larger than 4 gb then a deep scan is the only way to find the data clusters. However a vhd file is likely to be quite large and quite possibly fragmented. A scan of the clusters (looking for a file signature) will find the first fragment only as subsequent fragments don't have file signatures. It's not easy to find and reconstruct a fragmented file.

 

A deep scan might find the file contained inside the vhd container, I don't know. Whether this is any use I don't know either.

[eigenVector]

If a vhd file is larger than 4 gb then a deep scan is the only way to find the data clusters. However a vhd file is likely to be quite large and quite possibly fragmented. A scan of the clusters (looking for a file signature) will find the first fragment only as subsequent fragments don't have file signatures. It's not easy to find and reconstruct a fragmented file.

 

A deep scan might find the file contained inside the vhd container, I don't know. Whether this is any use I don't know either.

 

Thanks Augeas,

 

Yes, most of these VHD's are quite large (more than 4GB in size).  After performing a deep scan, the VHD's I was looking for do not show up in the list, however I do see one particular vhd in the list 14 times that has a GUID as a file name (which to me might be a Windows System Image backup file) and whose last modified date reports as a date one week apart at 8pm on friday (where my computer ran scheduled  backups.)

Since these backups were taken on a large 2TB volume and not much day-to-day activity occur on it, I would imagine the fragmentation to be very small (if any).  Each of these vhd files are 12,354,554KB in size and have an identical header, and recuva reports them as "No overwritten clusters detected"

https://onedrive.live.com/redir?resid=E44B1A21ABC4F5A8!44580&authkey=!AIxsoWRtYHHlVLc&v=3&ithint=photo%2cpng

 

When I select any of these vhd files and restore them to another drive, recuva reports back progress indication that never reaches 100%, after about 6% complete it report it is finished recovering the file successfully. 

https://onedrive.live.com/redir?resid=E44B1A21ABC4F5A8!44579&authkey=!AIS81RMvGn78enY&v=3&ithint=photo%2cpng

 

However on the device where the vhd files were restored to, the sizes of the restored vhd files are much smaller..

https://onedrive.live.com/redir?resid=E44B1A21ABC4F5A8!44582&authkey=!AFhjZnganYe5LNM&v=3&ithint=photo%2cpng

 

Attempting to attach the restored files in Disk Management fails with the file being corrupt:

https://onedrive.live.com/redir?resid=E44B1A21ABC4F5A8!44581&authkey=!AMjAt_jDyrOGI84&v=3&ithint=photo%2cpng

 

 

Assuming the issue is with recuva 'stopping' the restore operation at 6% in and incorrectly reporting as complete, is there anyway to force the restore of the whole 12GB worth of vhd file?

 

I think the underlying confusion is the nested vhd's involved here.

 

I have a 2TB physical drive that I had about 8 different VHD's on.  One of those VHD's was a "DesktopBackups.vhd" which pre-allocated to about 64GB or 128GB in size (don't recall the exact size.)  This DesktopBackups.vhd file was mounted to my desktop for scheduled backups to write to which upon that VHD the system image vhd's were written to.  

 

 

My situation is that I accidentally formatted the 2TB physical drive and performed a windows quick format on this drive, and would like to recover the 8 different VHD's on the drive itself (or if possible restore the original partitions/MFT, but not sure if this is possible.)

[SUKEN]

Hi Piriform, 

 

BIG fan of PiriForm until RECUVA, ....purchased today for a recovery project!

 

I have several VHDx files and others from a HYPER-V server from Microsoft that were accidentally erase yesterday, I see the files in RECUVA with the exact size of original but its RED and cannot be recovered, very disappointing that after I bought the product that states recovery of VHD files, it cannot recover!!  

 

What's the solution??   

 

Appreciate your input

 

thnx, rgds from Australia

[hazelnut]

Don't forget that as you purchased Recuva you are entitled to support direct from Piriform as well as on forum here..

 

https://piriform.zendesk.com/hc/en-us/requests/new