Is it still possible to recover data?

So I got miscommunication with my brother (he ask me to reinstalling windows) because the pc is laggy and buffering on boot. Then, I reset using the windows feature from troubleshoot menu and I decided to delete everything to speed things up, of course i didn’t panic and unplug it but still…

I’m in the middle trying to recover with TestDisk and next I’m gonna try Extundelete

I’m gonna send the news when I already did it

The answer is YES.

Even though you deleted you pendrive and SD Card, lets suppose its porn :sweat_smile: they can be recovered using a particular software…Tried it long times ago, I was shocked​:joy:

Even you format your laptop, your deleted stuffs stays in temporary drive on your laptop/mobile storage

You did the right thing by staying calm and going straight to recovery tools; now the main goal is to avoid further damage and give TestDisk (and anything else) the best chance to find data.​​

What you should do right now

  • Stop using that PC for anything except recovery work (no browsing, no installing big apps, no updates).​​

  • If possible, boot from a USB (Windows PE, Linux live USB, or a recovery disk) and run TestDisk from there so the internal drive is only read, not written.

  • When TestDisk shows recoverable files or partitions, always copy recovered data to a different physical drive (external HDD/SSD/USB), never back to the same disk.

  • extundelete only works on ext3/ext4 (Linux) partitions, so it will only help if that drive previously had a Linux filesystem or you’re recovering a Linux partition from that disk.

  • If you use extundelete, make sure the target partition is unmounted or mounted read‑only before running it, then restore either specific paths or use --restore-all and check the RECOVERED_FILES directory.

About “Reset this PC – Remove everything”

  • That option is designed to wipe personal files and user accounts from the Windows drive, not just reinstall Windows.​​

  • In practice, some or a lot of data can sometimes still be recoverable (it depends on how Windows reset did the cleanup and how much has been written since), which is why tools like TestDisk or commercial recovery tools can sometimes find files after a reset.​

If TestDisk and extundelete don’t find much

If these don’t give you what you need, you still have a few options:

  • Try a dedicated Windows file‑recovery program (EaseUS, Recoverit, etc.) and scan the entire disk deeply from another OS or another machine.​

  • If the data is very important (work, family photos, etc.), consider stopping DIY attempts and taking the drive to a professional data‑recovery service; every extra write or re‑partitioning step can reduce their chances.​

When you share the “news” (what TestDisk found or any screenshots/logs), mention: 1) is it an HDD or SSD, and 2) did you install anything or copy data after the reset,

If you do a “Reset PC” it does not mean that you lose your data and applications installed on your PC!
You have 2 options:
1.Keep my files: Reinstalls Windows but keeps personal files, removes apps and settings.
2.Remove everything: Deletes all personal files, accounts, apps, and settings, providing a clean slate.
Make a copy of the BOOT partition to try to restore deleted data later. There are applications that recover data from disk images.

Steps to Reset Your PC (Windows 11 & 10)

1.Open Settings: Click the Start menu and select the gear icon, or type “Reset” in the search bar.
2.Navigate to Recovery: Go to System > Recovery (Windows 11) or Update & Security > Recovery (Windows 10).
3.Reset Button: Under “Reset this PC,” click Reset PC or “Get Started”.
4.Choose Options:
a.Keep my files: Reinstalls Windows but keeps personal files, removes apps and settings.
b.Remove everything: Deletes all personal files, accounts, apps, and settings, providing a clean slate.
5.Reinstall Method: Select “Local reinstall” (easier) or “Cloud download” (requires internet, ~4GB download).
6.Finalize: Follow the prompts to confirm and start the process, which will restart your computer.

This video demonstrates how to factory reset your Windows 10 or 11 PC:
https://www.youtube.com/watch?v=EoC7frPlh8k&t=2s

Even deleted data can only be restored if you have not actively downloaded or installed new programs, otherwise new programs will replace what you deleted and the data will disappear

Yes, if the data hasn’t been overwritten. You can try free tools like Recuva or more advanced ones like PhotoRec and TestDisk. The main rule is: stop using the drive immediately and don’t install the recovery software on the same partition where the lost data was."

You hit Reset this PC → Remove everything. Feels gone. It usually isn’t.



A file only really dies when every copy of it is gone — cloud, backup, leftovers, and the raw bytes overwritten on disk. Miss one and it comes back. Below is every route to a copy, easiest → hardest. Know nothing or know everything — start at the top, stop when you win.

copy survived? ─▶ image the drive ─▶ data still there? ─▶ recover ─▶ repair
👀 5 times this quietly saves your ass

Same core move every time: chase the copy that survived.

  • :baby_bottle: Relative “sped up” the laptop with a reset — 6 years of baby photos “gone.” Half were in OneDrive the whole time; the rest carved back off the drive.
  • :credit_card: You sold/returned a laptop and “wiped” it — the buyer pulls your tax docs and logins, because a normal reset erases names, not the bytes.
  • :movie_camera: A dashcam/GoPro clip you need won’t play after recovery — one healthy clip from the same camera rebuilds it.
  • :locked: Laptop suddenly demands a 48-digit BitLocker code — that code is sitting in your own Microsoft account, free.
  • :floppy_disk: A backup USB stick reads “0 bytes / needs format” — that’s a 5-minute controller fix, not a dead stick.
🔑 the copy Microsoft stashed in your own account

BitLocker = drive encryption. If it was on and the reset killed the key, the data is scrambled — but Windows auto-saved the unlock key to your MS account at setup. Grab it from any device:
myrecoverykey · account → devices · work/school: aadrecoverykey · where-is-my-key map

Cloud sync you forgot was on (Windows syncs Desktop/Docs/Pics by default for lots of people):
OneDrive → folders, then Recycle bin, then version history (two separate stages) · Google Drive trash · Google Photos trash (60 days) · Dropbox · Mega · iCloud “Recently Deleted”

Found it? Close the tab. Done.

🩹 the Windows.old lie everyone repeats

“Remove everything” does not make a Windows.old folder — that’s the other reset. What it does leave:

  • C:\$SysReset\Logs\setupact.log — proves when + how it ran (ref)
  • ReAgent.xml and sometimes a Lost Files folder = straight recoverable (breakdown)
⚡ touch that drive and you kill it — do this instead

Every boot / download / install overwrites your files. Work from a copy (a bit-for-bit image), recover from that.

Boot read-only (look, can’t touch): CAINE (read-only by default) · SIFT · Tsurugi · Paladin

Clone it: ddrescue (+ GUI, viewer) · dying/clicking drive → OpenSuperClone/HDDSuperClone (skips failing heads) · ddrutility images only the used space · Windows-easy: FTK Imager (free, previews deleted files), Guymager, OSFClone

🔬 5-min check: is your data even down there

Before scanning for days, ask the drive:

  • Healthy or dying? CrystalDiskInfo / smartmontools
  • SATA drive secure-erased? hdparm -I /dev/sdX (ref)
  • NVMe (stick-shaped SSD) actually wiped? nvme-clinvme sanitize-log
  • Dead simple: dd if=/dev/sdX bs=1M count=100 | hexdump -C (or binwalk -E). Zeros = gone. Old junk = recoverable.

:bar_chart: 40%+ of “wiped” SSDs still had files (2023 study). Assume it’s there till the raw read says no.

🧰 pick the right tool or waste a week

Match the tool to what broke:

👻 that 'dead' SSD? don't believe them

“SSD + TRIM = gone” is wrong more than they admit. TRIM = the SSD’s auto-wipe of deleted blocks. But:

  • Pull power fast to beat the cleanup (Rossmann)
  • Many USB-SSD cases don’t pass TRIM through at all → data survives
  • Some drives still hand back old bytes on a raw read (dfir.ru)

Full when-it-works: Forensic Focus · ElcomSoft. Yank power → image via a cheap adapter → run the raw-read check.

🔧 recovered but won't open? the fix nobody posts

Carved files come out broken — the index (the part saying “here’s every frame”) got left behind.

  • untrunc — rebuilds a busted MP4/MOV from a healthy clip off the same camera (GoPro, DJI, phone)
  • JpegDigger — greyed/broken JPEGs
  • ffmpeg — re-wrap partial media, save the segments that survived
🖼️ even a nuked drive leaves photo ghosts

Windows keeps preview copies of every photo you ever viewed:

  • Thumbcache Viewer — pulls them (the 1024px ones = a usable copy) · grab all “file existed” traces: KAPE
  • Had System Restore / shadow copies (or a 2nd drive that wasn’t reset)? Full snapshots → ShadowExplorer (browse + export) · libvshadow from an image
💾 backup stick won't mount? different game

Dead / 0-byte / write-protected USB = controller problem, not files.
ChipGenius reads the chip ID → flashboot iFlash hands you the exact repair tool → deeper repo usbdev.ru

:warning: That repair does a low-level format — it wipes the stick. It revives the device, not your data. For the data: image it first, or send it for chip-off.

🎯 yank the exact stuff you lost
  • Browser passwords/history: NirSoft + DB Browser for SQLite opens recovered Chrome/Firefox databases
  • Outlook mail: scanpst.exe (already on your PC) repairs a recovered .pst/.ost
  • Code repo: recover the .git folder, then git reflog / git fsck brings back “lost” commits
  • Crypto wallet: carve the wallet.dat, then btcrecover if the password/seed is half-remembered
  • BitLocker image + key: dislocker mounts it on Linux, copy files out
☠️ when no software saves you

Physically dead (clicking, not spinning)? Lab territory:

  • HDDGuru forums (firmware/chip-level crowd) · PC-3000 / DeepSpar · chip-off for dead SSDs
  • The honest ceiling: NIST 800-88 — exactly when data is truly unrecoverable (verified overwrite, crypto-erase). Hit that wall → only a surviving copy saves you (back to top)

Top to bottom, stop when you win: cloud copy → image → confirm bytes exist → recover → repair. That’s the whole game.

Deleted just means forgotten. Overwritten means gone. Everything before that is still yours to take. :floppy_disk: