Wasn't sure where to post this. It's about trying to undo, or partly undo an NTFS file system that has been written over other data.

First the problem. In a state of brain lock, using Comodo Backup, I started a clone operation on an external drive thinking it was a creating an image of my disk. I caught it almost immediately, swearing at my own stupidity but also at the stupidity of an app which would allow a write process that could eradicate data without so much as a warning. Such apps should have a stupid notification asking, "do you really want to write over the data on this disk, stupid?"

Ok, I'm the dummy but I have given a great deal of thought as to how much data I could recover and how to go about it. Recovering the data is not critical but my reversing curiosity sees this as a good way to dig into an NTFS system. Most apps pertinent to data recovery that I have tried see the new NTFS partition, marked as primary, and presume nothing is wrong. I do have an app that goes deeper and recovers files but for some reason it messes them up while marking them as good. It is chopping of the front ends of the files.

I am at the bottom end of an NTFS learning curve but I have worked a fair amount with FAT16 and FAT32 recovery, so I have experience with manually repairing and removing partitions.

What I'd like to do is manually remove the NTFS partition added by Comodo Backup. I don't think it had time to do any real damage other than cutting off a lot of the data on the disk into an extended partition, now marked as free space. I think I'd have more luck if I could remove the partition and let a data recovery app have a look.

I am posting here in an attempt to prevent re-discovering the wheel. I don't mind putting in the time required for the learning curve but a few words from someone with experience on NTFS systems could point me in the right direction.

The question is which app to use. In the old days I would have used Norton recovery disks so I could read sector by sector from cylinder one out.

Since it was doing a clone and only had a few seconds of action before I stopped it, I am theorizing that a lot of my old data is still intact and lying there as lost clusters. However, if Comodo wrote over the original MFT, it could be a real chore to recover the data.

Does anyone know off hand if MFTs can be recreated, either manually or with a recovery app? Is it a good idea to kill the new partition and go from there?