Data recovery question

Hi guys working on a machine I just did a clean Windows XP install, Only problem is major brain fart moment and the customer had some documents on the machine which they needed backing up before I did the install.

Is all hope lost of is there a program in which I can use to recover these files

Many Thanks Guys

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

ally_uk

Can anyone help? I have tried Pc inspector and recuver but havent been able to recover the documents I am looking for.

Thanks

dynamik

Disk Recovery Software and Hard Drive Recovery tool for Windows

ally_uk

Any free or Open Source alternatives out there?

wheez

ally_uk wrote: »

I have tried Pc inspector and recuver but havent been able to recover the documents I am looking for.

Sorry to say.. but if PC inspector doesn't work, I'm afraid you might be out of luck. That's one of the best freeware recovery tools I've used so far.

As you did an OS reinstall it's likely the sectors that had the customers files on it have been overwritten.

Pash

Hi Ally,

Not sure what type of files you need to recover but you could try and run PhotoRec - CGSecurity under a linux vm with phsyical disk connected via usb or something. I think it runs under windows as well. I have used to before and it will recover many different file types.

But as rhermans said, you might have overwritten the original disk space and that way there is no way to recover

Devilsbane

You can certainly recover those files, but it is a difficult and expensive task. I don't know of any free programs.

tiersten

As you've reformatted the drive, you've lost all of the filesystem metadata. If you just deleted a file and want it back then the chances of finding it again are decent since the tools can inspect the metadata to find out where the free blocks are and ignore existing files. Recovering from a format however won't be easy or quick.

All the recovery software can do is trawl through the entire drive looking for blocks that it thinks are files. It won't always be accurate in determining what a file looks like or how big it is and whether it is all part of one file. If the filesystem was heavily fragmented then don't expect good results. You won't get filenames either since you blew those away when you did the format. You'll end up with thousands of files and you'll need to find the needed ones out of there if they even still exist.

Thats the best case scenario. The worst case scenario is that you lost it when it did the format and no amount of work will get them back.

In theory you can actually recover data from a HD that has been formatted and had everything overwritten a very low number of times. It'd involve dismantling the HD and then use specialised sensor hardware to do an extremely detailed scan of the platter surface. If you don't have a research lab handy with the necessary equipment then don't even bother asking for the price of something like that :P

Pash

tiersten wrote: »

Thats the best case scenario. The worst case scenario is that you lost it when it did the format and no amount of work will get them back.

In theory you can actually recover data from a HD that has been formatted and had everything overwritten a very low number of times. It'd involve dismantling the HD and then use specialised sensor hardware to do an extremely detailed scan of the platter surface. If you don't have a research lab handy with the necessary equipment then don't even bother asking for the price of something like that :P

I have done a silly thing of trying to fix the mbr on an encrypted disk and still gotten files back. As tiersten says, you can put in some serious work and still get your files back. A format is a little different as mentioned above but you might get lucky...

Let us know how you get on....

Pash

tiersten

Pash wrote: »

I have done a silly thing of trying to fix the mbr on an encrypted disk and still gotten files back.

Thats not quite as disasterous as formatting your drive though. The MBR for a regular drive doesn't contain anything particularly unique. I've no idea if your crypto package stored anything special in there though but I doubt it due to the small size of the MBR. If you can recreate the MBR then you'd regain access to the drive. You can't do that for missing metadata

Pash

tiersten wrote: »

Thats not quite as disasterous as formatting your drive though. The MBR for a regular drive doesn't contain anything particularly unique. I've no idea if your crypto package stored anything special in there though but I doubt it due to the small size of the MBR. If you can recreate the MBR then you'd regain access to the drive. You can't do that for missing metadata

Hey I am trying to give people hope here and explain how I have made some wally mistakes previously!

It made the partition tables unreadable in my case. I had to use some paid for recovery application we have at work. Ill double check the name tomorrow. Well £30 is worth files worth many thousands.

tiersten

Pash wrote: »

Hey I am trying to give people hope here and explain how I have made some wally mistakes previously!

Pash wrote: »

It made the partition tables unreadable in my case. I had to use some paid for recovery application we have at work. Ill double check the name tomorrow. Well £30 is worth files worth many thousands.

The sooner we move to GPT the better IMO. The old PC partition tables + MBR aren't capable of handling drives bigger than 2TB which is the current generally available max HD.

I guess the answer comes down to how much are these missing files worth? If they're a couple days work then it might be more worthwhile to just recreate them. Trawling through this drive to find the files won't be quick and you'll end up with thousands of files to inspect and verify. There are no guarantees the files even still exist on the drive or aren't corrupted.

zerglings

GetDataBack is my trusted product.

Pash

We used Get Data Back: Data Recovery, Email Recovery and File Repair Software to recover files for customers previously. Paid for, but worked a treat.

Pash

arwes

I've had varying results with Recuva:

Recuva - Undelete, Unerase, File and Disk Recovery - Free Download

Devilsbane

I ran a data carving tool on a 10GB HDD image for one of my college classes. Because of all of the false positives, the extracted content was something like 30GB in size, and of course had no file names because that was all blown away with the metadata. That could take days/weeks to go through, and still doesn't guarentee that you will have success because the install could have written over those files.

In which case the HDD needs to go to a cleanroom and have an electron microscope examine the platters at a sum of money that could likely buy a house. But if the data is worth it, there are options.

Asif Dasl

Have used GetDataBack successfully, I would recommend it as well.