Data recovery question

ally_ukally_uk Member Posts: 1,145 ■■■■□□□□□□
Hi guys working on a machine I just did a clean Windows XP install, Only problem is major brain fart moment and the customer had some documents on the machine which they needed backing up before I did the install.

Is all hope lost of is there a program in which I can use to recover these files

Many Thanks Guys
Microsoft's strategy to conquer the I.T industry

" Embrace, evolve, extinguish "

Comments

  • ally_ukally_uk Member Posts: 1,145 ■■■■□□□□□□
    Can anyone help? I have tried Pc inspector and recuver but havent been able to recover the documents I am looking for.

    Thanks
    Microsoft's strategy to conquer the I.T industry

    " Embrace, evolve, extinguish "
  • ally_ukally_uk Member Posts: 1,145 ■■■■□□□□□□
    Any free or Open Source alternatives out there?
    Microsoft's strategy to conquer the I.T industry

    " Embrace, evolve, extinguish "
  • wheezwheez Member Posts: 74 ■■□□□□□□□□
    ally_uk wrote: »
    I have tried Pc inspector and recuver but havent been able to recover the documents I am looking for.
    Sorry to say.. but if PC inspector doesn't work, I'm afraid you might be out of luck. That's one of the best freeware recovery tools I've used so far.

    As you did an OS reinstall it's likely the sectors that had the customers files on it have been overwritten.
    WIP: Considering cert path.. :-)
  • PashPash Member Posts: 1,600 ■■■■■□□□□□
    Hi Ally,

    Not sure what type of files you need to recover but you could try and run PhotoRec - CGSecurity under a linux vm with phsyical disk connected via usb or something. I think it runs under windows as well. I have used to before and it will recover many different file types.

    But as rhermans said, you might have overwritten the original disk space and that way there is no way to recover icon_sad.gif.
    DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
  • DevilsbaneDevilsbane Member Posts: 4,214 ■■■■■■■■□□
    You can certainly recover those files, but it is a difficult and expensive task. I don't know of any free programs.
    Decide what to be and go be it.
  • tierstentiersten Member Posts: 4,505
    As you've reformatted the drive, you've lost all of the filesystem metadata. If you just deleted a file and want it back then the chances of finding it again are decent since the tools can inspect the metadata to find out where the free blocks are and ignore existing files. Recovering from a format however won't be easy or quick.

    All the recovery software can do is trawl through the entire drive looking for blocks that it thinks are files. It won't always be accurate in determining what a file looks like or how big it is and whether it is all part of one file. If the filesystem was heavily fragmented then don't expect good results. You won't get filenames either since you blew those away when you did the format. You'll end up with thousands of files and you'll need to find the needed ones out of there if they even still exist.

    Thats the best case scenario. The worst case scenario is that you lost it when it did the format and no amount of work will get them back.

    In theory you can actually recover data from a HD that has been formatted and had everything overwritten a very low number of times. It'd involve dismantling the HD and then use specialised sensor hardware to do an extremely detailed scan of the platter surface. If you don't have a research lab handy with the necessary equipment then don't even bother asking for the price of something like that :P
  • PashPash Member Posts: 1,600 ■■■■■□□□□□
    tiersten wrote: »

    Thats the best case scenario. The worst case scenario is that you lost it when it did the format and no amount of work will get them back.

    In theory you can actually recover data from a HD that has been formatted and had everything overwritten a very low number of times. It'd involve dismantling the HD and then use specialised sensor hardware to do an extremely detailed scan of the platter surface. If you don't have a research lab handy with the necessary equipment then don't even bother asking for the price of something like that :P

    I have done a silly thing of trying to fix the mbr on an encrypted disk and still gotten files back. As tiersten says, you can put in some serious work and still get your files back. A format is a little different as mentioned above but you might get lucky...

    Let us know how you get on....

    Pash
    DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
  • tierstentiersten Member Posts: 4,505
    Pash wrote: »
    I have done a silly thing of trying to fix the mbr on an encrypted disk and still gotten files back.
    Thats not quite as disasterous as formatting your drive though. The MBR for a regular drive doesn't contain anything particularly unique. I've no idea if your crypto package stored anything special in there though but I doubt it due to the small size of the MBR. If you can recreate the MBR then you'd regain access to the drive. You can't do that for missing metadata :)
  • PashPash Member Posts: 1,600 ■■■■■□□□□□
    tiersten wrote: »
    Thats not quite as disasterous as formatting your drive though. The MBR for a regular drive doesn't contain anything particularly unique. I've no idea if your crypto package stored anything special in there though but I doubt it due to the small size of the MBR. If you can recreate the MBR then you'd regain access to the drive. You can't do that for missing metadata :)

    Hey I am trying to give people hope here and explain how I have made some wally mistakes previously! :D

    It made the partition tables unreadable in my case. I had to use some paid for recovery application we have at work. Ill double check the name tomorrow. Well £30 is worth files worth many thousands.
    DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
  • tierstentiersten Member Posts: 4,505
    Pash wrote: »
    Hey I am trying to give people hope here and explain how I have made some wally mistakes previously! :D
    :)
    Pash wrote: »
    It made the partition tables unreadable in my case. I had to use some paid for recovery application we have at work. Ill double check the name tomorrow. Well £30 is worth files worth many thousands.
    The sooner we move to GPT the better IMO. The old PC partition tables + MBR aren't capable of handling drives bigger than 2TB which is the current generally available max HD.

    I guess the answer comes down to how much are these missing files worth? If they're a couple days work then it might be more worthwhile to just recreate them. Trawling through this drive to find the files won't be quick and you'll end up with thousands of files to inspect and verify. There are no guarantees the files even still exist on the drive or aren't corrupted.
  • zerglingszerglings Member Posts: 295 ■■■□□□□□□□
    GetDataBack is my trusted product.
    :study: Life+
  • PashPash Member Posts: 1,600 ■■■■■□□□□□
    We used Get Data Back: Data Recovery, Email Recovery and File Repair Software to recover files for customers previously. Paid for, but worked a treat.

    Pash
    DevOps Engineer and Security Champion. https://blog.pash.by - I am trying to find my writing style, so please bear with me.
  • arwesarwes Member Posts: 633 ■■■□□□□□□□
    [size=-2]Started WGU - BS IT:NDM on 1/1/13, finished 12/31/14
    Working on: Waiting on the mailman to bring me a diploma
    What's left: Graduation![/size]
  • DevilsbaneDevilsbane Member Posts: 4,214 ■■■■■■■■□□
    I ran a data carving tool on a 10GB HDD image for one of my college classes. Because of all of the false positives, the extracted content was something like 30GB in size, and of course had no file names because that was all blown away with the metadata. That could take days/weeks to go through, and still doesn't guarentee that you will have success because the install could have written over those files.

    In which case the HDD needs to go to a cleanroom and have an electron microscope examine the platters at a sum of money that could likely buy a house. But if the data is worth it, there are options.
    Decide what to be and go be it.
Sign In or Register to comment.