How lost is my lost data?

[NewC]

So... I was having many problems with my laptop (many BSODs) and when it lost it's start button and task bar I'd had enough...

I got the local computer 'whizz' (youknow, my sister's friend's brother) to take a look at it, and before I knew it he'd recovered my system (by using the recovery console in safemode to get the origional recovery system, apparently) and returned it to the state it was in when I purchased it... which was fine, but it a)hasn't reduced the number of BSODs I'm seeing (although it has returned my start button) and b)has meant ~20G of my UNBACKED-UP data has been lost.

After system recovery I still have all the programs that came preinstalled, but MyDocs etc is empty Mr computer whizz seemed to think that nothing would have been lost, or that it would be stored elsewhere - but I can't find it.

I've been doing some fiddling (I know this is bad because I am probably writing over my old data - but what else can I do?!): Disk Manager says I currently have 3 partitions called C,D and RECOVERY. C has the usual stuff in, D is empty and mr computer whizz thought it would be a good idea to delete it and RECOVERY is 'Unknown' so I can't see what's in it.

I know I have many problems at the moment, but the one I would like help with is the recovery of my data... Is there some software that can help me out? Or is it forever lost? Why is my hard drive split into C and D partitions, can I combine them? What is the RECOVERY partition? Could some of my data be in there?! How can I look inside it???

[Railman5]

coupla things first.

what operating system u using.

do you recall having a d drive before as it sounds like this is new to you.

dont whatever you do delete that d drive until U R SURE its empty.

bit more info will help the guys to help U

Welcome to the mistical world of MSFN in all its technicolour glory.

[SmaugyGrrr]

I don't, off hand, know of freeware to do this, but there probably is some.

First, go back to your local "computer whizz" and give him three good slaps to the face. US Federal law was recently enacted that has made it completely legal to do this to local computer whizzes who do not back up data before doing something so drastic as a full system reload.

Next, find someone else (or use the same computer whizz if you're feeling adventurous!) and run Zero Assumption Recovery ( http://www.z-a-recovery.com/info_zar32.htm ) on the drive. Obviously, this should be done while it is in an external enclosure.

The evaluation version of ZAR should be able to tell you which, if any, of your files are recoverable. ZAR can, apparently, recover up to four directories in freeware mode. Although you may be able to run ZAR on your PC yourself, this is not recommended - you would need another drive (maybe a USB thumb drive) to save recovered files to. ZAR should be run on another PC with the drive in an external enclosure.

Other people might have their own undelete program recommendations.

[NewC]

Thanks for both the speedy replies!

I'm running Windows XP Pro.

Yes the D drive has always been in existance - empty - and I have always been puzzled by it.

The computer whizz already deleted the D partition I think. Disk Manager has its name (D), size and healthy status, but it has no file system and cannot be explored.

SmaugyGrrr - what do you mean by an 'external enclosure'? You mean run ZAR from an external hard drive, or clone the whole drive on to an external hard drive then run ZAR?

I have both an external hard drive and another computer if they're needed...

(Yup you guessed it - I'm going to try doing this myself... If I mess up I mess up, hopefully I will learn something on the way!

- on my way to becoming a (real) computer whizz! Oh yeah! -

[jaclaz]

OK, first thing, SWITCH OFF that laptop and DO NOT switch it on again, every boot you make, any fiddling you make, anything you make on that hard disk lowers the possibility and amount of recovery.

You need ANOTHER (desktop) PC and a IDE 2.5" to 3.5" adapter.

Take the hard disk off the laptop and mount it to the desktop PC through the adapter as "slave".

Make an image of the laptop HD AS IS saving it on the desktop PC hard disk, it is better if you make TWO such images.

The image(s) must be made with a byte-by-byte or sector-by-sector imaging utility, some are listed here:

http://www.msfn.org/board/index.php?showtopic=100299

Now try one of several data recovery utilities against the laptop hard disk.

A list is here:

http://www.msfn.org/board/index.php?showtopic=97759&hl=

http://www.msfn.org/board/index.php?showtopic=84345&hl=

Saving each time whatever has been recovered to the desktop hard disk.

Once you have done with an utility, if you are not satisfied by results, restore the image to the laptop hard disk and start anew with another utility.

Depending on the value you attribute to the data, you might want to contact a professional service, rates can go from "flat rates" of a few hundred dollars to several thousands, but all companies will give you for free or for a very small fee an exact estimate or you will be spending for the recovery.

Next time, ask here for opinions/suggestions BEFORE resorting to your "the local computer 'whizz'" (unless he is really is a 'whizz', of course ).

jaclaz

[NewC]

Thanks for all the help everyone I manged to image my hard drive using SelfImage (nice and simple user interface), then I used Zar with partial success - recovered about half my data, and a LOT of other random stuff.

Not bad for a novice, but there are a few things that are still bothering me:

1) I have an 80G hard drive but Zar claimed to be able to recover over 500G of stuff... how is that possible??

2) The documents I want to retrieve are mixed up with a lot of stuff I'm not interested in keeping... and ideas on how to sort the good from the bad? I just have hundreds of folders and files with helpful names like 'DIR0230' and 'FRG05839'... The best way I've found so far is to search by file type.

3) There is one word doc in particular I was hoping to recover, and I have retrieved several files with the same name(see attatched for part of one), but when opened in MS Word they are goble-de-goock! Is there anyway I can fix stuff like this?

goble.rtf

[Brando569]

ive had similar problems with recovery programs. stuff started to randomly disappear on my hdd so i ran a recovery program and after it was finished i was left with those helpful names also, and none of the files worked. pictures taken with a camera turned into clipart pics, exes and rars were useless/corrupted, etc... then later i was searching the directories of the HDDs (three at that time) and noticed that all of my stuff had been fully recovered and in working order but in a completely different location then where i told it to recover to! (ex. damaged drive was d, i told it to recover to c and the files ended up on e) figure that one out

[jaclaz]

The problem might be in Zar itself.

I mean the idea of Zero Assumption Recovery "implies" that everything, even remotely similar to a file of some kind is recovered.

This means that several fragments of the same file can be recovered, including those overlapping with other files.

Given the amount of fragmentation, moved files, renamed or updated files on a hard disk that has not been (possibly) defragged/optimized previously, it does not surprise me that a x6 factor comes out.

Now, telling what is good from what is not is a hard work.

This is why I suggested using more than a single app for attempting the recovery, as each app has a different "logic", it is possible that a certain app succeeds where another failed, I found this particularly true with different filesystems.

The .rtf file fragment you posted, specifically, appears to be part of a Word document with embedded equations, as a rule of thumb files with embedded objects tend to be harder to be fully recovered (the text is usually recovered allright, but embedded objects are trickier).

If I were you, before trying to rebuild from the files you already recovered, I would have a couple of tries with other utilities, first one I would try would be PHOTOREC:

http://www.cgsecurity.org/wiki/PhotoRec

If it does not work, if the filesystem was NTFS, your best bet is File Scavenger (COMMERCIAL):

http://quetek.com/prod02.htm

or Scroungge NTFS (Freeware):

http://memberwebs.com/stef/software/scrounge/

Next again it should be some filetype specific app, like this one (COMMERCIAL - untested by me):

http://www.tech-pro.net/doc-regenerator.html

jaclaz