Can I recover a partition after using Norton Ghost?

[ahmad2080]

Hello....

My problem is with Norton Ghost....

A friend of mine has troubles with his laptop which makes him install a new OS (and all of his hardware drivers) every week. However, I told him to use Norton Ghost to save time and effort. So he took an image from his C partition. When he needed to restore his C image, he mistake and chose " Restore whole disk" instead of "restore partition".

So he used the image of his C partition and copied it on his whole disk......

Now of course his D partition (which contains all of his imp. data) disappeared...and he is asking if there is a way to recover his data....or if recovering data is impossible after using Norton Ghost.????

Thanks in advance....

_________________

[DigeratiPrime]

It doesn't sound like Ghost overwrote any of the data where the D partition was so it might be possible to recover from those sectors.

Try Recuva (freeware)

http://www.piriform.com/recuva

[edit] After installing cancel out of the wizard, open Options, then Actions, check both: "Deep Scan" and "Scan for non-deleted files"; scan All Drives.

[jaclaz]

And before that I would try TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

there are chances that the second Volume (partition) is completely intact, particularly if it was a Logical Volume inside Extended, which would give a further 63 sectors of gap between C:\ and D:\

Translation:

Recuva, like PHOTOREC is a file oriented recovery app, TESTDISK is partition oriented.

jaclaz

[ahmad2080]

Thanks for your replies...

First I've tried TESTDISK ... The first search found the C partition only. Then the "Deeper Search" found the following:

Here are the Pics:

This is what's in The first volume:

This is what's in The second volume:

This is what's in The third volume that we need to recover:

After pressing ENTER it says:

TESTDISK found the D partition (Magdy volume) but didn't find all of the folders in it (Only the Gamez folder was found).

NOTE: The size of the hard disk is 120 GB.....After using Norton Ghost total space became 111 GB !!!!!

About Recuva...It's still in progress.....I'll post the results as soon as it finishes..

EDIT: After Recuva finished, It found SOME files that were in the D partition but indicates it's path as C:\?\

Should I proceed and recover those files? Or it's possible to recover the whole partition?

Edited September 23, 2009 by ahmad2080

[jaclaz]

Translation of Testdisk screenshots (apparently)

Before "overghosting" there was:

• a partition on cylinders 0÷2609, sectors 41,929,587x512=21,467,948,544 bytes (around 20 Gb)
  
• a partition on cylinders 2610÷14592, sectors 192,506,832x512=98,563,497,984 (around 100 Gb)
  

The image was "superimposed" spanning the whole disk, thus creating a new partition:

• a partition on cylinders 0÷1492, sectors 234,436,482x512=120,031,478,784 (around 120 Gb)
  

The "old" partitioning info was not overwritten, but it is possible that other filesystem structure partially were.

Yes, file oriented data recovery is needed at this point, depending on the fragmentation grade of the old partitioning (and size of the single files), results may vary from very good to very poor.

jaclaz

[ahmad2080]

Yes, he had two partitions: 100GB and 20 GB....

However, I just wanted to ask:

Can other file oriented recovery applications find what Recuva couldn't?? Or they all are the same??

[jaclaz]

Or they all are the same??

No, they are NOT the same.

As said, among the Freeware ones, PHOTOREC:

http://www.cgsecurity.org/wiki/PhotoRec

is worth a shot, as well as

http://www.pcinspector.de/Sites/file_recov....htm?language=1

Or the NTFS specific ScroungeNTFS:

http://memberwebs.com/stef/software/scrounge/

Among the Commercial ones the one that I found most effective are/were:

TiramiSU (old, not anymore available, it was bought by OnTrack)

NTFS File Scavenger:;

http://www.quetek.com/prod02.htm

But really there is no way one can say "app x will work where app y failed".

If the data has been overwritten there are NO chances, no matter what program you use.

If the data has NOT been overwritten, but was fragmented before, different programs may give you different results.

Read this, where more programs are listed and a possible (please read "right" ) approach to the problem is summed up:

http://www.msfn.org/board/data-recovery-to...45.html&hl=

jaclaz

Edited September 24, 2009 by jaclaz

[DigeratiPrime]

You shouldn't be using the hard drive you are attempting to recover from. You should be working on it 'offline' since any time you write to that disc there is a chance you are overwriting the sectors you are trying to recover from.

[ahmad2080]

Am, what do you mean by offline?

Do you mean attach the hard drive (slave) to another one (master)??

Unfortunately, the hard drive that we want to recover data from is a notebook's drive.....and we don't want to get our hands dirty doing a surgery in the notebook's organs "Never tried that before"

I think he's satisfied with what has been recovered since he didn't call me...

However, thanks for your support.....Your info WILL help me in similar situations...

Thanks DigeratiPrime & jaclaz ......... You just can't stop solving my software problems

[Ponch]

Yes, working on the one hard drive increases the odds of overwriting the data you want to recover with

-any programs you install for that purpose

-any file your OS is creating/moving in the mean time (temp files and others)

-already recovered data (though here that would be by a very badly designed recovery program)

Unfortunately, the hard drive that we want to recover data from is a notebook's drive.....and we don't want to get our hands dirty doing a surgery in the notebook's organs "Never tried that before"

In which case this could help you a next time. Boot a (heavily modded) VistaPE that contains free recovery softwares, from CD and save your data to a USB drive. You could also go one step further and run the PE from USB but that's an other story.

[DigeratiPrime]

No problem ahmad2080

As Ponch mentioned a VistaPE aka WinPE 2 boot disc is a good solution since everything will run off the disc and the the hard disk can be mounted as read only. You can also load PE into a ramdisk and eject the disc which makes everything very fast and allows you to burn discs within PE.

Another solution is to eject the laptop 2.5" HDD and connect it via a IDE/USB/SATA adapter.

http://www.newegg.com/Product/Product.aspx...N82E16812232002

[jaclaz]

Well, NO.

If we are talking about "attempting to recovery data and who cares if it fails", it's allright.

Otherwise, if the scope is "attempting to recovery data and be able to do further attempts", the "right" approach is in the already linked to post:

http://www.msfn.org/board/data-recovery-to...45.html&hl=

Rules are as follows, as I see it:

1) ALWAYS make a bit by bit copy of the damaged media, if possible, make TWO of them

2) Run against the image EVERY single piece of software you can think of, starting with a program you know and trust, but do NOT overlook "minor" ones or "narrow" ones, i.e. those aimed to recovery just a certain type of file or a certain type of damage

3) Given the low cost of todays hardware, NEVER attempt repair on original media, only do it AFTER recovery was succesful on the copy, what you were not able to do might be possible

4) Do not EVER give up, I was able to recover data that "so-called" professionals had determined to be an impossible recovery, simply by using a different tool or making some minor manual corrections.

5) TELL the customer that recovery has MANY levels of accuracy and corresponding many levels of time involved and cost, explain him that even if a quick scan determined that no recovery was possible, a deeper analisys may give some results, data recovery if not successful with "easy - press one button and go" tools, manual recover is often possible, and in some cases even partial data can be of great help, all in all is a matter of the VALUE the customer attributes to lost data

jaclaz

Edited September 27, 2009 by jaclaz

[Ponch]

His problem is solved and we are only adding extra info. Nothing's wrong with that. It's not like we are telling him to re do it all an other way.

[jaclaz]

His problem is solved and we are only adding extra info. Nothing's wrong with that. It's not like we are telling him to re do it all an other way.

Sure nothing is wrong , but since this thread will be read by a number of people that might want to know how it should be done BEFORE actually doing it, I find advisable to post HOW it should be done to be on the SAFE sife, (as opposed to "better than" or "good enough").

The whole point is that the target (or audience) is most probably made of inexperienced users (the experienced ones won't come here to learn what they already know ), it is at least possible than an unexperienced user:

• won't be able to build a proper PE with all the tools
  
• will do somethng "wrong" compromising the data or filesystem to be recovered
  

Having a dd copy of the thingy and working on the copy assures that if anything wrong is done (or a lightning strikes ) there is a possibility of trying again with another tool or another approach.

Just another post of the "better be safe than sorry" series.

jaclaz