Recovering Files - little different scenario this time...

Posted by redthil On 12/04/2009 12:34:00 AM

Today i was facing a new type of scenario, where my friend has lost all the data and files, which was a collection of past three years. yes.. you read it right... all the efforts and documents collected over the period of three years. When it comes to data, just like wine, the older it is, the golden it is. But whatever it is, how many years it is, all data are just data, combinations of binaries stored somewhere. Most of us, when a file gets deleted accidentally or unintentionally, we just try to live with missing it forever, than trying to find a way to recover. Even if we think otherwise, there are lot of File/Data Recovery Softwares available now. And with those, you just do recover the files, just like that.
But consider the following scenario:
> You've Win2000 installed in your machine
> You wanted to upgrade to WinXP (or Vista, etc). So, you asked someone (A Computer Administrator / Support Engineer from the Software/Hardware Provider) to install WinXP
> He just comes and installs WinXP and leaves. (everything is good till now..)
> When you login to your system, you find your D Drive "EMPTY"!!!!!!!!!!!! (What!!!!)

All the files and folders inside the D Drive is gone now. He does not have to touch D Drive, at any cause. But, he did choose to format and partition D Drive also, and the innocent OS Installer, obeyed the master and formatted D Drive. The entire drive is gone, adding to that, you have a completely different OS Version on your machine now.

I faced this challenge today, from one of my friend. And my friend was so much concerned, as there was no backup taken ever, and decided to write these files to DVDs just yesterday, and this tragedy happened today. My friend called me immediately, hence i could tell her few very little , but very very very important, things to follow, in order to , atleast try recovering files.
"Try!!!!!"
"is there any way to do that????"
well... i'm now typing these lines, as the files are getting recovered and copied to another drive, with the exact folder structure as it was.
coming to the precautions.. (here, i'm referring to the things to take care, after this tragedy happened and for successful recover of files)... also these are the constraints, for recovering the files/data successfully...
> Make sure that no files/activity is done involving the formatted Drive. Any new files copied to that drive, will overwrite the previously formatted files, resulting in unsuccessful recovery of those files infected by these new files.
> thats it.. no other constraint. i would actually give more stress on the previous point.

Once the above constraint is met, you just need an extra storage space, to store/copy the required formatted files. I would suggest an External HDD, with atleast twice (just in case) the space required to backup the data.

Just download a command-line utility called TestDisk. (i know, you're waiting for this s/w or utility name to be mentioned...). Its completely an Open-Source Software with GPL. This is not just for File/Data Recovery, it does magic and wonders, plays very well with your storage and partitions. It really an awesome tool and has features for both novices and experts. Let me give you a short intro about this Magician called TestDisk:

Whats TestDisk?
TestDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.


What can it do?
Fix partition table, recover deleted partition
Recover FAT32 boot sector from its backup
Rebuild FAT12/FAT16/FAT32 boot sector
Fix FAT tables
Rebuild NTFS boot sector
Recover NTFS boot sector from its backup
Fix MFT using MFT mirror
Locate ext2/ext3 Backup SuperBlock
Undelete files from FAT, NTFS and ext2 filesystem
Copy files from deleted FAT, NTFS and ext2/ext3 partitions.

What OS is required for this?
DOS (either real or in a Windows 9x DOS-box),
Windows (NT4, 2000, XP, 2003, Vista),
Linux,
FreeBSD, NetBSD, OpenBSD,
SunOS and
MacOS

What File Sytems it can be used on?


BeFS ( BeOS )
BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
CramFS, Compressed File System
DOS/Windows FAT12, FAT16 and FAT32
Windows exFAT
HFS, HFS+ and HFSX, Hierarchical File System
JFS, IBM's Journaled File System
Linux ext2 and ext3
Linux LUKS encrypted partition
Linux RAID md 0.9/1.0/1.1/1.2
   > RAID 1: mirroring
   > RAID 4: striped array with parity device
   > RAID 5: striped array with distributed parity information
   > RAID 6: striped array with distributed dual redundancy information
Linux Swap (versions 1 and 2)
LVM and LVM2, Linux Logical Volume Manager
Mac partition map
Novell Storage Services NSS
NTFS ( Windows NT/2000/XP/2003/Vista/2008 )
ReiserFS 3.5, 3.6 and 4
Sun Solaris i386 disklabel
Unix File System UFS and UFS2 (Sun/BSD/...)
XFS, SGI's Journaled File System


    Actually, this is the second time i'm using this software. First time, my C Drive got corrupted (because of the security feature in Vista), and while trying to format C Drive, since my D Drive was the extended partition of C Drive (all Dell Laptops comes with this kind of configuration, when you ask for separate D Drive), D Drive also got formatted. My situation then was far worse than what happened to my friend now. That time, i had a laptop, with nothing in it, no OS, no partitions, nothing. just a blank 60K worth piece, having lost my 250GB of files. Even to run this software, i need something.
    so, this is what i did then, 
    > download this software in my External HDD
    > insert bootable OS CD
    > go to the command prompt option, while booting
    > invoke this TestDisk Utility
    > Try to partition the corrupted partitions, and caz of the security feature in Vista, it wont allow to partition/format few areas in HDD (reserved for the system safety)
    > No luck with partitioning and couldnt write MBR, hence switched to Recover Mode and recovered all my 250GB of data.


    so, next time, use this tool, but take utmost care while using. A Very big warning from me, on handling this software, and misuse, would make you to throw your computer to trash.

    3 comments

    1. Vijesh Said,

      Informative and book marked.

      Posted on Friday, December 04, 2009 11:33:00 PM

       
    2. Unknown Said,

      Senthil.... naan othukkarean! Unakku konjam arivu irukkunu ;) hehehehe... kidding!!! Useful info yaar...

      Posted on Sunday, December 06, 2009 11:19:00 PM

       
    3. redthil Said,

      @Vijesh : thank u.. :) and atb..

      @Priya : thanks for the certificate priya... eppo'laernthu certification company aarambicha??? anyways, thanks priya.. :)

      Posted on Monday, December 07, 2009 7:00:00 AM

       
    My Photo
    redthil
    Some people go to priests; others to poetry; I to my friends.
    View my complete profile

    Labels