PDA

View Full Version : Data Recovery


Morrison5891
09-13-2009, 02:54 AM
How is it possible for data recover software not to find ANY files? I've run 5 different data recovery programs on a hdd and its finding NOTHING at all. Am I missing something? Can someone please help!?

MrUnknown
09-13-2009, 02:58 AM
very, very very bad corruption.

hard drive was wiped before you got to it.

what kinds of files are you trying to recover and in what manner? (slave, bootdisk, etc)

Morrison5891
09-13-2009, 03:00 AM
Trying to recover photos only. Its a laptop hdd. I have it connected to my machine via a use adapter.

I've tried using Getdataback, O&O Diskrecovery and a few other programs. I've tried a format recover and i've tried searching for files

Morrison5891
09-13-2009, 03:34 AM
I've tried everything... None of the software i've tried has recovered any files. I find that kinda weird... shouldn't it at least find something? There are no errors on the disk. I've even tried Spinrite and still nothing! Yes, i've tried Recuva

NYJimbo
09-13-2009, 03:39 AM
Get any program that will display the sectors on the drive and scroll through some of it. If you find patterns of fill then you can pretty much assume the drive is wiped.

Morrison5891
09-13-2009, 03:49 AM
Even if the drive has been "wiped" There still has to be a way to recover the pics. If the partition was deleted and a new one created... can you recover that?

computergeek1
09-13-2009, 04:07 AM
Have you tried photorec.

Kenhelms
09-13-2009, 04:08 AM
Hook it up to a disk diag program that will read the smart status, check and see how many hours the drive has on it.

there may be circumstances that the client hasnt made you aware about and its possible that it is a truly blank hard drive(as in new).

If secure wiping software was used, and not just the standard freeware wipes...your only bet would be electron microscope recovery. which is in the 50k+ range.

I would suggest trying R studio which is very good at raw recovery. Ontrack is as well. you are working from a sector image and not the actual drive right? If you have tried 5 different softwares without write block hardware inplace, you may be causing more corruption to the files you wish to recover.

Edit(just saw a couple of posts came in while I was typing)- yes you can recover if a partition table was deleted. Contrary to popular NCIS/CSI tv shows though...there are sometimes when data just cant be recovered, so you never want to guarantee that you can recover data.

Morrison5891
09-13-2009, 04:11 AM
Just finished scanning with that. Still nothing!

Kenhelms
09-13-2009, 04:37 AM
Just finished scanning with that. Still nothing!

did you check to see if the drive is even used?

It would also help to know why recovery is needed in the first place.

When you said "any files" do you mean any period, or any photos. did it recover any garbage files at all? was the computer running any kind of encryption?

If it was a sparse encryption you wouldnt be able to see the files without some specialized procedures

MrUnknown
09-13-2009, 04:44 AM
if a drive was even remotely properly wiped, software can not recover anything. even a basic wipe of making everything 0 will remove pretty much any possibility of recovering using software. Formatting is not a "wipe."

Honestly, if nothing was recovered using any of the programs you mentioned, then I would assume it is gone unless you want to pay Drive Savers or some other company. The simple fact that *nothing* turned up (not just pictures, any file at all), I would suspect a wipe or severe hard drive failure somehow reporting the wrong data on the drive.

I do not have very much experience with encrypted hard drives in laptops (can you read the data without supplying a password?), but if it was encrypted, then you won't be able to recover anything either as it will appear to be random data.

Morrison5891
09-13-2009, 04:57 AM
did you check to see if the drive is even used?

It would also help to know why recovery is needed in the first place.

When you said "any files" do you mean any period, or any photos. did it recover any garbage files at all? was the computer running any kind of encryption?

If it was a sparse encryption you wouldnt be able to see the files without some specialized procedures

I mean any at all ZERO files... no NOTHING!

Morrison5891
09-13-2009, 04:58 AM
if a drive was even remotely properly wiped, software can not recover anything. even a basic wipe of making everything 0 will remove pretty much any possibility of recovering using software. Formatting is not a "wipe."

Honestly, if nothing was recovered using any of the programs you mentioned, then I would assume it is gone unless you want to pay Drive Savers or some other company. The simple fact that *nothing* turned up (not just pictures, any file at all), I would suspect a wipe or severe hard drive failure somehow reporting the wrong data on the drive.

I do not have very much experience with encrypted hard drives in laptops (can you read the data without supplying a password?), but if it was encrypted, then you won't be able to recover anything either as it will appear to be random data.

No encrypted data, etc ... The lady I'm doing this for was using her laptop just the other day... Windows crashed, she re-booted and got the message "Operating System Missing" and that's it.

MrUnknown
09-13-2009, 05:15 AM
Well, unless you're doing something very randomly wrong, such as scanning the wrong drive, then the data is beyond your reach. You should quote for Drive Savers or a similar service.

the fact that *nothing* is recovered is incredibly odd and points to something else happening.

bagellad
09-14-2009, 04:34 PM
Yes if the customer wants the data no matter what i would send it to one of those recovery labs. I called local places and it was anywhere between 2000 and 750, giving you between 5-20% discount for being a computer service.

If the customer wants the info but isn't willing to pay then I would continue to fool around with it.

Doctor Micro
09-14-2009, 05:14 PM
I agree with all the other posters in that something is definitely very very odd. If she just had an OS crash, and didn't do anything before bringing it to you and no one else has touched it in the meantime, you should find TONS of recoverable data, even though most or all of it may not be anything you're specifically looking for. Something smells fishy here...

angry_geek
09-14-2009, 06:18 PM
I just finished recovering data from a drive that had an os reinstall . . . twice. I was still able to get all her d & s folder. Either the controller on your drive is toast, or the heads aren't moving. Time for professional data recovery.

JRDtechnet
09-15-2009, 01:20 AM
what does the partition tables show? For example an HP system you would see NTFS HP partition and then a fat32 recovery partition.

I doubt it would be the heads or the recovery programs wouldn't work at all.

Morrison5891
09-17-2009, 09:01 PM
It shows NTFS The drive works fine. I can copy to and from the drive. I copied a few programs and pics to the HDD and then deleted them. Re ran the recovery software, and it found everything I had copied and deleted. This is very weird and i've never seen this before.

JRDtechnet
09-17-2009, 09:44 PM
I bet someone isn't telling you the complete story. After they had the OS crash they must of used the built in recovery partition to restore their computer or at least tried too, this wiped the partition (perhaps using the secure erase command built into all HD's after 2001) this would kill any chance of getting data back off the drive, sans a few thousand hours with an electron microscope.

Morrison5891
09-24-2009, 12:55 AM
Well, thanks to everyone that replied and tried to help. I was unable to recover ANYTHING from this drive. Can't win them all, I guess.

Doctor Micro
09-24-2009, 08:58 AM
I bet someone isn't telling you the complete story.

I agree 100%. If it really went down as the user said, you should have been able to get a lot of data back.

studiot
09-24-2009, 09:35 AM
Sometimes it is not the (lady) owner, but 'little Johnny' who has done something his parents don't know about or aren't mentioning.

MCSTECH
09-25-2009, 03:43 AM
I'll throw my hat in the ring and say this -

Sometimes I have Very little luck recovering files using Windows computers.

I have lately been using a Mac with "DATA RESCUE" and mounting the "DISK" then Making the "target" a different disk.

The Mac file recovery seems to be TONS better - and I have much higher success rate.

tankman1989
11-02-2009, 11:57 PM
I'll throw my hat in the ring and say this -

Sometimes I have Very little luck recovering files using Windows computers.

I have lately been using a Mac with "DATA RESCUE" and mounting the "DISK" then Making the "target" a different disk.

The Mac file recovery seems to be TONS better - and I have much higher success rate.

I agree to an extent but use Linux instead of Windows or a Mac/

JosephLeo
11-03-2009, 12:10 AM
I agree to an extent but use Linux instead of Windows or a Mac/

I doubt platform matters at this level...I just use whatever works...right now my setups are as follows.

Gaming Rig
Windows XP Professional 64-Bit
Windows Vista Home Premium 64-Bit
Coming Soon - Windows 7 Premium 64-Bit

Workstation PC
Windows XP Home
Windows Vista Home Premium 32-Bit
Windows Vista Home Premium 64-Bit
Windows 7 Premium 64-Bit
Ubuntu 9.10 32-Bit
Ubuntu 9.10 64-Bit

Laptop
Windows Vista Home Premium 64-Bit

Portable Workstation (Netbook)
Windows Vista Home Premium 64-Bit
Ubuntu 9.10 64-Bit


I also have an iMac with Leopard installed- scared to upgrade to Snow Leopard. and a custom NAS with FreeNAS Linux installed.

My workstation has data recovery software in the 64-Bit partitions of Windows Vista and Linux but no where else since I mostly work in 64-Bit only.