Data Recovery after format an OS reload

YOCS

YOCS

Member
Reaction score
10
Location
Maine
I had to reload Win7 on a laptop. I backed up the usual spots Desktop, My Docs, Favorites, Email Etc using Fab's autobackup for techs. I asked them if they had any other spots where they store their files other than My Docs and they said no. I blew it away and re-installed the OS and restored their data. When they tested there was a shortcut on their desktop that pointed to a folder located at C:\Users\"Their Profile"\folder which I didn't backup. It's a Lenovo T420 laptop with Pointsec disk encryption. Would a data recovery expert even be able to recover the folder under these circumstances?
 
Something like getdataback will do this as long as the files haven't been over written.
We had a customer bring in a machine that they had done a factory restore on and needed to get their data back.
I was quite surprised at how much of the data we were able to recover with getdataback.
 
I'm a big fan of R-Studio. You can download and run a trial copy of it against the target drive. If you see things that make it look worth while you can convert it to a licensed by just paying for it and entering the key. Once licensed you can recover any size file. Trial version is limited to 64k if I remember correctly.
 
An alternative (and look-alike) to R-studio is Restorer Ultimate. In a comparison of the two, I found it faster, more user-friendly (less complex), and better value. That said, R-studio seems to be the DR industry standard.
 
+1 for R-Studio. Have a Linux machine with it installed and use it every time a customer does a factory restore by themselves and doesn't realize it deletes everything.

Though I'm not sure how it would work with whole disk encryption. You might need to run it on the machine itself, but I'm not sure how that works with the R-Studio license. If you can only use it on that computer and can't transfer it to a bench machine or something, it is probably worth looking for an alternative.
 
Most encryption products have a standalone app that can be installed to browse an attached drive. It does not decrypt the entire drive just decryption on the fly.

For me I have always decrypted the entire drive before doing any DR.
 
Yes, the Pro versions:
Restorer Ultimate PRO turns any computer into a powerful data recovery workstation. It allows you to connect any number of disks to your computer to perform file recovery for personal, corporate, or customer needs.
Click to expand...
I bought the Restorer Ultimate Pro Network version but haven't tried out the network features, which include...
Restorer Ultimate Network can connect to a remote computer, open and scan its hard drives, partitions, or their parts and recover files from a remote computer much as Restorer Ultimate can for a local device.
Click to expand...
At $69.99 USD, it's terrific value.
 
Last edited:
Thanks for the help guys. I'm going to have to unencrypt this drive before I attempt anything. I'll let you know how I make out.
 
markverhyden said:
Most encryption products have a standalone app that can be installed to browse an attached drive. It does not decrypt the entire drive just decryption on the fly.

For me I have always decrypted the entire drive before doing any DR.
Click to expand...

Good to know about the standalone apps. I've only ever had to do DR on one encrypted drive so I don't have much experience with it. For the one I did, I just decrypted it with the customer's permission using a bootable disk the company made. Thanks for the info.
 
On a side note, I am guessing you now do this, but we always make a complete acronis image of any computer we format, without exception. It is guaranteed that clients will forget to tell you about data in odd spots or human error will occur(we make a mistake). It is such a safety net to have a complete image to go back to if needed. Besides files, it gives you a chance to go back to a bootable system if needed.
 
redmon said:
On a side note, I am guessing you now do this, but we always make a complete acronis image of any computer we format, without exception. It is guaranteed that clients will forget to tell you about data in odd spots or human error will occur(we make a mistake). It is such a safety net to have a complete image to go back to if needed. Besides files, it gives you a chance to go back to a bootable system if needed.
Click to expand...
+1 on this advice.
 
+1 for R-Studio.

It's never let me down, isn't it amazing how much porn a single person can try to delete?
 
PhotoRec http://www.cgsecurity.org/wiki/PhotoRec

Lady had a miscommunication or something with someone that reloaded her OS - no backup.

Recovered pretty much everything; She had info that she accumulated over a span of 12 years in some cases.


It's not the most user friendly, but it is free. Select only the file types/extensions needed, if known (i.e.: .jpg, .mp4, etc)
 
Last edited:
redmon said:
On a side note, I am guessing you now do this, but we always make a complete acronis image of any computer we format, without exception. It is guaranteed that clients will forget to tell you about data in odd spots or human error will occur(we make a mistake). It is such a safety net to have a complete image to go back to if needed. Besides files, it gives you a chance to go back to a bootable system if needed.
Click to expand...

Amen! We do BOTH an Acronis image of the HD and a Fabs data backup anytime we're setting up to do a rebuild. Most of the time, the Fabs backup is sufficient, but more than once we've had to go back to the image to grab some customer must-have data that was buried deep.
 
Hope you get this done, but just wanted to point out this is why I *always* image a clients drive AND do a manual backup of the usual data locations. For every workstation I need to re-image, whether it's grandma, or my investment bank.

It's much easier & faster to backup & restore by just copying/pasting the docs/desktop/etc., but I know I'm covered with the image in case the user or some stupid program stores data in a strange location...which obviously happens.

Good luck!
 
Add another +1 for R-studio. GDB is ok, but R-studio is generally better. Haven't tried that other one, but R-studio is as mentioned the industry standard and as such can recognize more file types than most others.
 
If you do opt to use R-studio and you get stuck or confused, just PM me or Luke. We always give free advise on this stuff, and we're both in the data recovery field. I can even remote in and show you how to do some things if you need me to.

You'll only need to get the trial of r-studio for now. Don't have to pay until you actually want to save files.
 
You must log in or register to reply here.

Similar threads

M
Encryption virus data recovery / R-Studio
Replies
3
Views
1K
MrBojangles
M
Pacific Blue IT
A different type of data recovery solution needed - Query
Replies
7
Views
2K
Larry Sabo
Larry Sabo
P
customer unhappy with data recovery
Replies
14
Views
2K
brandonkick
B
xxsilk109xx
Data recovery
Replies
5
Views
650
iisjman07
iisjman07
P
[Release] Gotcha! Data Backup
2 3
Replies
54
Views
15K
ProfessorCPU
P
Back
Top