Recovering Data On XP Desktop After System Restore

[JustinG30]

I have a customer who brought in a Windows XP desktop in which they were having issues and did a system restore. They factory reset the machine and now want to try and recover the files that were on it. I have never done one of these. What is the best way to approach it and what do you recommend?

Thank you

 

[lcoughey]

First, a few questions:

1. Why did they run the system restore (we get a lot of system restored drives that are full of bad sectors which were likely the source of the issues they were trying to fix)
2. Did you get a full sector-by-sector clone, yet?
3. How much is the data worth to the client?
4. What data recovery programs do you own?
5. What kind of files do they want/need recovered?

 

[Markverhyden]

The first question to the customer is does the data have significant financial value? If it does then don't touch it, turn it on, etc. Don't know where you are but contact a qualified data recovery business.

If this is just a fishing expedition then @lcoughey has posted a couple of articles in the Resources section which should help you get started.

 

[ohio_grad_06]

Yes, if the data has value, have them take it to a data recovery center. If you are just fishing, then I would probably use ddrescue to clone to another known working drive and attempt recovery from that.

 

[DataMedics]

Yes, I agree with Ohio_grad. ddrescue is what to try to clone the drive to a new one. (this tutorial will help you use ddrescue) Though if you're hitting more than just a few bad sectors, probably is best to get it to a data recovery shop with proper tools for imaging around the bad sectors.

Then after you image it to a new drive, try running a scan using a demo of R-studio to see what's recoverable. Then if it looks worthwhile, buy the program and recover the data.

 

[JustinG30]

Thank you. It was a machine a customer didnt really care about so I told them i never done it and they said just do what i can. If they lost it o well. So it was a good first machine to start with.

 

[johnrobert]

Since they factory reset the machine your not likely to get any old data

 

[Markverhyden]

Since they factory reset the machine your not likely to get any old data

That's not entirely correct. All OEM resets I've seen just do a reimage. Basically re-writing the partition table and the drive contents without a wipe. So if you do a scan for file types you can recover a lot of data.

 

[pcpete]

With reformats do many of you get good recoveries with file structures and names intact or normally just raw recoveries of file types?

 

[DataMedics]

If it was NTFS formatted, which it should be, you may still be able to get a good amount of the file/folder structure. I'd recommend that you use R-Studio to scan it. Also, just FYI it's usually a good idea to clone the disk to another one before starting the logical recovery. You'd be amazed how often drives that seemed OK have bad sectors and die during data recovery scans. If it clones fine, then you're good to go to town scanning it for files.

 

[DataMedics]

Sorry, forgot to mention in my last post. I assume you're talking about a quick format with some data overwritten like the OP had, rather than a full long format which takes hours. If you long formatted it, the data is overwritten with zeros and can't be recovered by anyone.