recovering deleted data from your hdd

[_Ender_]

is it possible?

if so, how?



thanks!

[drew_952]

Your hard drive crashed? Or you just emptied your recycle bin and you want that stuff back?

[kormendi]

it is recoverable as long as no data has written over it.

you can even recover data from a format with the right software.

[Black_V!per]

Do a search on Google, and or Download.com i downloaded a few different types of recovery programs. Some worked better than otehrs. But it was so long ago i dont remember tha names, just i used google to get to download.com to download 3 or 4 programs.

[_Ender_]

I empited the bin, now I want the stuff back.

I tried google and stuff. But I just dont know what to download. They all say they do what I want them to do, but I dont know. Thats why I wanted the opinion of the community cause I am sure you guys know what to use and what works.

[T_BEAR]

What about system restore? Do you have that enabled?

[Black_V!per]

EEWWWW system restore?


I did a couple google searches myself, you never know, but i too was bafled with all the different kinds of software they have. I remember having Undelete from Executive, but i think that only works with stuff you delete after its installed. (I currently use teh Diskeeper from Executive"Great piece of softweare")

[Boomstick]

If anyone wants to know the basics of data recovery take a look at http://shsc.info/DataRecovery. That was written by a Something Awful goon named Gromit who knows his stuff (Ender I recommend you don't check that out until you read the following). That should give you some basic information on how data is written to your hard disk. Like kormendi said, the data should still be on your drive if it hasn't been overwritten yet. Also, the less fragmented your drive is the more likely you'll be able to recover those files. Use that drive as little as possible, it'll reduce the chance that the data will be overwritten. How long ago did you delete those files? If it was a while ago, you might be out of luck.

I had this crisis a while ago too and was able to recover all the files I deleted recently using the application I found here: http://www.geocities.jp/br_kato/ . It's free, it'll fit onto a floppy and you should be able to at least restore some of those files, provided they haven't been overwritten. Good luck!

[_Ender_]

how long is "awhile"? I think its been less than a week, is that too long?

I havent writen any new data to it since the delete, so here is hope.

[Overlag]

i used a program called finaldata. Was a long while ago now tho, so im not sure how it compairs to todays programs, NTFS etc.....

You CAN also pick up data after its been writen over. Ie Finaldata picked up about 25gig of data from a 20gig drive. However the stuff that has been writen over will often be currupted.

thats why if you want to delete stuff and not have it viewed you need to run these delete programs that fill the drive with 0's at least 5 times, because the data is still there... just faded

[Gromit]

Originally Posted by Overlag

You CAN also pick up data after its been writen over. Ie Finaldata picked up about 25gig of data from a 20gig drive. However the stuff that has been writen over will often be currupted.

thats why if you want to delete stuff and not have it viewed you need to run these delete programs that fill the drive with 0's at least 5 times, because the data is still there... just faded

Every now and again I check my referrer logs to see if anywhere interestng is reading my wiki page, and this place turned up. Thought I'd sign up just to reply to your statement, so I hope you feel honoured or something!

You CAN'T "pick up" data after it's been overwritten - it just can't happen. The reason you got 25GB back off a 20GB drive is because you ran a tool that recovers data based on a header search. For example, if you want to find jpegs you would search for any occurence of 0xFFD8FF (or something a little longer.) This will pull out anything with a JPG header, but will also grab loads of data that just happens to have this same string in it.
Given that every time the program finds this string of numbers it will copy that out and, say, 100k of data after it (in order to hopefully give you a JPG image), you can probably see how a text file with the contents "FFD8FF FFD8FF FFD8FF", which is only 21 characters long, would result in 3x100k files. Viola - 300k of data from a << 1k file (well, 4k really as that's probably your minimum cluster size.)

Your last paragraph is just one of those urban computer legends. I make it quite clear in that wiki entry why it is just bad science. Please don't keep the BS alive.

[=DdogG=]

nice....

If you care to elaborate in length on this or any other topic, i.e. a tutorial or guide, feel free to post it and we will, very possibly, sticky it for future reference... thanks for stopping in.

[Gromit]

I'm not sure what further I could write other than what's in that wiki entry. If there's anything specific of interest you'd like discussed or clarified, ask away. If it seems especially interesting I'll add it to the wiki for everyone to read.
So no-one gets the wrong idea - I'm not a data recovery expert. My line of work is forensic computer analysis, which has many parallels. However, I have met with and spoken at length to many data recovery experts, and been in contact with many people around the globe on this subject.
I like to think I have a knowledge on this subject that goes beyond that of the "average" Internet user, gamer, programmer, whatever.
Feel free, however, to correct any of the information in that wiki, SO LONG AS YOU HAVE SUPPORTING EVIDENCE. Believe me that if you just say that the NSA will have better gear than I will just result in me rediculing you at length

As there is such a widespread belief that overwritten data can be _usefully_ recovered, this is my pet hate and I can go off on a rant about it at the slightest provocation. If you're reading this and think it can be done, then give me contact details on who can do it. I can send so much high-profile work to that person that they will become amazingly rich, and hopefully I will too. Hell, if that happens I'll send you some cash too!

[Overlag]

nice attitude Gromit.

Firstly you have no clue what i was talking about it seems. It didnt pick up the same files over and over. It picked up files i deleted MONTHS ago, that HAD been writen over. The drive was full to the brim. But thanks for sprouting BS.

zero fill programs DO recommend you run them 5 times to totaly DELETE files (and they generaly write 0s, then 1s then 0s etc....), as you CAN still pick up stuff. So your last sentance was BS too

[Gromit]

Originally Posted by Overlag

nice attitude Gromit.

Firstly you have no clue what i was talking about it seems. It didnt pick up the same files over and over. It picked up files i deleted MONTHS ago, that HAD been writen over. The drive was full to the brim. But thanks for sprouting BS.

zero fill programs DO recommend you run them 5 times to totaly DELETE files (and they generaly write 0s, then 1s then 0s etc....), as you CAN still pick up stuff. So your last sentance was BS too

So, you are telling me that you managed to recover overwritten data, which you then stated was corrupt. How do you know what that data was?
I'm not saying it picked up the same files over and over - you seem to have failed to grasp the way my example matched the real world. I'll be happy to make it clearer if, when you re-read what I said, you still don't get it.
I'd be interested to know your background in this field, or is this all just your anecdotal opinions?
Why are you taking this so personally? You are wrong, but this doesn't make you an idiot, just not educated in this area.
It's just not possible, by the laws of physics, for this overwritten data to be recovered in a USEFUL way. That is to say, you can recover a few bytes of data off an MFM-encoded drive from circa 1995. If you would have read my wiki entry, you'd see where I remark on the professor from Maryland University who was quoted in New Scientist magazine and seems to be the leading guy in data recovery using STEMs and similar equipment. He managed to get speeds of about 1k per hour off a low-density drive - something you never see in use any more. I didn't specifically state this guy's name or where he was from (Professor Gomez, though, if you want to look him up), but there it is now. Go speak to him before you run off at the mouth again.
If you could recover data like this, why is it that out of the 30 or so seconds of wiped data from the Watergate Tapes, has not even one microsecond been recovered? The data density of audio tape is WAY lower than a hard drive and it should be apiece of cake. But no, it isn't.

Anyway, you obviously don't want to be convinced and have this particular hypothesis in your mind that you want to be true. I can't do anything beyond say you are wrong and point you in the direction of further material to investigate. If you don't chose to believe me, then there's nothing I can do. I won't lose sleep over it, I jsut don't like seeing misinformation being spread about in my field of, shall we say, expertise. If you have relevant qualifications in this field and/or can site some credible material I'm all ears.

I WANT overwritten data to be recoverable. My work would become oh so much easier. But no-one can do it, no matter what the financial incentive. I know this because we had a triple-homicide we wanted data recovered for and it was impossible.

Wow, I said I'd go off at the slightest provocation didn't I!