Jump to content

How Do I Recover Lost Data?


CITRUSDOPE
 Share

Recommended Posts

*********************************HOW MY PROBLEM HAPPENED************************************

I was transferring files from and to my Google Drive to my desktop and some how I'm not exactly positive how this occurred I deleted those files! A few movies and worst of all educational notes and software from my semesters!!! The files were so large that they never made it to the recycle bin. I think I double tapped the "enter" button or something I am not really sure. It was a horrible day all files and hope was lost.

*******************************************************************************************************


****************************HOW I TRIED TO FIX IT*************************************************

Knowing that once a file is deleted the data is basically no longer "stringed" together and becomes unallocated space I was hesitant to download a program that claim to recover files. Sadly it recovered the file title, but the recovery of the file contents and data itself required to buy a license. (I FOLLOW THE EULA & POLICY SO I DID NOT USE A "KRAK") .

I forgot that leaving the machine on with the operating system running writes to unallocated space because logs are created by the OS. I did not browse or download anymore programs after failing to recover files with the bait and switch "gimmick" program I left it running for 3 days such N00B mistakes.

As a proactive measure, however; I had a friend, who works at a PC repair shop, make an image/"clone" of the contents on my drive. I am using the clone he made and I have the original drive in storage.

***********************************************************************************************************


******************************Question*********************************************************


I am wondering what you recommend to recover the files in my case?

*********************************************************************************************************


Link to comment
Share on other sites

So many issues here. If the copy your friend made was not a bit stream copy, it probably only copied the allocated files. The first thing you should have done is not work off that disk at all. You risk recovering files and overwriting data while working on the same disk. There are file carving tools out there on linux and windows. Reccuva is a windows one. If you would like some more info let me know.

Link to comment
Share on other sites

1) Yes I believe my friend made an exact bit stream copy of it.

2) I am using that bit stream copy on my lap top and I have stored the original safely

3) I know that I should not have download or installed the program. I was desperate. Also I left the Operating System running for 3 days. This also writes to the unallocated space because it saves the logs.

4) Yes I believe I downloaded Reccuva but its not free, do you know of a free option to recover my lost data?

Edited by CITRUSDOPE
Link to comment
Share on other sites

I do not think I downloaded it from there. I am downloading it now.Wheres the hash for this file?

Once I download the program, what do you suggest I do? Try it out on the copy drive first? (I've de-fragmented and ran a PC utility for registry errors etc already)

I do not see how I will be able to use the program with out installing it on the original drive, which further increases the chances of unallocated data being written on.

But yes thank you guys for the help!

Link to comment
Share on other sites

I don’t think it would hurt to try on the copied drive first as you have nothing to lose but I don’t think it will work unless it is a complete clone of the drive.

If it was me i would boot up with the original and try to run recuva on a flash drive but i am not experienced with data recovery so there may be a better way. It also depends on how valuable the information is to you, if you absolutely need the data i would get a professional to look at it although that can be a costly solution.

Link to comment
Share on other sites

I don’t think it would hurt to try on the copied drive first as you have nothing to lose but I don’t think it will work unless it is a complete clone of the drive.

If it was me i would boot up with the original and try to run recuva on a flash drive but i am not experienced with data recovery so there may be a better way. It also depends on how valuable the information is to you, if you absolutely need the data i would get a professional to look at it although that can be a costly solution.

Well I'm reunning the program RECUVA right now. I have 20 minutes left before I get a prompt telling me what I can do. Again I defragmented and ran a PC utility to fix registry errors and I have been using this copy for some time. Well see what happens. Also Ill see if maybe I can figure out a way to access the drive with out using a write blocker.

Link to comment
Share on other sites

Ideally, you would attempt recovery off your image, not work off of the image and data recovery off of the original. I'm not sure what you defragged in your statement, but whatever you ran it on, you probably just destroyed most of unallocated data. If you would like to speak with me in Skype, send me a PM.

Link to comment
Share on other sites

You've had lots of good advice about trying to tackle the situation, but it does sound like the chances aren't good for recovering the files. If you do reach the stage that you have to admit that you aren't ever going to be able to recover those files, then here is some advice.

First Pick yourself back up, look at what you have lost and how you can deal with the immediate repercussions of it. In this case the key files lost look to be the seminar notes and software. I would suggest asking friends for copies of their seminar notes and doing some group study with those same friends (as notes are a very personal thing and you will need them to translate theirs). Start your revision early and if you can't understand something go and see the lecturer about it. Hopefully you can still learn enough to pass any exams or course work.

Secondly, once you have resolved the lost seminar notes, review your backup procedures. This time it was a mistake that lost you the files, next time it could be a drive that fails or some malware that encrypts your files, or something worse that you couldn't have predicted. Also having been stung by the lack of backups this time it will stick in your memory for quite a while and help you get into the habit of making regular backups.

Finally remember that you aren't alone in having done this, I'm pretty sure most people on this forum can remember a time when they have accidentally deleted a file they needed. Actually I'm pretty sure that most people on this forum have made mistakes which have wiped out entire disks. The important thing isn't that you made a mistake, but how you deal with the consequences and what you learn from it.

Link to comment
Share on other sites

First I want to thank every one that responded to this post.

Second I want to say that I went to work and came back and I am tired but I will try to see what I can recover on the (cloned) drive in my laptop.

Third Yes I noticed allot of the files seem to be unrecoverable because I ran a defragmentation tool. (good thing [sort of] I never did so on the original!)

Fourth Yes after finding out how to manage an OS system (a course required as part of my degree) I should have applied those principals to begin with.

Fifth ... MrProtocol I will be contacting you. Just not at the moment.

Thanks guys Ill keep you posted.

PS. I might just ask to have another bit copy done since I have been using the clone as if nothing ever happened for some time now.

Edited by CITRUSDOPE
Link to comment
Share on other sites

You need to make sure that it is not just a copy of the file system and is a bit copy as i don't think that deleted files get copied unless you make a bit stream copy, it might be better to find a live CD that is designed for recovering data instead of running an application of the drive and boot onto that with the original drive or clone connected and run some recovery tools on the drive, this prevents any log files being wrote to disk and can pick up more stuff but it comes down to how badly you need the data. In the past i have been able to recover data that was deleted a fair bit ago however that was on systems that did not get regularly defraged or any other maintenance as they were used by novice users.

You say that a lot of the files appear unrecoverable does that mean that you were able to see the file name of some of them? as that is a good sign it was a bit copy.

Link to comment
Share on other sites

Rule number one, generally when recovering files, you don't use the same drive, while its in use, or while doing recovery on the same drive. You usually offline, or mount in read only mode under another system or on the same box if its a spare disk(which in your case being the Desktop, you'd have to live boot usually unless recovering it immediately after deleting and even then you'd probably only get partial files on a live system), or boot off tools to check for deleted files to copy off to another drive.

That said, I've deleted a file, emptied the recycle bin, and gotten the file back, but because I did so right afterwards. Deleted files from the recycle bin, are generally only marked for deletion, meaning that file is still there, until the system needs space to write to, and will only overwrite those bits if it needs that space. Tools I use to get stuff back on windows drives, thumb drives and other storage media like SD cards are "Handy Recovery" (which I use the free version since I generally am only recovering images or small text docs) - http://www.handyrecovery.com/ and "File Recovery" - http://pcinspector.de/

For more in depth file carving, and different operating systems and file system types other than fat/vfat and NTFS, check out int0x80's episode on file carving under Linux with scalpel. There are also live distros specifically for forensics and data recovery(usually law enforcement tools but also available to the general public), that let you make images of drives for later file recovery, or read only mode to recover files. Chris from SecuraBit also did an episode demonstrating a few of these tools on forensic recovery.

If you are reading this, from the same system the files were deleted from though, and as mentioned, did a defrag, you can pretty much kiss most of that data goodbye but try the tools above, Handy Recovery (which is stable and works well in windows and I use it all the time) and File Recovery, which can be a bit buggy, but is MUCH more thorough and scans bit for bit and very slow, but will find files you deleted from like 2 years ago and be able to reconstruct them some times, which I always find fun to do on old machines people throw away or when I get a drive thats going dead and need to pull data off I use my Rosewill Drive kit to mount them over USB or eSATA to read and recover data off drives and it works a treat.

Edited by digip
Link to comment
Share on other sites

  • 5 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...