I hate to discourage, but it is a daunting task to run a recovery program on
a 20 GB drive or larger.
To illustrate Mark Rode's response, I have 40 GB Samsung drive configured
to be a 32 GB drive, a peculiarity of Samsung drives, that I have been
saving for a restore. It has about 20 GB of data that I did not back up.
Some is important and some is not.
I had some kind of catastrophic crash of my system that wiped out the drive.
On two separate occasions. Might have been a virus or trojan who knows.
Once it crashed, I could not run anything on it, the system refused to
recognize it.
The third time was after some punk had logged into my PC from the internet
(I had no meaningful protection from predators on the internet) Boy was I
in for a suprise. The punk from the outside was logged into my 40 GB
Samsung, according to Net Watcher, into a particular folder with about
100,000 files in it. He apparently corrupted the FAT on the drive, I guess
by systematically overwriting it with a hex editor. Or using some punk
script. He ate up enough files to cause the system to crash on the next
boot.
I learned about "protection" from that episode.
The first time I restored the data it took the best part of two days. I
used a program called Ontrack Data Recovery Professional. Now it is called
Kroll Ontrack Data Recovery Professional, I am sure in a newer and better
version.. As far as I can tell, Ontrack wrote the book on do it yourself
data recovery. Except for some minor glitches caused by giving it too many
files to recover at one time, it works perfectly, almost too perfectly.
After recovery, I had several copies of each file, all with the same date
and size. The ones I was interested in saving the most were wordperfect
files.
For example, in the wordperfect document folder, in a recovered subfolder
(with the name Blah~1 or Blah~2, and so on) there would be, for example, a
wordperfect file with the hypothetical name of data.wpd. Of course, there
were many thousands of such files in several hundred folders and sub
folders.
Often times I had long file names for the files to help me categorize them
better. I do a lot of word processing and I never delete files just archive
them, in the foolish hope that I can index and recycle the files, which is
possible every now and then. Saves a lot of typing.
The original file would be recovered, and also every one of its iterations
on the hard drive were recovered.
Each wordperfect backup file back to two or three earlier versions were
recovered also. Each time wordperfect did a save it did not really
overwrite the previous file and overwrite the backup file (with a typical
*.bk! extension) it wrote out the file to a new space on the hard drive, and
then deleted the previous version.
So the recovery program would look at the logical hard drive and find many
copies of the same file. I guess it recovers the FAT first, whichever
version is salvageable, and then starts looking for sectors. I am sure
there must be backup copies of the FAT that get stashed on the disk hither
and yon, when the FAT is updated. No doubt it gets tossed into the jumble
of "deleted" files. Well, this program recovers every file it can find on
the disk.
I think MS Word is worse, than Word Perfect, because when it opens a file it
also opens a temp file with a $ as part of the temp files name, and then
when the original file is saved, Word erases it. Each and every time one
opens a word file and writes to it, one should probably get lots of the $
files on the drive.
When the WordPerfect files were recovered, the file names of the files that
were copies of each other, were variations on the theme data~1.wpd,
data~2.wpd, etc. Each when opened in wordperfect appeared to be an almost
identical copy of the other. Some I never could figure out what the
difference was. I just picked what was the most likely suspect and ignored
or deleted the others.
Another problem arose with some of the older files. A lot of the files had
the right names, but the contents were pieces and scraps of email files that
I had saved from outlook express. It only seemed to successfully recover
the name, not the contents. This happened a lot with the really old files.
Going back to 1985 or so. I told you I save everything.
I had about 100,000 of these wordperfect files and the recovery program ran
for two days straight, and recovered every single file. But there were the
naming problems Mark mentiioned and many duplicates. And the files that
were gibberish email scraps. It was almost not worth it.
I did not run it the last time and have been saving the drive to put it in
another system I am building with a new 40 GB drive to save it to. I was
planning on putting in a bare bones win 98 system and the recovery program
and let it rip. I will just let it run as long as it takes. The program I
have won't run under Win 2k. I am seriously thinking about not doing it and
just re-FDisking the drive, and starting over. It looks like a Friday nite
to Monday morning type project to run recovery on it.
I also found that I could only reasonably recover a hundred folders at a
time. The program apparently saves its file list to memory, like an
internal ram disk (maybe another version of a FAT) and when it fills up, it
locks up the machine. This also took several days to learn.
So when I get around to it, I will just recover certain folders on certain
days, and slowly recover what I need from the drive. If it does not look
promising, I will just kiss it off as a lesson learned. At this point in
time, it is not a priority. Just that I am a stubborn old cuss, and do not
like to write off things that seem recoverable.
Also the bigger the hard drive, the longer it takes for a scan, because the
program scans every logical sector of the hard drive and there are a lot of
them on drives of 20 GB and larger. It would probably be a total waste of
time and energy to try it on one of the huge 80 or 120 GB drives. No
backup, you lose. It would probably take weeks to just scan it. Then it
generates a huge list of folders. Crash a biggie and you can just weep if
you did not backup.
I now do periodic backups to another hard drive in the same system. I have
so many files, it would take a week to back it up on CD Rom's.
Writing this makes me realize that I need to reorganize my folders so that
they can be more easily backed up. Duh! Live and Learn.
Robert Hemming
------------------------- Original
Message ----------------------------------
Date: Sun, 5 Oct 2003 12:22:33 -0700
From: Mark Rode <[log in to unmask] <mailto:[log in to unmask]
Subject: Re: Wiping hard drive clean
How much of the data can be recovered will depend on how many times the
data has been overwritten. If you have just formatted the partition, and
there is a image snapshot of the drive in the root sector, that was made
using utilities such as Norton Image, or SystemSuite image, then the hard
drive can be immediately, quickly, and fully restored using those
utilities.
If you have FDISKed and Formated then you will probably have to use a Data
Recovery program in order to recover the data, unless the image program can
see their root sector image files. SystemSuite has such a program.
Depending on your licensing you can either get back a few files while in
windows, or you boot off a DOS floppy, which will search the drive for
data, then you select the data you want to restore, which often has the
first character overwritten, and then you recover to a different physical
hard drive, after which you restore the first character. If you are trying
to restore more then a few files, then this is a VERY long and tedious
process.
Finally there are companies that will physically remove the platter, and
then using special methods, and equipment, recover the data at the machine
code level. The manufacture of SystemSuite offers this service. There are
quite a few companies that do data recovery. It is a very expensive
procedure, but as long as the platters are intact, and somebody hasn't
professionally overwritten the drive in a way that destroys the data, then
the data can usually be recovered at some level.
Rode
The NOSPIN Group
<http://freepctech.com
At
12:31 AM 10/4/2003, you wrote:
However, many of the responses to this thread seem to say a restoration is
easily done. So, for those who have done it, I'd like to know the exact
steps that will restore a Hard drive that has been fdisked and formated
with MS-DOS.
Please note that I'm not speaking of the restoration of deleted files but
the restoration of all the files on the hard drive that has been FDISKED
and FORMATED with MS-DOS.
mike michel
PCBUILD maintains hundreds of useful files for download
visit our download web page at:
http://freepctech.com/downloads.shtml
|
