To cut a long story short, my Dad was making space on his external hard drive, and in his haste to delete things he accidentally deleted a folder of family holiday pictures. I've used several downloadable file recovery tools and whilst a sizeable portion of the photos have been recovered there are photos in one folder that cannot be recovered.
After playing around with these tools I've discovered that these unrecoverable photos have been replaced by ones from an entirely different folder. Some tools have recovered images from the wrong folder whilst the rest won't recover but claim to be "wrongly linked" with this other folder (a folder containing the classic Virtual Pool game).
It seems unlikely as none of these popular tools have worked thus far, but is there a way for these photos to be recovered?
-
Most likely no, short of sending the drive to a data recovery service and shelling out some cash.
EnderMB : What could they do that's different to typical file recovery software? If they are capable of doing something are there any good guides on how one could do it themselves?squillman : They have more advanced tools that are not typically accessible to general consumers. In extreme cases they also have tools that will inspect the disk at the physical level and algorithms that might be able to make sense of what was found.David Zaslavsky : In some cases, it's possible to find a magnetic "echo" of data that's been overwritten - that's something that is impossible to do with software alone.sleske : @David The thing about the magnetic echo is probably more myth than reality: http://www.nber.org/sys-admin/overwritten-data-gutmann.html At any rate, it'd be impossibly expensive to recover any significant amount of data that way.duffbeer703 : @sleske: I've seen it done with tapes that were overwritten several times.Rob : @duffbeer703 - Getting data back based upon any sort of "echo" is highly dependent upon how tightly packed the data is. IIRC, a tape doesn't have the data packed as tightly as, say, a 1TB hard drive.From squillman -
Try Zero Assumption Recovery
I have frequently had it find/recover data and files that other programs couldn't locate or recover.
EnderMB : One of the first programs I turned to. Sadly, it didn't work.From Happy Hamster -
Try PhotoRec:
http://en.wikipedia.org/wiki/Photorec
It's free and open source (GPL). PhotoRec got all my photos back from a memory card I erased accidentally and it's supposed to work with hard drives too.
From Philip Durbin -
One of the first rules of file recovery is to always recover to a different disk in order to prevent things from getting over written. In fact, someone actually just posted on this topic over on Slashdot.org about this topic and the bad news is that if something was overwritten, there is an extremely good chance that you aren't going to be able to get it back.
That said, if you have been recovering the files to another disk you might be able to get some of the files back using the tools that other suggested.
From Rob -
If you're turning to file recovery software then I assume that the files weren't in the recycle bin, backups, etc, or possibly the disk itself has failed.
These first few steps will make your success more likely:
Pull the computer's plug out of the socket. Don't shut it down because the shutdown process might overwrite the data that you are trying to save. If you're reading this on the affected computer, keep reading on another computer. :-)
Now you want to make a copy of the entire drive. Get another hard drive. Install an operating system on that drive if it isn't there already and make a copy of the defective drive to that drive. Your recovery tool should come with the ability to make an entire disk copy. The copy is sometimes just one big file or a bunch of archive files, compressed.
Now run the recovery tools on the copy of that drive. Good tools have the ability to run on a copy of a drive. Recover from the copy on to the new hard drive.
The point of all this exercise is, as soon as you decide to use recovery tools, to stop all access to the defective drive except one read of the whole disk, the absolute minimum. The less you tamper with the original, the more likely you'll get something back.
From Eyal
0 comments:
Post a Comment