File Recovery

(Warning, this is an extremely informative post with no pictures, it’s long and includes much tech jargon. Enjoy)

It’s come to this, you accidentally formatted your hard drive and now your mom gloats over you by saying, “That’s why I like printing out my photos at Costco! and not saving them on your silly computer!” Ok that may not exactly happen to you but it happened to me once. And even though you backed up your valuable data a month ago. There’s some recently created stuff you can’t afford to lose, such as those vacation pictures you took a while ago, chapter 27 to your 4 year novel, or a game save that took forever to achieve and you don’t want to do it again.  That’s when Drive-Busters come in. Ok well not exactly, but you need to recover data off a formated disk right? or a deleted file? Well it can be done! And you can do it yourself! Or give it to me and I’ll do it for you! For a price. ;)

What’s the situation here? Did you accidentally wipe all your partitions when reinstalling Windows 7? Did your sister delete your game saves? Songs missing from your iPod? Laptop died? External hard drive committed suicide?  I’ve seen it all. Most has happened to me and some has happened to others. But you can get your valuable data out! Lets see the situation and how to get out of it. Note, there are no guarantees this may work, in fact you can actually make things worse. But really? How much worse could this possibly get? All your stuff is gone for Pete’s sake! Let’s get digital.

We shall start on Level 1. Computer died (Even if YOU killed it)

The most common type of File Recovery is when we have to get files off a dead machine. What does this mean, Not dead as it will never work again, but dead as in won’t boot any-more. All the components work but Windows or Mac just won’t boot, this is usually the user’s fault. Why do I blame them? Sometimes viruses cause this, also improper shut-downs, this wouldn’t even be a real issue if the user just learned to back up their information, but no! They never learn, that’s why I love those people, it’s the reason I have a job. So let’s get to it, if you want to try this yourself go on ahead, this even works with a working machine.

step 1: Burn an Ubuntu live cd from www.ubuntu.com

Step 2: Boot from cd

step 3: Once booted in a live session, you plug in a USB hard drive and drag all data into that hard drive.

Recovery done! (These steps may sound familiar and they should, I’ve mentioned them time over time in my posts with more detail, if you still do not know how to handle ISOs and booting from CD’s learn more from here before reading the rest of this post, it will be enlightening.

Level 2:  Recycle Bin Oops (Oh no I deleted it!)

Yes this happens to the best of us, in fact that’s what the recycle bin was invented for, to prevent accidental deletion and to ensure you don’t accidentally hit that delete button. (Yes there is one on your keyboard, look next to the backspace, it works) Well first let me say that anything you deleted many years ago will most certainly be gone. But it doesn’t hurt to try to recover that. So why don’t we start up on preventive measures. Install Recuva http://www.piriform.com/recuva/builds Download any of those versions, if you are working on the computer you need to recover data from then I recommend you download the portable version and run it from a USB drive that way you minimize chances of you over writing a file. Huh? You may ask? Let’s let Wikipedia show you how this recovery software works.

“When files have been “deleted” from a storage medium, deleted files are not erased immediately; instead, references to them in the directory structure are removed, and the space they occupy is made available for later overwriting. In the meantime, the original file may be restored.”

What? OH my gosh let me dumb this down even further. When you delete something off a hard drive, you are not really deleting something, but rather telling the hard drive to reuse that space and rewrite over that section. Kind of like how a graveyard works. Yes they do that.

So using recovery software actually allows you to find all data what is still readable and has not been completely overwritten, Recuva is excellent and the best software I have seen to do that, free and paid software. I would recommend you buy it if you need help from them to recover stuff on your hard drive, or just call me, whatever.

But I formatted my hard drive! What! Oh is there no end to your incompetence?! OK let’s get serious. This penultimate level of data recovery of extreme nature. There’s two ways to do this, the Windows method,and the Linux method. Let’s start with the obviously easy one.

Level 3: The Henchmen level

Situation, formated hard drive. Tools need, extra computer and this http://www.amazon.com/Universal-Drive-Adapter-Serial-ATAPI/dp/tags-on-product/B0012TOG08 it’s a Hard drive to USB adaptor tool. Turns your hard drive, (The one you need to get data off of) into and overly complex and huge usb drive. They go for around 30$ max for a cheap one and are a real lifesaver when you don’t want to plug them into a spare machine.

Step 1: Plug Hard drive to usb tool and into a working computer with windows.

Step 2: Install recuva on that computer.

Step 3:Enable the Deep Scan setting and you will be able to recover much data off of that drive even if you formated it.

Step 4: (Optional) I also like enabling Recuva to restore file structure, so you don’t have to pick and peck all the files one by one.

Well that wasn’t so bad now was it? You never want to restore your data on the same place you are recovering from for obvious reasons, just a warning. This method works for all Fat32 and NTFS File systems on your windows machines, flash drives, externals and everything can be recovered, but wait? I have a mac that i  need to get data off of it? Is there anyways I can do it? Yes! For free? Ummmmmm yes but this takes us to…

Level 3.5 The Boss Level. (Linux method)

I use Ubuntu on my rig today, and when I needed to recover data off an iPod I booted into Windows and tried to use Recuva to recover lost songs. It failed, I panicked for about 5 seconds then decided to use Linux tools. One way to do this may be to use a Hirens Boot CD, but I needed a tool to install on my system and do this regularly, plus something that can read MAC OS file systems, maybe even EXT3 filesystem recovery. Oh where would I find such a tool? Google! I found this. http://www.cgsecurity.org/wiki/TestDisk_Download They do have Windows versions but I have not used those, only the Linux version. And it works like a dream. Not only is this tool Terminal based but very fast and can recover from anything to anything. Here is what it does according to the Wiki

TestDisk can

  • Fix partition table, recover deleted partition
  • Recover FAT32 boot sector from its backup
  • Rebuild FAT12/FAT16/FAT32 boot sector
  • Fix FAT tables
  • Rebuild NTFS boot sector
  • Recover NTFS boot sector from its backup
  • Fix MFT using MFT mirror
  • Locate ext2/ext3/ext4 Backup SuperBlock
  • Undelete files from FAT, exFAT, NTFS and ext2 filesystem
  • Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.
I lied there is one picture.
(EEEEEE!) (I is so happy like squirrel!) So this method works the same Windows method. Plug in Hard drive with data to be recovered and use program to get data off. Since this is command line I would not recommend this to New Users, but to try recuva first, if recuva can’t do it, then call me and I’ll do this method for you. I need to make a living somehow. You can try this yourself, but if you damage anything, well your fault. Make sure you read all the documentation the site has to offer http://www.cgsecurity.org/wiki/TestDisk and if you really like the TestDisk or Recuva, consider Donating to them. I know I will as soon as I get paid from those tardy customers, rant, rant, rant Fade……….
  One more thing, there is one level of data recovery if have not mentioned, let’s say your computer was the victim of a terrorist attack, got shot, blown up. And he felt so bad that your pc decided to jump off a cliff. Your data might be recovered! Yes the last Level of Recovery is…
  Level 4: Ultimate Frankenstein
  When your hard drive has been damaged beyond use, experienced file-system corruption and outside damage as well, the professionals do Level 4 method. Pull out your hard disk’s data platters, buy an exact new working model of your hard drive and install the platters, very carefully, then start recovering data, this method is the most expensive and time-consuming, I have never done it, because no one wants to fork over 300$ for me to do this. That’s how expensive it is, and that’s my price. Imagine how much a real company charges? And it’s not only for really damaged hard drives, sometimes drives fail for no good reason, (Cough!) Western Digital (Cough!) Toshiba (Cough!) Cheap unknown brand (Cough!) Whoa! I think I might be getting a cold or something. And this method of replacing the disk platters works wonders sometimes. But it’s not always the same, I know this one guy bought a similar drive and replaced only the Circuit Board and his drive worked again, not as time-consuming but he had to buy another hard drive just to get it working again and his data off.
  There are many high level methods I myself wouldn’t try nor mention, but if you’re interested Wikipedia has a good entry on this.  http://en.wikipedia.org/wiki/Data_recovery Which includes Live PCB Swapping! So much fun!
                                                                                                                                                                                                  That’s about all for today, I do hope you enjoyed this article and hopefully you won’t ever have to do this, because like good Users, you should back up important data.
Advertisements

About Zerin

But can you show me the source code?

Posted on June 6, 2011, in Computers and Internet, Linux Stuff, Windows and tagged , , , , , , , . Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s