General discussion

Locked

File recovery

By ngntechpro ·
Could any please tell me:

On what conditions are files not recoverable by using a file recovery software?

Thanks a lot.

This conversation is currently closed to new comments.

11 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Conditions

by BFilmFan In reply to File recovery

Could be several. Platter is too severly damaged is the usual cause.

Collapse -

conditions:

by afram In reply to Conditions

I think if you delete a file, it only deletes the entries in the file allocation table - the file still exists on the disk, but the table says that the space is usable. If another file writes over that space, then I don't think you can recover it with a regular file recovery software.

Collapse -

Coruption

by dafe2 In reply to File recovery

Coruption or DOD wipe would be another, sector ovewrites.

Also depends on what you mean by 'file recovery software' too.

We're assuming general purpose tools here.

Collapse -

What exactly do you want to do?

by HAL 9000 Moderator In reply to File recovery

Recover a accidentally deleted file or securely delete files?

There are tools to do both but we would need to know exactly what it is you want to do before advising you any further.

Col

Collapse -

Fomatted

by ngntechpro In reply to What exactly do you want ...

If I format a partition (with files on it)of a hard disk, is it possible to recover any data?

Collapse -

Only Forensic Tools

by dafe2 In reply to Fomatted

The only tools that (I'm) aware of to do this properly, yourself, would be forensic tools. We use Encase. I've even completely recovered 200G Raid arrays that where scrubbed AND formatted.

Nothing is unrecoverable today unless a disc is shredded. There are disc shredders but I preffer a sledgehammer where I work. It's therapeudic:-)

Oh yes, the answer:

Depending on how critical this disc is, you might find a suitable tool for your situation by googling for data forensic tools.

Others here may have better answers but that's my 2%!

Good Luck

Collapse -

There are a few options

by HAL 9000 Moderator In reply to Only Forensic Tools

If you know Hex very well Win Hex from Germany is cheap and quite good at performing this task and if you do not know Hex Davaro is the easy version both are quite cheap for the personal versions something like 25 Euros from memory. They can be found at http://www.x-ways.net both products are listed there.

Also the On track product I'm told is very good but a bit more expensive and that can be found at http://www.ontrack.com

I suspose it all depends on just how important the erased data is. While I've never used the On Track option I've been told that it works quite well by those who use it. Davaro on the other hand will recover all the files of a certain suffix type in a group but will rename them from 1 to whatever so you would have to work your way through each file type to find out exactly what you have managed to recover.

As normal you always use a different HDD to save any recovered files to that way you retain the formatted drive just in case you need to dig a bit deeper to find more files.

It all depends on how big the drive is how much data is stored on it and just how critical it is/was. Davaro/Win Hex is quite time consuming to actually use as you need to look at every recovered file to make sure that you have got what you want and then you also have to run a scan for each file type.

On Track I'm told will just reverse the formatting on the drive provided that nothing has been written over it but it is a lot more expensive than the German option but a shorter amount of time is required as well so it all depends on just how much data needs to be recovered.

With Davaro/Win Hex if you know the file names you can do a direct recover of each file but that requires you to know all the file manes.

It time is short the On Track option would be the easiest way to go but then again if there is only a small amount of lost data Davaro/Win Hex would do the job quite well and at a fraction of the buying price of the software.

There are others around but I've had no direct contact with them so I'll leave them alone as I do not know just how well they work.

Have a Happy New Year

Col

Collapse -

I hope this isn't to far off topic

by cicle_98 In reply to There are a few options

As I followed this thread I had been wondering if appling a magnetic force(really strong magnetic force that is...) to the drive, would that make a drive or better yet the information on it unrecoverable? I have heard of a program call CIA Unerase. Though I have not used this program or have had any reason to recovery lost data, it does make me won't to try this program I have suggested seeing how I have access to it. I will leave a furture post to my findings...
Meanwhile, Happy New Year to everyone...

Mike

Collapse -

Mike once a drive is written to

by HAL 9000 Moderator In reply to I hope this isn't to far ...

The data is recoverable, but it all depends on just how much you want to pay for the privilege.

There is the use of a compound that is layered on the platters of a HDD and this substance makes it possible to read every data layer on the drive. Granted it is horrendously expensive and mostly only used by Government Departments to recover critical data or for investigative work.

Applying a strong magnetic source to a HDD may adversely affect the stepping motor for the read write heads so the drive may become unusable or worse unreliable work sometimes and not others. If destroying the drive isn't a worry you can apply Super Magnets to the outside of the top of the drive and it will affect the platters within the region that the magnets are but may leave the rest of the platters readable.

When I worked at a bank no drive ever left the premises we destroyed them all no matter what they where in., We used to take them apart and just add the platters to a pile and mess them up some what so it was impossible to find the same platters for a single HDD. When the pile got big enough we used to first apply a flame from a propane torch to the surfaces to burn of the magnetic material and then send them away to be melted down. Of course these always went under guard and where supervised being thrown into the furnace. The rest of the drive bits where just thrown out with the rubbish as they had no real importance.

Of course back in the days of the IBM Glass Platter Drives we used to burn off the magnetic material and then send the glass for recycling after being broken up.

It is amassing just how many frustrations you can work off destroying computer parts you feel so much better after the event.

Col

Collapse -

No disk is un-recoverable unless -

by dafe2 In reply to I hope this isn't to far ...

Unless you physically destroy a hard disk drive.

At one site I work for, A Nuclear Power Plant, they require that discs be physically destroyed, no matter what system they came out of. At times we are also required to recover disks and use sophisticated tools to do so.

I think you'd be surprised at just how far you can recover a so-called 'wiped' or 'damaged' disk.

As HAL9000 said it depends on how 'motivated' you are to recover data.

Back to Windows Forum
11 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums