Derrick’s Allmuffedup

July 9, 2009

File Recovery 101 Attempt to save lost data

Filed under: 1337 — Derrick @ 5:19 am

Ok say if your someone who will remain unnamed that accidentally blew away baby pics that you now realize you never made a backup of – assuming you haven’t continued to use the drive after the accident, there is a strong chance the lost pictures are physically still on the disk and can be recovered.

In laymans terms:

When windows deletes a file it really just removes the reference to the file… the raw data is still there its just ‘flagged’ as a spot on the hard drive that is free to be written over whenever the space is needed (this is why some of the hard core security programs out there will truly erase data to the point it can’t be recovered – by writing 1’s and 0’s over and over again at that physical spot of the disc where that data used to be therefore making it impossible to be recovered) – on the other hand though if you haven’t done much on the drive that would cause new data to be written in those free spots then there is a good chance all your data can be recovered – even still in a worse case senerio, if a new download did write over some of those spots you still have a strong chance at at least partial data recovery.

Step 1 (well if you are shaun – who i guess is no longer un named) and has his os on the drive that has the pics – i’d move that drive out of the computer its in and put it into another where you can boot into a different copy of windows with the deleted pics drive as a secondary drive (simply because even the OS itself writes to the hd… swap files tmp files.. installing the apps required to actually do a physical data recovery etc etc all are just taking the gamble that more and more data could be lost).

Step 2 – now that the drive is a secondary in a second machine…. go install a program like Active UNDELETE either buy it or aquire from the usual sources (can’t run the demo / shareware as it will only recover partial or a single file) – I know that particular one works well because not long ago I accidentally deleted an entire downloads folder accidentally because i always shift-delete and in my fatigue thought i had a subfolder selected not the root folder itself >_<

Step 3 – have enough free space on a second drive – be it the origional drive that the OS is on or a third drive doesn’t matter as long as you are not trying to recover the file by writing them back to the drive with the deleted files.  I have seen some programs back in the day (as this isn’t the first time i personally Oops’d) that would simply recover that windows tag that linked the file (kinda like what happens if you recover something out of the recycle bin) but I’m not sure if thats not possible anymore in vista or just not as safe, either way doing nothing but reading the origional data is by far the safest way to go.

at this point its rather self explanitory… let the program scan the drive and it will find any and all files that are recoverable, it will even list the partially recoverable files which if its a binary would be useless… a pic however may be somewhat valuable still….

active-undelete

finally select whatever files it found after the scan and let it read and copy them over to another drive. oh and if your Shaun / just in case this last part isn’t self explanitory…..

Step 5 – IMEDIATLY break out nero and burn 20+ backup copies of the pics… send some to family some in a fire proof safe etc etc etc :)

Older Posts »

Powered by WordPress