Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HDD recovery - help please


  • Please log in to reply
5 replies to this topic

#1 safi

safi

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 29 May 2009 - 11:13 PM

Hello,

I have this Win Me PC with 3 partition Hard disk -> C,D&E which need to reinstall its windows but needs to be format first.

First I do backup for D&E, then I deleted the D&E partition and formated the drive C.

Then I reinstalled back the Win Me OS and then ....my GOD I forgot to backup the drive C... :flowers:

Wow how am I going to recover the overlap sector... :trumpet:

I am looking for the "C:\UBSACC" folder in the previous C drive.

I had try using 20 types of recovery software, all can't find the "C:\UBSACC" folder.

What I got just in random fragment folder which I believe contains the UBSACC files but with the "X" marks (deleted).
But the best are all files belongs to the previous partition D&E are in the good recovery status.

"UBSACC" is the UBS accounting system folder (I not familiar with the system).

So can anybody assist me or give comment on how to get my "UBSACC" folder. My so tired for these 2 weeks ? :thumbsup:

These are the Recovery that I had used;
Nucleus kernal,R-studio,Getdataback,Power data recovery,O&O,ZAR,File scarvenger,Find and mount,Paragon,active file recovery,Easy Recovery,Recovery centre,easeus,file rescue,Handy recovery,recovery my file,restorer ultimate,restorator,stellar, Pc inspector.

Tq, please help.

BC AdBot (Login to Remove)

 


#2 Platypus

Platypus

  • Moderator
  • 14,478 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:11:39 PM

Posted 30 May 2009 - 05:28 AM

I think you'll find it impossible to recover using software, as you've found.

The contents of the D: and E: partitions are good candidates for recovery, as their partition record and file directories and tables still exist, and neither they nor the locations the files occupied have had their contents overwritten with different data.

However, much of the data that was on on the C: partition has been overwritten by the new file system and OS installation. If it has overwritten the locations that originally held the data you're looking for (the file directory and file table entries and the file contents), then only very expensive forensic recovery techniques can attempt to recover the original drive contents.

Edited by Platypus, 30 May 2009 - 05:29 AM.

Top 5 things that never get done:

1.


#3 safi

safi
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 31 May 2009 - 03:58 AM

Tq Platy,

But what do you means by - only very expensive forensic recovery techniques can attempt to recover the original drive contents.

Sorry.

Tq.

#4 Platypus

Platypus

  • Moderator
  • 14,478 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:11:39 PM

Posted 31 May 2009 - 08:50 AM

If data has been written over the top of something important enough to warrant it, the drive can be examined in a lab using magnetic microscopy. It's a time-consuming and expensive process, and can't be guaranteed to be successful. Since so many recovery utilities fail to find evidence of the previous existence of the folder you want, it seems fairly certain that new data has been written over the file system data that recorded the locations where the folder and contents were. It's also possible (but not certain) that new data has been written where the file contents previously were too.

So there's a double hurdle to recovery - first finding out where the desired files were located on the drive, and then if new data is there, trying to find remnants of the old data through the new.

This picture illustrates the difficulty of doing this:

Posted Image

The image is generated from data extracted from a drive surface where the logo of the company that developed the technique has been "written" over the top of existing data. In blank areas you can see the faint remnants of the previous contents of the tracks. Forensic recovery requires skilled operators using various techniques to attempt to reconstruct the previous contents by reading these remnants that are "hiding behind" the new data that's there now.

Edited by Platypus, 31 May 2009 - 08:51 AM.

Top 5 things that never get done:

1.


#5 safi

safi
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 31 May 2009 - 09:26 PM

wow, :thumbsup:

tq platy.

#6 Platypus

Platypus

  • Moderator
  • 14,478 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:11:39 PM

Posted 02 June 2009 - 06:38 AM

You're welcome, I'm sorry I couldn't provide a more encouraging answer. It would be nice if I turned out to be wrong... :thumbsup:

Top 5 things that never get done:

1.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users