PDA

View Full Version : Recovering a Crashed Drive? is it possible?


wickedestman
12-24-2007, 09:19 PM
Guys well my pc was sent to be cleaned out and well the guy, whom i "trusted" took it and it seems that he crashed it. He blamed the motherboard. He tried recovering data as he said but i didnt believe him. I want to know if it is possible to ever recover that data because i had A lot of music and all that is gone. i stuck the hard drive in my pc im using now and it read as if it is formatted hard drive.

Paul Komski
12-24-2007, 10:21 PM
it read as if it is formatted hard drivePresumably this means you can access it normally but there are no files to be seen. If that is the case then firstly write nothing to the drive. You could try GetDataBack (for FAT or NTFS as appropriate) and at least scan your system with it to see what may or may not be recoverable. It's possible to recover any such files one by one for free and the program has had a lot of success round here. You might also like to try the freeware FreeUndelete (http://www.officerecovery.com/freeundelete/download.htm).

wickedestman
12-24-2007, 10:54 PM
oh! d*mit. well... i kinda wrote stuff to it.
what about if i re formatted it also. that will totally mess it up rite?

thanks BTW im trying GetDataBack

Paul Komski
12-24-2007, 11:00 PM
The danger of writing ANYTHING to the drive is that you can overwrite the underlying data that you want to recover. Reformatting is probably not as bad as writing files as such but if your data is important to you dont do anything to it (including chkdsk or defrag) until you understand what you are doing.

wickedestman
12-24-2007, 11:42 PM
ohhh i should have asked about this before! i thought formatting loses the data entirely. So formating jus reorders the data then?

what happened is that i needed space on the pc im currently using so i wrote about 8gb :(

EDIT:

OMG! I wanna jump and scream! Thank GOD!!! I seeing most of my music! HEHE thanks so much. i gonna try and recover some,...

Paul Komski
12-25-2007, 04:16 AM
i thought formatting loses the data entirely. So formating jus reorders the data then?A quick format is like deleting all files and folders (hidden, system, read only, everone of them) in one go; a full format also checks the whole disk for errors, which is why it takes considerably longer. A full format is like a quick format plus chkdisk /r.

Deleting a single file under FAT just marks the file as deleted and writes zeros to the relevant part of the FAT table. Folders are not referenced from the FAT tables but from a directory hierachy, which is why the original names of folders in the root of the partition are unrecoverable.

Under NTFS all files and folders (which are technically special files under NTFS) have there type attribute marked as deleted. The metadata map file is updated to show that any space occupied outside the mft is now available again.

So formatting (using the same file system) though it sounds like it should be destructive to data hardly touches it at all. Changing the format can be slightly destructive since the metadata is not laid out identically.

The things that make recovery difficult, impossible or incomplete are a failed hard drive or if the platters contain file-system corruption and surface defects (particularly when this affects any metadata) and, of course, if new data has been written to the drive thus overwriting all or part of original files' data.

wickedestman
12-25-2007, 05:54 PM
OHHHHH! Boy i jus made another reply in another thread of mine. This forum should be some kinda top rated help site! the kinda things i learn here!

Thank God for NTFS! if i was in FAT format i wouldnt be able to get their path.

Thank you soooo much!!! when i went in via GetDataBack i saw most of my stuff as recoverable. i tried recovering some and it was 80% success. About 500MB of stuff. what i need is the music and some software installs. i still have to borrow my cousin external drive and back all the data i want on that and then write it to the hard drive again.

I think i am going to disconect that hard drive i wanna recover because i saw windows update made a backup of some of its installs in it.

I have two more questions for you. They are kind of off topic.

1) what format is the better? (NTFS right)
2) is there anyway to get rid of data ENTIRELY like show no existence of it?

im jus asking for general knowledge because initially i though formatting kills it DEAD! and all the data that was there is vanished! but that isnt so.

Paul Komski
12-25-2007, 11:45 PM
Thank God for NTFS! if i was in FAT format i wouldnt be able to get their path. The folders in the root directory would still be findable and so any included files and sub-folders would also be findable. It is just the original names of such folders that would be lost and recovery programs would create new virtually named folders as temporary holders of the content. Even without a folder hierachy or normal FAT tables, good recovery programs (that are more than simple undeleters) can still find much data on a FAT volume - particularly if such files are not fragmented.

1) what format is the better? (NTFS right)NTFS is generally better and more versatile with better prevention of file system corruption without the need for subsequent disk-checks. Fragmentation is less of an issue and both very small and very large files are dealt with sensibly. FAT volumes are generally limited to files no larger than 2 or 4 GB for those that need large files. The main value of FAT partitions is to make them accessible and easily readable from all versions of DOS, the early DOS-based versions of windows, and (particularly on removable media) on Macs and early versions of Linux.

2) is there anyway to get rid of data ENTIRELY like show no existence of it? Drop it in the middle of the deepest part of the Pacific Ocean should do the trick. You can to all intents and purposes "wipe" a drive by writing zeros to it with a program such as DBAN (http://dban.sourceforge.net/). The more times that random data and zeros are written to the whole disk surface the more unlikely that anyone (even with the resources of the CIA) could recover any data. The only absolutely sure way is physical destruction of the drive.

wickedestman
12-26-2007, 01:24 AM
ohhh ok bro thanks a lot for that info... so if i did a scan on a flash drive. say a MMC card i can get that back because i think it uses FAT16? or some? i know Sony MS Pro Duo uses that format.

OHHHH i c.. so older Hard drives use FAT well of course they were really smaller and now NTFS is the biggie! so it wont make sense putting NTFS format on say a memory card?
So FAT format however is faster to read data off?

Hahaha LOL! :D thats a plan! the CIA would still find it! its not like ill be in a run in with the CIA either. So say im gonna sell my hard drive or memory card. I can run dban on it, reformat it and no one can get that data, well besides the CIA lol?
Haha yes..

Thanks so much again.

BTW im going purely off topic:
i jus saw Die hard 4.0... and DAMN that was good.
are there guys like Matt Farrell and stuff in here?! like those high end hacker genius ppl!?

Paul Komski
12-26-2007, 01:34 AM
Flash memory drives are usually pre-formatted as FAT (FAT16 or FAT32 depending on the size of the drive). Most, if not all, can be formatted to NTFS if really so desired. GDB for FAT can recover from both fixed and removable drives. This presupposes that the hardware itself is still "visible" to the system BIOS.

The speed of accessing FAT or NTFS is not really an issue. The hardware bus or interface and other ancillary measures such as DMA are much more the determinants of data transfer rates.

wickedestman
12-27-2007, 06:48 PM
ohhhh i see. thanks for the info. so once that flash drive is at least picked up it can be recovered and i guess dban-ed as well?

ohh and well CPU speeds as well.

UPDATE:
Well i borrowed my cousin's 120GB external drive and recovered about ~30GB of music and other stuff. I would say it was probably successful to a greater extent. i am uploading the recovered files from the external now to the drive and i will let you know how it goes.

Thanks A lot Mr Komski!

awaj
12-27-2007, 07:20 PM
I thought you could wipe all the data off a flash drive by wiping a magnet across it. Once done, there is no way to get the data off of it. (assuming the magnet was a decent one, not a refrigerator magnet.) Is that correct, or would the drive be not useable at all?

Paul Komski
12-27-2007, 07:35 PM
I thought you could wipe all the data off a flash drive by wiping a magnet across it. Once done, there is no way to get the data off of it. (assuming the magnet was a decent one, not a refrigerator magnet.) Is that correct, or would the drive be not useable at all?


Electrically erasable programmable read-only memory (EEPROM) chips are similar to PROM devices, but require only electricity to be erased (http://semiconductors.globalspec.com/LearnMore/Semiconductors/Memory_Chips/EEPROM_Memory_Chips)

wickedestman
12-29-2007, 03:47 PM
hehe lol that sounds like a floppy disk... na i doubt magnets will work... thanks for that link!

BTW i completed the recovery... i would say it was 75% successful.
about 50% image files were mostly gone thru... and 20% of the music wasnt working. Text files were the worst! lol...

BUT! lol i have some mp3 files. they have their original file size but the song are not loading at all... and other are loading but seem corrupted. i guess its because some of them got messed up by my copying data before recovery. but is there a way to repair those files?