Hard drive Question? Can I get information off hard drive after OS has been removed?

[WSatre]

Hello, Newbie here with a question regarding getting information off a hard drive that has had the OD removed.

My mother passed away in August and I was told that I would get the computer I was letting her use, once my sister and her husband had a chance to see if there was a copy of my mothers will on it.

Well my brother-in-law said that he had no problems getting past the password on it, but there wasn't much on it other then pics and such, so it would be returned to me in good working order. But when my sister brought it to me the first thing she said was that it would need a OS before it would work.

Well I think she purposely removed the OS so that I would completely remove what is on the hard drive when I went to re-install the OS, in other words I beleive that she is trying to hide something from the rest of us.

Now is it possible to pull the hard drive from that computer and install it into another computer and see what may still be on the hard-drive, also is there a way to recover any data that is on the hard-drive? steps to take or a program that will make this possible?

I hope I haven't been to confusing with my question aned I thank you all in advance for your assistance in this.

W

[jlreich]

It depends on to what degree they deleted the drive. If they simply formated the drive or just deleted the data, recovery is usually pretty easy and with great success.

I would recommend using Get Data Back for whichever file system type the drive had on it (FAT32 or NTFS). It has saved the skin of many members around here including myself. You can scan for free to see what is recoverable, then any file that you have a program that you can open it with you can recover files one at a time and save them from the program for free. For instance if you have a Word doc you want to recover you would need to open it with Word, then save it from within Word. If you want to recover in batches you will need to buy the program.

Make sure you read through the instructions. It's worth the time if recovering data is important to you.

If they went through the trouble to actually use a program to make data recovery very difficult you may be looking at professional data recovery which can get pretty expensive.

[WSatre]

Ok, I can do that, but do I need to put that harddrive into another computer to get access to it? the computer won't start as is, because it can't find the OS, I probabally shoud have stated that in my first post.

W

[alternate]

...is it possible to pull the hard drive from that computer and install it into another computer and see what may still be on the hard-drive, also is there a way to recover any data that is on the hard-drive? steps to take or a program that will make this possible?

yes it is possible. the easiest way without getting inside your computer is to buy something like this or this. Take the hard drive out of your mother's computer chassis, attach it to the device, attach the device to your own computer. Then do as Jlreich said with Getdataback program, which costs under $80 for the program; personally I can attest to this working after a power failure on a HDD.

If you want to keep the data on that drive, I would say do not reinstall an OS, as this will write over the files that might be on the drive. By the way, it doesn't make sense to say that the OS was removed; more clearly, one can delete the OS files; 'delete' is the key word here.

[jlreich]

If you don't mind opening up your system the easiest way is to hook it up as a second drive on the system that does work. Then GDB will work much faster. GDB works best when it is installed on a working system and the drive in question is a second drive.

Also it may be worth waiting to see if Paul Komski happens upon this thread. He is very knowledgeable about these things and it may be a simple matter of undeleting the partition. Again it all depends on what they did to get rid of the OS.

On another note, once you recover your files and if these two systems are identical you should be able to clone your existing drive onto the empty drive and make it work just fine with the other system, if you so desire.

[Paul Komski]

At this point all I would say is that one needs to have a look see to see what is on the drive from another operating system. GDB has already been mentioned twice and it is a good utility as long as the drive has not been erased (with zeros or misc patterns written over the whole drive). If the drive has been truly erased in this way (as opposed to having partitions or files/folders deleted or formatted) you will likely need to have the resources of the FBI to even attempt recovery.

What actually happens when the computer is turned on? What messages, beeps, etc?

It has also been mentioned to access the drive from another PC and that is probably the best method whether simply accessed internally (often simply temporarily replacing the CD-Drive with the HD-Drive in question) or accessed externally with an enclosure or using a converter cable of some sort. You might also just want to see what you can see (if anything) from a Knoppix Live CD (link in my sig).

[WSatre]

Hey Paul,

Sorry it took me so long to get back with an answer to your question, but between working 18 hour days and being a dad it took longer then I would have liked.

Well, I finally got it hooked up to a monitor and powered up, no beeps of any kind. The next screen asks which OS I wanted to use, either XP Home or XP Professional, well this computer comes with XP home installed at the factory so I tried using it first to start the computer and got the following message.

Windows could not start because of a computer disk hardware configuration problem.

Could not read from the selected boot disk, check boot path and disk hardware.

Please check the Windows documentation about hardware disk configuration and your hardware reference manuals for additional information.

Well I don't have any documentation as far as I know none came with the computer from HP.

So seeing I couldn't start XP home I tried starting the XP Pro, I got a desktop but I also got a message saying I needed to activate XP Pro before I could go any further, will I didn't install it so I don't have and activation code, and when I contacted my sister she refused to give me any information.

Do you think I can still put this hard drive into another computer and possibly get any information that was deleted?

Thanks Again!

Wayne

[jlreich]

Look for a windows COA sticker on the computer somewhere. Do the activation and enter the product key in from the sticker and it should be good to go.

[Paul Komski]

Since you are trying to recover material from the drive it is best to not try to boot to it directly until you at least know what is going on. Either Slave it to another computer and see what GetDataBack or other DIY recovery software can find on the drive or boot to a Knoppix Live CD and see what it can see on the HDD.

It sounds as if something has happened to the original XP Home installtion (which you already indicated might have happened) but you also seem to have had or have had attempted an installation of XP Professional.

[WSatre]

Paul you're right, somthing has happened to the original XP home installation, but I haven't tried to have XP Pro installed, I have done nothing with it other then turning it on, since my sister gave it to me saying that it had no OS and I would have to get a new one(OS).

So whatever has been done happened while it was in her(sisters) posession.


As I said in the beginning this was my mother's computer (which was to come to me) when my sister took it, (looking to see if my mother's will was saved on it), it was working, but when she gave it to me was when she told me it had no OS, which made me think that she is trying to hide something and prompted me to ask my original question about recovering or finding out what the missing information was.

I will try connecting it as a slave drive in my other computer and run that program and see what I can find.

Thanks!
Wayne

[Paul Komski]

The next screen asks which OS I wanted to use, either XP Home or XP Professional

This looks as if you are getting a dual boot menu with both home and pro as options. If that is the case both have been or have been attempted to be installed. If the order has not been changed manually in boot ini the one at the top is the most recent installation and the one at the bottom the original one.

[no-mbr]

My mother passed away in August and I was told that I would get the computer I was letting her use, once my sister and her husband had a chance to see if there was a copy of my mothers will on it.

Gee-whiz, don't any of you think this was an important enough matter to suggest that the "newbie" get a professional to investigate the disk-drive data?

Obviously, this is a case where trying to help an end user proceed with data recovery likely produces unintended results.

[Whyzman]

Aside from the recovery problems you're encountering, it appears there's a bit of a hostile environment here. You didn't say whether you're Mother's will was actually found on the computer in question. I'm not sure if it would make any difference if such a "document" did exist on her computer.

I'm not an attorney, but I've encountered many of the intricacies of notorizing documents and the importance of "originals." If there was a "scanned" Last Will and Testament on the computer...there's an original somewhere. I don't know the legal ramifications of "original" electronic documents. There may be Last Will and Testament software programs out there where you can design your own will, but would they hold up if contested in probate...don't know. Did she have an attorney involved?

Who is handling your Mother's estate? Many attorneys will allow an initial gratis consultation. If her estate is sizeable and you believe it is being handled inappropriately, you can contest. It may be necessary to get a judge to sign a court order freezing the assests until things can be sorted out. It would be wise to do so immediately, before assests and heirlooms, etc. are "misplaced."

[WSatre]

Hello Whyzman,

I don't know if there was a copy of my Mother's will on the computer, I only have the information that my sister has given. My sister took possession of my mothers safe and computer (she had the only key to mothers safe) and has not told us what was in the safe but claimed that there was no will in it, I feel that there is a will some where from things that my mother told me shortly before she passed away and I beleive that a copy of it was scanned to her computer.

When it was agreed that I would get mother's computer, it took my sister 2 months to get it to me and when she did she told me it no longer had a OS and I would have to have a new OS installed and whatever data that was on it was lost.

I have heard about being able to recover data from hard drives and figured before I installed a new OS on it I would see what I could find, I called a few places that do data recovery and found I couldn't afford to have it done for me, so I asked here for information on how to do it.

I was advised to try and recover the data before I made any claims that it is being handled inappropiately,

[Paul Komski]

Only WSatre can put a price on the value or potential value of recovering this data. As long as the drive is not directly booted-to then it is unlikely (though not impossible) that any existing data will get overwritten. To be on the safe side it would be a good idea to maybe make an image file of the drive or to simply get another hard drive as big as or bigger than the current one and clone the problem drive to the new one. You can then experiment to your heart's content with the clone and leave the existing drive under wraps till you decide how best to treat it.

If you get a new hard drive from one of the big companies such as one made by Western Digaital or Seagate then it should be quite straightforward to use their own software to make the clone from a boot floppy or boot cd.

Swap the clone in and the current drive out and try booting to the XP Professional installation (IN SAFE MODE using F8 during boot-up). Even though not activated this should give you some access to the drive.

GetDataBack run from another PC with the actual drive or a clone of the drive slaved to it is still, I suspect, the best hope of recovering any deleted or otherwise inaccessible or hidden files.

[Whyzman]

Did your mother ever mention an attorney? Or, do you know of an attorney who might have handled something for her in the past. Attorneys are alot like doctors, in that there are General Practicioners and Specialists. If there was any association with an attorney in her past it's possible that she might have contacted him/her for drawing up a will. I'm just trying to jog your memory...

While you're attempting to recover what might be on the drive you might also pursue the attorney approach if something rings a bell. A tort lawsuit, a bill she needed to collect, clear title to something, something regarding your father, auto accident...anything where she would have reason to contact an attorney. Many times if it was, say a specialist, they would refer to a GP or know someone who specializes in trusts and, or wills.

[kurt2]

well paul komski was right try to run it to other computer and have it slave... in this way you can actually view the files that has on it, unless if the HDD that your sis gave you won't work... if endeed you can view the files from HDD(from your mother) and if cannot find what you are looking try it to recover using software application recovery tool that is free to download... try to download this (Easy recovery tool) through internet...