Drive/Partition Formatting Lost

[TedEBear]

I run XP home version and yesterday I logged off my account to go to work but left the computer on in case my roomie wanted to use it. When she came upstairs she saw that the computer had somehow done a reboot but stopped when trying to load the boot record and she could not get it to boot. Luckily, I'd installed XP in another partition on another drive so I managed to boot from that and found that my main XP partition as well as a partition on another drive had both lost formatting.

I went ahead and reformatted my XP partition and reinstalled but I'm wondering if there is any way I can recover the data from the other drive as it has a bunch of photos I've made with my digital camera and I'd hate to lose them. I tried using a couple of data recovery software utilities... one, Active Data File Recovery doesn't see anything on the drive. Another, PC Inspector, tries to scan the partition for lost data but gets a program error, but it did that with a good partition that some data was lost on so it's the pgm.

Is there any hope or should I give up on it? The partition in question was formatted in FAT32.

[glc]

Download the demo of Ontrack Easy Recovery, it will tell you what it can recover. If it's a go, decide if it's worth the money to you to do it.

[TedEBear]

Thanks for the suggestion! I did that and it found the majority of my data but the 25 file limit per session on the cheaper version made it not worth the $89 and the $199 'full' version was too pricey for my wallet. So I kept looking and found R-Studio for $79 that did just what I needed and was affordable enough.

[mike breck]

Uneraser is only $49...but too late now.

http://www.uneraser.com/

[TedEBear]

I tried that one too. It couldn't find the data.

[David_Jones]

Interesting that you re-formatted but still managed to recover data.

Does anyone know - is that normal?

David.

[glc]

Sure - that's what data recovery is all about. As long as a cluster hasn't been overwritten by a new file, you can recover the data one way or another. You have to zero wipe to completely wipe out the data, and forensic tools can still get some data back. That's why our government requires multiple passes writing zeros then ones to "declassify" a hard disk that's been used to store classified material.

[tekchik]

I was interested to read about the wiping of drives...I have some hard drives that I need to erase completely. While a software reformat will keep most end-users from recovering data, I have been looking for information on how to be sure that data is unrecoverable.

Could someone address this in more detail, or is there a URL that I can further educate myself on this topic?

[glc]

http://www.tomcoughlin.com/Techpaper...,%20042502.pdf

[David_Jones]

I read that article - quite interesting.

However, I still don't really see why such lengths are required.

In order to be sure that all data has been erased from a floppy (if not destroying) or a HDD, I employ the following technique:

1) Delete everything

2) Re-format

3) Ensure that the disk free space now matches (within a few bytes) the full disk capacity.

4) Recursively write a random file onto itself (effectively doubling it in size each round) until the disk is full to capacity.


For anyone to get the old data back would imply that they can read the info I put there (random file writ large) *AND* the original data.

If that was true, they have found a way to (double?) the data storage capacity of the drive and untold welath awaits them!

Am I missing something here?

David.

[tekchik]

I read the article as well - good stuff - but not in production yet.

How this came about was someone asked me before disposing of the drives to be sure that the data was unrecoverable. I said there are a couple of things I can do...they said can you be sure? Well, not wanting to sound like the know-it-all that I surely am not, I said not really. I guess it would also depend on the parameters - your average windows user or the NSA.

I then began to ask how others in the field do this. David - your technique sounds rather similar to what the article was discussing about overwritten sectors and distinguishing the two waves.

In the meantime, I got a big pile of HDD's that I am about ready to take a large magnet to...HA HA!

[David_Jones]

Perhaps I am just being dumb / naive, but it seems pretty foolproof to me.

David.

[glc]

http://directory.google.com/Top/Comp...cs-Degaussers/

Here's a list of stuff you might want to check out.

What you do before disposing of a drive all depends on just how "sensitive" the information is and on what, if any, laws apply to it. Forensic tools can recover *something* from any platter that still has magnetic material on it.

[tekchik]

Thanks glc...This has been a low priority project for me. For the time being, I am stashing the drives and I need to peruse the list that you were cool enough to bring together for me to determine what is going to work for us.

One of the problems is when dealing with an end user who is not as technologically advanced, you run the risk of not answering the question that they thought they asked. It is hard to get good info when you ask the wrong question.