Data Recovery

[dc_firedrake]

Alrighty.

I just got a 30 gig WD HDD from a friend. It has Windows XP Pro installed (I installed it). I don't know what happened exactly... But I'm guessing something happened that made it unbootable. All I want to do is pull some files off of the drive from the "My Documents" folder of a certain user (the only user).

I recall trying to get the files off by hooking it up to another computer as a slave that ran XP Home. But the 'My DOcuments" folder was encrypted for that user.

The computer I could use is a 386 server running Windows Server 2003 Enterprise. And I was wondering how I can pull these files off the disk so that we can finally reformat it and use it (my friend has been using a 4 gig lately).

Oh, and the last time I tried to access it (a while ago) the drive was fine. The only issue was that we could not get to the files because of the encyption from XP

Thanks!
«SK»

 

[Ice Czar]

its actually employing EFS (Encrypted File System)
or is it just a NTFS permissions issue?

If EFS youll need to salvage the certificates or brute force it (which we cant discuss here)
If permission, disable simple file sharing and take ownership of files and folders

 

[black_b[ ]x]

alright, how about a slightly different "recovery." Is there any way to recover hard drive contents after a "format C:" from a windows boot disk, then a re-install of windows and applications?

A co-workers computer was all screwed up (downloading internet crap), so I formatted it today. His email was supposed to be stored on the win2k server for tape backups, but at some point it stopped doing that and stored it locally. I only looked to see if the outlook.pst file was there, not how big it was or when it was dated

I didnt do a quick format either, the exact command was "format C:" ...
I'm think its gone, especially since i've already re-installed and probably written over it, but just to be sure... any chances w/o throwing money at it?

 

[MrMike]

I seriously don't think it's possible black_b[]x, how would you be able to locate the old files even if the first character in their names is just changed to null?

Formatting (even quick formatting) rewrites virtually every entry that is not a bad sector in the FAT table with null, so the O/S would have no idea where to look.

Maybe a specialized lower level program that I haven't heard of or a data recovery company would use would work, but there's throwing money at it.

 

[Ice Czar]

anything that was not overwritten would be sitting in plain sight of a direct scan, trial File Scavenger

youd have to pay to actually recover more than one file I think
but at $40 for a buisness
it really needs to be in your toolbox

who knows you might get lucky

 

[MrMike]

I'm not claiming to doubt the app here, just asking

Does it scan the entire hard disk, "empty" space and all?
Have you ever used it with positive results (post format)?
This could seriously be a useful program to get where I work so I'm more than interested.

 

[black_b[ ]x]

I found the closest thing I remembered, www.uneraser.com
Tried it out and it didnt seem to show anything from before the format. I'm assuming it only works on deleted items, or formats when you haven't overwritten the drive.

--edit- I'll try the scavenger program, thanks. --edit2- Doh, its NTFS only

 

[Ice Czar]

yes
yes
yes


your basic recovery ap there are lots of others,
that one happens to be a cut above

I own a couple

to actually repair a fubard partition
Disk Patch

i own its predecessor

 

[Ice Czar]

Originally posted by black_b[ ]x
I found the closest thing I remembered, www.uneraser.com
Tried it out and it didnt seem to show anything from before the format. I'm assuming it only works on deleted items, or formats when you haven't overwritten the drive.

--edit- I'll try the scavenger program, thanks. --edit2- Doh, its NTFS only

generally speaking if you delete a partition...you can recover
if you reformat...you can still recover
but if you overwrite

well recovery can also be done, but its very expensive and time consuming, its generally described as forensic data recovery
and typically at the high end it involves having the platters dismounted and the bits not only "read" but scaled on their magentic strength, which point to their probable previous magnetic oreintations, and then with the help of a computer, recompliled till they make sense again
that scales from a basic ability on the part of a metropolitian police department upto, the ability to read data that has been overwritten multiple times with various patterns at the FBI \ NSA level

Ive a little ap that will overwrite the freespace of a HDD 32 times with various patterns
it was freeware too, until just recently

Hard drives offer up secrets BBC

"The graduates from the Massachusetts Institute of Technology decided to find out just how many secrets the mountain of PCs thrown away every day could tell about their previous owners.

They bought 158 disk drives for less than $1,000 from eBay and other sources of used computer hardware.

Out of these, 129 were functional and there had been little or no attempt to erase information on 28 of these.

One of the drives had come from an ATM machine in Illinois and contained a year's worth of financial transactions.

Another disk contained 5,000 credit card numbers. Others showed up medical records and gigabytes of personal e-mail and pornography.

Only 12 had been properly cleaned.

Even disks that contained no files and could not be incorporated on a computer could still have data retrieved using special tools. "

the area where you get screwed straight off the bat, is if a drive fails in a RAID0, then its straight to the bank then the lab
if you want to recover

 

[dc_firedrake]

The data *I* need is not reformatted, all data tables intact, and directories viewable... just inaccessable -_-

 

[Ice Czar]

that sounds like a simple permissions issue

"disable simple file sharing"

and

"take ownership of files and folders"

just google those and you should have tutorials