Help with data recovery....

Robert Meyer meyer_rm at yahoo.com
Wed Nov 5 00:16:47 EST 2003


Hmmm... As soon as you started writing on the disk, you were in trouble.  When
windows deletes files, it just sets the first character in the filename to
something strange (can't remember what it is) and tags the disk blocks the file
took up as 'free'.  Norton unerase just let's you put the right character back
in the file name and tags the blocks as belonging to the file again.  There's
stuff it does in the file allocation table, too.  The problem is that if you
start writing on the disk (copy, or anything), the freed blocks get reused and
the file that was there is no longer recoverable.  The problem is made worse if
the disk was horribly fragmented to begin with because writing one file may
make MANY erased file unrecoverable.

If you run Norton unerase immediately after the deletion, you will typically do
a pretty good job of getting most of the stuff back.  File sizes may be wrong
since the actual size in the FAT was zeroed when the file was deleted but all
of the blocks come back.

Unfortunately, as you have already learned, if you write on the drive, you wind
up losing most of your stuff.  I suspect that there may be very little anyone
can do to help at this point... Sorry...

On the bright side, as a life lesson, you now know to backup all of your good
stuff to CD-R or DVD-R media.  Organizing your pictures into CD-R albums also
makes them portable.  Just make sure that you get two CD copies since you could
scratch one sufficiently to make it unusable.  Use one set as masters and the
other as the ones you use to show friends and family.  If the set  being used
gets damaged, you can get it back from the masters.

Cheers!

Bob
--- "Jeffrey Blank, P.E." <jblank at didonato.cc> wrote:
> Hi all... 
> I am looking for some help/recommendations...   I kinda FUBARed my 
> wife's computer over the weekend...  Here's the story:
> 
> I was working on my machine (gentoo linux) and looking to move some work 
> files to my wifes computer (Win98) for work (I need to use AUTOCAD).  I 
> created a link in xffm (xfce4 filemanager) and then tried to delete it.  
> It deleted my wifes entire 'E:' drive with all of the pictures of our 
> daughter from her birth a year and a half ago.  I don't have any good 
> backups...  Well in my rush to fix the problem, I grabbed an undelete 
> program from the web and went to town..  It ended up copying the deleted 
> files to the E: drive, the one with the deleted files.  I was only able 
> to get back about a third of the pics.  Running norton unerase gives me 
> nothing now.
> 
> What I am looking for is any recomendations of someone who might be able 
> to perform more of a low level recovery and what the costs might be.  My 
> wife is ready to kill me!!!!  Thanks for any and all help.....
> 
> Jeff (Longtime lurker, rare poster...)
> 


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree



More information about the nflug mailing list