0

Here is the scenario. A co-worker of mine was performing a migration to windows 7 pro from an xp box. They made a backup of the general user folders, but managed to miss a few critical folders that are stored elsewere. These folders contained critical year end excel documents. In their infinite wisdom they chose to format and re-install windows without making a backup image of the entire drive before hand.

I was now given the task of attempting to retrieve the lost documents using any methods known to me.

I've already tried most of the usual programs like get data back, ontrack easy recovery and a few others. seeing the folder path and file names is not an issue but all of the excel documents I retrieve contain useless machine language.

Does anybody out there know of a program or method to pull some of these files successfully from the ether's of binary space? Or am I up a creek without a paddle on this one?

Journeyman Geek
  • 129,178
Kythos
  • 331

4 Answers4

1

The testdisk/photorec combo works pretty well. Also, the the Recuva package is pretty good. Open source and freeware, respectively. Store and run these programs from a disk that is not on the one you're trying to restore from, of course. Ditto the recovered files.

Geoff Fritz
  • 959
1

BartPE & WinHex would be my tool of choice. WinHex is pretty much unrivaled in the realm of computer forensics.

if you only need to recover data, then the 'lite version', called Davory (€33 for a personal license) will do the job. it is based on the same technology.

however, succes depends on the question if the files in question have been overwritten or not. you can run the trial version of Davory to find out if it can find the files you're after, but you will need a license to restore the files.

when using Davory on a formatted and overwritten disk choose the Physical Disk, not a logical drive.

  • I haven't tried that combination yet so I will look into this, Thank you – Kythos Jan 07 '10 at 03:54
  • both WinHex and Davory can be made 'portable': cope the installation folder from another machine or extract the installer with Unversal Extractor. you can include the program in the BartPE disk or use it from a USB stick, BartPE supports USB. –  Jan 07 '10 at 12:17
0

Runtime.org has some recovery tools like GetDataBack FAT and GetDataBack NTFS that have a "post format" mode.

Bear in mind that if the data has been overwritten... the data has been overwritten.

ta.speot.is
  • 14,233
0

I've had good luck recovering data from reformatted drives with RecoverMyFiles. You can use a trial version to see whether the files exist and are recoverable, then you can purchase the full version for $70 to actually recover the files.

As others have mentioned, you will not be able to recover the files if those sectors have been overwritten since the format. There's a fair chance that you haven't overwritten the sectors that contained the files yet, but booting off that drive and/or installing software will increase the risk of overwriting the files (and decrease your chances of recovering anything).

While the other programs I tried could only recover files but scrambled all the filenames and paths, RecoverMyFiles was able to recover the files and directories with their original names.

rob
  • 14,228